Bill 40 (Legislature 24, Session 3)

L24 S3 915

Alberta — Bills

1999 BILL 40 Third Session, 24th Legislature, 48 Elizabeth II THE LEGISLATIVE ASSEMBLY OF ALBERTA B ILL 40 H EA LTH IN FO R M A TIO N A C T MS GRAHAM F irst Reading Second Reading C ommittee of the Whole Third Reading Royal Assent

Bill 40 Ms Graham B ILL 40 1999 H EA LTH IN FO R M A TIO N A C T (Assented to , 1999) Table of Contents

Part 1 Introductory Matters

Interpretation 1 Purposes of Act 2 Scope of Act 3 Inconsistency or conflict with another enactment 4 Application of Parts of Act 5 Act binds custodian acting under another enactment 6

Part 2 Individual’s Right to Access Individual’s Health Information Right of individual to access individual’s health information 7 How to make a request 8 Abandoned request 9 D uty to assist applicants 10 Right to refuse access to health information 11 Time limit for responding to a request for access 12 C orrection or amendment of health information 13 Refusal to correct or amend information 14 Extending time 15 Request under s8 or s13 deemed to be a request under F OIP 16 Existing procedures still available 17

Part 3 C ollection of Health Information Prohibition re collection of health information 18 C ollection of non-identifying health information 19 C ollection of individually identifying health information 20 C ollection of personal health number 21 D uty to collect health information from subject individual 22 1

23Use of recording device or camera C ollection of health information by affiliate 24

Part 4 Use of Health Information Prohibition re use of health information 25 Use of non-identifying health information 26 Use of individually identifying health information 27 Use of health information by affiliate 28 C onfidentiality of non-recorded information 29 Use of personal health number by non-custodian 30

Part 5 D isclosure of Health Information D ivision 1 General D isclosure Rules Prohibition re disclosure of health information 31 D isclosure of non-identifying health information 32 D isclosure of information to individual who is subject of information 33 D isclosure of individually identifying health information to be with consent 34 D isclosure of diagnostic, treatment and care information 35 D isclosure of registration information 36 D isclosure of health services provider information 37 D isclosure for purpose of storage 38 D isclosure by Minister and D epartment 39 D isclosure to Minister 40 Maintaining certain disclosure information 41 Notification of purpose of and authority for disclosure 42 D isclosure of health information by affiliate 43 C onfidentiality of non-recorded information 44 D uty of custodian 45 D ivision 2 D isclosure for Health System Purposes D isclosure to Minister or D epartment 46 D isclosure to other custodians 47 D ivision 3 D isclosure for Research Purposes D efinition 48 Research proposal 49 Role of ethics committee 50 Bar to research Application for disclosure of health information 52 2

C onditions and consents 53 Agreement between custodian and researcher 54 C onsent for additional information 55 C ourt order 56

Part 6 D uties and Powers of C ustodians Relating to Health Information D ivision 1 General D uties and Powers D uty to collect, use or disclose health information with highest degree of anonymity possible 57 D uty to collect, use or disclose health information in a limited manner 58 D uty to obtain consent before disclosing via electronic means 59 D uty to protect health information 60 D uty to ensure accuracy of health information 61 D uty to identify responsible affiliates 62 D uty to establish or adopt policies and procedures 63 D uty to prepare privacy impact assessment 64 Power to transform health information 65 Power to enter agreement with information manager 66 Power to charge fees 67 D ivision 2 D ata Matching Prohibition 68 D ata matching by custodian 69 D ata matching by custodians 70 D ata matching by custodian and non-custodian 71 D ata matching for research 72

Part 7 C ommissioner D ivision 1 Reviews by C ommissioner Right to ask for a review 73 How to ask for a review 74 Notifying others of review 75 Mediation may be authorized 76 Inquiry by C ommissioner 77 Refusal to conduct inquiry 78 Burden of proof 79 C ommissioner’s orders 80 No appeal 81 D uty to comply with order 82 3

D ivision 2 D isclosure to C ommissioner D isclosure to C ommissioner 83 D ivision 3 Additional Powers and D uties of C ommissioner General powers of C ommissioner 84 Power to resolve complaints 85 Advice and recommendations 86 Power to authorize a custodian to disregard requests 87 Powers of C ommissioner in conducting investigations or inquiries 88 Statements made to C ommissioner not admissible in evidence 89 Privileged information 90 Restrictions on disclosure of information by C ommissioner and staff 91 Immunity from suit 92 D elegation by C ommissioner 93 Role of Ombudsman 94 Annual report of C ommissioner 95 D ivision 4 C onflict of Interest of C ommissioner Adjudicator 96 Powers, duties and functions of adjudicator 97 Review where C ommissioner in conflict 98 How to ask for a review 99 Notifying others of review 100 C onduct and outcome of review 101

Part 8 General Provisions Oaths 102 Manner of giving notice 103 Exercise of rights by other persons 104 Immunity from suit 105 Protection of employee 106 Offences and penalties 107 Regulations 108 Review of Act 109 4

Part 9 C onsequential Amendments, Paramountcy and C oming into F orce C onsequential amendments 110-124 C oming into force 125 HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Alberta, enacts as follows: PA R T 1 IN TR O D U C TO R Y M A TTER S

Interpretation 1(1) In this Act, (a) “affiliate”, in relation to a custodian, includes (

i) an individual employed by the custodian, (ii) a person who performs a service for the custodian as an appointee, volunteer or student or under a contract or agency relationship with the custodian, and (iii) a health services provider who has the right to admit and treat patients at a hospital as defined in the Hospitals Act, but does not include (iv) an operator as defined in the Ambulance Services Act, or (

v) an agent as defined in the Health Insurance Premiums Act; (b) “applicant” means an individual who makes a request for access to a record under

section 8(1) or for a correction or amendment of health information under

section 13(1); (c) “audit” means a financial, clinical or other formal or systematic examination or review of a program, portion of a program or activity; (d) “collect” means to gather, acquire, receive or obtain health information; 5

(e) “C ommissioner” means the Information and Privacy C ommissioner appointed under

Part 3 of the Freedom of Information and Protection of Privacy Act; (f) “custodian” means (

i) the board of an approved hospital as defined in the Hospitals Act other than an approved hospital that is (

A) owned and operated by a regional health authority established under the Regional Health Authorities Act, or (

B) established and operated by the Alberta C ancer Board continued under the Cancer Programs Act; (ii) the operator of a nursing home as defined in the Nursing Homes Act other than a nursing home that is owned and operated by a regional health authority established under the Regional Health Authorities Act; (iii) a provincial health board established pursuant to regulations made under

section 17(1)(

a) of the Regional Health Authorities Act; (iv) a regional health authority established under the Regional Health Authorities Act; (

v) a community health council as defined in the Regional Health Authorities Act; (vi) a subsidiary health corporation as defined in the Regional Health Authorities Act; (vii) the Alberta C ancer Board continued under the Cancer Programs Act; (viii) a board, council, committee, commission, panel or agency that is created by a custodian referred to in subclauses (

i) to (vii), if all or a majority of its members are appointed by, or on behalf of, that custodian, but does not include a committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of

section 9 of the Alberta Evidence Act; 6

(ix) a health services provider who is paid under the Alberta Health C are Insurance Plan to provide health services; (

x) a licensed pharmacy as defined in the Pharmaceutical Profession Act; (xi) a pharmacist as defined in the Pharmaceutical Profession Act; (xii) the D epartment; (xiii) the Minister; (xiv) an individual or board, council, committee, commission, panel, agency or corporation designated in the regulations as a custodian; but does not include (xv) the Alberta Alcohol and D rug Abuse C ommission continued under the Alcohol and Drug Abuse Act, or (xvi) a C ommunity Board or a F acility Board, as those terms are defined in the Persons with Developmental Disabilities Community Governance Act, (g) “data matching” means the creation of individually identifying health information by combining individually identifying or non-identifying health information or other information from 2 or more electronic databases, without the consent of the individuals who are the subjects of the information; (h) “D epartment” means the D epartment of Health and Wellness of the Government of Alberta; (i) “diagnostic, treatment and care information” means information about any of the following: (

i) the physical and mental health of an individual; (ii) a health service provided to an individual; (iii) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance; 7

(iv) a drug as defined in the Pharmaceutical Profession Act provided to an individual; (

v) a health care aid, device, product, equipment or other item provided to an individual pursuant to a prescription or other authorization; (vi) the amount of any benefit paid or payable under the Alberta Health Care Insurance Act or any other amount paid or payable in respect of a health service provided to an individual, and includes any other information about an individual that is collected when a health service is provided to the individual but does not include information that is not written, photographed, recorded or stored in some manner in a record; (j) “ethics committee” means a committee designated by the regulations as an ethics committee; (k) “health information” means any or all of the following: (

i) diagnostic, treatment and care information; (ii) health services provider information; (iii) registration information; (l) “health professional body” means a body that regulates the members of a health profession or health discipline pursuant to

an Act; (m) “health service” means a service that is provided to an individual (

i) for any of the following purposes and is directly or indirectly and fully or partially paid for by the D epartment: (

A) protecting, promoting or maintaining physical and mental health; (

B) preventing illness; (

C) diagnosing and treating illness; (

D) rehabilitation; 8

(

E) caring for the health needs of the ill, disabled, injured or dying, or (ii) by a pharmacist engaging in the practice of pharmacy as defined in the Pharmaceutical Profession Act regardless of how the service is paid for, but does not include a service that is provided to an individual (iii) by an ambulance attendant as defined in the Ambulance Services Act, (iv) by the Alberta Alcohol and D rug Abuse C ommission continued under the Alcohol and Drug Abuse Act, or (

v) by a C ommunity Board or a F acility Board, as those terms are defined in the Persons with Developmental Disabilities Community Governance Act; (n) “health services provider” means an individual who provides health services; (o) “health services provider information” means the following information relating to a health services provider: (

i) name; (ii) business and home mailing addresses and electronic addresses; (iii) business and home telephone numbers and facsimile numbers; (iv) gender; (

v) date of birth; (vi) unique identification number that (

A) is assigned to the health services provider by a custodian for the purpose of the operations of the custodian, and 9

(

B) uniquely identifies the health services provider in relation to that custodian; (vii) type of health services provider and licence number, if a licence has been issued to the health services provider; (viii) date on which the health services provider became authorized to provide health services and the date, if any, on which the health services provider ceased to be authorized to provide health services; (ix) education completed, including entry level competencies attained in a basic education program and post-secondary educational degrees, diplomas or certificates completed; (

x) continued competencies, skills and accreditations, including any specialty or advanced training acquired after completion of the education referred to in subclause (ix), and the dates they were acquired; (xi) restrictions that apply to the health services provider’s right to provide health services in Alberta; (xii) decisions of a health professional body, or any other body at an appeal of a decision of a health professional body, pursuant to which the health services provider’s right to provide health services in Alberta is suspended or cancelled or made subject to conditions, or a reprimand or fine is issued; (xiii) business arrangements relating to the payment of the health services provider’s accounts; (xiv) profession; (xv) job classification; (xvi) employment status; (xvii) number of years the health services provider has practised the profession; (xviii) employer; 10

(xix) municipality in which the health services provider’s practice is located, but does not include information that is not written, photographed, recorded or stored in some manner in a record; (p) “individually identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information can be readily ascertained from the information; (q) “Minister” means the Minister determined under

section 16 of the Government Organization Act as the Minister responsible for this Act; (r) “non-identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information cannot be readily ascertained from the information; (s) “personal health number” means the number assigned to an individual by the D epartment to uniquely identify the individual; (t) “record” means a record of health information in any form and includes notes, images, audiovisual recordings, x-rays, books, documents, maps, drawings, photographs, letters, vouchers and papers and any other information that is written, photographed, recorded or stored in any manner, but does not include software or any mechanism that produces records; (u) “registration information” means information relating to an individual that falls within the following general categories and is more specifically described in the regulations: (

i) demographic information, including the individual’s personal health number; (ii) location information; (iii) telecommunications information; (iv) residency information; (

v) health service eligibility information; (vi) billing information, 11

but does not include information that is not written, photographed, recorded or stored in some manner in a record; (v) “research” means academic, applied or scientific health-related research that necessitates the use of individually identifying diagnostic, treatment and care information or individually identifying registration information, or both; (w) “use” means to apply health information for a purpose and includes reproducing the information, but does not include disclosing the information.

