What does Newfoundland and Labrador's PHIA ask a custodian to do after a breach?

When must a breach be reported?

The notice to the individual is due when personal health information is stolen, lost, disposed of other than as the Act permits, or disclosed to or accessed by an unauthorized person. The Act's words for timing are "at the first reasonable opportunity".

a custodian that has custody or control of personal health information shall notify the individual who is the subject of the information at the first reasonable opportunity where the information is

Is there an exception?

Yes. The notice to the individual is not due where the custodian reasonably believes the breach will not harm the individual's health care or benefits, or their mental, physical, economic or social well-being.

Subsection (3) and subsection 20(3) do not apply where the custodian reasonably believes that the theft, loss, unauthorized disposition, or improper disclosure or access of personal health information will not have an adverse impact upon

Who else must be told?

A custodian that reasonably believes there has been a material breach, as the regulations define it, must inform the Commissioner.

Where a custodian reasonably believes that there has been a material breach as defined in the regulations involving the unauthorized collection, use, or disclosure of personal health information, that custodian shall inform the commissioner of the breach.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.