What does Nova Scotia's PHIA ask a custodian to do after a privacy breach?

When must a breach be reported?

When a custodian believes on a reasonable basis that personal health information was stolen, lost, or accessed, used, disclosed, copied or changed without authority. The test is potential for harm or embarrassment to the individual. The Act's words for timing are "at the first reasonable opportunity".

a custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the custodian believes on a reasonable basis that (a) the information is stolen, lost or subject to unauthorized access, use, disclosure, copying or modification; and (b) as a result, there is potential for harm or embarrassment to the individual.

When may a custodian decide not to notify?

Where a breach is unlikely to have occurred, or there is no potential for harm or embarrassment to the individual.

(a) it is unlikely that a breach of the personal health information has occurred; or (b) there is no potential for harm or embarrassment to the individual as a result, the custodian may decide that notification to the individual pursuant to Section 69 is not required.

Who must be told?

The individual the information is about. A custodian that decides not to notify the individual must notify the Review Officer as soon as possible.

Where a custodian makes the decision not to notify an individual pursuant to this Section, the custodian shall notify the Review Officer as soon as possible.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.