This bill overhauls language and operational rules in the Health Information Act to reflect digital health records and contemporary data use. It rewrites key definitions (agent, custodian, health care facility), reorganizes access and correction processes, and creates statutory architecture for a province-wide electronic health record (PEI EHR) and drug information system (DIS).
The amendments centralize operational authority (giving the Minister new powers over EHR and DIS access), enable regulated data matching and research uses with inspection and warrant tools, and add compliance tasks for custodians and system operators. For health system managers, researchers and privacy officers, the changes shift practical control to system administrators while imposing new audit, recording and access-accountability obligations.
At a Glance
What It Does
Revises definitions and access rules; establishes ministerial authority to grant, suspend or revoke access to the PEI EHR and to require recording of prescribed personal health information. It allows data matching by custodians and requires custodians to follow research-specific steps before matching for research.
Who It Affects
Custodians (hospitals, clinics, pharmacies, Health PEI), the Minister and system managers, researchers and operators of research data repositories, and individuals whose health data populate the PEI EHR or DIS.
Why It Matters
The bill explicitly enables centralized electronic recordkeeping and audit trails while expanding permitted secondary uses (research and data matching). That combination increases the operational and compliance burden on custodians and the potential for centralized oversight of sensitive health data.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act tightens and modernizes definitions so that ‘‘agent’’ can include contractors or information managers acting on a custodian’s behalf, and the catalogue of custodians and health-care facilities is widened and made regulatable. That clean-up matters because it clarifies who can lawfully hold, record or act on personal health information when data flows across organizational and technical boundaries.
Individuals retain a statutory right to examine or receive copies of their records, and the bill structures the request process (written requests if required, an obligation for custodians to help clarify requests and to sever exempt material where possible). The response regime is procedural: a custodian must answer, inform of non-existence, transfer the request where appropriate, or refuse with written reasons and a path to review.
The Act also creates formal transfer mechanics — custodians can move requests to other custodians when records are elsewhere — and recognizes transferred-receipt timing for deadlines.On timing and oversight, custodians face a fixed response window with limited, defined extensions and a backstop power for the Commissioner to authorize additional time when reasonable. Correction requests follow the same extension rules.
For disclosures, the Act tightens language about consent, preserves an emergency exception to act without consent where health would be endangered, and requires prompt notice to the individual when the exception is used.The bill explicitly authorizes data matching using custodial holdings alone or combined with other custodians’ data, but imposes research-specific preconditions before matching for research. Custodians gain inspection powers over researchers’ premises to verify compliance and may, if refused, apply to the Supreme Court for a warrant (with a possibility of ex parte applications).
These provisions expand enforcement tools but also raise operational and legal friction between custodians and independent researchers.A major operational change is the Part 7 PEI EHR regime. The Minister may grant access to authorized custodians, agents and prescribed persons; assign unique user identifiers; and require authorized custodians to record ‘‘prescribed personal health information’’ in the PEI EHR without needing individual consent.
The PEI EHR must auto-log each access (who accessed what and when) and retain those logs for a decade. Parallel changes apply to the DIS (drug information system), including ministerial and manager controls over who is linked and how access is assigned.
The Five Things You Need to Know
A custodian that does not respond within the statutory response period is treated as having refused the request.
A custodian may transfer a request to another custodian within 15 days; the receiving custodian’s deadlines are measured from the date it receives the transferred request.
The PEI EHR must automatically record each access—user identifier, description of prescribed personal health information accessed, and date/time—and retain those access records for 10 years.
An authorized custodian is required, as the regulations may specify, to record prescribed personal health information in the PEI EHR and may do so without the individual’s consent.
If a researcher refuses inspection under the research disclosure rules, a custodian may apply to the Supreme Court for a warrant to inspect researcher premises; that application may be made without notice unless the court orders otherwise.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Redefined actors: agents, custodians and health-care facilities
This amendment tightens who counts as an agent or custodian and moves several categories into regulation-making territory. Practically, it means the government can expand or limit who is treated as a custodian by regulation (for example, naming repositories or specific organizations). The provision reduces ambiguity about contractors, volunteers and information managers acting for custodians, which affects contractual obligations, audit responsibilities and liability allocation.
Access and timing: request, clarification, extensions and transfers
The Act restates the individual’s right to access personal health information and sets a structured process: custodians can require written requests, must offer assistance to clarify vague requests, and must respond or be deemed to have refused. Custodians may extend response time for enumerated operational reasons and can ask the Commissioner for additional time where necessary; they may also transfer requests to the custodian holding the record, with clearly defined notice and timing consequences. These mechanics standardize the workflow for access requests and create precise trigger points for reviews and complaints.
Correction, consent and emergency exception
Correction requests must include enough detail to locate the record and are subject to the same extension rules as access requests. The bill streamlines consent language across disclosure sections and preserves an exception allowing disclosure without consent where failing to disclose would likely endanger health; when that exception is used the custodian must promptly notify the individual. The Act also requires custodians to sever exempt information where possible rather than withhold entire documents, reducing unnecessary denial of access.
