HEALTH INFORMATION ACT (RSA 2000 cH-5)

RSA 2000 cH-5

Alberta — Consolidated Statutes

© Published by Alberta King’s Printer Alberta King’s Printer Suite 700, Park Plaza 10611 - 98 Avenue Edmonton, AB T5K 2P7 Phone: 780-427-4952 E-mail: kings-printer@gov.ab.ca Shop on-line at kings-printer.alberta.ca Province of Alberta Office Consolidation Revised Statutes of Alberta 2000

Chapter H-5 Current as of December 18, 2025 HEALTH INFORMATION ACT

Copyright and Permission Statement The Government of Alberta, through the Alberta King’s Printer, holds copyright for all Alberta legislation. Alberta King’s Printer permits any person to reproduce Alberta’s statutes and regulations without seeking permission and without charge, provided due diligence is exercised to ensure the accuracy of the materials produced, and copyright is acknowledged in the following format: © Alberta King’s Printer, 20__.* *The year of first publication of the legal materials is to be completed.

Note All persons making use of this consolidation are reminded that it has no legislative sanction, that amendments have been embodied for convenience of reference only. The official Statutes and Regulations should be consulted for all purposes of interpreting and applying the law. Amendments Not in Force This consolidation incorporates only those amendments in force on the consolidation date shown on the cover.

It does not include the following amendments: 2020 c35 s15 amends s1(1); s57 repeals s56.51. 2021 c25 s7 amends s1(1)(a)(vi). 2024 c16 s8 amends s1(1)(f). 2025 c10 s25 amends s1(1). 2025 c21 s7 amends ss1, 2(b), 7(1), 20 and 21(3); adds s21.1; amends ss22(3) and 27; adds s27.1; amends s32; repeals and substitutes s34; amends ss35(1) and 36; adds s38.1; amends ss39 and 41; repeals and substitutes s46(5); amends ss49 and 50(1)(a); adds s52.1; amends ss53 and 54; adds s54.1; repeals and substitutes the heading preceding s56.1; repeals s56.1; repeals and substitutes s56.2; adds ss56.201 to 56.2092; amends s56.21; adds s56.22; amends s56.3; adds ss56.31 to 56.33; amends ss56.4, 56.5 and 56.6; repeals and substitutes s56.61; repeals s56.62; adds ss56.63 and 56.64; repeals and substitutes s56.7(1.1); amends s56.8; adds s56.9; adds s60.01; amends s60.1(1) and (2); adds s60.2; repeals ss62 to 64 and substitutes ss62 to 64.2; amends s65; repeals s66(1); repeals and substitutes ss69, 70 and 71; amends ss72, 72.1, 73 and 84(1); repeals and substitutes s104(1)(d); amends ss106, 107 and 108; adds s108.1; repeals and substitutes s109.

Regulations The following is a list of the regulations made under the Health Information Act that are filed as Alberta Regulations under the Regulations Act Alta. Reg.

Amendments Health Information Act Alberta Electronic Health Record .................. 118/2010 ......... 50/2015, 17/2018, 220/2025 Designation .................................................... 69/2001 ........... 220/2005, 21/2007, 210/2012, 219/2013, 56/2014, 127/2016, 27/2019, 168/2021 Health Information ......................................... 70/2001 ........... 251/2001, 354/2003, 8/2005, 105/2005, 212/2005, 14/2007, 35/2007, 68/2008, 196/2008, 119/2010, 155/2010, 31/2012, 170/2012, 168/2013, 49/2014, 20/2017, 17/2018, 60/2018, 206/2020, 60/2022, 216/2022, 59/2023, NOTE: AR 214/2025 s20 comes into force 125/2024, 216/2024, on the coming into force of s45(17) of the 158/2025, 214/2025, Health Statutes Amendment Act, 2025 291/2025

1 HEALTH INFORMATION ACT

Chapter H-5 Table of Contents

Part 1 Introductory Matters 1

Interpretation 2 Purposes of Act 3 Scope of Act 4 Inconsistency or conflict with another enactment 5 Application of Parts of Act 6 Act binds custodian acting under another enactment

Part 2 Individual’s Right to Access Individual’s Health Information 7 Right of individual to access individual ’s health information 8 How to make a request 9 Abandoned request 10 Duty to assist applicants 11 Right to refuse access to health information 12 Time limit for responding to a request for access 13 Correction or amendment of health information 14 Refusal to correct or amend information 15 Extending time 16 Request under s8 or s13 deemed to be a request under Access to Information Act or Protection of Privacy Act 17 Existing procedures still available

