HSM IT ServicesCompliance and Privacy (PIPA and HIA)
Practical help meeting Alberta privacy laws and security frameworks without drowning in paperwork. Our Compliance and Privacy services help Alberta organizations understand and meet their obligations under PIPA, the Health Information Act, the public-sector privacy legislation and PIPEDA. We assess your safeguards, build practical policies and map controls to frameworks such as CIS Controls v8.1, NIST CSF 2.0, ISO/IEC 27001:2022 and SOC 2.
Alberta organizations operate under several privacy laws depending on who they are and what information they hold. Private-sector businesses and many non-profits fall under the Personal Information Protection Act, or PIPA. Health custodians such as physicians, pharmacists and dentists must follow the Health Information Act. Public bodies now operate under the Protection of Privacy Act and the Access to Information Act, which replaced FOIP in 2025. Federal PIPEDA can apply to certain cross-border or federally regulated activities.
Each law expects organizations to protect information with reasonable security arrangements, and most create obligations around breach notification. Under PIPA, organizations must notify the Information and Privacy Commissioner of a breach where there is a real risk of significant harm, and the HIA has its own notification duties. HSM IT Services helps translate those requirements into specific technical and administrative safeguards, such as access controls, encryption, logging, retention practices, vendor agreements and staff training.
Our work starts with a gap assessment against the laws that apply to you and, where useful, a recognized framework. Smaller organizations often benefit from the CIS Controls v8.1 implementation groups, while others need NIST CSF 2.0 for governance, or readiness support for ISO/IEC 27001:2022 certification or a SOC 2 audit. We support privacy impact assessments, write and update policies, and help prepare evidence. We are not a law firm, and we work alongside your legal counsel where legal advice is needed.
What is included
- Privacy and security gap assessments under PIPA, HIA and public-sector law
- Privacy impact assessment support
- Information security and privacy policy development
- Breach response and notification procedures
- Vendor and cloud provider risk reviews
- Framework mapping to CIS Controls v8.1 and NIST CSF 2.0
- ISO/IEC 27001:2022 and SOC 2 readiness support
- Evidence collection and audit preparation
How it works
Scope
We identify which laws, contracts and frameworks apply to your organization and the information you hold.
Assess
We review current safeguards, policies and practices and document gaps by priority.
Remediate
We help implement technical controls, policies and procedures that close the most important gaps.
Sustain
We maintain evidence, review controls on a schedule and update documentation as laws and operations change.
Who it is for
This service suits Alberta health custodians, clinics and pharmacies, professional firms, non-profits, public bodies and contractors serving them, and growing companies facing SOC 2 or ISO/IEC 27001:2022 requests from customers. It is also valuable after a privacy incident, a new client contract, or a change in legislation, when leadership needs a clear view of where the organization stands and what to do next.
Questions we hear
Which Alberta privacy law applies to my organization?
It depends on the type of organization and information. Most private businesses follow PIPA. Health custodians, including physicians, pharmacists and dentists, follow the Health Information Act for health information. Public bodies follow the Protection of Privacy Act and the Access to Information Act. Some activities also fall under federal PIPEDA. We help you map this, alongside your legal counsel.
What happened to FOIP?
Alberta's Freedom of Information and Protection of Privacy Act was replaced in 2025 by two statutes: the Access to Information Act, which governs requests for records held by public bodies, and the Protection of Privacy Act, which governs how public bodies collect, use, disclose and protect personal information. Public bodies and their service providers should review their practices against the new laws.
Does HSM IT Services provide legal advice?
No. HSM IT Services provides technical, operational and framework expertise: assessing safeguards, writing security policies, implementing controls and preparing evidence. Interpreting your specific legal obligations is a matter for legal counsel. We regularly work alongside lawyers and privacy officers, so the technical measures we implement match the legal advice your organization receives.