SECTION NS — Nova Scotia: Agent Terms (PHIA)
NS-1. Public bodies excluded
Public bodies. This section does not apply to a public body, or to a service provider of a public body, within the meaning of the Personal Information International Disclosure Protection Act (Nova Scotia). A public body must not use the clickwrap; it contacts VstreamX instead.
The signatory's confirmation. The signatory confirms at signup that the Clinic is not such a body.
NS-2. Roles
VstreamX acts as the agent of each listed custodian under the Personal Health Information Act (Nova Scotia) ("PHIA-NS"). It acts for the custodian's purposes only, and not for its own (MDPA clause 4).
NS-3. Agent's duties
VstreamX:
- (a) collects, uses, discloses, retains and disposes of personal health information only as the custodian permits, and only to provide DentalX;
- (b) notifies the custodian at the first reasonable opportunity, and in any event within the 24 hours of MDPA clause 9, if personal health information handled on the custodian's behalf is stolen, lost, or subject to unauthorised access, use, disclosure, copying or modification [[TO CONFIRM: PHIA-NS section number for the agent's notice duty, cited in the matrix as s. 28(3)]]; and
- (c) applies the safeguards in MDPA Schedule 2.
NS-4. Record of user activity
What DentalX provides. The custodian must produce, at an individual's request, a record of user activity for its electronic information system (PHIA-NS s. 63). DentalX provides the custodian with the record of user activity for a patient's record: who accessed it, including every read, and when.
The custodian's request. VstreamX provides the record within 5 business days of the custodian's request.
Opening condition. This record is a condition for offering DentalX to new Nova Scotia Clinics. Until it is live, DentalX's audit trail records chart openings, exports, deletions and changes only, and for an existing Nova Scotia Clinic VstreamX delivers the full record on this dated plan: [[TO CONFIRM: dated plan for read-access logging sufficient for s. 63]].
NS-5. Breaches
VstreamX's notice allows the custodian to notify the individual at the first reasonable opportunity where there is potential for harm or embarrassment. Where the custodian decides not to notify, it notifies the Review Officer instead (PHIA-NS ss. 69–70).
NS-6. Retention
The custodian's retention. The custodian keeps its records for at least 10 years, and for minors 10 years from age 19, or as its regulatory body requires.
No auto-deletion. DentalX does not auto-delete clinical records.