a person typing on a laptop.

Access and Privacy Office

COVID-19 update

The Access and Privacy Office remains open and available to provide services and support. To limit the spread of COVID-19, access to the University of Manitoba campus and buildings is restricted. As mail service will be affected and fax machines may not be accessible, please submit all access to information applications via email to fippa@umanitoba.ca.

The university's ability to respond to access to information requests within the Act's legislated timeframes may be impacted in the coming weeks. We will respond to existing and new access applications electronically and make our best effort to respond as soon as we can.

Our hours remain the same, Monday to Friday, from 8 a.m. to 4:30 p.m. To access services and support, please contact us directly.

Application for access to information

The University of Manitoba is committed to the principles of access to information outlined in the Freedom of Information and Protection of Privacy Act (FIPPA) and the Personal Health Information Act (PHIA). These acts provide the public the right of access to records in the custody or under the control of UM and its colleges.

Records covered by FIPPA and PHIA at the University of Manitoba

FIPPA and PHIA applies to all records in the custody or under the control of UM and its colleges, but does not extend to information that may be considered exempt from disclosure, such as teaching or research materials, or a question that is to be used on an examination or test.

How to apply for access to UM records (non-health records)

Request for access to general information and an individual’s own personal information may be made either informally to the holding office, or formally to the Access and Privacy Office.  For formal request please complete the Application to Access form (PDF).

A formal Access to Information request is required if:

  • You are requesting access to:
    • Confidential information
    • Personal information concerning an individual who is not named as a requestor
    • Third-party business information
  • The holding office has doubts about whether the information should be released
  • You are not satisfied with the information you have received informally and are requesting additional information

How to apply for access to my health records

Requests for access to personal health information should be made to the office where the individual believes the records containing their personal health information are held.

No special forms are required if the individual is making a request for their own personal health information, but the request should be in writing. The written request must contain the name of the individual requesting the record(s), address, phone number, signature and date of the request.

Prior to permitting an individual to examine or receive a copy of their personal health information, UM will need to confirm their identity through photo or other appropriate identification.

Anyone seeking access to the personal health information of another individual must submit a written request to the Access and Privacy Office.

Information for applicants

After you submit your request

You will be sent an acknowledgement letter that specifies the date your request was received by the university. The wording of your request is mailed to the address supplied on your application form within the first five to seven days of the application process.

If the wording of your access request is modified based on conversations with the university after your application is submitted, a clarification letter will be sent to you detailing the changes made to the original wording of your request.

Who will know that I submitted an application for access at the university?

The Access and Privacy Office staff is obligated to protect your privacy during the access requests process, so your identity will only be shared with other university staff member(s) if your identity is required in the retrieval of the records you have requested.

If your identity needs to be shared, it will only be shared with the minimum amount of people required to complete the application for access.

Fees

There is no charge to submit an application for access. However, there are fees that may be applied to your application. If any of the following scenarios apply, a fee estimate letter will be sent to you.

  1. All access requests are allotted two free hours of search and preparation. A fee of $15 per 30-minutes will be charged to access requests that take longer than two hours.
  2. Computer programming and data processing fees of $10 per 15-minutes if internal programming or data processing is required, or the actual cost of external programming or data processing is incurred by the university.

A fee estimate puts the application process on hold until payment is received by the university. Therefore, the deadline to respond to your request will be delayed.

What happens if I receive a fee estimate, but I am unable or unwilling to pay it?

If you are unable to or do not want to pay the fee estimate, please contact the Access and Privacy Office to discuss your concerns. We may be able to help you narrow the scope of your access request in order to decrease the fees, or eliminate them entirely.

If the fee is not paid, and/or the Access and Privacy Office is not contacted to discuss the fee estimate, the file will be considered abandoned and closed 30 days after the last contact.

Response time

The university is required to respond to your access request within 30 calendar days of receipt of your application for access unless a time extension has been taken. The date the university received your application will be included in the acknowledgement letter sent to you.

FIPPA allows the public body to take a 30-day time extension under certain circumstances, which is outlined under subsection 15(1) of the Act.

For example, if a large number of records are requested which would unreasonably interfere with the operations of the university, or if the university needs to consult with a third party or another public body before deciding whether or not access will be granted to the record(s), the university can take a 30-day extension.

It has been 30 days since I sent in my application and I have not received a response. What should I do?

