Process of Responding to a PHIA Request
Request is Submitted and Received
An individual seeking access to their personal health information may make a request to the Data Privacy and Compliance Office, or directly to the department they believe retains the information. Unlike FIPPA, PHIA does not require applicants to use a formal request form to gain access to their own personal health information. However, the University may ask for a written request at its discretion and requests for correction must always be in writing.
Once a PHIA request has been received, the University must respond within:
- 72 hours, if the individual wants to see or get a copy of information about the care he or she is currently receiving; or
- 30 days, in all other circumstances.
Processing and Response
PHIA requests may be made directly to the department that maintains the personal health information or to the Data Privacy and Compliance Office.
If requested, the University will provide an explanation of any term, code or abbreviation used in the personal health information. In addition, when a request is made for personal health information that is maintained in electronic form, the University will provide the information to the individual in that form provided that it can be produced using the University's normal computer hardware and software and technical expertise.
However, PHIA also allows the University to refuse access in part or full if:
- There is a reasonable expectation that revealing the information would result in harm to the individual or someone else
- Disclosure would reveal the personal health information of another individual who has not consented to having his or her personal health information disclosed
- There is a reasonable expectation that disclosure would identify a third party, other than another trustee, who supplied the personal health information in confidence
- The information was compiled and is used solely for review or assessment purposes; or
- The information has been compiled for litigation purposes.
If an individual if refused access to their personal health information in part, the University will, where possible, sever the information that cannot be examined or copied and release the remainder of the information.
If an individual if granted full access to their personal health information, the University may respond either orally or in writing. If the information requested does not exist or cannot be found, the University will inform the requester in writing. If access is refused in full or part, the University will inform the applicant in writing of the refusal. As part of this response, the University will provide the reason(s) for the refusal and inform the individual of his or her right to complain to the Manitoba Ombudsman.
The University must be satisfied with the requester’s identity before allowing access to their personal health information. Departments should request photo identification and take all reasonable steps to ensure that any personal health information intended for an individual is received only by that individual.
Requests for Correction
Individuals may make a request in writing to have their personal health information corrected if they believe it to be inaccurate or incomplete. The University is not obligated to provide correction but will respond within 30 days. If the request is refused, the University will inform the individual in writing of the refusal. The University will also inform the individual of their right to complain to the Manitoba Ombudsman. If a correction is made, the University will, where practical, notify any other trustee or person to whom the personal health information has been disclosed within the year before the request was made that the record has been amended.