What does New Brunswick's PHIPAA ask a custodian to do after a breach?

When must a breach be reported?

When personal health information is stolen, lost, disposed of other than as the Act permits, or disclosed to or accessed by an unauthorized person.

(c) notify the individual to whom the information relates and the Ombud in the manner prescribed by the regulations at the first reasonable opportunity if personal health information is (i) stolen, (ii) lost, (iii) disposed of, except as permitted by this Act, or (iv) disclosed to or accessed by an unauthorized person,

Is there an exception?

Yes. The duty does not apply where the custodian reasonably believes the breach will not harm the individual's health care or benefits, will not harm their mental, physical, economic or social well-being, and will not lead to their identification.

Paragraph (1)(c) does not apply if the custodian reasonably believes that the theft, loss, disposition, disclosure or access of personal health information will not (a) have an adverse impact on the provision of health care or other benefits to the individual to whom the information relates,

Who must be told?

The notice goes to the individual the information is about and to the Ombud, in the manner the regulations set.

How fast?

The Act's words are "at the first reasonable opportunity". It gives no fixed number of days.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.