Governance, risk & compliance

New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) S.N.B. 2009, c. P-7.05; N.B. Reg. 2010-112

The Personal Health Information Privacy and Access Act (PHIPAA), S.

N. B.

2009, c. P-7.

05, and General Regulation 2010-112. PHIPAA binds custodians: individuals and organizations that collect, maintain or use personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system, or to deliver a government program or service.

An agent is an information manager or any person or organization that acts for or on behalf of a custodian for the custodian’s purposes, other than an employee (s. 1).

A custodian that uses an agent must have a written agreement requiring the agent to comply with the custodian’s legal obligations (s. 52(1)).

A custodian may give personal health information to an information manager (processing, storing or destroying it or providing information management or information technology services) only under a written agreement that protects it (s. 52(3)); Regulation s.

21 requires the agreement to describe the services and the information manager’s administrative, technical and physical safeguards; the information manager must follow the agreement and the custodian’s protection, retention and secure destruction rules (s. 52(4)).

Section 50 requires safeguards based on nationally or jurisdictionally recognized IT security standards, and the Regulation (s. 20) requires a written policy and procedures and a record of security breaches.

On a theft, loss, improper disposal, or unauthorized disclosure or access, the custodian must notify the individual and the Ombud at the first reasonable opportunity (s. 49(1)(c); Regulation s.

19), unless it reasonably believes the event will not harm care, well-being or lead to identification (s. 49(2)).

Data residency: a custodian that is a public body must ensure personal health information is stored and accessed only in Canada, with listed exceptions (s. 55(2)); Regulation s.

22 lets information managers that provide a public body with information management or information technology services store it outside Canada. Public bodies and prescribed custodians must do a privacy impact assessment in the situations in s.

56. Offences, including failing to protect information securely, are category F offences under the Provincial Offences Procedure Act (s.

76), with a fine of $240 to $10,200 under s. 56(6) of that Act as displayed when read, and a due-diligence defence (s.

76(4)). The Ombud oversees PHIPAA (ss.

65. 1 to 65.

3 and the complaints provisions). PHIPAA is deemed substantially similar to PIPEDA: custodians are exempt from Part 1 of PIPEDA for personal health information collected, used and disclosed in New Brunswick (SOR/2011-265).

This framework applies the existing Act to AI tools; it does not add AI rules. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) compliance

Most of New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to New Brunswick Personal Health Information Privacy and Access Act (PHIPAA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.