Act respecting health and social services information: Publication of two draft regulations

Draft Regulation respecting the application of certain provisions of the Act respecting health and social services information

This draft regulation:

• recognizes a new type of body by providing that a college- or university-level educational institution will be subject to the Act regarding its activities related to the provision of health services or social services;
• creates a simplified consent mechanism for the use or communication of HSSI by confirming that consent may be given (or withdrawn) verbally or in writing;
• creates an access refusal or restriction mechanism containing various cumulative conditions, including that of requiring refusals or restrictions to be in writing and to:
  • be given to the body holding the HSSI,
  • contain the prescribed information, and
  • be signed,

  (A similar mechanism applies to requests to amend or withdraw a refusal);

• sets the conditions under which a service provider who is not a professional within the meaning of the Professional Code may be informed of the existence of and have access to HSSI;
• provides for the contents of the register of technological products and services of HSSBs; and
• confirms certain obligations incumbent on HSSBs in the event of a confidentiality incident, notably as regards the notice to be sent should a confidentiality incident present a risk of serious injury, and the contents of the register of confidentiality incidents.

Draft Regulation respecting the governance of health and social services information

This draft regulation defines the rules governing the HSSI held by HSSBs, more specifically:

• the responsibilities of HSSBs, which must:
  • ensure that their personnel and professionals (including students and trainees) receive training regarding the protection of information recognized by the minister as soon as they begin working (some of this training can be found here);
  • see to it that their personnel and professionals undergo annual refresher training regarding the protection of HSSI and determine the contents of this training;
  • keep proof of any consent received in accordance with the Act;
  • identify a person in charge of communicating with any person who makes a notice of restriction so as to adequately inform him or her of the risks associated with exercising the right of restriction;
  • analyze their governance policy and security measures at least once a year, and analyze access to the HSSI that they hold and all other uses and communications of that information on a monthly basis, with the exception of those HSSBs listed in Schedule 2 to the Act (annually);
  • set up a committee on the governance of information and designate the individuals who will be sitting on this committee;
  • ensure that the HSSI remains usable despite any incident affecting the medium on which it is stored and in a manner that ensures its integrity.
• the terms for keeping and destroying HSSI, more specifically the keeping of HSSI that is subject to a restriction or a refusal of access and the obligation to enter into a contract in writing if the HSSB entrusts the destruction of HSSI to a third party, along with the contents of that contract; and
• the rules for maintaining and evaluating technological products or services, which includes designating a person in charge of ensuring the application of the standards applicable to the technological products or services that the HSSBs use, keeping a calendar of the dates on which these products no longer comply or are no longer provided, and ensuring that they undergo an evaluation pertaining to the prescribed standards at least once every other year.

These draft regulations will come into force on the fifteenth day following the date of their publication in the Gazette officielle du Québec.