Governance, risk & compliance

Prince Edward Island Health Information Act (HIA) RSPEI c H-1.41 (unofficial consolidation read)

Read 24 Oct 2026.

The Health Information Act, chapter H-1. 41, was read in the PEI Legislative Counsel Office unofficial consolidation, which the PDF itself says is not the official text; the copy I could retrieve ended at about s.

68, so ss. 69 onward, including the penalty section (s.

79 appears only as a heading, "Penalty for contravention") and the commencement section, were not read. From the sections read: a custodian is a person or organization that collects, maintains, uses or discloses personal health information (s.

1(e)); consent must be knowledgeable and cannot be obtained by deception or coercion (s. 13), and disclosure to a non-custodian needs express consent unless the Act says otherwise (s.

13(6)); collection, use and disclosure are limited to the minimum necessary (ss. 19, 22(2), 23(2)); access requests are answered within 30 days, with a further extension of up to 30 days in listed cases (ss.

8(4), 8. 1) and correction decisions within 30 days (s.

11(3)). Duties of a custodian (s.

36) include notifying the individual and the Commissioner in writing at the first reasonable opportunity when information is stolen, lost, improperly disposed of, or disclosed to or accessed by an unauthorized person (s. 36(1)(c)), unless the custodian reasonably believes there will be no adverse impact on health care or the individual’s well-being (s.

36(2)). Section 39 requires reasonable administrative, technical and physical safeguards that follow recognized standards; ss.

41 to 43 require written agreements with agents and with information managers. The Commissioner may give advice (s.

48), has inquiry powers and can require records within 10 days (s. 51), and after an inquiry may issue orders that are enforceable as a court judgment once filed (s.

64). The PEI Information and Privacy Commissioner’s Privacy Breach Reporting Guidelines (April 2024) add the expected steps: notify, contain, investigate with a written Breach Investigation Report, and remediate.

Private-sector note: the OPC page of laws deemed substantially similar to PIPEDA lists no Prince Edward Island law, so PIPEDA is the general private-sector privacy law there; whether it or the HIA applies to a given private provider should be decided case by case. The citation "SPEI 2014, c 31" and the 2017 commencement date are not read and are not asserted here.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Prince Edward Island Health Information Act (HIA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Prince Edward Island Health Information Act (HIA) compliance

Most of Prince Edward Island Health Information Act (HIA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Prince Edward Island Health Information Act (HIA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Prince Edward Island Health Information Act (HIA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Prince Edward Island Health Information Act (HIA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.