(2) Where a custodian provides services that are not health services, this Act does not apply (

a) to the custodian in respect of those other services, or (

b) to information relating to those other services. Purposes of Act 2 The purposes of this Act are (

a) to provide individuals with a right of access to health information about themselves, subject to limited and specific exceptions as set out in this Act, (

b) to provide individuals with a right to request correction or amendment of health information about themselves, (

c) to prescribe rules for the collection, use and disclosure of health information, which are to be carried out in the most limited manner and with the highest degree of anonymity that is possible in the circumstances, (

d) to enable health information to be shared and accessed, where appropriate, to provide health services and to manage the health system, (

e) to establish strong and effective mechanisms to protect the privacy of individuals with respect to their health information, (

f) to establish strong and effective remedies for contraventions of this Act, and 12

(

g) to provide for independent reviews of decisions made by custodians under this Act and the resolution of complaints under this Act. Scope of Act 3 This Act (

a) does not limit the information otherwise available by law to a party to legal proceedings, (

b) does not affect the power of any court or tribunal to compel a witness to testify or to compel the production of documents, and (

c) does not prohibit the transfer, storage or destruction of a record in accordance with an enactment of Alberta or C anada. Inconsistency or conflict with another enactment 4 If a provision of this Act is inconsistent or in conflict with a provision of another Act or of a regulation, the provision of this Act prevails unless (

a) another Act, or (

b) a regulation under this Act expressly provides that the other Act or regulation, or a provision of it, prevails despite this Act. Application of Parts of Act 5(1) This Act, except

Part 3, applies in respect of health information collected before or after the coming into force of this Act.

(2) Part 3 of this Act applies only in respect of health information collected after the coming into force of this Act. Act binds custodian acting under another enactment 6 A custodian that collects, uses or discloses health information pursuant to another enactment must comply with this Act. 13

PA R T 2 IN D IVID U A L’S R IG H T TO A C C ESS IN D IVID U A L’S H EA LTH IN FO R M A TIO N Right of individual to access individual’s health information 7(1) An individual has a right of access to any record containing health information about the individual that is in the custody or under the control of a custodian.

(2) The right of access to a record does not extend to information in respect of which a custodian is authorized or required to refuse access under

section 11, but if that information can reasonably be severed from a record, an individual has a right of access to the remainder of the record.

(3) The right of access to a record is subject to the payment of any fee required by the regulations. How to make a request 8(1) To obtain access to a record, an individual must make a request to the custodian that the individual believes has custody or control of the record.

(2) A custodian that has received a request for access to a record under subsection (1) may require the applicant to submit the request in writing.

(3) In a request, the applicant may ask (

a) for a copy of the record, or (

b) to examine the record. Abandoned request 9

(1) Where a custodian contacts an applicant in writing respecting the applicant’s request, including (

a) seeking further information from the applicant that is necessary to process the request, or (

b) requesting the applicant to pay a fee or to agree to pay a fee, and the applicant fails to respond to the custodian, as requested by the custodian, within 30 days of being contacted, the custodian may by notice in writing to the applicant, declare the request abandoned. 14

(2) A notice declaring a request abandoned must state that the applicant may ask for a review of that decision by the C ommissioner. Duty to assist applicants 10 A custodian that has received a request for access to a record under

section 8(1) (

a) must make every reasonable effort to assist the applicant and to respond to each applicant openly, accurately and completely, (

b) must create a record for an applicant if (

i) the record can be created from information that is in electronic form and is in the custody or under the control of the custodian, using its normal computer hardware and software and technical expertise, and (ii) creating the record would not unreasonably interfere with the operations of the custodian, and (

c) must provide, at the request of an applicant and if reasonably practicable, an explanation of any term, code or abbreviation used in the record. Right to refuse access to health information 11(1) A custodian may refuse to disclose health information to an applicant (

a) if the disclosure could reasonably be expected (

i) to result in immediate and grave harm to the applicant’s mental or physical health or safety, (ii) to threaten the mental or physical health or safety of another individual, or (iii) to pose a threat to public safety, (

b) if the disclosure could reasonably lead to the identification of a person who provided health information to the custodian explicitly or implicitly in confidence and in circumstances in which it was appropriate that the name of the person who provided the information be kept confidential, 15

(

c) if the disclosure could reasonably be expected to reveal (

i) advice, proposals, recommendations, analyses or policy options developed by or for a member of the Executive C ouncil, or (ii) consultations or deliberations involving a member of the Executive C ouncil or the member’s staff, (

d) if the disclosure could reasonably be expected to reveal advice, proposals, recommendations, analyses or policy options developed by or for a custodian referred to in

section l(1)(f)(iii), (iv) or (vii), or (

e) if the information relates to (

i) procedures or techniques relating to audits to be conducted or diagnostic tests or assessments to be given, (ii) details of specific audits to be conducted or of specific tests or assessments to be given, or (iii) standardized diagnostic tests or assessments used by a custodian, including intelligence tests, and disclosure of the information could reasonably be expected to prejudice the use or results of particular audits, diagnostic tests or assessments.

(2) A custodian must refuse to disclose health information to an applicant (

a) if the health information is about an individual other than the applicant, unless the health information was originally provided by the applicant in the context of a health service being provided to the applicant, (

b) if the health information sets out procedures or contains results of an investigation, a discipline proceeding, a practice review or an inspection relating to a health services provider, (

c) if the health information would reveal the substance of deliberations of the Executive C ouncil or any of its committees or of the Treasury Board or any of its committees, including any advice, recommendation, policy considerations or draft legislation or regulations submitted or prepared for submission to the Executive C ouncil or any 16

of its committees or to the Treasury Board or any of its committees, unless the health information (

i) has been in existence for 15 years or more, (ii) is part of a record of a decision made by the Executive C ouncil or any of its committees on an appeal under

an Act, or (iii) is part of a record the purpose of which is to present background facts to the Executive C ouncil or any of its committees or to the Treasury Board or any of its committees for consideration in making a decision where (

A) the decision has been made public, (

B) the decision has been implemented, or (C ) 5 years or more have passed since the decision was made or considered, or (

d) if the disclosure is prohibited by another enactment of Alberta. Time limit for responding to a request for access 12(1) A custodian must make every reasonable effort to respond to a request under

section 8(1) within 30 days after receiving the request or within any extended period under

section 15.

(2) In a response under subsection (1), the custodian must tell the applicant (

a) whether access to a record or part of it is granted or refused, (

b) if access to the record or part of it is granted, where, when and how access will be given, and (

c) if access to the record or part of it is refused, (

i) the reasons for the refusal and the provision of this Act on which the refusal is based, (ii) the name, title, business address and business telephone number of an affiliate of the custodian 17

who can answer the applicant’s questions about the refusal, and (iii) that the applicant may ask for a review of that decision by the C ommissioner.

(3) The failure of the custodian to respond to a request under

section 8(1) within the 30-day period or any extended period referred to in subsection (1) is to be treated as a decision to refuse access to the record. Correction or amendment of health information 13(1) An individual who believes there is an error or omission in the individual’s health information may in writing request the custodian that has the information in its custody or under its control to correct or amend the information.

(2) Within 30 days after receiving a request under subsection (1) or within any extended period under

section 15, the custodian must decide whether it will make or refuse to make the correction or amendment.

(3) If the custodian agrees to make the correction or amendment, the custodian must within the 30-day period or any extended period referred to in subsection (2) (

a) make the correction or amendment, (

b) give written notice to the applicant that the correction or amendment has been made, and (

c) notify any person to whom that information has been disclosed during the one-year period before the correction or amendment was requested that the correction or amendment has been made.

(4) The custodian is not required to provide the notification referred to in subsection (3)(

c) where (

a) the custodian agrees to make the correction or amendment but believes that the applicant will not be harmed if the notification under subsection (3)(

c) is not provided, and (

b) the applicant agrees.

(5) If the custodian refuses to make the correction or amendment, the custodian must within the 30-day period or any extended period referred to in subsection (2) give written notice to the applicant that 18

the custodian refuses to make the correction or amendment and of the reasons for the refusal.

(6) A custodian may refuse to make a correction or amendment that has been requested in respect of (

a) a professional opinion or observation made by a health services provider about the applicant, or (

b) a record that was not originally created by that custodian.

(7) The failure of the custodian to respond to a request in accordance with this

section within the 30-day period or any extended period referred to in subsection (2) is to be treated as a decision to refuse to make the correction or amendment. Refusal to correct or amend information 14(1) Where a custodian refuses to make a correction or amendment under

section 13, the custodian must tell the applicant that the applicant may elect to do either of the following, but may not elect both: (

a) ask for a review of the custodian’s decision by the C ommissioner; (

b) submit a statement of disagreement setting out in 500 words or less the requested correction or amendment and the applicant’s reasons for disagreeing with the decision of the custodian.

(2) An applicant who elects to submit a statement of disagreement must submit the statement to the custodian within 30 days after the written notice of refusal has been given to the applicant under

section 13(5) or within any extended period under

section 15(3).

(3) On receiving the statement of disagreement, the custodian must (

a) if reasonably practicable, attach the statement to the record that is the subject of the requested correction or amendment, and (

b) provide a copy of the statement of disagreement to any person to whom the custodian has disclosed the record in the year preceding the applicant’s request for the correction or amendment. 19

Extending time 15(1) The custodian may extend the time for responding to a request under

section 8(1) or 13(1) for an additional period of up to 30 days or, with the C ommissioner’s permission, for a longer period if (

a) the request does not give enough detail to enable the custodian to identify the record that is requested or to be corrected or amended, (

b) a large number of records are involved in the request and responding within the period set out in

section 12(1) or 13(2), as the case may be, would unreasonably interfere with the operations of the custodian, or (

c) more time is needed to consult with another custodian before deciding whether or not to grant access to a record or to make the correction or amendment requested.

