The bill replaces the language in clause 38(1)(d) of Nova Scotia's Personal Health Information Act so that custodians may disclose personal health information without consent to “prevent or lessen a risk of serious harm to the patient's health or safety or that of another person.” The existing wording — allowing disclosure to “avert or minimize an imminent and significant danger to the health or safety of any person or class of persons” — is struck out and substituted.
For health system actors, the amendment matters because it adjusts the trigger for non-consensual disclosure. Removing “imminent” and replacing “avert or minimize” with “prevent or lessen” changes the temporal and preventive posture of the test, while removing “class of persons” narrows the kinds of population-level threats that can justify disclosure.
The bill creates interpretive questions that will affect custodial policies, clinical risk decisions, and public health responses until regulators or courts clarify the new standard.
At a Glance
What It Does
The bill modifies PHIA’s disclosure ground in clause 38(1)(d) by substituting new wording that permits disclosure without consent to prevent or lessen a risk of serious harm to a patient or another person. It removes the words “imminent,” “significant danger,” and “class of persons.”
Who It Affects
Health information custodians (hospitals, clinicians, community care providers), public health units, and privacy officers who draft disclosure policies will face a changed legal test for when they can share protected health information without consent. Patients and third parties who may be at risk are also directly affected.
Why It Matters
The change shifts the balance between earlier preventive disclosure and protections for privacy and population-level disclosure. Without accompanying regulation or guidance, custodians will need to interpret whether the new phrasing permits earlier intervention, limits population-based disclosures, or both—affecting clinical practice, public-health surveillance and liability exposure.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill makes a single, targeted amendment to the Personal Health Information Act: it replaces the current phrase that allows disclosure to “avert or minimize an imminent and significant danger to the health or safety of any person or class of persons” with wording that allows disclosure to “prevent or lessen a risk of serious harm to the patient's health or safety or that of another person.” On its face the text removes the requirement that a danger be “imminent” and substitutes the concept of a “risk,” while also replacing the broader group reference “any person or class of persons” with references to the patient or another individual.
Practically, removing “imminent” and inserting “risk” changes the temporal character of the disclosure power: custodians may be able to act earlier—before a danger becomes imminent—if they form a reasonable view that a serious harm is likely to occur. At the same time, swapping “significant danger” for “serious harm” and removing “class of persons” narrows the locus of protection toward individual-focused harms rather than population-level threats.
That combination creates a legal posture focused on early intervention for individual safety but not clearly geared to broad public-health emergencies.Because the bill is limited to textual substitution and contains no procedural add-ons, it leaves unanswered how custodians should document decisions, what evidence establishes a “risk of serious harm,” whether disclosure must be proportionate, and whether notice to the patient is required after disclosure. Custodians will need to revise disclosure policies, update training for clinicians and privacy officers, and may seek guidance from the Office of the Information and Privacy Commissioner or from courts when disputes arise.Finally, this change interacts with other legal duties (for example, mandatory reporting to police or child protection authorities and public-health legislation).
In situations where population-level notification has been used under the previous wording, public health units should examine whether the narrower focus to individual harms will restrict their ability to disclose without consent and whether ancillary powers under public-health laws fill that gap.
The Five Things You Need to Know
The bill amends only clause 38(1)(d) of the Personal Health Information Act by replacing a single phrase — it does not add procedural safeguards, reporting duties, or standards of proof.
It removes the word “imminent” and replaces the trigger language with “prevent or lessen a risk of serious harm,” which emphasizes risk mitigation over immediate danger.
The amendment narrows the beneficiary group from “any person or class of persons” to the “patient’s health or safety or that of another person,” reducing explicit scope for population- or class-based disclosures.
The statutory change does not define “risk,” “serious harm,” or explain what evidence satisfies the new test, leaving interpretive gaps for custodians and courts.
Because the bill does not reference public-health statutes or add guidance, public-health units may lose an explicitly available PHIA ground for broad disclosures and will need to assess other legal authorities for population-level interventions.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Textual substitution of the disclosure test
This entry is the operative change: the bill strikes the old phrase and substitutes the new wording. Mechanically, custodians who rely on clause 38(1)(d) to disclose without consent must apply the new textual standard. Because the amendment is a direct substitution, legislative history and plain-language construction will matter for courts and regulators interpreting intent.
From imminent danger to risk-based prevention
By removing “imminent” and using “risk” and “prevent or lessen,” the bill shifts the disclosure test toward earlier intervention. Practically, clinicians and privacy officers will need to decide when a prospective risk justifies disclosure vs when waiting for imminence is required. That decision will affect clinical safety planning, mandatory reporting timing, and potential liability for failing to disclose.
Narrowing from classes of persons to individuals
The deletion of “class of persons” reduces the explicit statutory basis for disclosures aimed at protecting groups (for example, notifying a community about an infectious threat). Public health units and custodians who previously relied on clause 38(1)(d) for group notifications must now consider other statutory bases or whether the new individual-focused language can be stretched to cover group harms.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Clinicians and front-line custodians: The risk-based language allows earlier preventive disclosures in individual safety situations, giving clinicians more flexibility to act before danger becomes imminent.
- Patients at immediate individual risk: Individuals judged to face a 'risk of serious harm' may receive earlier protective interventions or notifications from custodians acting without consent.
- Privacy officers who favor clear individual-focused limits: Organizations that prefer case-by-case, individual-based decision-making gain statutory text that emphasizes individual safety rather than broad population notices.
Who Bears the Cost
- Public health units: Removing “class of persons” limits the explicit PHIA ground for population-level disclosures, potentially constraining large-scale notifications unless other legislation covers them.
- Custodians and institutions: Because the bill does not define key terms, custodians face legal uncertainty and compliance costs—policy rewrites, staff training, and possible legal advice to interpret “risk” and “serious harm.”
- Patients generally: The broadened temporal scope (acting on risk rather than imminence) may increase non-consensual disclosures and thus raise privacy intrusion risk for patients whose information is shared preemptively.
- Tribunals and courts: Expect increased litigation to clarify the new standard, imposing case work on adjudicators asked to reconcile 'risk' and 'serious harm' with existing precedent.
Key Issues
The Core Tension
The central dilemma is whether to prioritize earlier preventive action for identifiable individuals (by allowing disclosures based on risk) or to preserve privacy and public-health flexibility by requiring imminence or permitting class-based disclosures; the amendment pushes toward early, individual-focused intervention but does so without definitions or safeguards, forcing a trade-off between proactive safety measures and clear, consistent privacy protections.
The amendment packs multiple interpretive shifts into a short substitution. First, 'risk' versus 'imminent' cuts two ways: it permits earlier disclosure aimed at prevention, but it also creates vagueness about how proximate or probable a harm must be.
Second, 'serious harm' is not defined; in some contexts it may be read as a higher threshold than 'significant danger,' in others as effectively equivalent. Those uncertainties will push custodians to err on the side of caution (either over-disclosing to avoid failing to prevent harm or under-disclosing to avoid privacy breaches), producing inconsistent practice across institutions.
Third, the deletion of 'class of persons' narrows statutory cover for population-level action under PHIA. That may be intentional—prioritizing individual privacy and individual risk mitigation—but it also fragments the legal toolkit for public-health responses unless complementary statutory authority is used.
Finally, because the bill contains no procedural safeguards (no reporting, no notice requirements, no timelines or documentation mandates), it leaves unresolved how to balance urgency with accountability. Regulators, professional bodies, or the courts will probably need to supply criteria, and institutions should prepare to document clinical risk assessments to justify disclosures under the new wording.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.