Custodian: an authorized person who may collect, use, and disclose personal health information in accordance with HIPMA. Custodians include most health care providers, operators of hospitals, and health facilities, the Yukon government Department of Health and Social Services, the Department of Community Services Yukon Emergency Medical Services program, the Kwanlin Dün First Nation Health Centre, the Many Rivers Counselling and Support Services Society, and the Child Development Centre.

Health care providers: physicians, nurses, pharmacists, chiropractors, optometrists, dentists and related professionals, psychologists, occupational therapists, midwives, naturopaths, and speech language pathologists, as well as individuals defined in the Health Professions Act, such as physiotherapists.

Health facility: medical clinics, community health centres, dental clinics, medical laboratories, specimen collection centres, pharmacies, nursing homes and other continuing or long-term care facilities. 

Informal Case Resolution: The first stage in a complaint where the IPC authorizes an investigator to try to settle the issues of the complaint. Informal case resolution may succeed in settling the issue(s), reducing the number of issues in dispute, clarifying issue(s) and help the parties better understand the HIPMA. If the matter cannot be totally settled in informal case resolution, the IPC may conduct an adjudication.

Record of user activity: a record generated by the custodian’s electronic information system that identifies who has accessed an individual’s personal health information. HIPMA gives you the right to request access to this record and the custodian is not allowed to charge you a fee to provide you with it.

A custodian is an authorized person who may collect, use, and disclose personal health information in accordance with HIPMA. Custodians include most health care providers, operators of hospitals, and health facilities, the Yukon government Department of Health and Social Services, the Department of Community Services Yukon Emergency Medical Services program, the Kwanlin Dün First Nation Health Centre, and the Child Development Centre.

Yes.  Under HIPMA, an individual has the right to access their personal health information held by a custodian (see ‘What is a custodian?’ above).

Personal health information includes:

• information related to one’s health or health care provided to them,
• records of payments for one’s health care,
• information related to one’s donation of body parts, tissue or bodily substances, and
• information about testing or examinations that one has undergone.

HIPMA allows people to view or receive a copy of their personal health information.

They can do this by making a request to the custodian who has their personal health information. This request should be in writing unless the custodian agrees otherwise.

A custodian may refuse to grant access to their personal health information if the request is deemed to be frivolous or vexatious.

An individual may wish to keep a copy of their request letter and any response from the custodian in case they are not satisfied with the information received and want to make a complaint to our office.

The first two hours that a custodian spends responding to a request in any calendar year are free. After that, they may charge $9 for each 15 minutes.

If a copy of the information is printed or photocopied, the custodian may charge $0.25 per page. They may also charge the actual cost of using another medium, such as a removable storage device and the cost of shipping or delivering the records to the individual.

An estimate of the total fee may be made in advance.

A custodian is not allowed to charge the individual for a record containing information about who has accessed their personal health information in an electronic information system (see ‘What is a record of user activity?’ below).

If a custodian will no longer provide the individual with care, the custodian is not allowed to charge them for transferring their personal health information to a new health care provider.

What is a record of user activity? 

It is the record generated by a custodian’s electronic information system that identifies who has accessed an individual’s personal health information. HIPMA gives one the right to request access to this record without the custodian charging a fee.

Electronic information systems used by custodians should have a user-based capability to track access to any information within that system. This means that the system can differentiate between users, usually by the login credentials assigned to each user. Every time a custodian or one of their employees accesses your personal health information, they must each use their own login and the system records this access.

Individuals can request access to a record of user activity from a custodian in the same way they would request access to other personal health information from them (see ‘How do I request access to my personal health information?’ above).

Yes.  They have the right to examine or receive a copy of their personal health information from the custodian.  They can make this request under HIPMA but they must make it in writing unless the custodian agrees otherwise.

If a custodian receives an application that is incomplete, they are required to offer assistance to the client or patient in completing it. This includes asking for more details to identify the personal health information requested.

If the custodian doesn’t reply to the request or the client or patient is not satisfied with the response, they can file a complaint with our office.

A custodian is required to process a request within 30 days unless:

• compiling the information requires a significant amount of work, or
• taking that much time would seriously interfere with the client or patient’s operations or a scheduled consultation.

In these circumstances, the custodian may take up to 60 additional days as long as they provide reasons for the delay and when to expect a response.

A late response, or a lack of a response, from the custodian is considered as a refusal to provide the information and the client or patient can file a complaint with our office.