(2) If the time is extended under subsection (1), the custodian must tell the applicant (

a) the reason for the extension, (

b) when a response can be expected, and (

c) that the applicant may make a complaint to the C ommissioner about the extension.

(3) The C ommissioner may extend the time within which an applicant must submit the statement of disagreement under

section 14(2) if in the opinion of the C ommissioner (

a) it is unreasonable to expect the applicant to submit the statement within the period set out in

section 14(2), or (

b) it is fair to extend the time for any other reason. Request under s8 or s13 deemed to be a request under FOIP 16(1) If a written request is made under

section 8(1) for access to a record that contains information to which the Freedom of Information and Protection of Privacy Act applies, the part of the request that relates to that information is deemed to be a request under

section 7(1) of the Freedom of Information and Protection of Privacy Act and that Act applies to that part of the request as if it had been made under

section 7(1) of that Act.

(2) If a written request is made under

section 13(1) to correct or amend information to which the Freedom of Information and Protection of Privacy Act applies, the request is deemed to be a 20

request under

section 35(1) of the Freedom of Information and Protection of Privacy Act and that Act applies to the request as if it had been made under

section 35(1) of that Act.

(3) This

section does not apply if the custodian that receives the request is not a public body as defined in the Freedom of Information and Protection of Privacy Act. Existing procedures still available 17 An individual is not limited to the procedure set out in this Part to request access to health information about the individual if another procedure is available. PA R T 3 C O LLEC TIO N O F H EA LTH IN FO R M A TIO N Prohibition re collection of health information 18 No custodian shall collect health information except in accordance with this Act.

Collection of non-identifying health information 19 A custodian may collect non-identifying health information for any purpose. Collection of individually identifying health information 20 A custodian may collect individually identifying health information (

a) if the collection of that information is expressly authorized by an enactment of Alberta or C anada, or (

b) if that information relates directly to and is necessary to enable the custodian to carry out a purpose that is authorized under

section 27. Collection of personal health number 21(1) Only the following have the right to require an individual to provide the individual’s personal health number: (

a) custodians; (

b) persons authorized by the regulations to do so.

(2) When requesting a personal health number from an individual, the person referred to in subsection (1) must advise the individual of the person’s authority under subsection (1). 21

(3) An individual may refuse to provide the individual’s personal health number where the person requesting it is not a person referred to in subsection (1). Duty to collect health information from subject individual 22(1) A custodian must collect individually identifying health information directly from the individual who is the subject of the information unless subsection (2) applies.

(2) A custodian may collect individually identifying health information from a person other than the individual who is the subject of the information in the following circumstances: (

a) where the individual who is the subject of the information authorizes collection of the information from someone else; (

b) where the individual who is the subject of the information is unable to provide the information and the custodian collects the information from a person referred to in

section 104(1)(

c) to (

i) who is acting on behalf of that individual; (

c) where the custodian believes, on reasonable grounds, that collection from the individual who is the subject of the information would prejudice (

i) the interests of the individual, (ii) the purposes of collection, or (iii) the safety of any other individual, or would result in the collection of inaccurate information; (

d) where collection from the individual who is the subject of the information is not reasonably practicable; (

e) where collection is for any of the following purposes: (

i) assembling a family or genetic history; (ii) determining the eligibility of an individual to participate in a program of or to receive a benefit, product or health service from a custodian and the information is collected in the course of processing an application made by or for the individual who is the subject of the information; (iii) verifying the eligibility of an individual who is participating in a program of or receiving a benefit, 22

product or health service from a custodian to participate in the program or to receive the benefit, product or service; (iv) informing the Public Trustee or the Public Guardian about clients or potential clients; (

f) where the information is available to the public; (

g) where disclosure of the information is authorized under

Part 5.

(3) When collecting individually identifying health information about an individual directly from the individual, the custodian must take reasonable steps to inform the individual (

a) of the purpose for which the information is collected, (

b) of the specific legal authority for the collection, and (

c) of the title, business address and business telephone number of an affiliate of the custodian who can answer the individual’s questions about the collection. Use of recording device or camera 23 A custodian that collects health information from an individual using a recording device or camera or any other device that may not be obvious to the individual must, before collecting the information, obtain the written consent of the individual to the use of the device or camera.

Collection of health information by affiliate 24 An affiliate of a custodian must not collect health information in any manner that is not in accordance with the affiliate’s duties to the custodian. PA R T 4 U SE O F H EA LTH IN FO R M A TIO N Prohibition re use of health information 25 No custodian shall use health information except in accordance with this Act. Use of non identifying health information 26 A custodian may use non-identifying health information for any purpose. 23

Use of individually identifying health information 27(1) A custodian may use individually identifying health information in its custody or under its control for the following purposes: (

a) providing health services; (

b) determining or verifying the eligibility of an individual to receive a health service; (

c) conducting investigations, discipline proceedings, practice reviews or inspections relating to the members of a health profession or health discipline; (

d) conducting research (

i) if the custodian has submitted a proposal to an ethics committee in accordance with

section 49, (ii) if the ethics committee is satisfied as to the matters referred to in

section 50(1)(b), and (iii) where the ethics committee recommends that consents should be obtained from the individuals who are the subjects of the health information to be used in the research, if those consents have been obtained; (

e) providing for health services provider education; (

f) carrying out any purpose authorized by an enactment of Alberta or C anada; (

g) for internal management purposes, including planning, resource allocation, policy development, quality improvement, monitoring, audit, evaluation, reporting, obtaining or processing payment for health services and human resource management.

(2) A custodian referred to in

section l(1)(f)(iii), (iv), (vii), (xii) or (xiii) may, in addition, use individually identifying health information in its custody or under its control to carry out the following functions within the geographic area in which the custodian has jurisdiction to promote the objectives for which the custodian is responsible: (

a) planning and resource allocation; (

b) health system management; 24

(

c) public health surveillance; (

d) health policy development. Use of health information by affiliate 28 An affiliate of a custodian must not use health information in any manner that is not in accordance with the affiliate’s duties to the custodian. Confidentiality of non recorded information 29 A custodian that collects information described in

section 1(1)(i), (

o) or (

u) that is not written, photographed, recorded or stored in some manner in a record may use the information only for the purpose for which the information was provided to the custodian. Use of personal health number by non custodian 30 A person who is authorized to require an individual to provide a personal health number pursuant to

section 21(1)(

b) may use that information only for the purpose for which the information was collected. PA R TS D ISC LO SU R E O F H EA LTH IN FO R M A TIO N D ivision 1 G eneral D isclosure R ules Prohibition re disclosure of health information 31 No custodian shall disclose health information except in accordance with this Act. Disclosure of non-identifying health information 32(1) A custodian may disclose non-identifying health information for any purpose.

(2) If a disclosure under subsection (1) is to a person that is not a custodian, the custodian must inform the person that the person must notify the C ommissioner of an intention to use the information for data matching before performing the data matching. Disclosure of information to individual who is subject of information 33 A custodian may disclose individually identifying health information to the individual who is the subject of the information or to a person referred to in

section 104(1)(

c) to (

i) who is acting on behalf of that individual. 25

Disclosure of individually identifying health information to be with consent 34(1) Subject to sections 35 to 40, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure.

(2) A consent referred to in subsection (1) must be provided in writing or electronically and must include (

a) an authorization for the custodian to disclose the health information specified in the consent, (

b) the purpose for which the health information may be disclosed, (

c) the identity of the person to whom the health information may be disclosed, (

d) an acknowledgment that the individual providing the consent has been made aware of the reasons why the health information is needed and the risks and benefits to the individual of consenting or refusing to consent, (

e) the date the consent is effective and the date, if any, on which the consent expires, and (

f) a statement that the consent may be revoked at any time by the individual providing it.

(3) A disclosure of health information pursuant to this

section must be carried out in accordance with the terms of the consent.

(4) A revocation of a consent must be provided in writing or electronically.

(5) A consent or revocation of a consent that is provided in writing must be signed by the person providing it.

(6) A consent or revocation of a consent that is provided electronically is valid only if it complies with the requirements set out in the regulations. Disclosure of diagnostic, treatment and care information 35(1) A custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information (

a) to another custodian for any or all of the purposes listed in

section 27(1) or (2), as the case may be, 26

(

b) to a person who is responsible for providing continuing treatment and care to the individual, (

c) to family members of the individual or to another person with whom the individual is believed to have a close personal relationship, if the information is given in general terms and concerns the presence, location, condition, diagnosis, progress and prognosis of the individual on the day on which the information is disclosed and the disclosure is not contrary to the express request of the individual, (

d) where an individual is injured, ill or deceased, so that family members of the individual or another person with whom the individual is believed to have a close personal relationship or a friend of the individual can be contacted, if the disclosure is not contrary to the express request of the individual, (

e) to an official of a penal or other custodial institution in which the individual is being lawfully detained if the purpose of the disclosure is to allow the provision of health services to the individual, (

f) to a person authorized to conduct an audit of the information if the person agrees in writing (

i) to destroy the information at the earliest opportunity after the audit is concluded, and (ii) not to disclose the information to any other person, except as required to accomplish the audit or to report unlawful or improper conduct by the custodian or a health services provider, (

g) to a committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of

section 9 of the Alberta Evidence Act, (

h) for the purpose of a court proceeding or a proceeding before a quasi-judicial body to which the custodian is a party, (

i) for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body having jurisdiction to compel the production of information or with a rule of court that relates to the production of information, 27

(

j) to a municipal or provincial police service for the purpose of investigating an offence involving a life-threatening personal injury to the individual, if the disclosure is not contrary to the express request of the individual, (

k) to another custodian where the custodian disclosing the information has a reasonable expectation that disclosure will detect or prevent fraud, limit abuse in the use of health services or prevent the commission of an offence under an enactment of Alberta or C anada, (

l) to an officer of the Legislature if the information is necessary for the performance of the officer’s duties, (

m) to any person if the custodian believes, on reasonable grounds, that the disclosure will avert or minimize an imminent danger to the health or safety of any person, (

n) if that individual lacks the mental capacity to provide a consent and, in the opinion of the custodian, disclosure is in the best interests of the individual, (

o) to a descendant of a deceased individual, a person referred to in

section 104(1)(

c) to (

i) who is acting on behalf of the descendant or a person who is providing health services to the descendant if, in the custodian’s opinion, (

i) the disclosure is necessary to provide health services to the descendant, and (ii) the disclosure is restricted sufficiently to protect the privacy of the deceased individual, (

p) if the disclosure is authorized or required by an enactment of Alberta or C anada, or (

q) to its successor where (

i) the custodian is transferring its records to the successor as a result of the custodian ceasing to be a custodian, and (ii) the successor is a custodian.

(2) A committee to which health information is disclosed pursuant to subsection (1)(

g) must not disclose the information to any other person except in accordance with subsection (3). 28

(3) A committee referred to in subsection (2) may disclose non-identifying health information to another committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of

section 9 of the Alberta Evidence Act.