Part 3 Collection of Health Information 18 Prohibition re collecti on of health information 19 Collection of non-identifying health information 20 Collection of individually identifying health information 21 Collection of personal health number

RSA 2000

Chapter H-5 HEALTH INFORMATION ACT 2 22 Duty to collect health information from subject individual 23 Use of device to collect health information 24 Collection of health information by affiliate

Part 4 Use of Health Information 25 Prohibition re use of health information 26 Use of non-identifying health information 27 Use of individually identifying health information 28 Use of health information by affiliate 29 Confidentiality of non-recorded information 30 Use of personal health number by non-custodian

Part 5 Disclosure of Health Information Division 1 General Disclosure Rules 31 Prohibition re disclosure of health information 32 Disclosure of non-identifying health information 33 Disclosure of information to individual who is subject of information 34 Disclosure of individually identifying health information to be with consent 35 Disclosure of diagnostic, treatment and care information 36 Disclosure of registration information 37.1 Disclosure to prevent or limit fraud or abuse of health services 37.3 Disclosure to protect public health and safety 38 Disclosure for purpose of storage 39 Disclosure by Minister and Department 40 Disclosure to ministerial custodian 41 Maintaining certain disclosure information 42 Notification of purpose of and authority for disclosure 43 Disclosure of health information by affiliate 44 Confidentiality of non-recorded information 45 Duty of custodian Division 2 Disclosure for Health System Purposes 46 Disclosure to Minister or Department 47 Disclosure to other custodians Division 3 Disclosure for Research Purposes 49 Proposed research protocol

RSA 2000

Chapter H-5 HEALTH INFORMATION ACT 3 50 Role of research ethics board 50.1 Publication of response 51 Bar to research 52 Application for disclosure of health information or to perform data matching 53 Conditions and consents 54 Agreement between custodian and researcher 55 Consent for additional information 56 Court order

Part 5.1 Alberta Electronic Health Record 56.1

Definitions 56.2 Purpose 56.21 Department authorities and duties re Alberta EHR 56.3 Making health information accessible 56.4 Duties in making health information accessible via Alberta EHR 56.5 Accessing health information via the Alberta EHR 56.6 Maintaining record of Alberta EHR access 56.61 Access request for health information accessible via the Alberta EHR 56.62 Authorized custodian duties, authority 56.7 Multi-disciplinary data stewardship committee 56.71 Termination of agreement and protocol 56.8 Regulations

Part 6 Duties and Powers of Custodians Relating to Health Information Division 1 General Duties and Powers 57 Duty to collect, use or disclose health information with highest degree of anonymity possible 58 Duty to collect, use or disclose health information in a limited manner 60 Duty to protect health information 60.1 Duty to notify 61 Duty to ensure accuracy of health information 62 Duty to identify responsible affiliates 63 Duty to establish or adopt policies and procedures 64 Duty to prepare privacy impact assessment 65 Power to transform health information

RSA 2000

Chapter H-5 HEALTH INFORMATION ACT 4 66 Power to enter agreement with information manager 67 Power to charge fees Division 2 Data Matching 68 Prohibition 69 Data matching by custodian or health information repository 70 Data matching by custodians or health information repositories 71 Data matching by custodian or health information repository and non-custodian 72 Data matching for research

Part 6.1 Health Information Repository 72.1 Designation 72.2 Disclosure of information 72.3 Powers and duties of repository 72.4 Correction or amendment of health information by repository 72.5 Consultation with Commissioner

Part 7 Commissioner Division 1 Reviews by Commissioner 73 Right to ask for a review 74 How to ask for a review 75 Notifying others of review 76 Mediation may be authorized 77 Inquiry by Commissioner 78 Refusal to conduct inquiry 79 Burden of proof 80 Commissioner ’s orders 81 No appeal 82 Duty to comply with order Division 2 Disclosure to Commissioner 83 Disclosure to Commissioner Division 3 Additional Powers and Duties of Commissioner 84 General powers of Commissioner 85 Power to resolve complaints

