Health Information Act (HIA)

Alberta's law governing how health information is collected, used, disclosed and protected by custodians such as physicians, pharmacists and other regulated health professionals.

The Health Information Act applies to custodians, a defined group that includes many regulated health professionals and certain health organizations in Alberta, as well as the affiliates who work for them, such as staff and contractors. It sets rules for collecting, using and disclosing individually identifying health information, and requires custodians to protect it with reasonable administrative, technical and physical safeguards.

For clinics, pharmacies and other health practices, the HIA shapes IT decisions directly. Custodians generally must prepare privacy impact assessments for certain new systems and submit them to the Office of the Information and Privacy Commissioner of Alberta. The Act also includes duties to notify affected individuals, the Commissioner and the Minister of Health when certain breaches create a risk of harm. Using cloud services, remote access and third-party vendors all require careful consideration under the Act.

Practical tip: if you are a custodian, confirm that your IT provider understands the HIA, has signed appropriate agreements, and helps document safeguards such as access logging, encryption and audit trails. Seek legal or privacy advice for specific compliance questions.