(4) A custodian may disclose individually identifying diagnostic, treatment and care information to a health professional body for the purpose of an investigation, a discipline proceeding, a practice review or an inspection if (

a) the custodian has complied with any other enactment authorizing or requiring the custodian to disclose that information for that purpose, and (

b) the health professional body agrees in writing (

i) not to disclose the information to any other person except as authorized by or under the Act governing the health professional body, and (ii) to destroy the information (

A) at the earliest opportunity if the investigation, discipline proceeding, practice review or inspection is abandoned, or (

B) at the earliest opportunity after a final decision has been made relating to the investigation, discipline proceeding, practice review or inspection, including any decision made by a body authorized to hear appeals. Disclosure of registration information 36 A custodian may disclose individually identifying registration information without the consent of the individual who is the subject of the information (

a) for any of the purposes for which diagnostic, treatment and care information may be disclosed under

section 35(1) or (4), (

b) to any person for the purpose of collecting or processing a fine or debt owing by the individual to the Government of Alberta or to a custodian, or (

c) to a person who is not a custodian if the disclosure is in accordance with the requirements set out in the regulations. 29

Disclosure of health services provider information 37(1) A custodian may disclose individually identifying health services provider information without the consent of the individual who is the subject of the information (

a) to a health professional body that requests the information for the purpose of an investigation, a discipline proceeding, a practice review or an inspection relating to the health services provider, or (

b) if the disclosure is authorized or required by an enactment of Alberta or C anada.

(2) A custodian may disclose the health services provider information described in

section l(1)(o)(

i) to (iii), (vii), (xiv), (xv), (xviii) and (xix), other than home address, telephone number and licence number, to any person for any purpose without the consent of the individual who is the subject of the information, unless the disclosure (

a) would reveal other information about the health services provider, or (

b) could reasonably be expected to result in (

i) harm to the health services provider’s mental or physical health or safety, or (ii) undue financial harm to the health services provider. Disclosure for purpose of storage 38 A custodian may disclose individually identifying health information without the consent of the individual who is the subject of the information to the Provincial Archives of Alberta or to any other archives that is subject to this Act or the Freedom of Information and Protection of Privacy Act, for the purposes of permanent preservation and historical research if, in the opinion of the custodian, the information has enduring value. Disclosure by Minister and Department 39

(1) The Minister or the D epartment may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information to another Minister of the Government of Alberta for the purpose of developing public policy.

(2) The Minister or the D epartment may enter into an agreement with 30

(

a) another Minister of the Government of Alberta or a Minister of the Government of C anada or of any other province, or (

b) a person or entity in accordance with the regulations made pursuant to the Alberta Health Care Insurance Act, respecting the disclosure to the person referred to in clause (

a) or (b), as the case may be, of individually identifying registration information without the consent of the individual who is the subject of the information. Disclosure to Minister 40 A custodian other than the Minister may disclose individually identifying health information to the Minister without the consent of the individual who is the subject of the information if the disclosure is necessary or desirable in the opinion of the custodian to enable the Minister to carry out the duties of the Minister. Maintaining certain disclosure information 41(1) A custodian that discloses individually identifying diagnostic, treatment and care information under

section 35(1) or (4) must make a note of the following information: (

a) the name of the person to whom the custodian discloses the information; (

b) the date and purpose of the disclosure; (

c) a description of the information disclosed.

(2) The information referred to in subsection (1) must be retained by the custodian for a period of 10 years following the date of the disclosure.

(3) An individual who is the subject of information referred to in subsection (1) may ask a custodian for access to and a copy of the information, and

Part 2 applies to the request. Notification of purpose of and authority for disclosure 42(1) A custodian that discloses individually identifying diagnostic, treatment and care information must inform the recipient in writing of the purpose of the disclosure and the authority under which the disclosure is made. (2) Subsection (1) does not apply where the disclosure is (

a) to another custodian under

section 35(1)(a), 31

(

b) to the Minister or the D epartment under

section 46, or (

c) to another custodian under

section 47. Disclosure of health information by affiliate 43 An affiliate of a custodian must not disclose health information in any manner that is not in accordance with the affiliate’s duties to the custodian. Confidentiality of non recorded information 44 A custodian that collects information described in

section 1(1)(i), (

o) or (

u) that is not written, photographed, recorded or stored in some manner in a record may disclose the information only for the purpose for which the information was provided to the custodian. Duty of custodian 45 A custodian that discloses health information must make a reasonable effort to ensure that the person to whom the disclosure is made is the person intended and authorized to receive the information. D ivision 2 D isclosure for H ealth System Purposes Disclosure to Minister or Department 46(1) The Minister or the D epartment may request another custodian to disclose individually identifying health information for any of the purposes listed in

section 27(2) (

a) if the Minister or the D epartment, as the case may be, is authorized by an enactment of Alberta or C anada to obtain the information from the other custodian, or (

b) if the information requested relates to a health service provided by the other custodian (

i) that is fully or partially paid for by the D epartment, or (ii) that is provided using financial, physical or human resources provided, administered or paid for by the D epartment.

(2) If the requirements of subsection (1) are met, the custodian must disclose the information to the Minister or the D epartment as the case may be. 32

(3) On receipt of information under this section, the Minister or the D epartment, as the case may be, may disclose the information to a custodian referred to in

section l(1)(f)(iii), (iv) or (vii) for any of the purposes listed in

section 27(2).

(4) Individually identifying health information may be disclosed under this

section without the consent of the individual who is the subject of the information. Disclosure to other custodians 47(1) A custodian referred to in

section l(1)(f)(iii), (iv) or (vii) may request another custodian to disclose to the requesting custodian individually identifying health information for any of the purposes listed in

section 27(2) (

a) if the requesting custodian is authorized by an enactment of Alberta or C anada to obtain the information from the other custodian, or (

b) if the information requested relates to a health service provided by the other custodian (

i) that is fully or partially paid for by the requesting custodian, or (ii) that is provided using financial, physical or human resources provided or administered by the requesting custodian.

(2) Where a request relates to information described in subsection (1)(b), the custodian receiving the request may refuse to disclose the information if disclosure could reasonably be expected (

a) to result in immediate and grave harm to the mental or physical health or safety of the individual who is the subject of the information, (

b) to threaten the mental or physical health or safety of another individual, or (

c) to pose a threat to public safety.

(3) If a custodian refuses to disclose information in accordance with subsection (2), (

a) the custodian must provide the requesting custodian with non-identifying health information in the form requested by that custodian, and 33

(

b) the requesting custodian may ask for a review of that refusal by the C ommissioner.

(4) In making a decision on a review under subsection (3)(b), the C ommissioner must, if the custodian is a member of a health professional body, inform the health professional body of the review and provide an opportunity for that body to make comments to the C ommissioner relating to the review.

(5) On receipt of information under this section, the requesting custodian may disclose the information (

a) to a custodian referred to in

section 1(1)(f)(iii), (iv) or (vii), (

b) to the Minister, and (

c) to the D epartment for any of the purposes listed in

section 27(2).

(6) Individually identifying health information may be disclosed under this

section without the consent of the individual who is the subject of the information. D ivision 3 D isclosure for R esearch Purposes Definition 48 In this D ivision, “health information” means individually identifying diagnostic, treatment and care information or individually identifying registration information, or both. Research proposal 49 A person who intends to conduct research may submit a proposal to an ethics committee for review by that committee. Role of ethics committee 50(1) The ethics committee must (

a) consider whether the researcher should be required to obtain consents for the disclosure of the health information to be used in the research from the individuals who are the subjects of the information, and (

b) assess whether, in the opinion of the ethics committee, (

i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest 34

in protecting the privacy of the individuals who are the subjects of the health information to be used in the research, (ii) the researcher is qualified to carry out the research, (iii) adequate safeguards will be in place at the time the research will be carried out to protect the privacy of the individuals who are the subjects of the health information to be used in the research and the confidentiality of that information, and (iv) obtaining the consents referred to in clause (

a) is unreasonable, impractical or not feasible.

(2) In making an assessment under subsection (1)(b), the ethics committee must consider the degree to which the proposed research may contribute to (

a) identification, prevention or treatment of illness or disease, (

b) scientific understanding relating to health, (

c) promotion and protection of the health of individuals and communities, (

d) improved delivery of health services, or (

e) improvements in health system management.

(3) The ethics committee must prepare a response setting out (

a) its recommendation under subsection (1)(a), (

b) its assessment of the matters set out in subsection (1)(b), and (

c) any conditions that the ethics committee considers should be imposed on the researcher. Bar to research 51 If the ethics committee is not satisfied as to any of the matters referred to in

section 50(1)(b), the researcher may not apply to a custodian under

section 52. 35

Application for disclosure of health information 52 If the ethics committee is satisfied as to the matters referred to in

section 50(1)(b), the researcher may forward to one or more custodians (

a) the response of the ethics committee to the researcher’s proposal, and (

b) a written application for disclosure of the health information to be used in the research. Conditions and consents 53(1) A custodian who has received the documents referred to in

section 52 may, but is not required to, disclose the health information applied for.

(2) If the custodian decides to disclose the health information, (

a) the custodian (

i) must impose on the researcher any conditions suggested by the ethics committee, and (ii) may impose other conditions on the researcher, and (

b) the researcher must obtain the consents referred to in

section 50(1)(a), if recommended by the ethics committee, prior to the disclosure. Agreement between custodian and researcher 54(1) If the custodian decides to disclose health information to a researcher, the researcher must enter into an agreement with the custodian in which the researcher agrees (

a) to comply with (

i) this Act and the regulations made under this Act, (ii) any conditions imposed by the custodian relating to the use, protection, disclosure, return or disposal of the health information, and (iii) any requirement imposed by the custodian to provide safeguards against the identification, direct or indirect, of an individual who is the subject of the health information, 36

(

b) to use the health information only for the purpose of conducting the proposed research, (

c) not to publish the health information in a form that could reasonably enable the identity of an individual who is the subject of the information to be readily ascertained, (

d) not to make any attempt to contact an individual who is the subject of the health information to obtain additional health information unless the individual has provided the custodian with the consent referred to in

section 55, (

e) to allow the custodian to access or inspect the researcher’s premises to confirm that the researcher is complying with the enactments, conditions and requirements referred to in clause (a), and (

f) to pay the costs referred to in subsection (3).

(2) When an agreement referred to in subsection (1) has been entered into, the custodian may disclose to the researcher the health information requested under

section 52 (

a) with the consent of the individuals who are the subjects of the information, where the ethics committee recommends that consents should be obtained, or (

b) without the consent of the individuals who are the subjects of the information, where the ethics committee does not recommend that consents be obtained.

(3) The custodian may set the costs of (

a) preparing information for disclosure, (

b) making copies of health information, and (

c) obtaining the consents referred to in

section 55, which must not exceed the actual cost of providing that service.

