DentalX Back to home

New Brunswick Annex: Information Manager Agreement

ANX-CA-NB · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 1e11e58cad874386d6abb518399ca31134c3ae8a6e68ce9989e71629e57ac83a

SECTION NB — New Brunswick: Information Manager Agreement (PHIPAA, s. 52)

NB-1. Roles

VstreamX is an information manager under section 52 of the Personal Health Information Privacy and Access Act (New Brunswick) ("PHIPAA"). Each listed custodian provides personal health information to VstreamX so that VstreamX can process, store or destroy it, and provide information management and information technology services through DentalX.

NB-2. Written agreement

This section, with the MDPA, is the written agreement that section 52 requires. Under it, VstreamX:

  • (a) uses and discloses the information only to provide those services, on the custodian's instructions (MDPA clauses 3 and 4);
  • (b) protects the information by the safeguards in MDPA Schedule 2, against risks such as unauthorised access, use, disclosure, destruction or alteration;
  • (c) complies with PHIPAA and its regulations as they apply to an information manager;
  • (d) notifies the custodian, within the 24 hours of MDPA clause 9, of any theft, loss, or unauthorised access, use or disclosure;
  • (e) makes the information available to the custodian to respond to requests for access and correction, within 5 business days (MDPA clause 8); and
  • (f) returns and destroys the information at the end of the service (MDPA clause 14).

[[TO CONFIRM: any further content that s. 52 and N.B. Reg. 2010-112 prescribe for the agreement]]

NB-3. Breaches

VstreamX's notice allows the custodian to notify, as soon as possible:

  • the individual; and
  • the Ombud of New Brunswick, as PHIPAA requires.

NB-4. Retention

The custodian's retention. The custodian keeps its records for the period the New Brunswick Dental Society recommends: 15 years. [[TO CONFIRM: current NBDS guidance]]

No auto-deletion. DentalX does not auto-delete clinical records.

Items to confirm before publication (MB, SK, NS, NB)

  1. Publication date.
  2. The French version of ANX-CA-NB.
  3. MB: the dated plan for read-access logging under Reg. 245/97 s. 4 (MB-4(d)); Manitoba opens to new Clinics only when it is live; the Manitoba Dental Association retention requirement (MB-6).
  4. SK: items (a) to (f) checked verbatim against s. 7 of The Health Information Protection Regulations, 2023 (SK-2); whether HIPA now has an express breach-notice duty (SK-4).
  5. NS: the PHIA-NS section for the agent's notice duty (NS-3(b)); the dated plan for read-access logging under s. 63 (NS-4); Nova Scotia opens to new Clinics only when it is live.
  6. NB: any further content that s. 52 and Reg. 2010-112 prescribe (NB-2); the current NBDS retention guidance (NB-4).