Know Your Rights

Health Information Act

How to Request a Review Under the Health Information Act

If you don’t receive a response to your Request for Information under the Health Information Act, or you feel that the response is, for some reason incomplete or there are other issues with the response you receive, you may ask the Information and Privacy Commissioner (IPC) to review the response.

You may ask the IPC to review any decision, act or failure to act by a health information custodian that relates to your access request or request for correction to your personal health information.  You may also ask the IPC to review any incident which you feel has resulted in an improper collection, use or disclosure of your personal health information.

To ask for a review of any of these matters, you must do so in writing, either on a complaint form, which you can get on this website or by means of a letter to the IPC. While the IPC will accept a complaint by email, she will require that the complaint be perfected by providing a letter or form with your signature.

Your request for a review must be made within 60 days after the day you became aware of the circumstances giving rise to the request. The IPC may, however, accept a Request for Review after 60 days have passed in some circumstances. If you are submitting a Request for Review more than 60 days after you have the health information custodian’s response, you should provide reasons as to why the IPC should allow you a longer time to deliver your request.

The IPC does not generally accept requests for review or complaints via email, but may do so on the condition that signed copies of the request are mailed or delivered to her office.

The IPC may take steps to attempt to resolve the issue informally, but it this is not successful, she will collect all of the necessary information from both the health information custodian and the applicant or complainant, prepare a report and make recommendations, which will then be presented to the health information custodian for consideration.  If the health information custodian chooses not to comply with the recommendations of the Information and Privacy Commissioner, the Applicant seeking records from the health information custodian has a right to appeal that decision to the Supreme Court of the Northwest Territories.  There is no appeal from the decision of a health information custodian with respect to a breach of privacy complaint.

Inquiries/Reviews

If you need more information about how to ask the Information and Privacy Commissioner to conduct a review, please contact our office.

What Can You Do if You Think That There Has Been an Improper Collection, Use or Disclosure of Your Personal Health Information

You may ask the Information and Privacy Commissioner (IPC) to investigate if you believe your personal health information has been collected, used or disclosed in contravention of the Health Information Act (section 134).  It is, however, suggested that you first try to address your concerns with the health care provider.

If you have asked that a health information custodian correct your personal information and they have failed or refused to do so, you may ask the IPC to review that decision.

A request for a review of a privacy matter  under the Health Information Act must be in writing. There is a form available for this, but there is no requirement that you use the form. Provide the IPC with as much background information as you can, including the name of the custodian or health care provider involved, the date or approximate date of the incident, and why you think that your personal health information has been improperly collected, used or disclosed.

While the IPC will accept a complaint by email, she will require that the complaint be perfected by providing a letter or form with your signature.

The IPC must conduct a review of the complaint except in very narrow circumstances and prepare a report with recommendations. The health information custodian and you will both receive a copy of the report and the report will, eventually, be publicly posted. Reports will always be written in such a way as to protect the name and other personal details of the person who made the complaint.

The IPC may also initiate a review of her own accord if she becomes aware of a breach or possible breach of privacy involving personal health information through means other than an actual complaint.

There are no time limits for filing a complaint about a breach of privacy involving personal health information.
Inquiries/Reviews

For more information about filing a complaint about a breach of privacy involving your personal health information, please contact our office.

How to Request a Correction to your Personal Health Information

If you believe there is an error or omission in your personal health information in the custody or control of a health information custodian, you may request that the health information custodian correct the information.

The request must be made in writing.

No fees may be charged for making such a request.

The health information custodian must, within 30 days of receiving the request for correction either make the correction or advise you that no such correction will be made. If the health information custodian refuses to make the correction, they must tell you why they are refusing to make the correction and provide you with contact information for someone within the organization who can answer any questions you might have.

If the health information custodian refuses to make a correction to your personal health information, you have a number of options available to you. You may

  1. submit a statement to be placed on your file which outlines your reasons for disagreeing with the reasons for the refusal to correct your personal health information;
  2. request that the health information custodian attach a copy of your Request for Correction to the record which is the subject of the correction request;
  3. ask the Information and Privacy Commissioner to review the refusal to make the requested correction.

