HEALTH INFORMATION ACT (HIA) BILL
QUESTIONS AND ANSWERS
KEY HIA CONCEPTS AND PROVISIONS
Q.
What is the purpose of the legislation?

To protect clients’ personal health information.

To set rules on the collection, use and disclosure of personal health information
that health care providers must follow.

To have rules that enable improved care to clients, while still protecting client
privacy appropriately.
Q.
What is Personal Health Information?

Information about an identifiable person that relates to their physical or mental
health and health services provided.

It includes the person’s:
o Health care plan number;
o treatment and chart information;
o test results;
o information collected and used to determine program and service eligibility
and registration;
o billing and payment information.
Q.


Q.
What are custodians?
“Custodians” is the legal term for the Department of Health and Social Services,
Health and Social Services Authorities, private pharmacists and private
physicians. Others may be designated in the future.
Custodians are usually those health care providers that play a key role in the
core health system and in circles of care.
What are agents?

Agents are those employees, volunteers, appointees, contractors, and
information managers acting on behalf of a custodian.

Physicians and pharmacists when employed or contracted by the Department of
Health and Social Services, an Authority, or another private custodian are agents
and not their own custodians.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 1 of 9
Q.
What are information managers?

They manage and store information, transform information, or provide
information technology, system and management services on behalf of someone.

The Technology Services Centre (TSC) and the Yellowknife Health and Social
Services Authority are information managers.
Q.
What is the circle of care?

The circle of care refers to the group of health care providers involved in a
specific patient’s care.

The HIA allows for the sharing of information within a patient’s circle of care as
necessary without asking for the patient’s further consent each time the
information is shared.

However, health care providers must still respect any express instructions from a
patient that their information not be shared with, for example, their community
counsellor.

The Act does not specifically refer to a circle of care.
Q.
What is implied consent versus express consent? When do you need
consent?

Implied consent occurs when the patient shares their health information with a
health care provider in the course of a regular check-up.

When sharing information within a circle of care or for reasons set out under the
HIA (billing, health system and internal management, inspections) health care
providers can assume they are covered by the initial implied consent, so long as
the patient has not explicitly stated otherwise.

Express consent must be written except where circumstances allow for a verbal
express consent to be recorded.

The main example of when express consent is needed is for research.

Express consent is required when a health care provider shares information
outside the circle of care or outside of the reasons allowed under the HIA.
Q.
What is authorized use, also known as secondary use?

Authorized/secondary use refers to the concept where information collected as
part of providing a health service can be used for another purpose as well.

It can be used for purposes set out in the HIA, such as to verify billing and
benefits eligibility, for internal and health system management purposes, to
provide information to another member of the circle of care, or for health
promotion.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 2 of 9
Q.
What is the role of the NWT Information and Privacy Commissioner (IPC)?

The IPC provides an oversight role for the HIA, similar to the role provided under
ATIPP.

The ATIPP IPC is automatically the HIA IPC as well.

The IPC has recommendation-making powers under the HIA to review and make
recommendations.
WHY HAVE THE HIA
Q.
Why do we need this legislation?

To provide better care to clients, we need to allow information to be easily shared
between Health and Social Services Authorities, the Department of health and
Social Services, and external health care providers such as pharmacists and
private physicians.

As the health sector grows and adopts electronic health systems, we need to
recognize and respond to increased privacy risks.
Q.
What does this legislation mean for the public?

It better protects the privacy of your personal health information.

It allows for efficient exchange of charts, test results, prescription information,
and other health information within your circle of care to improve how you receive
health services.
Q.
How does the HIA better protect patient privacy?

ATIPP has limited privacy and security safeguard requirements.

Because the HIA allows for easier flow of information, the Act requires tougher
safeguard measures to ensure patients’ privacy is protected appropriately.

Custodians are only allowed to share information that is absolutely necessary.

Custodians are required to follow privacy and security policies and standards
based on nationally and territorially recognized standards appropriate for highly
sensitive information.

Custodians must put in place access controls, such as role-based access to
electronic health information systems, to ensure only those health care providers
who have a legitimate reason to view someone’s personal health information are
able to see the information.

Custodians are required to notify an individual and follow certain protocols if a
privacy breach occurs.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 3 of 9

Q.
The Department of Health and Social Services and Health and Social Services
Authorities are required to complete Privacy Impact Assessments (PIAs) when
they propose new or make changes to existing information systems and
communications technologies, and these Assessments must be shared with the
Information and Privacy Commissioner.
What does the Act mean for the health system?