RSA 2000

Chapter H-5 HEALTH INFORMATION ACT 5 85.1 Power to order notification under

section 60.1 86 Advice and recommendations 87 Power to authorize a custodian to disregard requests 88 Powers of Commissioner in conducting investigations or inquiries 89 Statements made to Commissioner not admissible in evidence 90 Privileged information 91 Restrictions on disclosure of information by Commissioner and staff 92 Immunity from suit 93 Delegation by Commissioner 94 Role of Ombudsman 95 Annual report of Commissioner Division 4 Conflict of Interest of Commissioner 96 Adjudicator 97 Powers, duties and functions of adjudicator 98 Review where Commissioner in conflict 99 How to ask for a review 100 Notifying others of review 101 Conduct and outcome of review

Part 8 General Provisions 102 Oaths 103 Manner of giving notice 104 Exercise of rights by other persons 105 Immunity from suit 106 Protection of employee 107 Offences and penalties 108 Regulations 109 Review of Act

Part 9 Consequential Amendments, Paramountcy and Coming into Force 110-124 Consequential amendments 125 Coming into force

RSA 2000

Section 1

Chapter H-5 HEALTH INFORMATION ACT 6 HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Alberta, enacts as follows:

Part 1 Introductory Matters

Interpretation 1(1) In this Act, (a) “affiliate”, in relation to a custodian, means (

i) an individual employed by the custodian, (ii) a person who performs a service for the custodian as an appointee, volunteer or student or under a contract or agency relationship with the custodian, (iii) a health services provider who is exercising the right to admit and treat patients at an approved hospital under the Provincial Health Agencies Act, (iv) an information manager as defined in

section 66(1), and (

v) a person who is designated under the regulations to be an affiliate, but does not include (vi) an agent as defined in the Health Insurance Premiums Act, or (vii) a health information repository other than a health information repository that is designated in the regulations as an affiliate; (b) “applicant” means an individual who makes a request for access to a record under

section 8(1) or for a correction or amendment of health information under

section 13(1); (c) “audit” means a financial, clinical or other formal or systematic examination or review of a program, activity or other matter under this Act; (d) “collect” means to gather, acqu ire, receive or obtain health information; (e) “Commissioner” means the Information and Privacy Commissioner appointed under

Part 2 of the Access to Information Act;

RSA 2000

Section 1

Chapter H-5 HEALTH INFORMATION ACT 7 (f) “custodian” means (

i) a hospital operator of a health services sector in an approved hospital under the Provincial Health Agencies Act other than a hospital operator that is a provincial health agency, regional health authority or provincial health corporation under the Provincial Health Agencies Act; (ii) the operator of a continui ng care home as defined in the Continuing Care Act other than a continuing care home owned and operated by a provincial health agency, regional health authority or provincial health corporation under the Provincial Health Agencies Act; (ii.1) an ambulance operator as defined in the Emergency Health Services Act; (iii) a provincial health corporation as defined in the Provincial Health Agencies Act; (iv) a provincial health agency , regional health authority or provincial health corporation under the Provincial Health Agencies Act; (

v) a community health council as defined in the Provincial Health Agencies Act; (vi) a subsidiary health corporation as defined in the Provincial Health Agencies Act; (vii) repealed 2 008 cH-4.3 s18; (viii) a board, council, committee, commission, panel or agency that is created by a custodian referred to in subclauses (

i) to (vi), if all or a majority of its members are appointed by, or on behalf of, that custodian, but does not include a committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of

section 9 of the Alberta Evidence Act; (ix) a health services provider who is designated in the regulations as a custodian, or who is within a class of health services providers that is designated in the regulations for the purpose of this subclause; (ix.1) the Health Quality Council of Alberta; (ix.2) the Canadian Centre of Recovery Excellence;

RSA 2000

Section 1

Chapter H-5 HEALTH INFORMATION ACT 8 (

x) a licensed pharmacy as defined in the Pharmacy and Drug Act; (xi) repealed 2009 c25 s2; (xii) the Department; (xii.1) the department administered by the Minister referred to in subclause (xiii.1); (xii.2) the department administered by the Minister referred to in subclause (xiii.2); (xii.3) the department administered by the Minister referred to in subclause (xiii.3); (xiii) the Minister; (xiii.1) the Minister responsible for the Mental Health Services Protection Act; (xiii.2) the Minister responsible for the Health Facilities Act; (xiii.3) the Minister responsible for the Continuing Care Act; (xiv) an individual or board , council, committee, commission, panel, agency, corporation or other entity designated in the regulations as a custodian, (xv) repealed 2008 cH-4.3 s18, (xvi) repealed 2013 cB-7.5 s11; (g) “data matching” means the creation of individually identifying health information by combining individually identifying or non-identifying health information or other information from 2 or more electronic databases, without the consent of the individuals who are the subjects of the information; (h) “Department” means the De partment administered by the Minister; (h.1) “departmental custodian” means a custodian referred to in clause (f)(xii), (xii.1), (xii.2) or (xii.3); (i) “diagnostic, treatment and care information” means information about any of the following: (

i) the physical and mental health of an individual;

