What does Manitoba's PHIA ask a trustee to do after a privacy breach?

What counts as a privacy breach?

Theft or loss of personal health information, or access, use, disclosure, destruction or alteration of it that breaks the Act.

"privacy breach" means, in relation to personal health information, (a) theft or loss; or (b) access, use, disclosure, destruction or alteration in contravention of this Act.

When must a breach be reported?

The duty falls on a trustee who maintains the information. The test is whether the breach could reasonably be expected to create a real risk of significant harm to the individual. The trustee weighs the factors the regulations list in deciding that.

A trustee who maintains personal health information about an individual must notify the individual about a privacy breach relating to the information if, after considering the relevant factors prescribed in the regulations, the breach could reasonably be expected to create a real risk of significant harm to the individual.

Who must be told?

The individual the information is about. A trustee that must notify an individual must also notify the Ombudsman, at the time and in the form the Ombudsman sets.

If the trustee is required to notify an individual about a privacy breach under subsection (2), the trustee must also notify the Ombudsman at the time and in the form and manner that the Ombudsman requires.

How fast?

The Act's words are "as soon as practicable" after the trustee learns of the breach. It gives no fixed number of days.

Notice to the individual must (a) be given as soon as practicable after the privacy breach becomes known to the trustee;

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.