Governance, risk & compliance

Northwest Territories Health Information Act (HIA) SNWT 2014, c 2 (in force 1 Oct 2015)

PARTLY VERIFIED.

Read 24 Oct 2026. The NWT justice site could not be retrieved, so the Health Information Act text was not read.

This framework rests on the Department of Health and Social Services’ Ten-Year Report on the Act (1 October 2025, tabled as TD 484-20(1) on 4 March 2026) and the Information and Privacy Commissioner’s 2021-22 annual report (TD 711-19(2)), which quote the Act and Regulations. The Act came into force on 1 October 2015.

It defines four roles: health information custodian, agent, contact person and information manager (a custodian must have an information management agreement before using an information manager, with an exception for the GNWT Technology Service Centre). Section 85 requires reasonable administrative, technical and physical safeguards, including training of agents; s.

87 requires a custodian to give notice to the individual and to a prescribed person as soon as reasonably possible when information is used or disclosed other than as the Act permits, lost or stolen, or altered, destroyed or disposed of without authorization; Regulations s. 15 requires notice to the Information and Privacy Commissioner, except for loss, unauthorized use, destruction or alteration that does not present a reasonable risk of harm to the affected individual, and Regulations s.

13 requires policies against unauthorized access, use or disclosure. Privacy impact assessments go to the Commissioner under s.

89(3) (s. 175 allows comment).

The Commissioner’s review reports are recommendations: a custodian must produce records within 14 days (s. 153), and once it accepts a recommendation must comply within 45 days (s.

158). Offences: s.

192 sets a fine of up to $500,000 for a corporation and up to $50,000 for any other person, s. 193 reaches corporate officers, and charges must be laid within three years (s.

194). Section 44 allows disclosure for continuing care.

The quoted sections come from the 2025 report, not from the statute, and may have been amended; check the Act. Private-sector note: PIPEDA applies to commercial activity in the Northwest Territories, which the OPC treats as federally regulated.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Northwest Territories Health Information Act (HIA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Northwest Territories Health Information Act (HIA) compliance

Most of Northwest Territories Health Information Act (HIA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Northwest Territories Health Information Act (HIA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Northwest Territories Health Information Act (HIA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Northwest Territories Health Information Act (HIA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.