RSA 2000

Section 1

Chapter H-5 HEALTH INFORMATION ACT 9 (ii) a health service provided to an individual, including the following information respecting a health services provider who provides a health service to that individual: (

A) name; (

B) business title; (

C) business mailing address and business electronic address; (

D) business telephone number and business facsimile number; (

E) type of health services provider; (

F) licence number or any ot her number assigned to the health services provider by a health professional body to identify that health services provider; (

G) profession; (

H) job classification; (

I) employer; (

J) municipality in which the health services provider’s practice is located; (

K) provincial service provider identification number that is assigned to the health services provider by the Minister to identify the health services provider; (

L) any other information specified in the regulations; (iii) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance; (iv) a drug as defined in the Pharmacy and Drug Act provided to an individual; (

v) a health care aid, device, product, equipment or other item provided to an individual pursuant to a prescription or other authorization; (vi) the amount of any benefit paid or payable under the Alberta Health Care Insurance Act or any other amount

RSA 2000

Section 1

Chapter H-5 HEALTH INFORMATION ACT 10 paid or payable in respect of a health service provided to an individual, and includes any other information about an individual that is collected when a health service is provided to the individual, but does not include information that is not written, photographed, recorded or stored in some manner in a record; (

j) repealed 2006 c18 s2; (k) “health information” means one or both of the following: (

i) diagnostic, treatment and care information; (ii) registration information; (k.1) “health information re pository” means an agency, corporation or other entity designated by the Minister to act as a health information repository in accordance with

Part 6.1; (l) “health professional body” means a body that regulates the members of a health profession or health discipline pursuant to

an Act; (m) “health service” means a se rvice that is provided to an individual for any of the following purposes: (

i) protecting, promoting or maintaining physical and mental health; (ii) preventing illness; (iii) diagnosing and treating illness; (iv) rehabilitation; (

v) caring for the health needs of the ill, disabled, injured or dying, but does not include a service excluded by the regulations; (n) “health services provider” means an individual who provides health services; (

o) repealed 2009 c25 s2; (p) “individually identifying”, when used to describe health information, means that the identity of the individual who is

RSA 2000

Section 1

Chapter H-5 HEALTH INFORMATION ACT 11 the subject of the information can be readily ascertained from the information; (q) “Minister” means the Minist er of Primary and Preventative Health Services; (q.1) “ministerial custodian” me ans a custodian referred to in clause (f)(xiii), (xiii.1), (xiii.2) or (xiii.3); (r) “non-identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information cannot be readily ascertained from the information; (s) “personal health number” me ans the number assigned to an individual by the Department to uniquely identify the individual; (t) “record” means a record of health information in any form and includes notes, images, audiovisual recordings, x-rays, books, documents, maps, drawings, photographs, letters, vouchers and papers and any other information that is written, photographed, recorded or stored in any manner, but does not include software or any mechanism that produces records; (u) “registration information” means information relating to an individual that falls within the following general categories and is more specifically described in the regulations: (

i) demographic information, including the individual’s personal health number; (ii) location information; (iii) telecommunications information; (iv) residency information; (

v) health service eligibility information; (vi) billing information, but does not include information that is not written, photographed, recorded or stored in some manner in a record; (v) “research” means academic, applied or scientific research that necessitates the use of individually identifying health information;

RSA 2000

Section 2

Chapter H-5 HEALTH INFORMATION ACT 12 (v.1) “research ethics board” means a body designated by the regulations as a research ethics board; (w) “use” means to apply health information for a purpose and includes reproducing the information, but does not include disclosing the information.

(2) Where a custodian provides services that are not health services, this Act does not apply (

a) to the custodian in respect of those other services, or (

b) to information relating to those other services.

(3) A custodian who is an affiliate of another custodian is deemed not to be a custodian while acting in the capacity of an affiliate.

