A Quebec law regulating personal information in the health sector

The Bill entitled An Act respecting health and social services information and amending various legislative provisions (“Bill 19”)^[1] was released on December 3, 2021, and was introduced as a mammoth bill that would change how health information is managed.^[2]

The purpose of this bill is to establish a legal framework specific to health and social services information, and the intention is to cover everything in a single statute. At present, there are several statutes that concern this information, including the Act respecting Access to documents held by public bodies and the Protection of personal information (“Access Act”),^[3] the Act respecting the protection of personal information in the private sector (“Private Sector Act”), the Act respecting the sharing of certain health information,^[4] and the Act respecting health services and social services (“AHSSS”).^[5]

What the bill does is, first, creates a legal regime specific to health information, and second, amends existing legislation.

A gap to be filled: defining health information

This bill defines health information as follows:

FASKEN TRANSLATION

“2. Within the meaning of this Act, health or social services information is any information held by a health and social services body that concerns a person, whether or not it allows the person to be identified, and that has one of the following characteristics:

(1) it concerns the person’s state of physical or mental health and his or her health determinants, including his or her medical or family history;

(2) it concerns any material, including biological material, collected in the context of an assessment or treatment, and any implants, orthesis, prostheses or other aids that compensate for the person’s incapacity;

(3) it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or bodies that provided them;

(4) it was obtained in the exercise of a function under the Public Health Act (chapter S-2.2); or

(5) any other characteristic determined by government regulation.

Despite the first paragraph, information concerning a member of the personnel of the body or a professional practising his or her profession within the body, including a student, a trainee, a mandatary or a service provider, is not health or social services information when it is collected by that body for human resources management purposes.

In addition, information allowing a person to be identified, such as the person’s name, date of birth, contact information, health insurance number or any other information of the same nature, is health or social services information when it is next to information referred to in the first paragraph or when it is collected for registration, enrolment or admission of the person concerned to or at a health and social services institution or for the taking in charge of the person concerned by another health services or social services body.”

This definition does not exist at present, and adding it will bring us closer to the European Union’s General Data Protection Regulation.^[6]

We would also note that Bill 19 applies to health and social services bodies that hold health information (Bill 19, s. 4). It is worth noting that this definition is broad and is not limited to institutions that provide care directly. They are defined in section 4 of Bill 19 and in Schedules 1 and 2 to the bill:

• the Ministère de la Santé et des Services sociaux;
• a person, partnership or body operating in the health and social services sector, being: the Health and Welfare Commissioner; the Commission sur les soins de fin de vie; the Corporation d’urgences-santé; Héma-Québec; the Institut national d’excellence en santé et en services sociaux; the Institut national de santé publique du Québec; the RAMQ; an organization that coordinates organ or tissue donations; a person or a partnership operating a private health facility; a person or a partnership operating a specialized medical centre; a health communication centre governed by the Act respecting pre-hospital emergency services; a person or a partnership operating a centre for assisted procreation; a person or a partnership operating a laboratory; a private seniors’ residence; an intermediate or family-type resource; a resource offering lodging; a holder of a funeral services business licence; a holder of an ambulance service permit; a palliative care hospice;
• a health and social services institution, the Nunavik Regional Board of Health and Social Services established under section 530.25 of the Act respecting health services and social services and the Cree Board of Health and Social Services of James Bay established under the Act respecting health services and social services for Cree Native persons;
• a person, partnership or body not already referred to in this section that enters into an agreement with a body referred to in subparagraph 2 or 3 concerning the provision of certain health services or social services on behalf of that body; and
• any other person, partnership or body determined by government regulation.

Creation of rules specific to health information

Bill 19 creates rules that apply to the collection and keeping of information by a body in the health sector that are in large part modelled on the rules that apply to the protection of personal information (chapter 2 of Bill 19) and to confidentiality incidents (ss. 58 and 59, for health bodies). The Commission d’accès à l’information will have jurisdiction in this area (see, inter alia, ss. 75 to 114) and penalties ranging up to $150,000 may be imposed (ss. 115 to 122) for failure to comply with the Act.

Bill 19 provides the situations in which access by the person concerned or their representative, by a health worker, or by any other body may be allowed in certain circumstances (Bill 19, ss. 34 et seq.). There are other rules that govern consultation of information in the event of the death of the person concerned.

Special rules are also provided for research, in sections 30 et seq., and there are also the privacy impact assessments introduced by Bill 25. Researchers who use health information will no longer have to follow the obligations that arise from privacy legislation but will have to comply with the obligations provided by Bill 19.

Section 49 of Bill 19 introduces a new position: “delegated manager of government digital data for the Ministère de la Santé et des Services sociaux.” This person will have to manage authorizations for access to health and social services information without consent.

More specifically, this person will be able to authorize a health or social services body to access health or social services information held by another health or social services body where:

• the access to the information is necessary for the application of an Act in Québec, without the release, transmission or disclosure of the information or any other action enabling its examination being expressly provided for by law;
• the access is necessary for fulfilling its mission or its purpose, exercising its functions or activities or implementing a program under its management;
• the access is clearly for the benefit of the person concerned; or
• the access is justified by exceptional circumstances.

They may also, in any of the above cases, authorize a public body or a body of another government to access health or social services information. Where the authorization is given to a body of another government, the access must be governed by a written agreement entered into in accordance with the law (Bill 19, s. 35).

To make it possible to monitor the various authorizations to access given, this manager must keep a register that contains the identity of the natural or legal persons that have been granted access, a description of the information covered and its origin, the purposes for which the access was authorized, the duration of and conditions applicable to each authorization, including the special security measures, and the processing time for the request for authorization (Bill 19, s. 50).

Amendments to existing legislation

Bill 19 also amends existing legislation such as the Access Act and the Private Sector Act to provide that those two statutes do not apply to health information. In addition, researchers who use health information will no longer have to follow the obligations that arise from privacy legislation but will have to comply with the obligations provided by Bill 19.

It should be noted, however, that there are no dates for its coming into force. The provisions of the Access Act and the Private Sector Act, even those amended by Bill 25, continue to apply for the moment.

It should be pointed out that Bill 19 amends the AHSSS to provide for the creation of a national information filing system (Bill 19, ss. 195 et seq.). That system must make it possible to integrate records relating to patients, consent for the post-mortem removal of organs or tissues, and advance medical directives concerning medical assistance in dying. A regulation will have to be made to determine what bodies must file all or part of the information they collect in this system.

Bill 19 will implement a specific regime for health information that would no longer be subject to existing legislation. If you have questions, Fasken will be pleased to provide you with information or assistance and can help you apply the right law in the right circumstances and find practical solutions for complying with the new obligations created by Bill 19.