Yukon Information and Privacy Commissioner
Frequently Asked Questions
- What is a custodian?
‘Custodian’ is a key term in HIPMA. This is an authorized person who may collect, use and disclose personal health information only in accordance with the legislation. Custodians include most health care providers, operators of hospitals and health facilities, the Yukon Government Department of Health and Social Services, the Department of Community Services Yukon Emergency Medical Services program, the Kwanlin Dun First Nation Health Centre, the Many Rivers Counselling and Support Services Society, and the Child Development Centre.
‘Health care providers’ are also defined. They include physicians, nurses, pharmacists, chiropractors, optometrists, dentists and related professionals, psychologists, occupational therapists, midwives, naturopaths, and speech language pathologists, as well as individuals defined in the Health Professions Act, such as physiotherapists.
‘Health facility’ is a defined term and includes medical clinics, community health centres, dental clinics, medical laboratories, specimen collection centres, pharmacies, nursing homes and other continuing or long-term care facilities.
- Do I have the right to access my personal health information?
Yes. Under HIPMA, you have the right to access your personal health information held by a custodian (see ‘What is a custodian?’).
Personal health information includes:
- information related to your health or health care provided to you;
- records of payments for your health care;
- information related to your donation of body parts, tissue or bodily substances; and
- information about testing or examinations that you have undergone.
- What is a ‘record of user activity’?
Electronic information systems used by custodians should have a ‘user-based’ capability to track access to any information within that system. This means that the system can differentiate between users, usually by the login credentials assigned to each user. Every time a custodian or one of their employees accesses your personal health information, they must each use their own login and the system records this access.
A ‘record of user activity’ is the record generated by the system that identifies who has accessed your personal health information. HIPMA gives you the right to request access to this record and the custodian is not allowed to charge you a fee to provide you with it.
You would request access to a record of user activity from a custodian in the same way you would request access to other personal health information from them (see ‘How do I request access to my personal health information?’).
- How do I request access to my personal health information?
HIPMA allows you to view or receive a copy of your personal health information.
You can do this by making a request to the custodian who has your personal health information. This request should be in writing unless the custodian agrees otherwise.
A custodian may refuse to grant you access to your personal health information if the request is deemed to be frivolous or vexatious.
You may wish to keep a copy of your request letter and any response from the custodian in case you are not satisfied with the information that you receive and want to make a complaint to our Office.
- How much does it cost to have access to my personal health information?
The first two hours that a custodian spends in any calendar year responding to your request to access your personal health information is free. After that, they may charge $9 for each 15 minutes.
If a copy of your information is printed or photocopied, the custodian may charge you $0.25 for each page and they may charge the actual cost of using another medium, such as a removable storage device. They may also charge you the cost of shipping or delivering the records to you.
You may ask for an estimate of the total fee in advance.
A custodian is not allowed to charge you for a record containing information about who has accessed your personal health information in an electronic information system (see ‘What is a record of user activity?’).
If it is expected that a custodian will no longer provide you with care and you request them to transfer your personal health information to a new health care provider, then the custodian is not allowed to charge you for this transfer.
- When will I get an answer in response to my request for access?
A custodian is normally required to process your request for access to your personal health information in 30 days or less. However, sometimes compiling the information will take a significant amount of work. In that case, the custodian may take up to a maximum of 60 days as long as they give you reasons for the delay and let you know when you can expect a response.
If you do not receive a response by the deadline indicated by the custodian, you can make a complaint to our Office (see ‘How can I make a complaint to the Office of the Information and Privacy Commissioner?’).
- What if I am not satisfied with the response of the custodian?
A custodian can refuse all or part of your request to access your personal health information. However, they must provide you with reasons for the refusal.
If your request is refused, partially refused, or not answered in time, you may file a complaint with our Office (see ‘How do I make a complaint to the Office of the Information and Privacy Commissioner?’).
If you believe that a custodian has applied HIPMA incorrectly in refusing access and has, therefore, not complied with HIPMA, you have 60 days to file a complaint with our Office from the date of the alleged non-compliance. We do not charge any fees to investigate your complaint.
- What can I do if I believe my personal health information contains an error or is incomplete?