(4) For the purposes of this Act, the information specified in subsection (1)(i)(ii) respecting a health services provider is deemed to be individually identifying health information about the individual who received the health service from the health services provider and not individually identifying health information about the health services provider. RSA 2000 cH-5 s1;RSA 2000 cP-13 s47.1;2006 c18 s2;2006 c25 s24; 2007 c18 s2;2008 cE-6.6 s52;2008 cH-4.3 s18;2009 c25 s2; 2011 cH-7.2 s26;2013 cB-7.5 s11;2022 cC-26.7 s70;2023 c9 s11; 2024 c10 s20;2024 c16 s8;2025 c10 s25;2025 c21 s7(2);AR 141/2025 Purposes of Act 2 The purposes of this Act are (

a) to establish strong and effective mechanisms to protect the privacy of individuals with respect to their health information and to protect the confidentiality of that information, (

b) to enable health informat ion to be shared and accessed, where appropriate, to provide health services and to manage the health system, (

c) to prescribe rules for the collection, use and disclosure of health information, which are to be carried out in the most limited manner and with the highest degree of anonymity that is possible in the circumstances, (

d) to provide individuals w ith a right of access to health information about themselves, subject to limited and specific exceptions as set out in this Act,

RSA 2000

Section 3

Chapter H-5 HEALTH INFORMATION ACT 13 (

e) to provide individuals with a right to request correction or amendment of health information about themselves, (

f) to establish strong and effective remedies for contraventions of this Act, and (

g) to provide for independent reviews of decisions made by custodians under this Act and the resolution of complaints under this Act. 1999 cH-4.8 s2 Scope of Act 3 This Act (

a) does not limit the information otherwise available by law to a party to legal proceedings, (

b) does not affect the power of any court or tribunal in Canada to compel a witness to testify or to compel the production of documents, and (

c) does not prohibit the transfer, storage or destruction of a record in accordance with an enactment of Alberta or Canada. RSA 2000 cH-5 s3;2006 c18 s3 Inconsistency or conflict with another enactment 4 If a provision of this Act is inconsistent or in conflict with a provision of another Act or of a regulation, the provision of this Act prevails unless (

a) another Act, or (

b) a regulation under this Act expressly provides that the other Act or regulation, or a provision of it, prevails despite this Act. 1999 cH-4.8 s4 Application of Parts of Act 5(1) This Act, except

Part 3, applies in respect of health information collected before or after the coming into force of this Act.

(2) Part 3 of this Act applies only in respect of health information collected after the coming into force of this Act. 1999 cH-4.8 s5

RSA 2000

Section 6

Chapter H-5 HEALTH INFORMATION ACT 14 Act binds custodian acting under another enactment 6 A custodian that collects, uses or discloses health information pursuant to another enactment must comply with this Act. 1999 cH-4.8 s6

Part 2 Individual’s Right to Access Individual’s Health Information Right of individual to access individual’s health information 7(1) An individual has a right of access to any record containing health information about the individual that is in the custody or under the control of a custodian.

(2) The right of access to a record does not extend to information in respect of which a custodian is authorized or required to refuse access under

section 11, but if that information can reasonably be severed from a record, an individual has a right of access to the remainder of the record.

(3) The right of access to a record is subject to the payment of any fee required by the regulations. 1999 cH-4.8 s7 How to make a request 8(1) To obtain access to a record, an individual must make a request to the custodian that the individual believes has custody or control of the record.

(2) A custodian that has received a request for access to a record under subsection (1) may require the applicant to submit the request in writing.

(3) In a request, the applicant may ask (

a) for a copy of the record, or (

b) to examine the record. 1999 cH-4.8 s8 Abandoned request 9(1) Where a custodian contacts an applicant in writing respecting the applicant’s request, including (

a) seeking further information from the applicant that is necessary to process the request, or (

b) requesting the applicant to pay a fee or to agree to pay a fee,

RSA 2000

Section 10

Chapter H-5 HEALTH INFORMATION ACT 15 and the applicant fails to respond to the custodian, as requested by the custodian, within 30 days after being contacted, the custodian may, by notice in writing to the applicant, declare the request abandoned.