A custodian can refuse all or part of a request to access personal health information. However, they must provide reasons for the refusal.

If a request is refused, partially refused, or not answered in time, a complaint can be filed with our office.

If it is believed that a custodian has applied HIPMA incorrectly in an access refusal and has, therefore, not complied with HIPMA, there is a 60 day limit to file a complaint with our office from the date of the alleged non-compliance. We do not charge any fees to investigate a complaint.

An individual has the right to request a correction to their personal health information. They should make this request in writing to the custodian who has 30 days to respond upon receipt of the request. If providing a response will seriously interfere with the operations of the custodian, they can take an extra 15 days as long as they provide reasons for the delay and when to expect a response.

The custodian will either make the requested record correction or refuse to do so. If the custodian refuses, a statement of disagreement can be added to the individual’s record and that individual may make a complaint to our office. The statement of disagreement is a short note written by the individual that explains the requested correction and their reasons for it.

A custodian is not required to make a correction or to add a statement of disagreement to a ‘good faith’ professional opinion, or if the requested correction is deemed to be of a repetitious, frivolous, or vexatious nature.

A custodian is not allowed to charge a fee for correcting a record or adding a statement of disagreement.

If it is believed the custodian has not followed HIPMA in managing a request for correction, a complaint can be made to our office.

Custodians are required to protect personal health information by applying information practices that include adequate administrative policies, as well as technical and physical safeguards that ensure the confidentiality, security, and integrity of one’s information that is within their custody or control.

Custodians must also take measures to limit the collection, use, and disclosure of personal health information. They must prevent breaches of the privacy of this information, and they must ensure that this information is securely stored, disposed of, or destroyed. If there are concerns that a custodian is improperly protecting personal health information or that a privacy breach has occurred, you may make a complaint to our office.

If you are concerned that someone has improperly accessed your personal health information stored in an electronic health information system, you may request a record from the custodian that shows who has accessed this information (see ‘What is a record of user activity?’ above).  There is no cost for a copy of this record (see ‘How much does it cost to request health information?’).

If it is reasonably believed that a custodian has not complied with HIPMA, a complaint can be made to our office by completing and submitting a Complaint Form. A form can also be obtained by contacting us.

When we receive a complaint, we will:

• notify the custodian about the complaint, and
• provide both the complainant and the custodian with a summary of the complaint, as well as a summary of the procedure we will use to consider the complaint.

Our office will work with the complainant and the custodian to settle the complaint informally. If this is not possible, the Information and Privacy Commissioner (IPC) may conduct a hearing. Under HIPMA, this is called a ‘consideration’. Following a consideration, the IPC will generate a report with their findings and recommendations.  Both the complainant and the custodian will receive a copy of the report.

The IPC may refuse to consider a complaint for a number of reasons. For example, it may be trivial or has already been dealt with. In that case, the IPC will inform you of the reasons for their refusal.

Learn more about our general investigation process.

If the custodian decides not to follow the recommendations of the Information and Privacy Commissioner (IPC) or agrees to follow them but has not done so within a reasonable time, a complainant may appeal to the Yukon Supreme Court. The appeal must be initiated within six months of the IPC’s report being issued.

HIPMA, together with its Health Information General Regulation, prohibit any person from collecting, using, or disclosing a YHCIP card and number except in the following limited and specified circumstances.

A YHCIP number may only be collected, used, or disclosed:

• for health care related purposes including the provision of health care, for health research or an investigation, for a purpose related to the Yukon Health Information Network, for a proceeding, and by the Canadian Institute for Health Information, or similar body if there is an agreement authorizing use of the number,
• by a person who is processing a payment for a life, health or disability insurance policy, or administrating a matter under the Workers’ Compensation Act, the Jury Act, the Coroners Act or the Occupational Health and Safety Act if the collection, use or disclosure is necessary,
• by any person, except a custodian, for the purpose of determining before 2018, if you are a resident of Yukon, and
• by an election officer who may only collect and use the number to verify identity and to determine place of residence.

The production of a YHCIP card may be requested by:

• a custodian or their agent to provide health care,
• the Department of Highways and Public Works Motor Vehicles program for the purpose of organ donation,
• an election officer in relation to their collection and use of a number, and
• any person, except a custodian, who may collect and use a YHCIP number to determine Yukon residency if the collection and use is before 2018.