You have the right to request a correction to your personal health information. You should make this request in writing to the custodian. On receipt of your request, a custodian has 30 days to respond. If providing a response will seriously interfere with the operations of the custodian, they can take an extra 15 days as long as they give reasons for the delay and let you know when you can expect a response.
The custodian will either make the requested correction to your record or refuse to do so. If they refuse, you can have a statement of disagreement added to your record and you may make a complaint to our Office. The statement of disagreement is a short note written by you that explains the requested correction and your reasons for it.
A custodian is not required to make a correction or to add a statement of disagreement to a ‘good faith’ professional opinion, or if the requested correction is deemed to be of a repetitious, frivolous, or vexatious nature.
A custodian is not allowed to charge you a fee for correcting your record or adding a statement of disagreement.
If you believe the custodian has not followed HIPMA in managing your request for correction, you can make a complaint to our Office (see ‘How do I make a complaint to the Office of the Information and Privacy Commissioner?’).
- What if I am concerned about the privacy of my personal health information?
Custodians are required to protect personal health information by applying information practices that include adequate administrative policies, as well as technical and physical safeguards, that ensure the confidentiality, security and integrity of your information within their custody or control.
Custodians must also take measures to limit the collection, use, and disclosure of your personal health information. They must prevent breaches of the privacy of this information, and they must ensure that this information is securely stored, disposed of or destroyed. If you are concerned that a custodian is improperly protecting your personal health information or you are aware that a breach of your privacy has occurred, you may make a complaint to our Office (see ‘How do I make a complaint to the Office of the Information and Privacy Commissioner?’).
If you are concerned that someone has improperly accessed your personal health information stored in an electronic health information system, you may request a record from the custodian that shows who has accessed this information (see ‘What is a record of user activity?’). There is no cost for a copy of this record (see ‘How much does it cost to request health information?’).
- What are the rules about my Yukon Public Health Care Insurance Plan (YHCIP) number and card?
HIPMA, together with its Health Information General Regulation, prohibit any person from collecting, using or disclosing your YHCIP card and number except in the following limited and specified circumstances.
Your YHCIP number may only be collected, used or disclosed:
- for health care related purposes including the provision of health care, for health research or an investigation, for a purpose related to the Yukon Health Information Network, for a proceeding, and by the Canadian Institute for Health Information, or similar body if there is an agreement authorizing use of the number;
- by a person who is processing a payment for a life, health or disability insurance policy, or administrating a matter under the Workers’ Compensation Act, the Jury Act, the Coroners Act or the Occupational Health and Safety Act if the collection, use or disclosure is necessary;
- by any person, except a public body, for the purpose of determining before 2018 if you are a resident of Yukon; and
- by an election officer who may only collect and use the number to verify your identity and to determine if you are a resident of Yukon.
The production of your YHCIP card may be requested:
- by a custodian or their agent to provide you with health care;
- by the Department of Highways and Public Works Motor Vehicles program if the purpose of collection and use is for the purposes of your organ donation;
- by an election officer in relation to their collection and use of your number; and
- by any person, except a public body, who may collect and use your YHCIP number for the purpose of determining if you are a resident of Yukon if the collection and use is before 2018.
- How do I make a complaint to the Office of the IPC?
If you reasonably believe that a custodian has not complied with HIPMA, you can make a complaint to our Office by completing and submitting a ‘Review/ Complaint Form’.
This form can be found by clicking here.
You can also obtain the form by contacting us as follows.
Office of the Information and Privacy Commissioner
Suite 201, 211 Hawkins Street
Whitehorse, Yukon Y1A 1X3
Toll free: 1-800-661-0408 ext. 8468
The Office is open between 8:30 A.M. and 4:30 P.M. from Monday to Friday.
- What happens when I file a complaint?
When we receive your complaint, we will:
- notify the custodian about the complaint, and
- provide you and the custodian with a summary of the complaint, as well as a summary of the procedure we will use to consider the complaint.
Our Office will work with you and the custodian to settle the complaint informally. If this is not possible, the Information and Privacy Commissioner (IPC) may conduct a hearing. Under HIPMA, this is called a ‘consideration’. Following a consideration, the IPC will generate a report with her findings and recommendations. Both you and the custodian will receive a copy of the report.
