The CPQ is responsible for the compliance and enforcement of the HDPR and may delegate its powers and duties to any appropriate committee(s) constituted by it or to appropriate person(s) appointed by it (section 42 HDPR).

The powers, duties and functions of CPQ include: (a) conducting an audit of Patient Health Information when requested by a Licensee for the purpose of ascertaining whether or not the information is maintained in accordance with the HDPR; (b) monitoring the use of Personal Identifiers, and to reporting to the Executive Body from time to time on the results of that monitoring, including any recommendations relating to the need for, or desirability of taking regulatory, administrative, or other action to give protection, or better protection, to the Patient or the Licensee; and (c) monitoring compliance with the HDPR.

CPQ may require a Licensee to produce specified information or documents when requested in writing, in relation to the Processing of Patient Health Information of a complaint about an Interference with Patient Health Information. If the Licensee does not comply with the request, the CPQ may impose a Penalty as set out in a list to be published by the DHCA from time to time (section 42).

It does not appear that the DHCA have produced any further information on the penalties that apply in relation to a breach of HDPR. It is unclear how any breaches of the HDPR will be dealt with in the DHCC.

As noted above, the DHA’s interpretation and application of the HDPR may be relevant to the ultimate enforcement of the HDPR.