Data matching and research preconditions
Custodians may perform data matching using their data alone or combined with others. But the Act makes data matching for research conditional on complying with the same Part 4 research requirements (sections 30–32 as amended), which include approvals, safeguards and oversight. This preserves research access while inserting procedural gates designed to manage re-use risk and accountability.
Inspection powers over researchers
A custodian may inspect a researcher’s premises, run or request searches of researcher systems, copy or temporarily remove records for copying, and must promptly return removed material. If the researcher refuses inspection the custodian can seek a Supreme Court warrant and may apply without notice. These provisions give custodians teeth to verify compliance after disclosure but raise legal questions about researcher protections and judicial oversight.
PEI EHR: ministerial control, mandatory recording and audit logs
Part 7 establishes the PEI EHR regime: the Minister may authorize classes of users, assign unique user IDs, and require authorized custodians to record prescribed personal health information in the EHR—potentially without consent. The EHR must keep automated access records that include who accessed what information and when, and those logs are retained for ten years. The law also clarifies that recording information in the EHR is not itself a disclosure and that use and disclosure remain governed by the Act and regulations.
DIS access and manager controls
The drug information system (DIS) receives parallel updates: the manager (and the Minister in some cross-references) controls who may be linked and who may access the DIS, assigns unique IDs, and may permit individuals to access their own DIS data. The Act expands regulation-making power to prescribe eligible users, suspension protocols and agreements required for access.
Regulatory framework and delegation
The Lieutenant Governor in Council gains broader regulation-making authority over who can access the EHR and DIS, obligations for recording, procedural rules for access and correction within the EHR, auditing and safeguards, and the power to restrict types or classes of custodians and users. This hands the executive significant detail-work to operationalize the Act and to set boundaries on ministerial discretion.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Patients and individuals — clearer processes for access, correction and notice when emergency disclosures occur, plus the ability to request access to PEI EHR access logs about their records.
- Researchers with approved projects — statutory pathways for data matching and repository access, subject to the Act’s research safeguards and inspection regime.
- Health system administrators and operators — a clearer legal basis to centralize records in the PEI EHR and DIS, with explicit authority to grant, monitor and audit user access.
- Pharmacies and electronically linked facilities — explicit inclusion as potential authorized custodians for DIS/PEI EHR linkage, enabling integrated medication and clinical data for care delivery.
- Regulators and oversight bodies — clearer legal tools (audit logs, inspection warrants, regulatory delegation) to police misuse and investigate compliance.
Who Bears the Cost
- Custodians (hospitals, clinics, pharmacies) — must implement clarification workflows, severing procedures, respond to access/correction requests, comply with PEI EHR recording requirements and retain audit trails, increasing IT and administrative costs.
- Small providers and contractors acting as agents — new exposure and compliance duties if prescribed as custodians or agents, including contractual, security and liability implications.
- Researchers and research data repositories — additional preconditions for data matching, potential inspections and judicial warrant processes that can delay or complicate projects.
- Government (Minister’s office and system managers) — responsibility to create regulations, manage access accounts and agreements, and to oversee long-term audit retention, which will require funding, technical capacity and governance frameworks.
- Information managers and IT teams — must implement access controls, role-based restrictions, automated logging and ten-year log retention while guarding against unauthorized access.
Key Issues
The Core Tension
The central dilemma is between creating an integrated, auditable digital health ecosystem that supports care coordination and research, and protecting individual privacy and limiting centralized power: enabling mandatory, centralized recording and long-term access logs improves oversight and utility but concentrates control and sensitive metadata in government-operated systems, increasing the stakes of access decisions, regulatory design and technical security.
The bill centralizes substantial operational authority in the Minister and in managers of the PEI EHR and DIS, but leaves much of the practical detail to regulations. That delegation speeds passage but pushes hard policy choices—what counts as ‘‘prescribed personal health information,’’ who is an ‘‘authorized custodian,’’ and which classes of users may record data—into regulatory rulemaking where parliamentary scrutiny is thinner and administrative discretion stronger.
Implementation will depend heavily on forthcoming regulations and on the technical capacity to enforce rules across many disparate custodians.
Mandatory recording of prescribed information in the PEI EHR and a 10-year retention requirement for access logs create a tension between auditability and privacy. Long log retention supports forensic review and compliance but increases the volume of sensitive metadata that itself requires protection.
The inspection-and-warrant approach for researchers strengthens custodial verification but risks chilling independent research if courts and custodians apply a low threshold for warrants or if researchers face repeated intrusive requests. Finally, permitting data matching and expanded secondary uses for research—subject to procedural safeguards—raises re-identification and purpose-migration risks that depend on how strictly custodians, review boards and regulators apply de-identification and access controls.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.