The IPC may refuse to consider your complaint for a number of reasons. For example, it may be trivial or has already been dealt with. In that case, the IPC will inform you of the reasons for her refusal.
- What if the custodian does not follow the recommendations of the IPC?
If the custodian decides not to follow the recommendations of the Information and Privacy Commissioner (IPC) or agrees to follow them but has not done so within a reasonable time, you may appeal to the Yukon Supreme Court. You must initiate your appeal within six months after the IPC’s report is issued.
- Is the Information and Privacy Commissioner part of government?
No, the Information and Privacy Commissioner (IPC) is an independent officer of the Yukon Legislative Assembly and is, therefore, not part of the Yukon Government.
In Yukon, the IPC is the same person as the Ombudsman and the Public Interest Disclosure Commissioner. For more information about these roles, our website at: http://www.ombudsman.yk.ca.
The IPC is responsible for monitoring compliance with HIPMA and the Access to Information and Protection of Privacy Act (ATIPP).
ATIPP applies to Yukon public bodies, such as Yukon Government departments. HIPMA applies to custodians (see ‘What is a custodian?’).
The IPC has a number of responsibilities under these Acts and has broad authority to investigate complaints made, including the power to compel production of records and witnesses. Under HIPMA, the IPC has adjudicative authority. This means she can make findings of fact and law that are binding on custodians. At the conclusion of an adjudication, called a ‘consideration’ under HIPMA, she has the authority to recommend any remedy that she determines appropriate.
- Where can I get more information?
For any questions about your rights and custodians’ responsibilities under HIPMA, please contact us.
Office of the Information and Privacy Commissioner
Suite 201, 211 Hawkins Street
Whitehorse, Yukon, Y1A 1X3
Toll free: 1-800-661-0408 ext. 8468
The Office is open between 8:30 A.M. and 4:30 P.M. from Monday to Friday.
- When does the IPC hold inquiries?
Most requests for review initially proceed to mediation to try to settle the issues for review. Where a request for review is not completely settled during mediation, a party can ask the IPC to conduct an inquiry. The IPC has discretion to decide whether to proceed to inquiry.
- What happens in an inquiry?
An inquiry is the final stage in the request for review process. An inquiry is a formal adjudicative process conducted by the IPC. The parties to an inquiry are entitled to make representations * to the IPC about the issues identified for inquiry. In most inquiries, the representations are made in writing and the parties do not appear before the IPC.
If the IPC decides to proceed to inquiry, a notice of inquiry is issued to the parties. The notice of inquiry outlines the next steps in the inquiry. The notice of inquiry will confirm:
- the parties to the inquiry,
- the sections of the ATIPP Act that will be considered,
- the issues for inquiry,
- the timeline for notifying the IPC of any preliminary objections to the inquiry,
- the schedule for delivery and exchange of initial and reply submissions from the parties, and
- a deadline for requesting the IPC’s approval for “in camera”* submission material.
At the inquiry, the IPC considers the Fact Report prepared by the mediator, the representations received from the parties, reviews any records in dispute, and decides how each issue should be resolved and makes her recommendation(s) *. The IPC issues a written report to the parties setting out her findings, recommendation(s) and reasons for the findings and recommendation(s). Some of the things the IPC can recommend are:
- the release of some or all of the information in a record
- the modification of a fee waiver
- the correction of personal information
- When does an inquiry conclude?
An inquiry concludes when the IPC issues her written report. If the written report includes recommendation(s), the public body * has 30 days to decide whether it will follow the IPC’s recommendation(s) and give notice of that decision to the IPC and any other person given the report (i.e. the applicant and third parties, if applicable). If the public body does not give notice of its decision within the required time, the public body is deemed to have refused to follow any recommendation(s). If the public body decides not to follow the IPC’s recommendation(s), the public body must, in writing, inform the persons who received the IPC’s report of their right to appeal to the Supreme Court of Yukon.
- How long does an inquiry take?
The time to complete an inquiry and issue a written report depends on a number of factors including the number and complexity of the issues for inquiry, the nature and number of the records, the number of other inquiries underway and whether there are any procedural delays such as the need for additional submissions.
- Who participates in an inquiry?
If the inquiry involves a decision of the public body to refuse access to records or information, the person who requested the inquiry, the public body and a third party are always provided an opportunity to participate in the inquiry.
