A Guide to The Personal Health Information Act

Your health information is personal and sensitive, and your privacy must be protected. In Manitoba, a law called The Personal Health Information Act (PHIA) gives you the right to access your personal health information. It also requires the individuals and organizations that keep your personal health records – known as “trustees” – to protect the privacy and security of your information.

Note: This information was developed by the Manitoba government with collaboration from the Ombudsman’s office. It is designed as a guidance tool to provide information about your access to information and privacy rights under PHIA. The information is not legally binding and is not intended to be legal advice. Any examples used are illustrative only and should not be used as authority for any decisions made under PHIA. Readers should refer to PHIA and the Personal Health Information Regulation made under PHIA and seek their own legal advice when interpreting and applying the law.

What are my rights?

PHIA gives you the right to:

• examine and receive a copy of your personal health information, subject to a few exceptions, within the time frame that PHIA requires;
• name someone you trust, for example a family member, to access your information on your behalf; and
• request a correction if you believe the information is wrong or missing.

What is personal health information?

Simply put, it is recorded information about you, your health and health care that is held by trustees. It can include:

• your name, address and telephone number
• information about your health, health care history and your family history
• information about the type of care or treatment you are receiving
• your Personal Health Identification Number (PHIN)
• information about payment for your health care

PHIA applies to all recorded personal health information no matter if it is kept in a paper file, in an electronic information system on a computer or in any other form.

Who are trustees?

• health professionals such as doctors, nurses, dentists, pharmacists, physiotherapists and others
• health care facilities such as hospitals, medical clinics, community health centres and personal care homes
• health services agencies such as organizations that provide health services in the home
• Manitoba public bodies such as provincial government departments and government agencies, municipalities, health authorities, or school divisions, colleges or universities.

What if I want to see my information?

You can ask a trustee holding your personal health information for access to it. You may be asked to put your request in writing. Under PHIA, trustees have a duty to make every reasonable effort to help you and to respond to your request openly, accurately, completely and without delay.

A trustee must explain any term, code or abbreviation used in personal health information as soon as reasonably practicable after you request such an explanation.

A trustee may require you to provide additional information that is necessary to respond to the request. If you do not provide additional information within 30 days, the trustee may determine that your request has been abandoned.

Will I get to see all my information?

Trustees must provide you with as much of the information you have requested as possible. But the law, including PHIA, allows them to hold back certain information from being disclosed to you. If that happens, the trustees must:

• tell you about the refusal in writing,
• explain why the information cannot be provided, and
• let you know that you have the right to complain to the Manitoba Ombudsman about it.

If a trustee does not have the information you requested, it may advise you that the personal health information you requested access to cannot be found or does not exist. You also have the right to make a complaint to the Manitoba Ombudsman in this instance.

Will I have to pay to get my information?

You may be charged a fee by the trustee holding your information to look at or get a copy of your personal health information. Currently, there is no limit on the fee trustees may charge, but the fee must be reasonable.

If you cannot afford to pay the fee, talk to the trustee.

A trustee may require you to indicate if you accept the estimate of the amount of the fee charged. If you do not provide the acceptance within 30 days, the trustee may determine that your request has been abandoned.

How long will it take to get my information?

Under PHIA, you should get a response within:

• 24 hours if you are in the hospital and want to see information about health care currently being provided to you as an in-patient.
• 72 hours if you are not in the hospital but want to see or get a copy of your current care information.
• 30 days for any other type of request.

You have the right to make a complaint to Manitoba Ombudsman  about an unreasonable delay by the trustee in responding to the request.

What if I disagree with the recorded information?

If you think your health information is wrong or missing, you can ask the trustee to correct it.

If the trustee decides not to make the change, they must tell you why in writing and let you know:

• the reason the trustee will not make the change;
• that you have the right to write a statement of disagreement with the information(see below) to explain what you think is wrong with the information;
• that you have the right to make a complaint about the refusal to the Manitoba Ombudsman.

What is a statement of disagreement?