(4) If the researcher contravenes or fails to meet the terms and conditions of an agreement under this section, the agreement is cancelled. 37

Consent for additional information 55 If the researcher wishes to contact the individuals who are the subjects of the information disclosed under

section 54(2) to obtain additional health information, the custodian or an affiliate of the custodian must first obtain consents from those individuals to their being contacted for that purpose. Court order 56(1) If a researcher refuses to allow a custodian to access or inspect its premises in accordance with the agreement referred to in

section 54, the custodian may apply to the C ourt of Queen’s Bench by notice of motion for an order under subsection (2).

(2) If the C ourt is satisfied that there are reasonable and probable grounds to believe that access to premises or the production or removal of documents is necessary for the purpose of determining whether an agreement referred to in

section 54 is being complied with, the C ourt may make any order it considers necessary to enforce compliance with the agreement.

(3) Where authorized to do so by an order under subsection (2), a custodian may (

a) enter and search any premises of the researcher where the research is conducted, (

b) operate or cause to be operated any computer system of the researcher to search any data contained in or available to the system and produce a document from the data, and (

c) seize and make copies of any documents of the researcher that are or may be relevant to the investigation.

(4) An application for an order under this

section may be made ex parte unless the C ourt orders otherwise.

(5) The custodian must return any documents seized pursuant to a court order within 60 days after the conclusion of the investigation that gave rise to the seizure, including any hearing or appeal.

(6) In this section, document” includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microfilm, sound recording, videotape, machine readable record or other material or thing, regardless of physical form or characteristics. 38

PA R T 6 D U TIES A N D PO W ER S O F C U STO D IA N S R ELA TIN G TO H EA LTH IN FO R M A TIO N D ivision 1 G eneral D uties and Pow ers Duty to collect, use or disclose health information with highest degree of anonymity possible 57(1) In this section, “aggregate health information” means non-identifying health information about groups of individuals.

(2) A custodian that intends to collect, use or disclose health information must first consider whether collection, use or disclosure of aggregate health information is adequate for the intended purpose, and if so, the custodian must collect, use or disclose only aggregate health information.

(3) If the custodian believes that collecting, using or disclosing aggregate health information is not adequate for the custodian’s intended purpose, the custodian must then consider whether collection, use or disclosure of other non-identifying health information is adequate for the intended purpose, and if so, the custodian may collect, use or disclose other non-identifying health information.

(4) If the custodian believes that collecting, using or disclosing aggregate and other non-identifying health information is not adequate for the custodian’s intended purpose, the custodian may collect, use or disclose individually identifying health information if the collection, use or disclosure (

a) is authorized by this Act, and (

b) is carried out in accordance with this Act.

(5) This

section does not apply where the collection, use or disclosure is for the purpose of (

a) providing health services, or (

b) determining or verifying the eligibility of an individual to receive a health service. Duty to collect, use or disclose health information in a limited manner 58(1) When collecting, using or disclosing health information, a custodian must, in addition to complying with

section 57, collect, use or disclose only the amount of health information that is essential to enable the custodian or the recipient of the information, as the case may be, to carry out the intended purpose. 39

(2) In deciding how much health information to disclose, a custodian must consider as an important factor any expressed wishes of the individual who is the subject of the information relating to disclosure of the information, together with any other factors the custodian considers relevant. Duty to obtain consent before disclosing by electronic means 59

(1) A custodian that intends to disclose individually identifying diagnostic, treatment and care information about an individual by electronic means must obtain the individual’s consent to the disclosure or ensure that the individual’s consent has been previously obtained.

(2) A consent referred to in subsection (1) must be provided in writing or electronically and must include (

a) an authorization for any custodian to disclose individually identifying diagnostic, treatment and care information about the individual by electronic means for all of the purposes listed in

section 27, (

b) an acknowledgment that the individual providing the consent has been made aware of the reason for disclosure by electronic means and the risks and benefits to the individual of consenting or refusing to consent, (

c) the date the consent is effective, and (

d) a statement that the consent may be revoked at any time by the individual providing it.

(3) A disclosure of health information pursuant to this

section must be carried out in accordance with the terms of the consent.

(4) A revocation of a consent must be provided in writing or electronically.

(5) A consent or revocation of a consent that is provided in writing must be signed by the person providing it.

(6) A consent or revocation of a consent that is provided electronically is valid only if it complies with the requirements set out in the regulations.

(7) This

section does not apply where the disclosure is for the purpose of obtaining or processing payment for health services. 40

Duty to protect health information 60(1) A custodian must take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will (

a) protect the confidentiality of health information that is in its custody or under its control and the privacy of the individuals who are the subjects of that information, (

b) protect the confidentiality of health information that is to be stored or used in a jurisdiction outside Alberta or that is to be disclosed by the custodian to a person in a jurisdiction outside Alberta and the privacy of the individuals who are the subjects of that information, (

c) protect against any reasonably anticipated (

i) threat or hazard to the security or integrity of the health information or of loss of the health information, or (ii) unauthorized use, disclosure or modification of the health information or unauthorized access to the health information, and (

d) otherwise ensure compliance with this Act by the custodian and its affiliates.

(2) The safeguards to be maintained under subsection (1) must include appropriate measures for the proper disposal of records to prevent any reasonably anticipated unauthorized use or disclosure of the health information or unauthorized access to the health information following its disposal. Duty to ensure accuracy of health information 61 Before using or disclosing health information that is in its custody or under its control, a custodian must make a reasonable effort to ensure that the information is accurate and complete.

Duty to identify responsible affiliates 62(1) Each custodian must identify its affiliates who are responsible for ensuring that this Act, the regulations and the policies and procedures established or adopted under

section 63 are complied with.

(2) Any collection, use or disclosure of health information by an affiliate of a custodian is considered to be collection, use or disclosure by the custodian. 41

(3) Any disclosure of health information to an affiliate of a custodian is considered to be disclosure to the custodian.

(4) Each affiliate of a custodian must comply with (

a) this Act and the regulations, and (

b) the policies and procedures established or adopted under

section 63. Duty to establish or adopt policies and procedures 63(1) Each custodian must establish or adopt policies and procedures that will facilitate the implementation of this Act and the regulations.

(2) A custodian must at the request of the Minister or the D epartment provide the Minister or the D epartment, as the case may be, with a copy of the policies and procedures established or adopted under this section. Duty to prepare privacy impact assessment 64(1) Each custodian must prepare a privacy impact assessment that describes how proposed administrative practices and information systems relating to the collection, use and disclosure of individually identifying health information may affect the privacy of the individual who is the subject of the information.

(2) The custodian must submit the privacy impact assessment to the C ommissioner for review and comment before implementing any proposed new practice or system described in subsection (1) or any proposed change to existing practices and systems described in subsection (1). Power to transform health information 65 A custodian may, in accordance with the regulations, strip, encode or otherwise transform individually identifying health information to create non-identifying health information. Power to enter agreement with information manager 66(1) In this section, “information manager” means a person or body that (

a) processes, stores, retrieves or disposes of health information, (

b) in accordance with the regulations, strips, encodes or otherwise transforms individually identifying health information to create non-identifying health information, and 42

(

c) provides information management or information technology services.

(2) A custodian may enter into an agreement with an information manager in accordance with the regulations for the provision of any or all of the services described in subsection (1).

(3) A custodian that has entered into an agreement with an information manager may disclose health information to the information manager without the consent of the individuals who are the subjects of the information for the purposes authorized by the agreement.

(4) An information manager to which information is disclosed pursuant to subsection (3) may use or disclose that information only for the purposes authorized by the agreement.

(5) An information manager must comply with (

a) this Act and the regulations, and (

b) the agreement entered into with a custodian in respect of information disclosed to it pursuant to subsection (3).

(6) Notwithstanding subsection (5)(a), a custodian continues to be responsible for compliance with this Act and the regulations in respect of the information disclosed by the custodian to the information manager. Power to charge fees 67(1) A custodian may charge the fees provided for in the regulations for services provided under

Part 2. (2) Subsection (1) does not permit a custodian to charge a fee in respect of a request for access to an applicant’s own health information, except for the cost of producing the copy.

(3) A custodian must give an applicant an estimate of the total fee for its services before providing the services.

(4) A custodian may excuse an applicant from paying all or part of a fee if, in the opinion of the custodian, the applicant cannot afford the fee or in any other circumstances provided for in the regulations.

(5) If an applicant has requested a custodian to excuse the applicant from paying all or part of a fee and the custodian has refused the applicant’s request, the custodian must notify the 43

applicant that the applicant may ask for a review by the C ommissioner.

(6) The fees referred to in subsection (1) must not exceed the actual cost of the services. D ivision 2 D ata M atching Prohibition 68 A custodian must not (

a) collect the health information to be used in data matching, or (

b) use or disclose the health information to be used in data matching or created through data matching in contravention of this Act. Data matching by custodian 69 A custodian may perform data matching using information that is in its custody or under its control. Data matching by custodians 70(1) A custodian may perform data matching by combining information that is in its custody or under its control with information that is in the custody or under the control of another custodian.

(2) Before performing data matching under this section, the custodian in whose custody and control the information that is created through data matching will be stored must prepare a privacy impact assessment and submit the assessment to the C ommissioner for review and comment.

(3) A privacy impact assessment referred to in subsection (2) must (

a) describe how the information to be used in the data matching is to be collected, and (

b) set out how the information that is created through data matching is to be used or disclosed. Data matching by custodian and non custodian 71(1) A custodian may perform data matching by combining information that is in its custody or under its control with information that is in the custody or under the control of a person that is not a custodian. 44

(2) Before performing data matching under this section, the custodian must prepare a privacy impact assessment and submit the assessment to the C ommissioner for review and comment.

(3) A privacy impact assessment referred to in subsection (2) must meet the requirements of

section 70(3). Data matching for research 72 If data matching is performed for the purpose of conducting research, sections 48 to 56 must be complied with before the data matching is performed. PA R T 7 C O M M ISSIO N ER D ivision 1 R eview s by C om m issioner Right to ask for a review 73(1) An individual who makes a request to a custodian for access to or for correction or amendment of health information may ask the C ommissioner to review any decision, act or failure to act of the custodian that relates to the request.

(2) An individual who believes that the individual’s own health information has been collected, used or disclosed in contravention of this Act may ask the C ommissioner to review that matter.

(3) A custodian may ask the C ommissioner to review the decision of another custodian to refuse to disclose health information pursuant to

section 47(2). How to ask for a review 74(1) To ask for a review under this D ivision, a written request must be delivered to the C ommissioner.

(2) A request under

section 73 for a review of a decision of a custodian must be delivered to the C ommissioner within (a) 60 days after the person asking for the review is notified of the decision, or (

b) any longer period allowed by the C ommissioner.

(3) The failure of a custodian to respond in time to a request for access to a record is to be treated as a decision to refuse access, but the time limit in subsection (2)(

a) for delivering a request for a review does not apply. 45

Notifying others of review 75(1) On receiving a request for a review, the C ommissioner must as soon as practicable (

a) give a copy of the request (

i) to the custodian concerned, and (ii) to any other person who in the opinion of the C ommissioner is affected by the request, and (

b) provide a

summary of the review procedures and an anticipated date for a decision in respect of the review (

i) to the person who asked for the review, (ii) to the custodian concerned, and (iii) to any other person who in the opinion of the C ommissioner is affected by the request.