For information on how to request a review from the Information and Privacy Commissioner,  see “How to Request a Review Under the Health Information Act”

How to Make a Request for Information – Health Information Act

Under the Health Information Act (HIA), you may ask for access to your own personal health information which is in the custody or under the control of a health information custodian.

You may not need to use the Health Information Act to obtain the information you are seeking. There are many instances in which your health care provider will simply provide you with the information you are seeking. You may, therefore, wish to make an informal request before making a more formal request under the Health Information Act. If your informal request is not successful, make the same request formally, using the form * or simply by means of a letter which clearly states that the request is being made pursuant to the Health Information Act.

The Information and Privacy Commissioner (IPC) can only review the response to a formal Access to Information Request.

To make a formal request for access under the Act:

  • You must submit your access request directly to the health information custodian that you believe has custody or control of the records you are seeking.
  • Your access request under the HIA does not have to be in writing unless the health information custodian requires that it be in writing. Best practice would be to make the request in writing so that if you don’t receive the information you are requesting, you have a record of your request. It is also recommended that you retain a copy of your access request made under the HIA. There are forms available but these are not required to make a request.
  • You may ask for a copy of the record(s) or ask to examine the record(s). For various reasons, a health information custodian may not be able to allow you to examine the record(s), in which case you will be provided with either paper or electronic copies.
  • Your request must provide enough detail to enable the health information custodian to identify the information/records you are asking for.
  • It is also recommended that your request state that the request is made pursuant to the Act. This ensures that all parties are clear that this is a formal access request and that the IPC has authority to review any response or failure to respond to your access request.
  • There may be fees associated with a Request for Information if the request involves a significant number of records or records over an extended period of time.
  • You may ask the health information custodian to waive the fees. If your request is denied, you may ask the IPC to review that decision.
  • Generally speaking, health information custodians have 30 days to respond to your request. However, the time limits for response may be extended in certain circumstances. You may ask the IPC to review a failure to respond within the time frame or an extension taken by a public body.

For information on how to request a review from the Information and Privacy Commissioner, see “How to Request a Review under the Health Information Act”

Access to Information and Protection of Privacy Act

How to Request a Review under the Access to Information and Protection of Privacy Act

If you don’t receive a response to your Request for Information, or you feel that the response is, for some reason incomplete or there are other issues with the response you receive, you may ask the Information and Privacy Commissioner (IPC) to review the response.

You may ask the IPC to review any decision, act or failure to act by the public body that relates to your access request or request for correction to your personal information or if you believe that a public body has improperly collected, used or disclosed your personal information.

If you have been notified by a public body that they are considering disclosing information about you or your business to a third party applicant, you may ask the IPC to review that decision.

If you have asked that a public body correct your personal information and they fail or refuse to do so, you may ask the IPC to review that decision.

To ask for a review of any of these matters:

  • you must do so in writing, either on a complaint form or just by means of a letter or filling out the form, which you can get on this website. While the IPC will accept a complaint by email, she will require that the complaint be perfected by providing a letter or form with your signature.
  • Your request for a review must be made within 30 days after you have been notified of the decision by the public body’s response to your Request for Information. If you are submitting a Request for Review more than 30 days after you have the public body’s response, you should provide reasons as to why the IPC should allow you a longer time to deliver your request.
  • If you are requesting a review of a public body’s decision to release your information to an applicant, you must complete and submit a Request for Review to the IPC within 30 days after being notified by a public body of its decision to disclose. The IPC has no power to allow you a longer period than 30 days to submit a request for review.
  • There is no time limit for asking for a review of an improper collection, use or disclosure of personal information.
  • The IPC does not generally accept requests for review or complaints via email, but may do so on the condition that signed copies of the request are mailed or delivered to her office.

The IPC may take steps to attempt to resolve the issue informally, but it this is not successful, she will collect all of the necessary information from both the public body and the applicant or complainant, prepare and report and make recommendations, which will then be presented to the head of the public body for consideration.  If the public body chooses not to comply with the recommendations of the Information and Privacy Commissioner, the Applicant seeking records from the public body has a right to appeal that decision to the Supreme Court of the Northwest Territories.  There is no appeal from the decision of a public body with respect to a breach of privacy complaint.

Inquiries/Reviews

If you need more information about how to ask the Information and Privacy Commissioner to conduct a review, please contact our office.