(2) A notice declaring a request abandoned must state that the applicant may ask for a review of that decision by the Commissioner. 1999 cH-4.8 s9 Duty to assist applicants 10 A custodian that has received a request for access to a record under

section 8(1) (

a) must make every reasonable effort to assist the applicant and to respond to each applicant openly, accurately and completely, (

b) must create a record for an applicant if (

i) the record can be created from information that is in electronic form and is in the custody or under the control of the custodian, using its normal computer hardware and software and technical expertise, and (ii) creating the record woul d not unreasonably interfere with the operations of the custodian, and (

c) must provide, at the request of an applicant and if reasonably practicable, an explanation of any term, code or abbreviation used in the record. 1999 cH-4.8 s10 Right to refuse access to health information 11(1) A custodian may refuse to disclose health information to an applicant (

a) if the disclosure coul d reasonably be expected (

i) to result in immediate and grave harm to the applicant’s mental or physical health or safety, (ii) to threaten the mental or physical health or safety of another individual, or (iii) to pose a threat to public safety,

RSA 2000

Section 11

Chapter H-5 HEALTH INFORMATION ACT 16 (

b) if the disclosure could reasonably lead to the identification of a person who provided health information to the custodian explicitly or implicitly in confidence and in circumstances in which it was appropriate that the name of the person who provided the information be kept confidential, (

c) if the disclosure could reas onably be expected to reveal (

i) advice, proposals, recommendations, analyses or policy options developed by or for a member of the Executive Council, or (ii) consultations or delibera tions involving a member of the Executive Council or the member’s staff, (

d) if the disclosure could reas onably be expected to reveal advice, proposals, recommendations, analyses or policy options developed by or for a custodian referred to in

section 1(1)(f)(iii) or (iv), or (

e) if the information relates to (

i) procedures or techniques relating to audits to be conducted or diagnostic tests or assessments to be given, (ii) details of specific audits to be conducted or of specific tests or assessments to be given, or (iii) standardized diagnostic tests or assessments used by a custodian, including intelligence tests, and disclosure of the information could reasonably be expected to prejudice the use or results of particular audits, diagnostic tests or assessments.

(2) A custodian must refuse to disclose health information to an applicant (

a) if the health information is about an individual other than the applicant, unless the health information was originally provided by the applicant in the context of a health service being provided to the applicant, (

b) if the health information sets out procedures or contains results of an investigation, a discipline proceeding, a practice visit or an inspection relating to a health services provider,

RSA 2000

Section 12

Chapter H-5 HEALTH INFORMATION ACT 17 (

c) if the health information would reveal the substance of deliberations of the Executive Council or any of its committees or of the Treasury Board or any of its committees, including any advice, recommendation, policy considerations or draft legislation or regulations submitted or prepared for submission to the Executive Council or any of its committees or to the Treasury Board or any of its committees, unless the health information (

i) has been in existence for 15 years or more, (ii) is part of a record of a decision made by the Executive Council or any of its committees on an appeal under

an Act, or (iii) is part of a record the purpose of which is to present background facts to the Executive Council or any of its committees or to the Treasury Board or any of its committees for consideration in making a decision where (

A) the decision has been made public, (

B) the decision has been implemented, or (C) 5 years or more have passed since the decision was made or considered, or (

d) if the disclosure is prohibited by another enactment of Alberta. RSA 2000 cH-5 s11;2020 c35 s38;2023 c9 s11 Time limit for responding to a request for access 12(1) A custodian must make every reasonable effort to respond to a request under

section 8(1) within 30 days after receiving the request or within any extended period under

section 15.

(2) In a response under subsection (1), the custodian must tell the applicant (

a) whether access to a record or pa rt of it is granted or refused, (

b) if access to the record or part of it is granted, where, when and how access will be given, and (

c) if access to the record or part of it is refused,

RSA 2000

Section 13

Chapter H-5 HEALTH INFORMATION ACT 18 (

i) the reasons for the refusal and the provision of this Act on which the refusal is based, (ii) the name, title, business address and business telephone number of an affiliate of the custodian who can answer the applicant’s questions about the refusal, and (iii) that the applicant may ask for a review of that decision by the Commissioner.

(3) The failure of the custodian to respond to a request under

section 8(1) within the 30-day period or any extended period referred to in subsection (1) is to be treated as a decision to refuse access to the record. 1999 cH-4.8 s12 Correction or amendment of health information 13(1) An individual who believes there is an error or omission in the individual’s health information may in writing request the custodian that has the information in its custody or under its control to correct or amend the information.

(2) Within 30 days after receiving a request under subsection (1) or within any extended period under

section 15, the custodian must decide whether it will make or refuse to make the correction or amendment.

(3) If the custodian agrees to make the correction or amendment, the custodian must within the 30-day period or any extended period referred to in subsection (2) (

a) make the correction or amendment, (

b) give written notice to the applicant that the correction or amendment has been made, and (

c) notify any person to whom that information has been disclosed during the one-year period before the correction or amendment was requested that the correction or amendment has been made.

