HIA basics for clinic IT

Custodians, affiliates and information managers

The Health Information Act governs how health information is collected, used, disclosed and protected in Alberta. It applies to custodians, a group that includes many regulated health professionals, Alberta Health Services and others named in the legislation and regulations. Staff and contractors who work for a custodian are affiliates and must follow the custodian's policies.

Outside companies that store, process or manage health information on a custodian's behalf, including some IT providers and software vendors, are generally treated as information managers. The HIA requires a written agreement with an information manager that addresses how health information will be handled. Ask your lawyer or professional college for guidance on what that agreement should contain before you sign with a new vendor.

Safeguards the HIA expects

Custodians must take reasonable steps to maintain administrative, technical and physical safeguards that protect the confidentiality, integrity and availability of health information. For a clinic, that covers everything from the electronic medical record to the fax machine at the front desk and the laptop a physician takes home. It also covers the people side, such as confidentiality agreements, role-based access and clear rules about discussing patients in shared spaces.

Most of these controls are ordinary good practice, but in a clinic they need to be applied consistently and documented, because the information is highly sensitive. A short written standard that lists the controls, who maintains them and how often they are checked makes it much easier to show compliance if the Commissioner's office ever asks.

• Unique user accounts for every staff member, never shared logins
• Multi-factor authentication for EMR and remote access
• Full disk encryption on laptops and workstations
• Automatic screen locks in exam rooms and reception
• Audit logs that record who viewed which records
• Secure disposal of old drives, copiers and printers

Privacy impact assessments

The HIA requires custodians to prepare a privacy impact assessment and submit it to the Office of the Information and Privacy Commissioner of Alberta in certain situations, such as when introducing new administrative practices or information systems involving health information. Access to provincial systems like Alberta Netcare also involves privacy impact assessment requirements.

A privacy impact assessment describes what information a system collects, how it flows, who can see it and what safeguards protect it. Your IT provider can supply much of the technical detail, such as hosting location, encryption and access controls, but the custodian remains responsible for the assessment. Plan for this work early when changing EMR vendors or opening a new location.

Breach notification under the HIA

The HIA has its own mandatory breach notification rules. When health information is lost or accessed or disclosed without authority and there is a risk of harm to an individual, the custodian must notify the Commissioner, the Minister of Health and the affected individual, subject to the details set out in the Act and regulations. The assessment criteria differ from PIPA, so do not assume the same threshold applies.

Because of these rules, clinic IT should be designed so that you can answer key questions quickly: which records were exposed, whether the device was encrypted and who accessed the data. Good logging and encryption can be the difference between a contained incident and a large notification exercise. Make sure the EMR audit log is enabled and retained.

Practical steps for a clinic

Start by listing every system that touches health information, including the EMR, billing software, email, scanning workflows, fax services and any cloud storage. Confirm who has access to each and remove accounts belonging to former staff. Then check that your information manager agreements are in place and current for each vendor.

Finally, train every affiliate at least once a year on privacy basics: no snooping, how to spot phishing, how to send information securely and how to report a possible breach. Your professional college and the Commissioner's office both publish resources that can support this training. Record who attended and when, so you can show training is current.