On February 21, 2024, the Government of Québec launched its draft Regulation respecting the application of certain provisions of the Act respecting health and social services information (PDF) (“Draft 1”). The purpose of this draft regulation is to clarify the application of certain sections of the new law governing the collection, use and communication of health and social services information in Québec. Note that this draft regulation was followed by the draft Regulation respecting the governance of health and social services information (PDF) on March 6, 2024 (“Draft 2”). Draft 2 will be the subject of the next Bulletin.
Here are the key takeaways.
Addition of a New Health and Social Services Body
The Act respecting health and social services information (the “AHSSI”), also known as Bill 5, applies, among others, to the groups listed in Schedules I and II of that Act. Certain categories of bodies that are subject to the AHSSI are set out in Schedule II. The AHSSI states that the government may add any other person or group to the schedules by regulation.[1]
Under Draft 1 a college- or university-level educational institution is considered a health and social services body referred to in Schedule II for its activities related to the provision of health services or social services, including the provision of such services to students of that institution.[2] These would include student health clinics on campus and schools granting technical college diplomas (DECs) in nursing.
These institutions, which are already subject to applicable privacy laws, may have to apply two different regulatory frameworks depending on the activity.
Consent
Draft 1 sets out the means by which a person may consent to the use or communication of health and social services information concerning them under the AHSSI. Draft 1 specifies that consent may be given or withdrawn either in writing or verbally.[3]
Draft 1 is clearer with respect to the means of consent than, for example, the Act respecting access to documents held by public bodies and the protection of personal information. While the latter also allows a person to give their consent in writing or verbally, the means of doing so are not expressly stated.[4] It is possible the legislative intent is to confirm that written consent given under the AHSSI can be withdrawn verbally, and vice versa.
Terms of Notice of Restriction & Notice of Refusal
Among other things, the AHSSI gives individuals the right to restrict or refuse access to their health information.[5] Draft 1 describes the information that must be included in any notice of restriction or refusal sent to a given body.
A notice of restriction must contain:
- The name and contact information of the person concerned by the information.
- The identity of the service provider[6] or the category of service providers concerned by the restriction.
- A description of the information concerned by the restriction.
- The signature of the person giving the notice.[7]
- A notice of refusal must contain:
- The name and contact information of the person concerned by the information.
- The person or persons to whom the refusal applies, from among those referred to in subsection 8(1) of the AHSSI.
- In the case of a refusal applicable to the persons referred to in subsection 8(4) (i.e., certain researchers), the research themes or categories of research activities covered by the refusal.
- The signature of the person giving the notice.[8]
In both cases, if the notice concerns a minor under 14 years of age, it must be given by the person having parental authority or the tutor, and must also include the name and contact information of that person.
Conditions for Service Provider to Access Information
The AHSSI allows a service provider who is not a professional within the meaning of the Professional Code to be informed of the existence of, and have access to information held by a given body if the service provider needs the information to provide health services or social services to the person concerned, or needs the information to provide technical or administrative support services to another service provider offering these services.[9]
Draft 1 clarifies the requirements for granting such access. Namely, the person with the highest authority within the body may grant such authorization—or suspend it—to any person who meets the following conditions:
- they are a member of body’s personnel;
- they have completed a legally-mandated training course on the protection of personal information;[10]
- they have signed a written confidentiality agreement.[11]
We note that Draft 1 does not describe the requirements for granting access to researchers, which would have been useful for pharmaceutical companies and other private-sector stakeholders. However, this could be the subject of a future regulation.[12]
Technological Products and Services
The AHSSI requires bodies to keep a record of the technological products and services it uses.[13] Draft 1 states that the following information must be included in the register:
- the type of technological product or service;
- a brief description of the technological product or service and the purposes for which it is used;
- the name of the technological product or service supplier;
- if applicable, an indication that the technological product or service is certified by the Minister;
- if applicable, an indication that the technological product or service uses information to make a decision based solely on automated processing.[14]
Confidentiality Incidents
The final chapter of Draft 1 sets out the information that must be included in the notice to the Minister, the Commission d’accès à l’information, and the persons concerned by a confidentiality incident, as well as the contents of the incident register. These requirements are similar to those described in the Regulation respecting confidentiality incidents.[15]
If you need assistance with your personal information or health information compliance program, Fasken is here to help. For more information, please contact the authors of this bulletin.
[1] Act respecting health and social services information, s 4(5) (AHSSI).
[2] Draft 1, s 1.
[3] Draft 1, s 2; AHSSI, s 6.
[4] Act respecting Access to documents held by public bodies and the Protection of personal information, s 53.1.
[5] AHSSI, ss 7–8.
[6] Under the AHSSI, the term “service provider” means a natural person who offers health services or social services within a health and social services body or who provides such a person with technical or administrative support services; see definitions in section 3 of the AHSSI.
[7] Draft 1, s 3.
[8] Draft 1, s 5.
[9] AHSSI, s 39.
[10] This training is referred to in section 1 of the draft Regulation respecting the governance of health and social services information (i.e., Draft 2).
[11] Draft 1, s 8.
[12] AHSSI, s 54.
[13] AHSSI, s 107.
[14] Draft 1, s 10.
[15] See our Bulletin on this topic: Regulations for confidentiality incidents - Tons of clarity and few distinctions!