The HIA facilitates a circle of care for each patient made up of core health care
providers.

Information may be shared more easily to provide seamless care to clients.

The HIA allows the Department of Health and Social Services and Health and
Social Services Authorities to gather information for internal and health system
management purposes.

Using this information the Department and Authorities are able to develop and
deliver evidence-based programs and services that better meet the needs of
NWT residents. For example, our chronic disease prevention and management
teams will be able to work together to provide better support and care to their
patients. They will be able to compile information to identify trends in chronic
disease cases and determine improved methods of early intervention and clinical
care.
Q.
Does having the HIA let us share patient information with Alberta and
Nunavut more easily?

The HIA facilitates improved sharing of patient information with Alberta and
Nunavut.
WHAT THE ACT APPLIES TO
Q.
Does the HIA apply to just medical care? Does it apply to mental health and
addictions services? Does it apply to community counselling services?

The HIA applies to health services, including mental health services.

In order for the health system to better address mental health and addictions as
inter-related, the HIA also applies to addiction services and mental health
counselling services.
Q.
Does it apply to how patients and health care providers make treatment
decisions?

No. The HIA is about the handling and management of patient information. In no
way does it set up rules on how treatment decisions are made.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 4 of 9
Q.
Does the HIA apply just to the public sector or the private sector as well?

Q.
The HIA applies to the Department and Authorities, as well as private
pharmacists and private practice doctors, such as Medical Directors at mines.
Others may be designated in the future, for example perhaps emergency medical
services (EMS) providers.
Does the HIA apply to electronic records? What about hard copy
records?

Q.
Yes, this legislation applies to all records, whether in paper or electronic form.
How does this legislation relate to the Electronic Medical Record (EMR)
system, interoperable Electronic Health Record (iEHR) system, and other
ehealth systems?

It allows for the easy sharing of information between health care providers from
different organizations through the EMR, iEHR and other ehealth systems.

It requires us to establish administrative, technical and physical safeguards
related to electronic health information systems to properly protect patient
privacy.

Whenever we start work on a new ehealth system, we will be required to carry
out a privacy impact assessment.
Q.
Would my personal health information ever NOT be covered by this
legislation?

Yes. It only applies when personal health information is collected for health
services and is kept by the Department of Health and Social Services, a Health
and Social Services Authority, a private pharmacist, or private physician.

Personal health information in child and family services records and adoption
records is not covered by the HIA.

Health information that appears in human resource personnel records and
professional licensing files is not covered by the HIA.
HIA, ATIPP AND WHAT TAKES PRECEDENCE
Doesn’t the Government already have privacy legislation?
Q.

The NWT also has the Access to Information and Protection of Privacy Act
(ATIPP).

ATIPP is not specific to health information and does not apply to private
physicians and pharmacists.

It does not meet the sharing of information needs of the health system.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 5 of 9
Q.
Do the Department and Authorities still need to follow ATIPP?

The Department and Authorities still need to abide by ATIPP outside the health
services context.

For example, public records such as contracts and records of decisions will still
be governed by ATIPP.
Q.
How does the HIA differ from ATIPP?

The HIA deals with an individual’s personal health information, whereas ATIPP
focuses on setting rules around public access to government records.

ATIPP applies to public bodies; whereas the HIA applies to public and private
persons and organizations whose primary purpose it is to deliver health services
to Northwest Territories residents.

Routine access to your own medical record was not envisioned under ATIPP.
The HIA regulates the routine disclosures currently occurring to better ensure the
proper protection of patient privacy.

Under ATIPP, any party can request access to certain government records;
whereas the HIA is focused on granting access to patients and health care
providers.
Q.
What happens when someone wants access to a record that includes
personal health information covered by the HIA as well as information
covered by ATIPP?

Q.
When someone wants access to a record covered by both the HIA and ATIPP,
the person processing the request would split the request into two and follow
both the HIA and ATIPP.
Does ATIPP prevail? Will any legislation override the HIA?

The HIA prevails over ATIPP.

Parts of the following will override the HIA:
o Elections and Plebiscites Act,
o Mental Health Act,
o Guardianship and Trusteeship
Act,
o Public Health Act,
o Jury Act,
o Workers’ Compensation Act.
o Vital Statistics Act, and
o Maintenance Orders
Enforcement Act,
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 6 of 9
CONSULTATION
Q.
Who did the Department of Health and Social Services consult with on the
development of this legislation?

