Privacy — psychology, counselling therapy and social work (Nova Scotia)
A custodian must notify the affected individual at the first reasonable opportunity where it believes on a reasonable basis BOTH that the information was stolen, lost, or subject to unauthorized access, use, disclosure, copying or modification, AND that as a result there is potential for harm or embarrassment to the individual (s. 69). Where the custodian instead determines that a breach is unlikely to have occurred, or that there is no potential for harm or embarrassment, it may decide not to notify the individual — but it MUST then notify the Review Officer (the Information and Privacy Commissioner) as soon as possible (s. 70). There is no threshold below which a custodian may simply record nothing and tell no one: either the individual is notified, or the regulator is.
“69 Subject to the exceptions and additional requirements, if any, that are prescribed, a custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the custodian believes on a reasonable basis that (a) the information is stolen, lost or subject to unauthorized access, use, disclosure, copying or modification; and (b) as a result, there is potential for harm or embarrassment to the individual.” … “70(2) Where a custodian makes the decision not to notify an individual pursuant to this Section, the custodian shall notify the Review Officer as soon as possible.” — Personal Health Information Act, S.N.S. 2010, c. 41 (consolidation to April 1, 2026)