If the inquiry is about a decision of the records manager such as an extension of time for responding to an access request or a fee waiver, the person who requested the inquiry and the records manager participate in the inquiry.
The IPC may decide to give notice of the inquiry and invite participation from any person who, in the opinion of the IPC, should have received notice of the inquiry or may be able to present useful information to aid in the disposition of the issues.
The person who asked for the review, the public body and any person given notice of the request for review may be represented at the inquiry by legal counsel or an agent.
All inquiry participants are collectively referred to as parties.
- What is a written submission?
A party’s representations to the IPC are made by way of a written submission. A submission contains a party’s argument and evidence presented to persuade the IPC to resolve the issue in the inquiry in a particular way. Evidence is what a party provides, in addition to arguments, during the inquiry to prove or disprove the facts in dispute. The IPC is not bound by ordinary rules of evidence. However, where a party is submitting evidence, it is preferable that it be in affidavit form.
Parties are also encouraged to review any relevant IPC Inquiry Reports, other case law or statutory materials and include references to such material in their submission.
Mediation Material to preserve the integrity of the mediation process, a party may not refer to or include in its submission any information or records related to the mediation process and attempts to settle the issues including the mediator’s opinions or recommendations on the issues. The IPC will not consider mediation materials in reaching a decision. If a submission contains any mediation material, the Registrar will require the party to remove the material from the submission. This does not include factual outcomes of mediation, for example, changes in the issues or exceptions claimed, the scope of disputed records or the amount of fees assessed by the records manager.
- Can a submission be received in camera* (in private)?
The IPC exchanges submissions received from a party with the other parties unless a party requests that some or all of its submission be kept private or in camera. If a party wishes to submit material in camera, it must obtain the IPC’s approval ahead of time in accordance with the time limit set out in the notice of inquiry. The party seeking approval must submit to the Registrar a letter requesting the IPC’s approval of the in camera information. The letter should provide the reasons why that material should be received in camera and include a copy of the submission with the proposed in camera portions highlighted.
For the IPC to agree to receive material in camera, it must be information that:
- if revealed would result in the disclosure of some or all the details of the disputed information in the record, or
- might itself be subject to an exception under the ATIPP Act.
If the IPC agrees to receive in camera evidence and arguments, it will be kept from the other parties and will not be revealed in the written report. The Registrar will inform the parties if the IPC’s decision is to accept material on an in camera basis.
- What if a party does not make a submission?
If any party does not make a submission by the date specified by the IPC, the inquiry may proceed and a decision may be made in the absence of any submission.
- What is the sequence for submissions?
- The public body provides the initial submission. If the IPC considers it appropriate, the IPC may ask other parties to provide an initial submission. A party’s initial submission should include its argument about how the relevant sections of the legislation apply in the circumstances of their case and explain how the evidence supports its position.
- The applicant or third party provides a response submission. It should focus on the issues set out in the notice of inquiry and the information provided by the other parties in their initial submission.
- The parties that provided initial submissions are then given an opportunity to provide a reply submission. The reply submission must only reply to what is contained in the response submission.
The Notice of Inquiry sets out the date by which submissions must be received in the IPC’s office.
At any stage of the inquiry process, the IPC may request an additional submission from any party where necessary or desirable. Unsolicited supplementary or additional submissions will only be considered in exceptional circumstances.
- Can I request an extension of time for providing a written inquiry submission?
The notice of inquiry will set out the date for receipt of the written inquiry submissions. If a party requires an extension of time for providing a submission, the party must send a letter to the Registrar at least three days before the due date for the submission. The letter should include the reasons for requesting an extension. The IPC will then decide whether to allow or refuse an extension of time to provide the submission. The Registrar will notify the parties of the IPC’s decision.
- How are submissions exchanged?
The Registrar accepts and exchanges submission on behalf of the parties.
The IPC accepts written submissions in all formats (i.e. mail, in-person, fax, and email). There are significant security risks however associated with the use of e-mail communication so we strongly recommend that you encrypt e-mail submissions. Please contact our office if you require additional information about how to encrypt documents. Submissions should be addressed to:
Office of the Information and Privacy Commissioner
Suite 201 – 211 Hawkins Street
Whitehorse, YT Y1A 1X3
- How do I make a preliminary objection?