The Department of Health and Social Services consulted with the:
o Information and Privacy Commissioner (IPC);
o NWT Medical Association;
o NWT Pharmacy Association;
o Registered Nurses Association of the NWT and Nunavut;
o Canadian Medical Protective Association;
o Canada Health Infoway;
o Health and Social Services Authorities;
o Clerk of the Legislative Assembly; and
o Departments and Agencies affected by necessary consequential
amendments to their respective pieces of legislation as a result of the HIA:

Department of Justice;

Workers’ Safety and Compensation Commission; and

Chief Electoral Officer.
HEALTH CARE PROVIDER TRAINING
Q.
What training has been delivered to health care providers?

The Department has had great uptake on in-person HIA training being delivered
to health service providers across the Northwest Territories (NWT).

The HIA in-person training has been delivered in Yellowknife, Hay River, Inuvik,
Fort Simpson, Norman Wells, and Fort Smith, to both private and public health
service providers.
Community
Yellowknife
Date
June 23-25, 2015; September 14-15, 2015; September 23-24, 2015
Hay River
Inuvik
August 11-12, 2015
August 31 – September 2, 2015
Fort Simpson
September 10-11, 2015
Norman Wells
September 21-23, 2015
Fort Smith
September 28-29, 2015
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 7 of 9
Q.
What training materials are available?

The Department has developed a plain language HIA Guide, which is being
distributed to health care providers across the NWT.

In-person training materials are available.

The Department is also finalizing a Privacy Risk Toolkit and online short tutorials
to accompany the HIA Guide and in-person training, as resources to help health
care providers comply with the Act.
Q.
Will there be more training in the future?

Yes, the Department will provide ongoing HIA training in the future. In addition,
part of the in-person training available is a Train the Trainer module, giving each
custodian under the HIA the resources required to carry out further internal
training.
LOOKING TO THE FUTURE
Q.
What work is the Department focused on now?

The ongoing work that will be carried out by the Department includes:
o Updating and monitoring health privacy and security policies, including
privacy breach protocols for the Department and Authorities;
o Administration and enforcement of the HIA for the Department,
Authorities, private physicians and pharmacists;
o Ongoing health privacy training for the Department, Authorities, private
physicians and pharmacists, and updating of the HIA Manual;
o Annual preparation of the Government Response to the Information and
Privacy Commissioner’s Annual Report on the HIA;
o Review of mandatory privacy impact assessments;
o Auditing and monitoring of e-health systems and privacy practices;
o Participating in a health information governance committee;
o Privacy and security advice to private physicians and pharmacists;
o Collaboration with private physicians and pharmacists on records retention
schedules that harmonize with GNWT records retention schedules.
Q.
Will the Department of Health and Social Services pursue PIPEDA
substantial similarity status?

Yes, once the HIA has been brought into force, the Department of Health and
Social Services will contact Industry Canada to apply for this status.

The HIA is drafted to be substantially similar to PIPEDA, using a Pan-Canadian
model, to ensure we get this status.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 8 of 9
Q. What are the implications of the HIA receiving federal Personal Information
Protection and Electronics Document Act (PIPEDA) substantial similarity
status?
 Currently NWT public bodies follow ATIPP and private pharmacists and
physicians follow PIPEDA.

When we bring the HIA into force, private pharmacists and physicians would
have to abide by both PIPEDA and the HIA, unless we get substantial similarity
status.

This status would allow private pharmacists and physicians to abide by just the
HIA, and not PIPEDA as well.

This would reduce the regulatory burden for private pharmacists and physicians
and ensure all custodians designated under the HIA follow the same privacy
framework.
LEGISLATION OF OTHER PROVINCES AND TERRITORIES
Q.
Do other provinces and territories have similar legislation?

Alberta, Saskatchewan, Manitoba, Ontario, Newfoundland and Labrador,
New Brunswick, Nova Scotia, British Columbia and Quebec have similar
legislation.

PEI and Nunavut do not.

Yukon introduced their Health Information Privacy and Management Act Bill on
the same day as the NWT introduced the HIA Bill. The Act was passed later that
session.
DEPARTMENT OF HEALTH AND SOCIAL SERVICES
Page 9 of 9