Law 5: A New Paradigm In Health And Social Services Information Governance (Part I)

On July 1, 2024, the Act respecting health and social services information ("Law 5") and two related regulations finally came into force. Law 5 is an extensive and complex new statute that brings significant changes to personal health information governance in the public and private sectors.

This first article provides an outline of Law 5 and its accompanying regulations. Its purpose is to help public bodies, professionals and businesses assess whether they are obliged to comply with Law 5, and to what extent. A second article, to be published shortly, will focus on key components of Law 5 and provide a comparative analysis with Law 25.

Purpose of Law 5

With a few exceptions,¹ Law 5 introduces an exclusive legal framework for certain health and social services bodies and service providers that exempts the health and social services information they collect and hold from the application of Law 25.²

Enforcing this complex legislation requires simultaneous consideration of (i) the nature and characterization of the health and social services information in question; (ii) the identity of the health and social services actors involved and (iii) the scope of contractual agreements binding these actors with third parties who may not otherwise be subject to Law 5 but who may be deemed to be governed by it as a result of such agreements.

Law 5 does not cover information about an employee if collected for human resources management purposes.

Which bodies are governed by Law 5?

Law 5 applies to a wide range of bodies and service providers in the health and social services sector, including the following public bodies:

• The Ministère de la Santé et des Services sociaux;
• Institutions such as the CISSS, CIUSSS, CHU/university institutes;
• Institutions that serve northern populations and some Indigenous communities;
• College- or university-level educational institutions related to the provision of health services or social services, including the provision of such services to students;³
• Corporation d'urgences-santé;
• Héma-Québec;
• Institut national d'excellence en santé et en services sociaux;
• Institut national de santé publique du Québec;
• Régie de l'assurance maladie du Québec.

Law 5 also applies to:

• Persons or groups operating a private health facility within the meaning of the Act respecting health services and social services, i.e., a "private health consulting room or office is a consulting room or office, situated elsewhere than in a consulting room or office maintained by an institution, in which one or more physicians, dentists or other professionals, individually or as a group, regularly practise their professions, privately and solely on their own account, without directly or indirectly providing their patients with lodging." Law 5 applies in particular to most medical clinics and family medicine groups;
• Persons or groups operating a specialized medical centre within the meaning of the Act respecting health services and social services, i.e., a "place, outside a facility maintained by an institution, that is equipped for the provision by one or more physicians of medical services necessary for a hip or knee replacement, a cataract extraction and intraocular lens implantation or any other specialized medical treatment determined by regulation of the Government";
• Organizations that coordinate organ or tissue donations designated by the Minister, in accordance with recent section 10.3.4 of the Act respecting the Ministère de la Santé et des Services sociaux;
• Health communication centres governed by the Act respecting pre-hospital emergency services;
• Persons or groups operating a centre for assisted procreation within the meaning of the Act respecting clinical and research activities relating to assisted procreation;
• Persons or groups operating a laboratory within the meaning of the Act respecting medical laboratories and organ and tissue conservation;
• Persons or groups operating a private seniors' residence referred to in section 346.0.1 of the Act respecting health services and social services. Note that section 346.0.1 refers to "all or part of a congregate residential facility occupied or designed to be occupied mainly by persons 65 years of age or over; in addition to leasing rooms or apartments, the operator of the residence offers various services included in at least two of the following categories of services, defined by regulation: meal services, personal assistance services, nursing care services, domestic help services, security services or recreation services";
• Intermediate resources or family-type resources within the meaning of the Act respecting health services and social services;
• Other resources offering lodging referred to in section 346.0.21 of the Act respecting health services and social services;
• Holders of a funeral services business licence issued in accordance with the Funeral Operations Act;
• Holders of an ambulance service permit issued in accordance with the Act respecting pre-hospital emergency services;
• Palliative care hospices within the meaning of the Act respecting end-of-life care.

In addition, Law 5 also applies in the event that a person or a group enters into an agreement with any of the aforementioned bodies or persons (excluding the Ministère de la Santé et des Services sociaux) concerning the provision of health services or social services on behalf of that body. In such circumstances, this person or group is governed by Law 5 only for activities related to the provision of these services. In other words, a business otherwise subject to Law 25 may be required to comply with Law 5 depending on the nature of the services offered to any of the aforementioned bodies or persons.

Lastly, Law 5 applies to a "service provider" who offers health services or social services within a body or an aforementioned person, other than an institution such as a CISSS or a CIUSSS, and whose records are not kept by this body. Law 5 defines a service provider as "a natural person who offers health services or social services within a health and social services body or who provides such a person with technical or administrative support services".

As we have seen, Law 5 is very broad but also includes many exceptions. In practice, a case-by-case analysis will often be required to determine whether Law 5 applies.

What is health and social services information?

Law 5 defines health and social services information as any information that allows a natural person to be identified, directly or indirectly, and that has any of the following characteristics:

1. It concerns the person's state of physical or mental health and his or her health determinants, including the person's medical or family history;
2. It concerns any material collected from the person, including biological material, collected in the context of an assessment or treatment, or any implants, ortheses, prostheses or other aids that compensate for a disability of the person;
3. It concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or groups that provided them;
4. It was obtained in the exercise of a function under the Public Health Act; or
5. Any other characteristic determined by government regulation.

Section 2 of Law 5 also stipulates that information allowing a person to be identified, such as the person's name, date of birth, contact information or health insurance number, is health and social services information when it appears with information referred to in the first paragraph or when it is collected for registration, enrolment or admission of the person concerned at, in or to an institution or for the taking in charge of the person concerned by another health and social services body.

Again, unless a situation is clear cut, a case-by-case analysis will often be required to determine whether information constitutes "health and social services information" within the meaning of Law 5. This is especially true given that, depending on how the information is characterized, it may be governed by separate rules on collection, use and retention, and communication to third parties. These important distinctions will be discussed in our second article on Law 5.

What are the best practices for determining whether Law 5 applies to my organization?

With the entry into force of the second statutory regime for the protection of personal information in the wake of Law 25, implementing and updating an inventory (or mapping) of the information that public bodies and businesses collect, use and retain is more essential than ever. Without this inventory, public bodies and businesses might end up applying the wrong statutory framework to information that could qualify as health and social services information within the meaning of Law 5.

In addition, businesses that provide health and social services should immediately educate their key employees about the implications that entering into an agreement concerning the provision of services may have on their obligations with respect to personal information. In some cases, this may require that in-house IT specialists configure all relevant IT tools to comply with Law 5.

Footnotes

1 Law 5, s. 4(4): A person or a group that enters into an agreement with a health body concerning the provision of health services or social services will be subject to Law 5 for activities related to the provision of health services or social services on behalf of that body.

2 Comprising the Act respecting the protection of personal information in the private sector and the Act respecting Access to documents held by public bodies and the Protection of personal information.

3 Regulation respecting the application of certain provisions of the Act respecting health and social services information, s. 1.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.