Governance, risk & compliance

Newfoundland and Labrador Personal Health Information Act (PHIA) SNL 2008, c P-7.01 (in force 1 Apr 2011)

Read 24 Oct 2026.

The Personal Health Information Act, SNL 2008, c P-7. 01, was read in the King’s Printer version (amended through 2024 c22 s50 and later chapters listed on the page).

Parts and their numbers are the Act’s own: I Purpose, interpretation and application (ss. 3-12), II Practices to protect personal health information (ss.

13-22), III Consent (ss. 23-28), IV Collection, use and disclosure (ss.

29-50), V Access and correction (ss. 51-64), VI Review by Commissioner (ss.

65-82), VII Appeals (ss. 83-86), VIII General (ss.

87-91). Who it covers: custodians named in s.

4 (health authorities, regulated professionals and others) and, through s. 22, their information managers.

A custodian must take reasonable steps against theft, loss and unauthorized access, use or disclosure (s. 15(1)), and must notify the individual at the first reasonable opportunity when information is stolen, lost, improperly disposed of, or disclosed to or accessed by an unauthorized person, unless it reasonably believes there will be no adverse impact on health care or on the individual’s mental, physical, economic or social well-being (s.

15(3) and (7)). It must also tell the Commissioner when it reasonably believes there was a material breach (s.

15(4)); the Personal Health Information Regulations, NLR 38/11, s. 5, list the factors: sensitivity, number of people, belief that the information has been or will be misused, and whether the cause or pattern shows a systemic problem.

The Commissioner reviews complaints and makes recommendations (s. 72); the custodian has 15 days to decide whether to comply (s.

74), and there is an appeal to the Trial Division (Part VII). The Commissioner does not make binding orders under PHIA.

Offences (s. 88): fines of up to $10,000, up to six months in prison, or both, for wilful acts such as obtaining information by false pretences or destroying records to evade access, and for a custodian or information manager that collects, uses or discloses contrary to the Act or fails to protect information securely, with a defence if all reasonable steps were taken (s.

88(3)). Private-sector note: the federal Governor in Council exempted personal health information custodians subject to PHIA from Part 1 of PIPEDA for collection, use and disclosure that occurs in Newfoundland and Labrador (Personal Health Information Custodians in Newfoundland and Labrador Exemption Order, SI/2012-72, P.

C. 2012-1091).

Not read: the Act’s detailed disclosure sections (ss. 37-46) were read only in part.

This framework carries no provincial private-sector privacy law: other private businesses in the province are under PIPEDA. AI tools are covered by applying these existing duties, not by a new statute.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Newfoundland and Labrador Personal Health Information Act (PHIA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Newfoundland and Labrador Personal Health Information Act (PHIA) compliance

Most of Newfoundland and Labrador Personal Health Information Act (PHIA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Newfoundland and Labrador Personal Health Information Act (PHIA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Newfoundland and Labrador Personal Health Information Act (PHIA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Newfoundland and Labrador Personal Health Information Act (PHIA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.