(2) D espite subsection (1)(a), the C ommissioner may sever any information in the request that the C ommissioner considers appropriate before giving a copy of the request to the custodian or any other person affected by the request. Mediation may be authorized 76 The C ommissioner may authorize a mediator to investigate and attempt to settle any matter that is the subject of a request for a review. Inquiry by Commissioner 77(1) Unless

section 78 applies, if a matter is not settled under

section 76, the C ommissioner must conduct an inquiry and may decide all questions of fact and law arising in the course of the inquiry.

(2) An inquiry under subsection (1) may be conducted in private.

(3) The person who asked for the review, the custodian concerned and any other person given a copy of the request for the review must be given an opportunity to make representations to the C ommissioner during the inquiry, but no one is entitled to be present during, to have access to or to comment on representations made to the C ommissioner by another person. 46

(4) The C ommissioner may decide whether the representations are to be made orally or in writing.

(5) The person who asked for the review, the custodian concerned and any other person given a copy of the request for the review may be represented at the inquiry by counsel or an agent.

(6) An inquiry under this

section must be completed within 90 days after the C ommissioner receives the request for the review unless the C ommissioner (

a) notifies the person who asked for the review, the custodian concerned and any other person given a copy of the request for the review that the C ommissioner is extending that period, and (

b) provides an anticipated date for the completion of the review. Refusal to conduct inquiry 78 The C ommissioner may refuse to conduct an inquiry pursuant to

section 77 if in the opinion of the C ommissioner the subject of a request for a review under

section 73 has been dealt with in an order or investigation report of the C ommissioner. Burden of proof 79 If an inquiry relates to a decision to refuse access to all or part of a record, the onus is on the custodian to prove that the person asking for the review has no right of access to the record or part of the record. Commis sioner’s orders 80(1) On completing an inquiry under

section 77, the C ommissioner must dispose of the issues by making an order under this section.

(2) If the inquiry relates to a decision to grant or to refuse access to all or part of a record, the C ommissioner may, by order, do the following: (

a) require the custodian to grant access to all or part of the record, if the C ommissioner determines that the custodian is not authorized or required to refuse access; (

b) either confirm the decision of the custodian or require the custodian to reconsider it, if the C ommissioner determines that the custodian is authorized to refuse access; 47

(

c) require the custodian to refuse access to all or part of the record, if the C ommissioner determines that the custodian is required to refuse access.

(3) If the inquiry relates to any other matter, the C ommissioner may, by order, do one or more of the following: (

a) require that a duty imposed by this Act or the regulations be performed; (

b) confirm or reduce the extension of a time limit under

section 15; (

c) confirm or reduce a fee required to be paid under this Act or order a refund, in the appropriate circumstances, including if a time limit is not met; (

d) confirm a decision not to correct or amend health information or specify how health information is to be corrected or amended; (

e) require a person to stop collecting, using, disclosing or creating health information in contravention of this Act; (

f) require a person to destroy health information collected or created in contravention of this Act.

(4) The C ommissioner may specify any terms or conditions in an order made under this section.

(5) The C ommissioner must give a copy of an order made under this

section (

a) to the person who asked for the review, (

b) to the custodian concerned, (

c) to any other person given a copy of the request for the review, and (

d) to the Minister.

(6) A copy of an order made by the C ommissioner under this

section may be filed with a clerk of the C ourt of Queen’s Bench and, after filing, the order is enforceable as a judgment or order of that C ourt. 48

No appeal 81 An order made by the C ommissioner under this Act is final. Duty to comply with order 82(1) Subject to subsection (2), not later than 50 days after being given a copy of an order of the C ommissioner, the custodian concerned must comply with the order.

(2) A custodian must not take any steps to comply with a C ommissioner’s order until the period for bringing an application for judicial review under subsection (3) ends.

(3) An application for judicial review of a C ommissioner’s order must be made not later than 45 days after the person making the application is given a copy of the order.

(4) If an application for judicial review is made pursuant to subsection (3), the C ommissioner’s order is stayed until the application is dealt with by the C ourt.

(5) D espite subsection (3), the C ourt may, on application made either before or after the expiry of the period referred to in subsection (3), extend that period if it considers it appropriate to do so. D ivision 2 D isclosure to C om m issioner Disclosure to Commissioner 83(1) An affiliate of a custodian may disclose to the C ommissioner any health information that the affiliate is required to keep confidential and that the affiliate, acting in good faith, believes is being collected, used or disclosed in contravention of this Act.

(2) The C ommissioner must investigate and review any disclosure made under subsection (1).

(3) If an affiliate makes a disclosure under subsection (1), the C ommissioner must not disclose the identity of the affiliate to any person without the affiliate’s consent.

(4) An affiliate is not liable to a prosecution for an offence under any Act for disclosing health information to the C ommissioner unless the affiliate was acting in bad faith.

(5) In carrying out an investigation and review under this section, the C ommissioner has all of the powers and duties set out in sections 76, 77, 80(1) to (5), 88 and 91, and sections 89, 90, 92 and 94 apply. 49

D ivision 3 A dditional Pow ers and D uties of C om m issioner General powers of Commissioner 84 In addition to the C ommissioner’s powers and duties under D ivisions 1 and 2 with respect to reviews, the C ommissioner is generally responsible for monitoring how this Act is administered to ensure its purposes are achieved, and may (

a) at the request of the Minister or otherwise, conduct investigations to ensure compliance with any provision of this Act or compliance with rules relating to the destruction of records set out in an enactment of Alberta, (

b) make an order described in

section 80 whether or not a review is requested, (

c) inform the public about this Act, (

d) receive comments from the public concerning the administration of this Act, (

e) engage in or commission a study of anything affecting the achievement of the purposes of this Act, (

f) comment on the implications for access to health information or for protection of health information of privacy impact assessments submitted to the C ommissioner under

section 64, 70 or 71, (

g) comment on the implications for protection of health information of using or disclosing health information for the purpose of performing data matching, (

h) give advice and recommendations of general application to a custodian on matters respecting the rights or obligations of custodians under this Act, and (

i) bring to the attention of a custodian any failure by the custodian to assist applicants under

section 10. Power to resolve complaints 85 Without limiting

section 84, the C ommissioner may investigate and attempt to resolve a complaint that (

a) a duty imposed by

section 10 has not been performed, 50

(

b) an extension of time for responding to a request is not in accordance with

section 15, (

c) a fee charged under this Act is inappropriate, (

d) a correction or amendment of health information requested under

section 13 has been refused without justification, or (

e) health information has been collected, used, disclosed or created by a custodian in contravention of this Act. Advice and recommenda tions 86(1) A custodian may ask the C ommissioner to give advice and recommendations on any matter respecting any rights or duties under this Act.

(2) The C ommissioner may in writing provide the custodian with advice and recommendations that (

a) state the material facts either expressly or by incorporating facts stated by the custodian, (

b) are based on the facts referred to in clause (a), and (

c) may be based on any other considerations the C ommissioner considers appropriate. Power to authorize a custodian to disregard requests 87 At the request of a custodian, the C ommissioner may authorize the custodian to disregard one or more requests under

section 8(1) or 13(1) if (

a) because of their repetitious or systematic nature, the requests would unreasonably interfere with the operations of the custodian or amount to an abuse of the right to make those requests, or (

b) one or more of the requests are frivolous or vexatious. Powers of Commissioner in conducting investigations or inquiries 88(1) In conducting an inquiry under

section 77 or an investigation under

section 84(

a) or in giving advice and recommendations under

section 86, the C ommissioner has all the powers, privileges and immunities of a commissioner under the Public Inquiries Act and the powers given by subsection (2) of this section.

(2) The C ommissioner may require any relevant record to be produced to the C ommissioner and may examine any information 51

in the record, whether or not the record is subject to the provisions of this Act.

(3) D espite any other enactment or any privilege of the law of evidence, a custodian must produce to the C ommissioner within 10 days any record or a copy of any record required under subsection (1) or (2).

(4) If a custodian is required to produce a record under subsection (1) or (2) and it is not practical to make a copy of the record, the custodian may require the C ommissioner to examine the original at its site.

(5) After completing a review or investigating a complaint, the C ommissioner must return any record or any copy of any record produced. Statements made to the Commissioner not admissible in evidence 89

(1) A statement made or an answer given by a person during an investigation or inquiry by the C ommissioner is inadmissible in evidence in court or in any other proceeding, except (

a) in a prosecution for perjury in respect of sworn testimony, (

b) in a prosecution for an offence under this Act, or (

c) in an application for judicial review or an appeal from a decision with respect to that application. (2) Subsection (1) applies also in respect of evidence of the existence of proceedings conducted before the C ommissioner. Privileged information 9 0 Anything said, any information supplied or any record produced by a person during an investigation or inquiry by the C ommissioner is privileged in the same manner as if the investigation or inquiry were a proceeding in a court.

Restrictions on disclosure of information by Commissioner and staff 9 1(1) The C ommissioner and anyone acting for or under the direction of the C ommissioner must not disclose any information obtained in performing their duties, powers and functions under this Act, except as provided in subsections (2) to (5).

(2) The C ommissioner may disclose, or may authorize anyone acting for or under the direction of the C ommissioner to disclose, information that is necessary (

a) to conduct an investigation or inquiry under this Act, or 52

(

b) to establish the grounds for findings and recommendations contained in a report under this Act.

(3) In conducting an investigation or inquiry under this Act and in a report under this Act, the C ommissioner and anyone acting for or under the direction of the C ommissioner must take every reasonable precaution to avoid disclosing and must not disclose (

a) any health information a custodian would be required or authorized to refuse to disclose if it were contained in a record requested under

section 8(1), or (

b) whether health information exists, if a custodian in refusing to grant access does not indicate whether the information exists.

(4) The C ommissioner may disclose to the Minister of Justice and Attorney General information relating to the commission of an offence under an enactment of Alberta or C anada if the C ommissioner considers there is evidence of an offence.

(5) The C ommissioner may disclose, or may authorize anyone acting for or under the direction of the C ommissioner to disclose, information in the course of a prosecution, application or appeal referred to in

section 89(1). Immunity from suit 9 2 No action lies and no proceeding may be brought against the C ommissioner, or against a person acting for or under the direction of the C ommissioner, for anything done, reported or said in good faith in the exercise or performance or the intended exercise or performance of a duty, power or function under this Part. Delegation by Commissioner 9 3(1) The C ommissioner may delegate to any person any duty, power or function of the C ommissioner under this Act except the power to delegate.

(2) A delegation under subsection (1) must be in writing and may contain any conditions or restrictions the C ommissioner considers appropriate. Role of Ombudsman 9 4 The Ombudsman may not investigate any matter that the C ommissioner has the power to investigate or review under this Part unless the C ommissioner agrees. 53

Annual report of Commissioner 9 5(1) The C ommissioner must report annually to the Speaker of the Legislative Assembly on (

a) the work of the C ommissioner’s office, and (

b) such other matters relating to the protection of health information as the C ommissioner considers appropriate.