If you ask for a correction to your health information and the trustee says no, you can object by writing a “statement of disagreement.” This statement should include what you disagree with and what you believe to be accurate. The trustee is required to add this statement to your personal health record.

Can someone else act on my behalf?

Yes. If you are unable or need help to carry out your rights under PHIA, you can authorize someone else to do so. You do this by giving the trustee a written authorization that sets out who will act and the right(s) that person may carry out on your behalf. For example, you may limit the person assisting you to see or copy only certain information from your personal health record.

If you are unable to give authorization in writing, speak to the trustee about your options.

There may be a situation where you are not able to authorize another person to act for you. If that happens, PHIA sets out who may legally exercise your rights under PHIA on your behalf. 

When can trustees share my information?

Trustees are generally prohibited from sharing your personal health information without your consent.  However, PHIA provides some circumstances in which trustees are permitted to share your information without consent, including when the purpose of the disclosure is: 

• to provide you with health care.
• to get payment for your health care (for example from a private health insurance company).
• for health system planning or research.
• when authorized or required by law (like reporting certain infectious diseases).

What information can be shared with family, friends and others?

General information about you

If you are a patient in a hospital or a resident in a personal care home, and unless you tell the trustee not to, the trustee may share certain general information with people who ask about you. This information includes:

• confirming that you are a patient/a resident in the facility;
• your general health status such as critical, stable or satisfactory; and
• what room you are in.

Information about the health care you are receiving

If you are a patient or resident in a hospital or personal care home, or are receiving care at home from a trustee (ex: home care services), a trustee may share the information about the care you are currently receiving with your family or friends. The trustee will only do so if it is good medical or professional practice, and the trustee believes it is acceptable to you.

If you do not want your information shared with others, you must tell the trustee about your wishes.

What information can be shared with health-care providers?

Your personal health information can only be shared with the doctors, nurses and other members of your health care workers who are providing you with care, or as otherwise authorized by PHIA. This includes health care providers who have treated you in the past, are treating you now, or will be treating you in the future.

If you do not want your information shared with a member of your health care team, you can tell the trustee not to share it.

Can my information be given to a religious organization?

If you are receiving care in a hospital or personal care home, the facility may share your name, your general health status and the room you are in with a representative of a religious organization unless you tell the facility not to do so. This representative may come visit you while you are receiving care.

Can my information be given to a charitable fundraising foundation?

If you are or were a patient in a hospital, personal care home or other health care facility, and unless you tell the facility not to do so, the facility can share your name and mailing address with an associated charitable fundraising foundation. The foundation may contact you to ask for future charitable donations.

What if my information was involved in a privacy breach?

You are required to be notified by the trustee if your information is involved in a privacy breach, when the breach is considered to create a real risk of significant harm. Trustees are also required to report the breach to the Ombudsman. The criteria for determining if a breach could create a risk of harm is defined under PHIA regulation.

What if I have a complaint about how a trustee has handled my personal health information?

If you have a concern about how your personal health information was handled, you should first talk to the trustee responsible. You also have the right to make a complaint to the Manitoba Ombudsman. Manitoba Ombudsman is an independent office that can investigate complaints about an action or decision of a trustee relating to protecting your privacy or accessing your own information.

You can make a complaint to the Ombudsman if you think the trustee did not properly collect, use, share or protect your information.

You can also make a complaint to the Ombudsman if the trustee:

• did not respond to your access request within the time required by PHIA
• refused your request to see or get a copy of your personal health information
• refused your request to correct your information
• charged you an unreasonable or an unauthorized fee

Who can I contact if I have more questions?

If you have questions bot how your health information is used or shared, the fees to access your records, or any privacy practices, talk first to the health care facility, health care provider or other trustee who holds your information.

For more information about your privacy rights or accessing your personal health records, contact Manitoba Health at 204-788-6612, or by email PHIAinfo@gov.mb.ca, or check out the online resource at: www.gov.mb.ca/health/phia/index.html

Complain to the Manitoba Ombudsman

Click here to learn more about making a complaint to the Manitoba Ombudsman.