(4) The custodian is not required to provide the notification referred to in subsection (3)(

c) where (

a) the custodian agrees to make the correction or amendment but believes that the applicant will not be harmed if the notification under subsection (3)(

c) is not provided, and (

b) the applicant agrees.

RSA 2000

Section 14

Chapter H-5 HEALTH INFORMATION ACT 19

(5) If the custodian refuses to make the correction or amendment, the custodian must within the 30-day period or any extended period referred to in subsection (2) give written notice to the applicant that the custodian refuses to make the correction or amendment and of the reasons for the refusal.

(6) A custodian may refuse to make a correction or amendment that has been requested in respect of (

a) a professional opinion or observation made by a health services provider about the applicant, or (

b) a record that was not origin ally created by that custodian.

(7) The failure of the custodian to respond to a request in accordance with this

section within the 30-day period or any extended period referred to in subsection (2) is to be treated as a decision to refuse to make the correction or amendment. 1999 cH-4.8 s13 Refusal to correct or amend information 14(1) Where a custodian refuses to make a correction or amendment under

section 13, the custodian must tell the applicant that the applicant may elect to do either of the following, but may not elect both: (

a) ask for a review of the custodian’s decision by the Commissioner; (

b) submit a statement of disagreement setting out in 500 words or less the requested correction or amendment and the applicant’s reasons for disagreeing with the decision of the custodian.

(2) An applicant who elects to submit a statement of disagreement must submit the statement to the custodian within 30 days after the written notice of refusal has been given to the applicant under

section 13(5) or within any extended period under

section 15(3).

(3) On receiving the statement of disagreement, the custodian must (

a) if reasonably practicable, a ttach the statement to the record that is the subject of the requested correction or amendment, and (

b) provide a copy of the statement of disagreement to any person to whom the custodian has disclosed the record in the year preceding the applicant’s request for the correction or amendment. 1999 cH-4.8 s14

RSA 2000

Section 15

Chapter H-5 HEALTH INFORMATION ACT 20 Extending time 15(1) The custodian may extend the time for responding to a request under

section 8(1) or 13(1) for an additional period of up to 30 days or, with the Commissioner’s permission, for a longer period if (

a) the request does not give enough detail to enable the custodian to identify the record that is requested or to be corrected or amended, (

b) a large number of records are involved in the request and responding within the period set out in

section 12(1) or 13(2), as the case may be, would unreasonably interfere with the operations of the custodian, or (

c) more time is needed to consult with another custodian before deciding whether to grant access to a record or to make the correction or amendment requested.

(2) If the time is extended under subsection (1), the custodian must tell the applicant (

a) the reason for the extension, (

b) when a response can be expected, and (

c) that the applicant may make a complaint to the Commissioner about the extension.

(3) The Commissioner may extend the time within which an applicant must submit the statement of disagreement under

section 14(2) if in the opinion of the Commissioner (

a) it is unreasonable to expect the applicant to submit the statement within the period set out in

section 14(2), or (

b) it is fair to extend the time for any other reason. 1999 cH-4.8 s15 Request under s8 or s13 deemed to be a request under Access to Information Act or Protection of Privacy Act 16(1) If a written request is made under

section 8(1) for access to a record that contains information to which the Access to Information Act applies, the part of the request that relates to that information is deemed to be a request under

section 7(1) of the Access to Information Act and that Act applies to that part of the request as if it had been made under

section 7(1) of that Act.

(2) If a written request is made under

section 13(1) to correct or amend information to which the Protection of Privacy Act applies,

RSA 2000

Section 17

Chapter H-5 HEALTH INFORMATION ACT 21 the request is deemed to be a request under

section 7(1) of the Protection of Privacy Act and that Act applies to the request as if it had been made under

section 7(1) of that Act.