Unless a notice for a time extension was sent to you, the university has 30 calendar days from the day they received the application for access to complete your request. Please allow two to three business days after the 30-day deadline to see if a response arrives in the mail. If nothing arrives, contact the Access and Privacy Office to inquire on the status of your request, either by phone (1-204-474-9462) or by email: fippa@umanitoba.ca.

Your access request decision

You can contact the Access and Privacy Office by phone (1-204-474-9462) or by email at fippa@umanitoba.ca to discuss your questions or concerns about the university's decision regarding your request.

How do I make a complaint about my access request?

Subsection 59(1) of The Freedom of Information and Protection of Privacy Act provides that you may make a complaint about the university's decision regarding your request for access to the Manitoba Ombudsman's Office. You have 60 days from the receipt of the university's decision letter to make a complaint.

Access requests

September 2022

The vast majority of large public entities use a records/data management system to track and manage FOI requests. I am seeking access to several fields included in that system: 1) the request text (if this is not available, a summary of the request), 2) the date it was received, 3) the date it was completed, 4) whether access was granted in full or in part, and 5) how many pages were released. I am seeking this information for records that were completed between January 1, 2021 and June 30, 2022. I am only seeking access to general records requests, not personal record requests. 

For more information regarding fees, timelines and what to expect when you submit an access to information request to the University of Manitoba contact the Access and Privacy Office at fippa@umanitoba.ca.

Freedom of Information and Protection of Privacy Act (FIPPA)

The University of Manitoba is committed to the principles of access to information and the protection of privacy outlined in the Freedom of Information and Protection of Privacy Act (FIPPA).

How FIPPA affects the University of Manitoba

  • The public has a right of access to UM records (subject to specific exceptions).
  • The public has a right to request corrections be made to their own information held at UM.
  • UM must securely collect, store, share and dispose of personal information.
  • Set defined limitations on the use and sharing of personal information based on minimum amount and need to know for approved and authorized purposes.
  • UM’s actions and decisions regarding access and privacy decisions are subject to independent reviews by the Manitoba Ombudsman’s Office.

How to apply for access to university records under FIPPA

Please refer to Application for access and information for more information on requesting access to information under the Freedom of Information and Protection of Privacy Act.

Definition of personal information

Personal information means recorded information about an identifiable individual, including:

  1. The individual's name.
  2. The individual's home address, home telephone  or email address.
  3. Information about the individual's age, sex, sexual orientation, marital or family status.
  4. Information about the individual's ancestry, race, colour, nationality, or national or ethnic origin.
  5. Information about the individual's religion or creed, or religious belief, association or activity.
  6. Personal health information about the individual.
  7. The individual's blood type, fingerprints or other hereditary characteristics.
  8. Information about the individual's political belief, association or activity.
  9. Information about the individual's education, employment or occupation, or educational, employment or occupational history.
  10. Information about the individual's source of income or financial circumstances, activities or history.
  11. Information about the individual's criminal history, including regulatory offences.
  12. The individual's own personal views or opinions, except if they are about another person.
  13. The views or opinions expressed about the individual by another person.
  14. An identifying number, symbol or other particular assigned to the individual.

Definition of recorded information

Record or Recorded Information means a record of information in any form, including information that is written, photographed, recorded or stored in any manner, on any storage medium, or by any means, including by graphic, electronic or mechanical means, in the custody or under the control of the University of Manitoba.

All records (regardless of format or medium) created, received, used or maintained by officers and employees of the University of Manitoba in the course of their duties on behalf of the university are the property of the university.

Records to which The Freedom of Information and Protection of Privacy Act (FIPPA) applies

FIPPA applies to all records in the custody or under the control of the University of Manitoba and its Colleges, including records containing general information, personal information and personal health information. It does not apply to teaching or research materials, or a question that is to be used on an examination or test.

The Personal Health Information Act (PHIA)

PHIA applies to all records containing personal health information in the custody or under the control of the University of Manitoba.

The purposes of the Act are:

  • To provide individuals with a right to examine and receive a copy of personal health information about themselves maintained by a trustee, subject to the limited and specific exceptions set out in this Act.
  • To provide individuals with a right to request corrections to personal health information about themselves maintained by a trustee.
  • To control the manner in which trustees may collect personal health information.
  • To protect individuals against the unauthorized use, disclosure or destruction of personal health information by trustees.
  • To control the collection, use and disclosure of an individual's PHIN.
  • To provide for an independent review of the decisions of trustees under this Act.

