PRESCRIBED ENTITIES

Definitions 1. In this Regulation, “prescribed entity” means an entity set out in section 2; (“entité prescrite”) “research ethics board” has the same meaning as in the Personal Health Information Protection Act, 2004. (“commission d’éthique de la recherche”) Prescribed entities 2. Each of the following entities is a prescribed entity for the purposes of subsection 52.1 (1) of the Act: 1. Cancer Care Ontario. 2. Canadian Institute for Health Information. 3. Institute for Clinical Evaluative Sciences. Use of personal information for research 3. (1) A prescribed entity may use personal information about an individual it receives under subsection 52.1 (1) of the Act for research conducted by the prescribed entity if a research ethics board approves the research under subsection (3) of this section and if the prescribed entity meets the requirements set out in subsection (4) of this section. (2) Before conducting the research, the prescribed entity shall submit a research plan, in writing, to a research ethics board that sets out, (a) the affiliation of each person involved in the research; (b) the nature and purposes of the research; (c) the public or scientific benefit of the research that the prescribed entity anticipates; (d) a description of the research proposed to be conducted and the duration of the research; (e) a description of the personal information required and the sources or potential sources of the information; (f) a description of how the personal information will be used in the research, and if it will be linked to other information, a description of the other information as well as how the linkage will be done; (g) an explanation as to why the research cannot reasonably be accomplished without the personal information and, if it is to be linked to other information, an explanation as to why this linkage is required; (h) an explanation as to why consent to the disclosure of the personal information is not being sought from the individuals to whom the information relates; (i) a description of the reasonably foreseeable harms and benefits that may arise from the use of the personal information and how the prescribed entity intends to address those harms; (j) a description of all persons who will have access to the personal information, why their access is necessary, their roles in relation to the research and their related qualifications; (k) the safeguards that the prescribed entity will impose to protect the confidentiality and security of the personal information, including an estimate of how long information will be retained in an identifiable form and why; (l) information as to how and when the personal information will be disposed of or returned; (m) the funding source for the research; (n) whether the prescribed entity has applied for the approval of any other research ethics boards with respect to this research and the response to or status of any such application; and (o) whether the prescribed entity’s interest in the disclosure of the personal information or the performance of the research would likely result in an actual or perceived conflict of interest with the prescribed entity’s other duties. (3) The research ethics board may approve the research plan after considering the matters it considers relevant, including, (a) whether the purposes of the research can reasonably be accomplished without using the personal information that is to be disclosed; (b) whether, at the time the research is conducted, adequate safeguards will be in place to protect the privacy of the individuals whose personal information is being disclosed and to preserve the confidentiality of the information; and (c) the public interest in conducting the research and the public interest in protecting the privacy of the individuals whose personal information is being disclosed. (4) In conducting the research, the prescribed entity, (a) must comply with the conditions, if any, specified by the research ethics board in respect of the research plan; (b) must use the personal information only for the purposes set out in the research plan approved by the research ethics board; and (c) must not directly or indirectly make contact, or directly or indirectly attempt to make contact, with the individuals to whom the personal information relates in respect of that disclosed information, unless the Chief Coroner first obtains the individual’s consent to being contacted. (5) The prescribed entity shall immediately notify the Chief Coroner in writing if it becomes aware of any failure to comply with subsection (4). Use of personal information for additional research outside scope of agreement 4. Despite subsection 52.1 (6) of the Act, a prescribed entity may use personal information about an individual it receives under subsection 52.1 (1) of the Act for a research purpose that is outside of the scope of the purposes for which it received the information if, (a) the Chief Coroner consents to the use of the personal information for this purpose; (b) the purpose of the research is related to the health or safety of the public or any segment of the public; and (c) the prescribed entity complies with the requirements set out in section 3. Disclosure of personal information for research purposes 5. (1) Despite subsection 52.1 (6) of the Act, a prescribed entity may disclose personal information about an individual it receives under subsection 52.1 (1) of the Act to a researcher if, (a) the researcher submits an application in writing to the prescribed entity requesting the disclosure of the personal information; (b) the researcher has submitted a research plan to a research ethics board for approval that contains the information set out in subsection 3 (2), which shall be read for this purpose by substituting a reference to the researcher every time that subsection refers to a prescribed entity; (c) the research ethics board has approved the research plan in accordance with the considerations set out in subsection 3 (3), which shall be read for this purpose by substituting a reference to the researcher every time that subsection refers to a prescribed entity; (d) the researcher submits a copy of the research ethics board’s decision to the prescribed entity; (e) the purpose of the research is related to the health or safety of the public or any segment of the public; (f) the Chief Coroner consents to the disclosure of the personal information; and (g) the researcher enters into an agreement with the prescribed entity, before any personal information is disclosed, in which the researcher agrees to, (i) comply with the conditions and restrictions, if any, that the prescribed entity imposes relating to the use, security, disclosure, return or disposal of the information, (ii) comply with the conditions, if any, specified by the research ethics board in respect of the research plan, (iii) use the personal information only for the purposes set out in the research plan approved by the research ethics board, (iv) not directly or indirectly make contact, or directly or indirectly attempt to make contact, with the individuals to whom the personal information relates in respect of that disclosed information, unless the Chief Coroner first obtains the individual’s consent to being contacted, (v) not disclose the personal information except as required by law, and (vi) immediately notify the prescribed entity in writing if the researcher becomes aware of any failure to comply with the agreement. (2) The prescribed entity shall immediately notify the Chief Coroner in writing if it becomes aware of any failure of the researcher to comply with the agreement described in clause (1) (g). Disclosure to Chief Coroner 6. (1) Despite subsection 52.1 (6) of the Act and subject to subsection (3) of this section, a prescribed entity may disclose personal information about an individual to the Chief Coroner if it originally received the information from the Chief Coroner under subsection 52.1 (1) of the Act. (2) The information described in subsection (1) may be disclosed even if it has been manipulated or altered. (3) Subsection (1) does not permit a prescribed entity to disclose personal information to the Chief Coroner if the disclosure contains any additional identifying information that was not originally disclosed by the Chief Coroner. 7. Omitted (provides for coming into force of provisions of this Regulation).