(2) On receiving a report from the C ommissioner, the Speaker must lay the report before the Legislative Assembly (

a) as soon as possible, if the Legislature is then sitting, or (

b) if the Legislature is not then sitting, within 15 days after the commencement of the next sitting. D ivision 4 C onflict of Interest of C om m issioner Adjudicator 9 6(1) The Lieutenant Governor in C ouncil may designate a judge of the C ourt of Queen’s Bench of Alberta to act as an adjudicator (

a) to investigate complaints respecting any matter referred to in

section 85 made against a custodian where the C ommissioner has been a member, employee or administrator of that custodian or where, in the C ommissioner’s opinion, the C ommissioner has a conflict in respect to that custodian; (

b) to review, if requested under

section 98, a decision, act or failure to act of a custodian where the C ommissioner has been a member, employee or administrator of that custodian or where, in the C ommissioner’s opinion, the commissioner has a conflict with respect to that custodian.

(2) An adjudicator must not review an order of the C ommissioner made under this Act.

(3) An adjudicator may retain the services of any persons necessary to assist in performing the adjudicator’s functions under this Act.

(4) The Government of Alberta may pay out of the General Revenue F und (

a) to an adjudicator, the expenses a judge is entitled to receive under

section 57(3) of the Judges Act (C anada) while acting as an adjudicator, and 54

(

b) to a person whose services are retained under subsection (3), remuneration for those services. Powers, duties and functions of adjudicator 9 7(1) F or the purposes of

section 96, an adjudicator has the powers, duties and functions given to the C ommissioner by sections 85(

a) to (d), 87, 88 and 91(1), (2)(

a) and (3) to (5).

(2) Sections 89, 90, 92 and 94 apply for the purposes of an investigation, inquiry or review by an adjudicator. Review where Commissioner in conflict 9 8(1) This

section applies where the C ommissioner is asked under

section 73 to review a decision, act or failure to act of a custodian and the C ommissioner had been a member, employee or administrator of that custodian or, in the C ommissioner’s opinion, the C ommissioner has a conflict with respect to that custodian.

(2) An individual who makes a request to a custodian for access to or for correction or amendment of health information may ask an adjudicator to review any decision, act or failure to act of the custodian that relates to the request.

(3) An individual who believes that the individual’s own health information has been collected, used or disclosed in contravention of this Act may ask an adjudicator to review that matter.

(4) A custodian may ask an adjudicator to review the decision of another custodian to refuse to disclose health information pursuant to

section 47(2). How to ask for a review 9 9

(1) To ask for a review under this D ivision, a written request must be delivered to the Minister.

(2) A request for a review of a decision must be delivered to the Minister within (a) 60 days after the person asking for the review is notified of the decision, or (

b) any longer period allowed by the adjudicator. Notifying others of review 100 On receiving a request for a review, the Minister must as soon as practical (

a) give the request to an adjudicator, 55

(

b) give a copy of the request (

i) to the C ommissioner, and (ii) to any other person who in the opinion of the Minister is affected by the request, and (

c) provide a

summary of the review procedures (

i) to the person who asked for the review, (ii) to the C ommissioner, and (iii) to any other person who in the opinion of the Minister is affected by the request. Conduct and outcome of review 101(1) An adjudicator has the powers and duties given to the C ommissioner by sections 76 and 77(1) and (2), and sections 77(3) to (6) and 79 apply to an inquiry conducted by an adjudicator.

(2) On completing an inquiry, an adjudicator has the same duty to dispose of the issues, the same power to make orders and the same duty to notify others of those orders as the C ommissioner has under

section 80(1) to (5).

(3) An adjudicator must give a copy of an order made by the adjudicator under this Act to the C ommissioner.

(4) A copy of an order made by an adjudicator under this Act may be filed with a clerk of the C ourt of Queen’s Bench and, after filing, the order is enforceable as a judgment or order of that C ourt.

(5) Section 82 applies to an order of an adjudicator.

(6) An order made by an adjudicator under this Act is final. PA R T 8 G EN ER A L PR O VISIO N S Oaths 102(1) Before beginning to perform duties under this Act, the C ommissioner must take an oath to faithfully and impartially perform the duties of the C ommissioner under this Act and not to disclose any information received by the office of the C ommissioner under this Act, except as provided for in this Act. 56

(2) Every person employed or engaged by the office of the C ommissioner must, before beginning to perform duties under this Act, take an oath not to disclose any information received by that person under this Act, except as provided for in this Act.

(3) The oath referred to (

a) in subsection (1) must be administered by the Speaker of the Legislative Assembly or the C lerk of the Legislative Assembly, and (

b) in subsection (2) must be administered by the C ommissioner. Manner of giving notice 103 Where this Act requires any notice or other document to be given to a person, it is to be given (

a) by sending it to that person by prepaid mail to the last known address of that person, (

b) by personal service, (

c) by substitutional service if so authorized by the C ommissioner, or (

d) by means of a machine or device that electronically transmits a copy of a document, picture or other printed material by means of a telecommunications system. Exercise of rights by other persons 104(1) Any right or power conferred on an individual by this Act may be exercised (

a) if the individual is 18 years of age or older, by the individual, (

b) if the individual is under 18 years of age and understands the nature of the right or power and the consequences of exercising the right or power, by the individual, (

c) if the individual is under 18 years of age but does not meet the criterion in clause (b), by the guardian of the individual, (

d) if the individual is deceased and was 18 years of age or over immediately before death, by the individual's personal representative if the exercise of the right or power relates to the administration of the individual s estate, 57

(

e) if a guardian or trustee has been appointed for the individual under the Dependent Adults Act, by the guardian or trustee if the exercise of the right or power relates to the powers and duties of the guardian or trustee, (

f) if an agent has been designated under a personal directive under the Personal Directives Act, by the agent if the directive so authorizes, (

g) if a power of attorney has been granted by the individual, by the attorney if the exercise of the right or power relates to the powers and duties conferred by the power of attorney, (

h) if the individual is a formal patient as defined in the Mental Health Act, by the individual’s nearest relative as defined in that Act if the exercise of the right or power is necessary to carry out the obligations of the nearest relative under that Act, or (

i) by any person with written authorization from the individual to act on the individual’s behalf.

(2) Any notice required to be given to an individual under this Act may be given to the person entitled to exercise the individual’s rights or powers referred to in subsection (1).

Immunity from suit 105 No action lies and no proceeding may be brought against the C rown, a custodian or any person acting for or under the direction of a custodian for damages resulting from anything done or not done by that person in good faith while carrying out duties or exercising powers under this Act including, without limitation, any failure to do something where a person has discretionary authority to do something but does not do it.

Protection of employee 106(1) A custodian or a person acting on behalf of a custodian must not take any action against its affiliate to negatively affect its status as an affiliate of the custodian because the affiliate, acting in good faith, (

a) has exercised or may exercise a right under

section 83, or (

b) has properly disclosed information in accordance with this Act.

(2) A person who contravenes subsection (1) is guilty of an offence and liable to a fine of not more than $10 000. 58

Offences and penalties 107(1) No custodian or affiliate of a custodian shall knowingly (

a) alter, falsify or conceal any record, or direct another person to do so, with the intent to evade a request for access to the record, or (

b) destroy any record that is subject to this Act, or direct another person to do so, with the intent to evade a request for access to the record.

(2) No person shall knowingly (

a) collect, use, disclose or create health information in contravention of this Act, (

b) gain or attempt to gain access to health information in contravention of this Act, (

c) make a false statement to, or mislead or attempt to mislead, the C ommissioner or another person performing the duties, powers or functions of the C ommissioner or other person under this Act, (

d) obstruct the C ommissioner or another person in the performance of the duties, powers or functions of the C ommissioner or other person under this Act, (

e) fail to comply with an order made by the C ommissioner under

section 80 or by an adjudicator under

section 101, or (

f) use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual who is the subject of the health information has specifically consented to its use for that purpose.

(3) No researcher shall knowingly breach the terms and conditions of an agreement entered into with a custodian pursuant to

section 54.

(4) No information manager shall knowingly breach the terms and conditions of an agreement entered into with a custodian pursuant to

section 66.

(5) No person to whom non-identifying health information is disclosed and who intends to use the information to perform data matching shall fail to comply with

section 32(2). 59

(6) A person who contravenes this

section is guilty of an offence and liable to a fine of not more than $50 000. Regulations 108(1) The Lieutenant Governor in C ouncil may make regulations (

a) designating boards, councils, committees, commissions, panels, agencies or corporations or individuals as custodians; (

b) describing registration information for the purposes of

section l(1)(u); (

c) expressly providing that another Act or a regulation, or a provision of it, prevails despite this Act for the purposes of

section 4; (

d) authorizing persons other than custodians to require individuals to provide their personal health numbers; (

e) respecting the requirements of a consent or a revocation of a consent that is provided electronically for the purposes of sections 34 and 59; (

f) respecting the disclosure of individually identifying registration information by custodians to persons who are not custodians for the purposes of

section 36(c); (

g) respecting the retention, disposal and archival storage of records for the purposes of

section 60; (

h) respecting the administrative, technical and physical safeguards that a custodian must maintain in respect of health information pursuant to

section 60; (

i) respecting the stripping, encoding or other transformation of individually identifying health information to create non-identifying health information pursuant to

section 65 or an agreement referred to in

section 66; (

j) respecting fees payable for services provided under

Part 2 and providing for circumstances in which applicants may be excused from paying all or part of a fee; (

k) defining terms that are used but not defined in this Act.

(2) The Minister may make regulations 60

(

a) designating committees as ethics committees for the purposes of sections 48 to 56; (

b) respecting agreements to be entered into by custodians and information managers pursuant to

section 66. Review of Act 109

(1) A special committee of the Legislative Assembly must begin a comprehensive review of this Act within 3 years after the coming into force of this

section and must submit to the Legislative Assembly, within one year after beginning the review, a report that includes the committee’s recommended amendments.

(2) The review referred to in subsection (1) must include a review of the application of this Act (

a) to departments of the Government of Alberta, (

b) to local public bodies as defined in the Freedom of Information and Protection of Privacy Act, and (

c) to any other entity that is not a custodian and has information about the health of an individual in its custody or under its control. PA R T 9 C O N SEQ U EN TIA L A M EN D M EN TS, PA R A M O U N TC Y A N D C O M IN G IN TO FO R C E Amends RSA 1980 cA-24 110(1) The Alberta Health Care Insurance Act is am ended by this section.

(2) Section 13 is am ended (

a) by repealing subsection (1) and substituting the follow ing: Disclosing health information 13(1) Except as permitted or required under this Act, the Minister or a person employed in the administration of this Act and authorized by the Minister may disclose health information acquired under this Act or the Health Insurance Premiums Act only in accordance with the Health Information Act.