Obtaining access under the Act

Under the Act, a person has the right to examine and to receive a copy of his or her personal health information (PHI) subject to the exceptions of PHIA. At UM, PHI may be held by a faculty, department, division, program, centre or service, health care unit or health services agency.

A request to access your own PHI must first be made by contacting the unit or office where you believe the records are held. You may be asked to put the request in writing and it should include your name, address, phone number, signature and date of signing. Please note that prior to being allowed to examine your record, the office that holds the record must confirm your identity through photo or other appropriate identification.

If you are requesting PHI on behalf of another person, you will be referred to the Access and Privacy Office and you will be asked to provide a written request. Prior to the release of any information, the Access and Privacy Office, and if necessary, the Office of Legal Counsel, will require you to verify your identity.

Before a record containing PHI is released for viewing, the office holding the record and/or the Access and Privacy Office will first review the record under the provisions of the Act. If the record does not contain any third party or otherwise confidential information, the record may be examined in the office that holds the record. A copy may be provided if requested.

Personal health information

Personal health information means recorded information about an identifiable individual that relates to:

  • The individual's health or health care history, including genetic information about the individual.
  • The provision of health care to the individual.
  • Payment for health care provided to the individual, and includes the personal health information number (PHIN) and any other identifying number, symbol or particular assigned to an individual, and any identifying information about the individual that is collected in the course of, and is incidental to, the provision of health care or payment for health care.

PHIA and privacy training

Click on the headings below to determine which training session you are required to complete.

Online training modules for users who cannot access content in UM Learn. Please email fippa@umanitoba.ca if you have any questions about what training you should complete.

General online PHIA training

General University of Manitoba PHIA training for employees, contractors, students or affiliates who have or will have access to personal health information. Personal health information includes doctor’s notes, diagnosis, medical accommodations and records, etc.

Register for the PHIA training module

General online privacy training

General privacy (FIPPA) training for employees, contractors, students or affiliates who have or will have access to personal information. Personal information includes names, contact information, financial information etc.

Register for the General Online Privacy Training

Researchers (REB proposals/projects) - PHIA training

Privacy Training for Researchers is now available as a self-registration course in UM Learn.

To access the course:

  1. Login to UM Learn.
  2. Select the Self Registration menu item.
  3. Click on Privacy Training for Researchers.

Privacy Training Requirements for Research

All individuals involved in a UM research project that collects Personal Health Information MUST complete this training, even if the individuals involved with the research project are not employed by or are a student of the University.

This new Privacy Training for Researchers course replaces the previous PHIA Training module for researcher.

The successful completion of the Privacy Training for Researchers course will satisfy the Research Ethics Boards (REB) requirements for PHIA training.

Delivery Methods

For those involved in a UM research projects who have a UMNetID (students, staff, faculty), please complete Privacy Training for Researchers in UM Learn.

For those involved in a UM research project who do not have a UMNetID (i.e. external collaborators), take the Privacy Training for Researchers course online.

UM Common Records Authority Schedule

The University of Manitoba's Common Records Authority Schedule has been designed to ensure that all departments across the university classify and retain their common administrative records in a way that ensures operational effectiveness and consistency across the organization.

Download the updated 2020 Common Records Authority Schedule (PDF), or review the Records Classification and Retention Schedule (CRAS) listed below for a specific group of records.

If your unit has records that do not fall within the common records schedule, please contact us to set up an appointment to review your forms and set up an appropriate records authority schedule.

These documents are available in alternate formats, upon request. Please contact us for more information.

#UMCYBERSECURITYAWARENESS #UMCYBERSECURITYAWARENESS Scavenger Hunt

Coming soon. An online scavenger hunt contest to promote Cyber Security Awareness Month. #UMcybersecurityawareness

Policies and procedures

Access and Privacy Policy and procedures

The following Access and Privacy Policy and procedures have been approved by the Board of Governors and replaces the former FIPPA and PHIA Policy and PHIA Procedures, effective June 23, 2015:

Records Management Policy and procedures

The following Records Management Policy and procedures have been approved by the Board of Governors, effective June 23, 2015:

You may also be interested in

Staff resources

Contact us

If you need more information or would like to request the information on this website in an alternate format, please contact us.

Access and Privacy Office
233 Elizabeth Dafoe Library
University of Manitoba (Fort Gary campus)
Winnipeg, MB R3T 2N2 Canada

204-474-7559
204-474-9308