R-22.1 - Act respecting health and social services information

Section 84 Disposition versions

Not in force

Not in force

84. A body holding information of which a person or group has been authorized to receive communication under this subdivision must communicate the information to the person or group.

Where the person or group is not a body, such communication must be the subject of a written agreement between the person or group and the body holding the information. Such an agreement must, on pain of nullity, set out

(1)  the purposes for which the information is communicated;

(2)  the nature of the information communicated;

(3)  the method of communication used;

(4)  the measures to be taken by the person or group to ensure, at all times,

(a)  that the confidentiality of the information is respected;

(b)  that the information is protected, which measures must comply with the information governance rules referred to in section 90 and the special rules defined by the network information officer under section 97; and

(c)  that the information is used only for the purposes for which the communication has been authorized;

(5)  the intervals at which the information is communicated;

(6)  the term of the agreement; and

(7)  the following obligations to be complied with by the person or group:

(a)  send to the body holding the information, before any communication, a confidentiality agreement completed by every person to whom the information may be communicated or who may use it for the purposes for which the communication has been authorized;

(b)  use only technological products or services authorized by the body holding the information to collect, keep, use or communicate the information;

(c)  immediately notify the person in charge of the protection of information within the body holding the information of any violation or attempted violation by any person of an obligation relating to the protection of information provided for by the agreement;

(d)  allow the body holding the information to conduct any verification or investigation relating to the protection of the information; and

(e)  not keep the information beyond the time necessary for the purposes for which the communication has been authorized, and destroy it in a secure manner.

In the case of information communicated outside Québec, the agreement must also take into account the results of the privacy impact assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.

A copy of the agreement must be sent to the Commission d’accès à l’information.

2023, c. 5, s. 84.