(1.01) If there is an inconsistency or conflict between subsection (3.2) or (4) and the Health Information Act, subsection (3.2) or (4), as the case may be, prevails. 61

(

b) in subsections (2), (2.1) and (3) by striking out “or communicate”; (

c) by adding the follow ing after subsection (3.1):

(3.2) The Minister or a person employed in the administration of this Act and authorized by the Minister may disclose individually identifying health information, other than a diagnosis given by a person who has provided health services, acquired under this Act (

a) to the individual who is the subject of the information, (

b) to a person referred to in

section 105(1)(

c) to (

i) of the Health Information Act who is acting on behalf of the individual who is the subject of the information, or (

c) to a person other than the individual who is the subject of the information if the individual has consented to the disclosure in accordance with

section 34 of the Health Information Act. (

d) in subsection (4) (

i) by striking out the w ords preceding clause (

a) and substituting the follow ing:

(4) The Minister or a person employed in the administration of this Act and authorized by the Minister may disclose information pertaining to the date on which health services were provided and a description of those services, the name and address of the person who provided the services, the registration number of the person who received the services, the benefits paid for those services and the person to whom they were paid, but the information may be disclosed only (ii) by repealing clauses (e), (e.1) and (e.2); (

e) in subsection (4.1) (

i) by striking out “provide” and substituting “disclose”; (ii) by striking out “provided” and substituting “disclosed”; 62

(

f) by repealing subsections (5) to (5.4); (

g) in subsections (5.5) and (5.6) by striking out “residents’ or”; (

h) by adding the follow ing after subsection (11):

(12) In this section, (a) “health information” means health information as defined in the Health Information Act; (b) “individual identifying”, when used to described health information, means that the identity of the individual who is the subject of the information can be readily ascertained from the information.

(3) Section 14 is am ended (

a) by striking out “furnishes” and substituting “discloses”; (

b) by striking out “furnishing” and substituting “disclosure”. Amends RSA 1980 cC-1 111(1) The Cancer Programs Act is am ended by this section.

(2) The follow ing is added after

section 20.1: Paramountcy 20.11 If there is an inconsistency or conflict between this Part and the Health Information Act, this Part prevails. Amends SA 1984 cC-8.1 112(1) The Child Welfare Act is am ended by this section.

(2) Section 75(3) is am ended by striking out “the Hospitals Act, the Mental Health Act” and substituting “the Health Information Act”. Amends RSA 1980 cF-6 113(1) The Fatality Inquiries Act is am ended by this section.

(2) Section 22(3) is repealed and the follow ing is substituted: 63

(3) Notwithstanding any other Act, regulation or other law, a medical examiner is entitled to inspect and make copies of any diagnosis, record or information relating to (

a) a person receiving diagnostic and treatment services in a diagnostic and treatment centre under the Mental Health Act, or (

b) a patient under the Hospitals Act.

(3) Section 40(1.1) is am ended by striking out “section 17(4) of the Mental Health Act or

section 40(3) of the Hospitals Act or”. Amends SA 1994 cF-18.5 114(1) The Freedom of Information and Protection of Privacy Act is am ended by this section.

(2) Section 1(1) is am ended (

a) in clause (g) (

i) by repealing subclause (

i) and substituting the follow ing: (

i) the board of an approved hospital as defined in the Hospitals Act other than an approved hospital that is (

A) owned or operated by a regional health authority under the Regional Health Authorities Act, or (

B) established and operated by the Alberta C ancer Board continued under the Cancer Programs Act, (ii) in subclause (iii.1) by adding “continued under the Cancer Programs Act” after “Board”; (

b) in clause (

q) by adding “notes, images, audiovisual recordings, x-rays,” before “books”.

(3) Section 4(1) is am ended by adding the follow ing after clause (o): (

p) health information as defined in the Health Information Act that is in the custody or under the control of a public body that is a custodian as defined in the Health Information Act. 64

(4) The follow ing is added after

section 14: Request under

section 7 deemed to be a request under HIA 14.1(1) If a request is made under

section 7(1) for access to a record that contains information to which the Health Information Act applies, the part of the request that relates to that information is deemed to be a request under

section 8(1) of the Health Information Act and that Act applies as if the request had been made under

section 8(1) of that Act. (2) Subsection (1) does not apply if the public body that receives the request is not a custodian as defined in the Health Information Act.

(5) The follow ing is added after

section 35.1: Request under

section 35 deemed to be request under HIA 35.2(1) If a request is made under

section 35(1) to correct personal information that contains information to which the Health Information Act applies, the part of the request that relates to that information is deemed to be a request under

section 13(1) of the Health Information Act and that Act applies as if the request had been made under

section 13(1) of that Act. (2) Subsection (1) does not apply if the public body that receives the request is not a custodian as defined in the Health Information Act.

(6) Section 76(2) is am ended by striking out “section 68(1), (2), (3)(

a) to (d), (4) and (5)” and substituting “section 68(1) to (5)”.

(7) Section 77(7) is am ended by striking out “68(1), (2), (3)(

a) to (d), (4) and (5)” and substituting “68(1) to (5)”.

(8) Section 86(1)(

e) is am ended by adding “, or direct another person to do so,” after “Act”. Amends RSA 1980 cH-4 115(1) The Health Facilities Review Committee Act is am ended by this section.

(2) Section 10(2)(

b) is repealed and the follow ing is substituted: (

b) records containing individually identifying health information within the meaning of the Health Information Act unless the patient or the patient’s guardian consents to those records being inspected. 65

Amends 1999 cH-5.5 116(1) The Health Professions Act is am ended by this section.

(2) Section 155(4) is am ended by striking out “after clause (o)” and substituting “before clause (p)”. Amends RSA 1980 cH-11 117(1) The Hospitals Act is am ended by this section.

(2) Section 40 is am ended (

a) by adding the follow ing after subsection (1):

(1.1) Except as permitted or required under this Act, a board or employee of a board, the Minister or a person authorized by the Minister or a physician may disclose health information obtained from hospital records or from persons having access to them only in accordance with the Health Information Act. (

b) in subsection (2) (

i) in clauses (

a) and (

b) by striking out “m edical” and substituting “health information”; (ii) by repealing clause (c); (

c) by repealing subsections (3) and (4); (

d) in subsection (4.1) by striking out “Notwithstanding subsection (3) or any other law, the Minister” and substituting “The Minister”; (

e) in subsection (5) (

i) by striking out “Notwithstanding subsection (3) or any other law, a board” and substituting “A board”; (ii) by repealing clauses (a), (a.1) and (b); (iii) in clause (

c) by striking out “divulge any diagnosis, record or” and substituting “disclose health”; (

f) by repealing subsection (5.1); (

g) in subsection (6) 66

(

i) by striking out “Notwithstanding subsection (3) or any other law,” and substituting “The following applies with respect to disclosing records of diagnostic and treatment services in respect of a patient:”; (ii) by repealing clauses (b), (c.1) and (d.1); (iii) in clauses (

g) and (

h) by striking out “divulge” and substituting “disclose”; (

h) in subsection (6.1) by striking out “Notwithstanding subsection (3) or any other law, the board” and substituting “The board”; (

i) by repealing subsection (7); (

j) by repealing subsection (9 ) and substituting the follow ing: (9 ) An Appeal Board is entitled, for the purpose of an appeal under

section 36, to inspect and make copies of any health information or other records relating to a patient and may admit a copy of the health information or other records in evidence of the appeal, but all proceedings related to the health information or other records must be held in private. (

k) by repealing subsections (10) to (12); (

l) in subsection (13) by renum bering clause (

a) as clause (a.1) and by adding the follow ing before clause (a.1): (a) “health information” means health information as defined in the Health Information Act; Amends RSA 1980 cH-12 118(1) The Human Tissue Gift Act is am ended by this section.

(2) Section 11 is am ended by adding the follow ing after subsection (2):

(3) If there is an inconsistency or conflict between subsection (1) and the Health Information Act, subsection (1) prevails. 67

Amends SA 1988 cM-13.1 119

(1) The Mental Health Act is am ended by this section.

(2) Section 17 is am ended (

a) in subsection (1) by adding the follow ing after clause (b): (b.1) “health information” means health information as defined in the Health Information Act; (

b) by adding the follow ing after subsection (1):

(1.1) Except as permitted or required under this Act, the Minister, a person authorized by the Minister, a board, an employee of a board or a physician may disclose health information obtained from records maintained in a diagnostic and treatment centre or from persons having access to them only in accordance with the Health Information Act. (

c) in subsection (3) (

i) in clause (

a) by striking out “m edical” and substituting “health information”; (ii) by repealing clause (c); (

d) by repealing subsections (4) and (5); (

e) in subsection (5.1) by striking out “Notwithstanding subsection (4) or any other law, the Minister” and substituting “The Minister”; (

f) in subsection (6) (

i) by striking out “Notwithstanding subsection (4) or any other law, the Minister” and substituting “The Minister”; (ii) by striking out “diagnosis, record or” w herever it occurs and substituting “health”; (iii) by repealing clauses (a), (b), (c), (g), (

k) and (o); (9 ) by repealing subsections (7), (9 ), (10), (11) and (12). 68

Amends SA 1985 cN-14.1 120(1) The Nursing Homes Act is am ended by this section.

(2) Section 27 is am ended by adding the follow ing after subsection (3): (4) Subsection (2) does not apply to health information as defined in the Health Information Act. Amends SA 1999 P-7.3 121 The Pharmacy and Drug Act is am ended by adding the follow ing after

section 47: Consequential 47.1 The Health Information Act is am ended in the follow ing provisions by striking out “Pharmaceutical Profession Act" and substituting “Pharmacy and Drug Act":

section 1(1)(f)(x);

section 1(1)(f)(xi);

section 1(1)(h)(iv);

section 1(1)(l)(ii). Amends SA 1995 cP-19.5 122(1) The Protection for Persons in Care Act is am ended by this section.

(2) Section 7(5)(

b) is am ended by striking out “the medical or clinical records of a person” and substituting “a person’s health information records within the meaning of the Health Information Act". Amends SA 1984 cP-27.1 123(1) The Public Health Act is am ended by this section.

(2) Section 63(4)(

d) is repealed.

(3) Section 83 is repealed and the follow ing is substituted: Paramountcy 83 Except for the Alberta Bill of Rights, this Act prevails over any enactment that it conflicts or is inconsistent with, including the Health Information Act, and a regulation under this Act prevails over any other by-law, rule, order or regulation with which it conflicts. Amends SA 1994 cR-9.07 124(1) The Regional Health Authorities Act is am ended by this section.

(2) Section 21(1)(

o) is repealed. 69

Title: 1999 (24th, 3rd) Bill 40, Health Information Act Coming into force 125 This Act comes into force on Proclamation. 70

Document details

Collection	Alberta — Bills
Citation	L24 S3 915
Type	bill
Volume / chapter	L24 S3 915
Language	en
Format	json
Source	PROVINCIAL
Identifier	323bb743350f2d736176c14aece9d5076ab4798d

Source file is stored in the law ingest library (json).