What Can You Do if You Think That There Has Been an Improper Collection, Use or Disclosure of Personal Information Under the Access to Information and Protection of Privacy Act

You may ask the Information and Privacy Commissioner (IPC) to investigate if you believe your personal information has been collected, used or disclosed in contravention of the Access to Information and Protection of Privacy Act.

If you have asked that a public body correct your personal information and a public body has failed or refused to do so, you may ask the IPC to review that decision.

A request for a review of a privacy matter does not have to be in writing, but it is strongly recommended that you do put the complaint in writing so that the nature of the complaint is clear. Provide the IPC with as much background information as you can, including the name of the public body involved, the date, or approximate date of the incident, and why you think the public body has improperly collected, used or disclosed your personal information.

While the IPC will accept a complaint by email, she will require that the complaint be perfected by providing a letter or form with your signature.

The IPC may conduct a review if she is of the opinion that a review is warranted, but only after receiving a request for such a review. She is not authorized under the current legislation to conduct a review simply because she becomes aware of a breach or possible breach of privacy through the press or through any other means.

There are no time limits for filing a complaint about a breach of privacy.
Inquiries/Reviews

For more information on how to file a breach of privacy complaint to the Information and Privacy Commissioner, please contact our office.

How to Request a Correction to your Personal Information Under the Access to Information and Protection of Privacy Act

An individual who believes a public body has made an error or omission in recording their personal information may request that the public body that has the information in its custody or under its control to correct the information.

Within 30 days after the request is received, the head of the public body that receives the request must give written notice to the individual that the correction has been made. If the public body does not agree to making the correction requested, they must still put a note of the requested correction on or cross-referenced to the information to which the request for correction relates. If this is done, the public body must give you notice that this has been done.

You may ask the Information and Privacy Commissioner to review a decision by a public body not to make a requested correction. For how to make such a request, see “How to Request a Review under the Access to Information and Protection of Privacy Act”

How to Make a Request for Information under the Access to Information and Protection of Privacy Act

Under the Access to Information and Protection of Privacy Act (ATIPP Act), you may ask for access to any record, including your own personal information, in the custody or under the control of a public body.

You may not need to use the Act to obtain the information you are seeking. Some information/records are routinely disclosed and there may be other access procedures established. However, the Information and Privacy Commissioner (IPC) has no authority to review a response or failure to respond to an informal access request (that is, a request made outside of the ATIPP Act).

To make a formal request for access under the ATIPP Act:

  • You must submit your access request directly to the public body that you believe has custody or control of the records you are seeking.
  • Your access request under the ATIPP Act must be in writing. It is recommended that you retain a copy of your access request, as the IPC may ask you to produce the copy in its review process. There are forms available but these are not required to make a request.
  • You may ask for a copy of the record(s) or ask to examine the record(s). For various reasons, a public body may not be able to allow you to examine the record(s), in which case you will be provided with either paper or electronic copies.
  • Your request must provide enough detail to enable the public body to identify the information/records you are asking for.
  • It is also recommended that your request state that the request is made pursuant to the ATIPP Act. This ensures that all parties are clear that this is a formal access request and that the IPC has authority to review any response or failure to respond to your access request.
  • There is no application fee. However, there may be additional fees for printing or copying and other specified costs.
  • A fee estimate must be provided to you before your request is processed. You may ask the IPC to review whether the fees have been calculated correctly.
  • You may ask the public body to waive the fees. If your fee waiver request is denied, you may ask the IPC to review that decision.
  • Public bodies have 30 days to respond to your request. However, the time limits for response may be extended in certain circumstances. You may ask the IPC to review a failure to respond within the time frame or an extension taken by a public body.

For information on how to request a review by the IPC, see “How to Request a Review under the Access to Information and Protection of Privacy Act”.

Access Requests to the Office of the Information and Privacy Commissioner

The Office of the Information and Privacy Commissioner is not subject to the ATIPP Act. However, this office will respond to an Access to Information request for any records other than records that are created by or for or in the custody of the office which relate to the exercise of the IPC’s functions.

An access to information request to the IPC must be in writing and must provide enough detail to enable IPC to identify the record.

Note: The IPC does not accept requests via email.