Electronic Health Records Regulations
made under Section 110 of the
Personal Health Information Act
S.N.S. 2010, c. 41
O.I.C. 2024-273 (effective July 2, 2024), N.S. Reg. 132/2024
Table of Contents
Please note: this table of contents is provided for convenience of reference and does not form part of the regulations.
Click here to go to the text of the regulations.
Citation
Definitions
Application of regulations
Minister is custodian of personal health information in electronic health records
Individual has right to access personal health information
Collection, use and disclosure of information
Personal health information held in EHR covered by Act
Detecting and investigating privacy breaches
Complaints and mediation
Notice of amendments
Review of regulations by Minister
Citation
1 These regulations may be cited as the Electronic Health Records Regulations.
Definitions
2 In these regulations,
“Act” means the Personal Health Information Act;
“agent” means an agent as defined in the Act and includes an EMR provider;
“Department” means the Department of Health and Wellness;
“electronic health record” or “EHR” means an electronic health record as defined
in the Personal Health Information Regulations;
“electronic medical record” or “EMR” means a practice-based computer
application that enables the longitudinal collection of patient information;
“EMR provider” means a vendor, individual or entity that provides to a provider
an electronic medical record service, which may include providing the secure
storage of a patient’s personal health information on the provider’s behalf;
“Minister” means the Minister of Health and Wellness;
“Personal Health Information Regulations” means the Personal Health
Information Regulations made under the Act;
“provider” means a regulated health professional who provides health care to an
individual in the Province;
“provider care team” means any of the following people who are authorized by the
provider to assist in providing and administering care to the provider’s patients:
(i) a care provider,
(ii) a medical professional,
(iii) a clinic or medical office staff member.
Application of regulations
3 (1) Subject to subsection (2), these regulations apply to all providers in the Province.
(2) Despite subsection (1), a First Nation, First Nation community or representative
body may opt out of participating in an EHR created and managed under these
regulations and may designate First Nations providers to whom these regulations
and the Personal Health Information Regulations do not apply.
Minister is custodian of personal health information in electronic health records
4 The Minister is the custodian of all personal health information that, for the purpose of
creating and maintaining EHR programs and services and the planning and management
of the health system, is
(a) disclosed to the Minister by providers in accordance with these regulations;
(b) collected by the Minister under these regulations; and
(c) accessed by authorized users of an EHR program or service.
Individual has right to access personal health information
5 An individual has the right to access their own personal health information, including
any information that is collected by the Minister or an agent of the Minister for the
purpose of an EHR program or service.
Collection, use and disclosure of information
6 (1) The Minister, or an agent of the Minister, may require a provider who is a
custodian under subclause 3(f)(i) of the Act, or an agent of the provider, to disclose
the personal health information of the provider’s patients for the purpose of
creating and maintaining an EHR.
(2) The Minister must ensure that personal health information contained in an EHR
that identifies the patient who is the subject of the personal health information is
accessible to only the following people:
(a) the patient who is the subject of the personal health information;
(b) individuals who have the express consent of the patient who is the subject
of the personal health information;
(c) an agent of the Minister for the purposes of maintaining the operational
components of the EHR and who is bound by a confidentiality agreement
regarding the personal health information.
(3) The Minister or their agent must limit the personal health information a patient
may access from an EHR by excluding information considered by the Minister to
belong to any of the following categories:
(a) notes or documentation not intended for patient access that might, if
accessed by the patient, negatively affect the relationship between the
patient and the provider or provider care team;
(b) information that might negatively affect the patient if accessed by the patient
without advice from the provider to explain or provide context for the
information.
(4) To determine which categories of information to exclude under subsection (3), the
Minister must consult with the regulatory authority, professional association or
union applicable to the provider.
(5) Personal health information contained in an EHR may be used for the purposes of
the planning and management of the health system or for research undertaken in
accordance with the Act only when accessed in a form that does not identify the
individual who is the subject of the personal health information.
(6) If the personal health information of a provider’s patients referred to in subsection
(1) is in the possession of an EMR provider, the Minister may require the EMR
provider to disclose personal health information on behalf of a provider under
subsection (1).
(7) Despite subsection (5), the Minister must not aggregate personal health
information or permit the aggregation of personal health information contained in
an EHR in a manner that stratifies data or outcomes or permits analysis based upon
any of the following without the consent of the First Nation or the First Nation’s
designated representative:
(a) Indigenous identity;
(b) First Nation status;
(c) First Nation community;
(d) whether the personal health information was collected from a provider who
operates in a First Nation community.
Personal health information held in EHR covered by Act
7 (1) The Minister’s collection, use and disclosure of personal health information
collected from a provider or an EMR provider acting on behalf of a provider under
subsection 6(1) and held in an EHR for the purposes of EHR programs and
services is governed by the requirements of the Act.
(2) As the custodian of personal health information that is collected, used and
disclosed as part of EHR programs and services, the Minister must abide by the
requirements of the Act respecting practices to protect personal health information
and the privacy of [the] individual to whom that information relates.
(3) As the custodian of an EHR, the Minister must implement the additional
safeguards under Section 65 of the Act for personal health information held in an
electronic information system as prescribed in Section 10 of the Personal Health
Information Regulations.
Detecting and investigating privacy breaches
8 The Minister or their agent may audit information held in an EHR and records of EHR
user activity to detect and investigate privacy breaches in accordance with the Act, the
Personal Health Information Regulations or guidelines set by the Minister.
Complaints and mediation
9 (1) The Minister, or their agent for the purposes of administering and maintaining an
EHR, must implement a complaints policy in the manner set out in the Personal
Health Information Regulations.
(2) If a complaint is made against the Minister or their agent about actions taken under
these regulations, the Review Officer must proceed in the manner set out in
Sections 91 to 100 of the Act.
(3) The Review Officer may settle matters under review through mediation.
Notice of amendments
10 (1) The Minister or Department must notify providers of any amendments to these
regulations that may affect them.
(2) The Minister or Department must notify patient users of any amendments to these
regulations that may affect how patients access their information contained in an
EHR.
Review of regulations by Minister
11 The Minister may review these regulations to determine their effectiveness in governing
the implementation, administration and management of EHR programs and services.
The following regulations are not
yet in force and are not included in the current consolidation: