R-22.1 - Act respecting health and social services information

Section 48 Disposition versions

Not in force

Not in force

48. The authorization is made official by a written agreement between the researcher and the body to which the researcher is attached. The agreement must stipulate, among other things, that information covered by the authorization

(1)  may be used only by persons who need to examine it to exercise their functions and who have signed a confidentiality agreement;

(2)  may not be used for purposes other than those specified in the detailed presentation of the activities related to the research project;

(3)  may not be paired with any information other than information mentioned in the detailed presentation of the activities related to the research project; and

(4)  may not be communicated, published or otherwise distributed in a form allowing the person concerned to be identified.

The agreement must also

(1)  specify the information that must be communicated to the persons concerned if information concerning them is used for the purpose of soliciting their participation in the research project;

(2)  specify that the information may be used or communicated only in a form not allowing the person concerned to be identified directly, where it is possible to carry out the research project by using or receiving the information in such a form;

(3)  specify the security measures that will be in place for the carrying out of the project;

(4)  determine a preservation period for all the information;

(5)  set out the obligation to inform the person exercising the highest authority within the body to which the researcher is attached of the destruction of the information; and

(6)  set out the obligation to inform without delay the person exercising the highest authority within the body to which the researcher is attached and the Commission d’accès à l’information

(a)  of non-compliance with any condition set out in the agreement;

(b)  of any failure to comply with the security measures provided for in the agreement; and

(c)  of any event that could breach the confidentiality of information.

Where the research project involves the communication of information outside Québec, the agreement must take into account, in particular, the results of the privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

A copy of the agreement must be sent to each body consulted under section 46 and to the Commission d’accès à l’information.

2023, c. 5, s. 48.