A party who wants to make a preliminary objection must direct their objection to the IPC. The notice of inquiry specifies the date by which any preliminary objections must be made to the IPC. The objections must be provided in writing. The party objecting should state the objection(s) and include any relevant supporting information. Before making a decision, the IPC will decide whether to give the other parties an opportunity to make representations. The IPC will make a decision about the objection(s) before proceeding further with the review. The IPC will provide her decision in writing to the parties.
- Who has the burden of proof in an inquiry?
Section 54 of the ATIPP Act sets out the burden of proof in an inquiry.
Where a public body has decided to refuse access to records or information that relates to a third party:
- if the record contains personal information, then it is up to the applicant to prove that disclosure of the information would not be an unreasonable invasion of the third party’s personal privacy
- if the record contains any information other than personal information, then it is up to the third party to prove that the applicant has no right of access to the information or record. For example, where there is information that may be harmful to business interests of a third party, it would be up to the third party to prove that the applicant has no right of access.
In all other cases, it is up to the public body to prove that the applicant has no right of access to the information or record.
If the inquiry concerns an extension of time to respond or a fee waiver, it is up to the records manager to prove that the extension or fee is justifiable.
The ATIPP Act is silent on the burden of proof regarding requests for corrections or complaints made about the collection, use and disclosure of personal information by a public body contrary to the ATIPP Act. When conducting the inquiry, the IPC will decide which party bears the burden of proof for these issues.
- Why does the IPC publish reports?
The IPC reports publishes reports on our website for educational purposes. To protect individuals’ privacy names and other identifying personal information is removed from the report. The names of public bodies and parties who are businesses or corporate bodies are published in the report.
- Glossary of Terms
Affidavit: A written statement of facts made under oath. Affidavits are a means of providing evidence. An affidavit must be affirmed or sworn before a Notary Public for the Yukon Territory.
Applicant: A person who makes a request under for access to a record the ATTIP Act. Also a person who makes a request for correction of their personal information in a record, or requests a review of the records manager’s grant of an extension of time to respond to a request or a refusal to waive a fee.
Burden of Proof: The party with the burden of proof must convince the IPC of its case in order to be successful at the inquiry. In most cases, the Notice of Inquiry states which party bears the burden of proof.
Evidence: Information submitted to prove or to disprove a fact or allegation. This may include documents, physical evidence and oral or written testimony. Evidence received by affidavit is sworn evidence.
In Camera: In private. Evidence, arguments or records received in private are considered to be in camera.
Inquiry: The second stage in the review process. An adjudicative process in which the IPC receives submissions from the parties, considers and decides all questions of fact and law in relation to the issues for inquiry and disposes of the issues in a written report.
Party: The person who requested the review, the public body, and a third if applicable.
Public Body: An organization or entity that is subject to the ATIPP Act. Public bodies include departments, secretariats or other similar executive agencies of the Government of Yukon, boards, commissions, foundations and corporations that are agents of the Government of Yukon and those organizations listed in Schedule A of the ATIPP Act.
Mediation: The first stage in a request for review. The IPC authorizes a mediator to try to settle the issues for review. Mediation may succeed in settling the issue(s), reducing the number of records in dispute, clarifying issue(s) and help the parties better understand the ATIPP Act. If the matter cannot be totally settled in mediation, the IPC may conduct an inquiry.
Records Manager: A member of the public service designated as the “records manager” for the purposes of the ATIPP Act. The records manager has authority to extend the timelines for a response and to decide whether to waive all or part of the fees associated with a request.
Registrar of Inquiries: The IPC staff member responsible for all administrative aspects of inquiries.
Representations: Information provided to the IPC by a party about the issue(s) for inquiry. Representations are usually made in writing by way of a submission (defined below).
Review: An Applicant can request the IPC review certain decisions of the public body or records manager. Reviews proceed in two stages. When the IPC receives a request to review a decision, most cases proceed to mediation. If the issue(s) are not completely settled in mediation, the IPC can decide to proceed to the inquiry stage of a review.
Submission: The written argument and evidence in support of a party’s position provided to the IPC.
Third party: In relation to a request for access to a record or information or for correction of personal information, means any person, group of persons or organization other than the person who made the request or the public body.