Governance, risk & compliance

Nova Scotia Personal Health Information Act (PHIA) S.N.S. 2010, c. 41; N.S. Reg. 217/2012

Nova Scotia Personal Health Information Act (PHIA), S.

N. S.

2010, c. 41, in force since 1 June 2013, and the Personal Health Information Regulations.

It applies to custodians, public or private: regulated health professionals and their group practices, the Minister, health authorities (Nova Scotia Health and the IWK), licensed pharmacies, continuing-care facilities licensed or approved by the Minister, Canadian Blood Services, and others prescribed by regulation (s. 3(f) and Regulations s.

3). It also governs agents, the people and organizations that handle personal health information for a custodian, including employees, volunteers and IT service providers (s.

3(aaa), s. 28).

Because Canada declared PHIA substantially similar (SOR/2016-62), custodians are exempt from PIPEDA Part 1 for personal health information handled in Nova Scotia. What makes PHIA different from other provinces: every electronic information system holding personal health information needs a record of user activity (s.

63), and a patient can ask for it free of charge, answered within 30 days; Regulations s. 11 lists what it must show (who accessed, user ID, whose record, what was accessed, date and time) and requires the underlying data to be kept at least one year.

Breaches are notified to the individual at the first reasonable opportunity where there is potential for harm or embarrassment (s. 69); a custodian that decides not to notify must tell the Review Officer as soon as possible (s.

70). Regulations s.

10 requires written safeguards for networks (including wireless), hardware and operating systems, and user authentication, plus a record of security breaches and the corrective steps taken. Offences carry fines up to $10,000 or six months for individuals and $50,000 for corporations (s.

107), and breaching the terms of an agreement with a custodian is itself an offence (s. 106(m)).

PHIA has no data residency rule of its own; s. 44 limits disclosure outside the province.

Nova Scotia Health and the IWK are also public bodies, so the public sector rules (NS_FOIPOP), including PIIDPA, apply to them as well. The AI domain applies the Act's existing duties to AI tools; Nova Scotia has no AI statute.

Note: PHIA defines the Review Officer by reference to the Privacy Review Officer Act, which the 2025 FOIPOP Act repeals from 1 April 2027; confirm how PHIA oversight is described after that date. Requirements map to the shared control library, so work credited to PIPEDA, Ontario PHIPA or Alberta HIA counts here where the control is the same.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Nova Scotia Personal Health Information Act (PHIA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Nova Scotia Personal Health Information Act (PHIA) compliance

Most of Nova Scotia Personal Health Information Act (PHIA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Nova Scotia Personal Health Information Act (PHIA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Nova Scotia Personal Health Information Act (PHIA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Nova Scotia Personal Health Information Act (PHIA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.