Know Your Rights

If you don’t receive a response to your Request for Information under the Health Information Act, or you feel that the response is, for some reason incomplete or there are other issues with the response you receive, you may ask the Information and Privacy Commissioner (IPC) to review the response.

You may ask the IPC to review any decision, act or failure to act by a health information custodian that relates to your access request or request for correction to your personal health information.  You may also ask the IPC to review any incident which you feel has resulted in an improper collection, use or disclosure of your personal health information.

To ask for a review of any of these matters, you must do so in writing, either on a complaint form, which you can get on this website or by means of a letter to the IPC. While the IPC will accept a complaint by email, she will require that the complaint be perfected by providing a letter or form with your signature.

Your request for a review must be made within 60 days after the day you became aware of the circumstances giving rise to the request. The IPC may, however, accept a Request for Review after 60 days have passed in some circumstances. If you are submitting a Request for Review more than 60 days after you have the health information custodian’s response, you should provide reasons as to why the IPC should allow you a longer time to deliver your request.

The IPC does not generally accept requests for review or complaints via email, but may do so on the condition that signed copies of the request are mailed or delivered to her office.

The IPC may take steps to attempt to resolve the issue informally, but it this is not successful, she will collect all of the necessary information from both the health information custodian and the applicant or complainant, prepare a report and make recommendations, which will then be presented to the health information custodian for consideration.  If the health information custodian chooses not to comply with the recommendations of the Information and Privacy Commissioner, the Applicant seeking records from the health information custodian has a right to appeal that decision to the Supreme Court of the Northwest Territories.  There is no appeal from the decision of a health information custodian with respect to a breach of privacy complaint.

Inquiries/Reviews

If you need more information about how to ask the Information and Privacy Commissioner to conduct a review, please contact our office.

You may ask the Information and Privacy Commissioner (IPC) to investigate if you believe your personal health information has been collected, used or disclosed in contravention of the Health Information Act (section 134).  It is, however, suggested that you first try to address your concerns with the health care provider.

If you have asked that a health information custodian correct your personal information and they have failed or refused to do so, you may ask the IPC to review that decision.

A request for a review of a privacy matter  under the Health Information Act must be in writing. There is a form available for this, but there is no requirement that you use the form. Provide the IPC with as much background information as you can, including the name of the custodian or health care provider involved, the date or approximate date of the incident, and why you think that your personal health information has been improperly collected, used or disclosed.

While the IPC will accept a complaint by email, she will require that the complaint be perfected by providing a letter or form with your signature.

The IPC must conduct a review of the complaint except in very narrow circumstances and prepare a report with recommendations. The health information custodian and you will both receive a copy of the report and the report will, eventually, be publicly posted. Reports will always be written in such a way as to protect the name and other personal details of the person who made the complaint.

The IPC may also initiate a review of her own accord if she becomes aware of a breach or possible breach of privacy involving personal health information through means other than an actual complaint.

There are no time limits for filing a complaint about a breach of privacy involving personal health information.
Inquiries/Reviews

For more information about filing a complaint about a breach of privacy involving your personal health information, please contact our office.

If you believe there is an error or omission in your personal health information in the custody or control of a health information custodian, you may request that the health information custodian correct the information.

The request must be made in writing.

No fees may be charged for making such a request.

The health information custodian must, within 30 days of receiving the request for correction either make the correction or advise you that no such correction will be made. If the health information custodian refuses to make the correction, they must tell you why they are refusing to make the correction and provide you with contact information for someone within the organization who can answer any questions you might have.

If the health information custodian refuses to make a correction to your personal health information, you have a number of options available to you. You may

1. submit a statement to be placed on your file which outlines your reasons for disagreeing with the reasons for the refusal to correct your personal health information;
2. request that the health information custodian attach a copy of your Request for Correction to the record which is the subject of the correction request;
3. ask the Information and Privacy Commissioner to review the refusal to make the requested correction.

For information on how to request a review from the Information and Privacy Commissioner,  see “How to Request a Review Under the Health Information Act”

Under the Health Information Act (HIA), you may ask for access to your own personal health information which is in the custody or under the control of a health information custodian.

You may not need to use the Health Information Act to obtain the information you are seeking. There are many instances in which your health care provider will simply provide you with the information you are seeking. You may, therefore, wish to make an informal request before making a more formal request under the Health Information Act. If your informal request is not successful, make the same request formally, using the form * or simply by means of a letter which clearly states that the request is being made pursuant to the Health Information Act.

The Information and Privacy Commissioner (IPC) can only review the response to a formal Access to Information Request.

To make a formal request for access under the Act:

• You must submit your access request directly to the health information custodian that you believe has custody or control of the records you are seeking.
• Your access request under the HIA does not have to be in writing unless the health information custodian requires that it be in writing. Best practice would be to make the request in writing so that if you don’t receive the information you are requesting, you have a record of your request. It is also recommended that you retain a copy of your access request made under the HIA. There are forms available but these are not required to make a request.
• You may ask for a copy of the record(s) or ask to examine the record(s). For various reasons, a health information custodian may not be able to allow you to examine the record(s), in which case you will be provided with either paper or electronic copies.
• Your request must provide enough detail to enable the health information custodian to identify the information/records you are asking for.
• It is also recommended that your request state that the request is made pursuant to the Act. This ensures that all parties are clear that this is a formal access request and that the IPC has authority to review any response or failure to respond to your access request.
• There may be fees associated with a Request for Information if the request involves a significant number of records or records over an extended period of time.
• You may ask the health information custodian to waive the fees. If your request is denied, you may ask the IPC to review that decision.
• Generally speaking, health information custodians have 30 days to respond to your request. However, the time limits for response may be extended in certain circumstances. You may ask the IPC to review a failure to respond within the time frame or an extension taken by a public body.

For information on how to request a review from the Information and Privacy Commissioner, see “How to Request a Review under the Health Information Act”