New Brunswick’s Personal Health Information Privacy and Access Act (PHIPAA), similar to Ontario’s PHIPA, governs the healthcare industry. It requires that personal health information is stored in Canada. Storing the information outside of Canada requires the individual’s consent or it specifically authorized under PHIPAA.
Information managers, or cloud service providers, that deliver services and programs or are otherwise engaged by the organization must be identified by it. There must also be written agreements between the organization and the service provided that include a detailed description of the methods of protection of the information, that it is stored in Canada, and contain a statement that all procedures that pertain to personal information complies with PHIPAA.
Evaluation
When you are selecting a cloud provider at the provincial private and public sector level in New Brunswick, it is essential that you conduct a thorough evaluation of the provider and their policies. Questions to ask include:
- Is the business’ ownership inside of Canada?
- Where are the business and data centers physically located?
- For businesses located in a province and governed under that province’s laws, is the data center also located within that province?
- Are all contractual provisions aligned with the privacy laws of your province including third party access limitations and requirement to provide notification of a suspected or actual security breach?
- What policies does the cloud company have in place for privacy, security, and access management?
- What are the protocols for infrastructure security including encryption of information when it is stored and transferred?
- What policies does the cloud company have in place regarding subpoenas and warrants that are issued to them from jurisdictions outside of the province or outside of Canada?
Canadian Privacy Laws:
For More information on New Brunswick’s privacy laws, visit:
Leave a Reply
Want to join the discussion?Feel free to contribute!