(3) This

section does not apply if the custodian that receives the request is not a public body as defined in the Protection of Privacy Act. RSA 2000 cH-5 s16;AR 141/2025 Existing procedures still available 17 An individual is not limited to the procedure set out in this Part to request access to health information about the individual if another procedure is available. 1999 cH-4.8 s17

Part 3 Collection of Health Information Prohibition re collection of health information 18 No custodian shall collect health information except in accordance with this Act. 1999 cH-4.8 s18 Collection of non-identifying health information 19 A custodian may collect non-identifying health information for any purpose. 1999 cH-4.8 s19 Collection of individually identifying health information 20 A custodian may collect individually identifying health information (

a) if the collection of that information is expressly authorized by an enactment of Alberta or Canada, or (

b) if that information relates directly to and is necessary to enable the custodian to carry out a purpose that is authorized under

section 27. 1999 cH-4.8 s20 Collection of personal health number 21(1) Only the following have the right to require an individual to provide the individual’s personal health number: (

a) custodians; (

b) persons authorized by the regulations to do so.

RSA 2000

Section 22

Chapter H-5 HEALTH INFORMATION ACT 22

(2) When requesting a personal health number from an individual, the person referred to in subsection (1) must advise the individual of the person’s authority under subsection (1).

(3) An individual may refuse to provide the individual’s personal health number where the person requesting it is not a person referred to in subsection (1). 1999 cH-4.8 s21 Duty to collect health information from subject individual 22(1) A custodian must collect individually identifying health information directly from the individual who is the subject of the information unless subsection (2) applies.

(2) A custodian may collect individually identifying health information from a person other than the individual who is the subject of the information in the following circumstances: (

a) where the individual who is the subject of the information authorizes collection of the information from someone else; (

b) where the individual who is the subject of the information is unable to provide the information and the custodian collects the information from a person referred to in

section 104(1)(

c) to (

i) who is acting on behalf of that individual; (

c) where the custodian believes, on reasonable grounds, that collection from the individual who is the subject of the information would prejudice (

i) the interests of the individual, (ii) the purposes of collection, or (iii) the safety of any other individual, or would result in the collec tion of inaccurate information; (

d) where collection from the individual who is the subject of the information is not reasonably practicable; (

e) where collection is for any of the following purposes: (

i) assembling a family or genetic history where the information collected is to be used in the context of providing a health service to the individual who is the subject of the information; (ii) determining the eligibility of an individual to participate in a program of or to receive a benefit, product or health

RSA 2000

Section 23

Chapter H-5 HEALTH INFORMATION ACT 23 service from a custodian and the information is collected in the course of processing an application made by or for the individual who is the subject of the information; (iii) verifying the eligibility of an individual who is participating in a program of or receiving a benefit, product or health service from a custodian to participate in the program or to receive the benefit, product or service; (iv) informing the Public Trustee or a Public Guardian about clients or potential clients; (e.1) where use of the inform ation is authorized by

section 27(1)(d); (e.2) where the custodian is conducting data matching for a purpose authorized under

section 27; (

f) where the information is available to the public; (

g) where disclosure of the information is authorized under

Part 5; (

h) where disclosure of the information is authorized by an enactment of Alberta or Canada.

(3) When collecting individually identifying health information about an individual directly from the individual, the custodian must take reasonable steps to inform the individual (

a) of the purpose for which the information is collected, (

b) of the specific legal authority for the collection, and (

c) of the title, business address and business telephone number of an affiliate of the custodian who can answer the individual’s questions about the collection. RSA 2000 cH-5 s22;2008 cA-4.2 s131;2009 c25 s3; 2020 c35 s39 Use of device to collect health information 23 A custodian that collects health information from an individual using any device that may not be visible to the individual must, before collecting the health information, obtain the written consent of the individual to use the device. RSA 2000 cH-5 s23;2020 c35 s40

RSA 2000

Section 24

Chapter H-5 HEALTH INFORMATION ACT 24 Collection of health information by affiliate 24 An affiliate of a custodian must not collect health information in any manner that is not in accordance with the affiliate’s duties to the custodian. 1999 cH-4.8 s24

Part 4 Use of Health Information Prohibition re use of health information 25 No custodian shall use health information except in accordance with this Act. 1999 cH-4.8 s25 Use of non-identifying health information 26 A custodian may use non-identifying health information for any purpose. 1999 cH-4.8 s26 Use of individually identifying health information 27(1) A custodian may use individually identifying health information in its custody or under its control for the following purposes: (

a) providing health services; (

b) determining or verifying the eligibility of an individual to receive a health service; (

c) conducting inves tigations, discipline proceedings, practice visits or inspections relating to the members of a health profession or health discipline; (

d) conducting research or performing data matching or other services to facilitate another person’s research (

i) if the custodian or researcher has submitted a proposed research protocol to a research ethics board in accordance with

section 49, (ii) if the research ethics boar d is satisfied as to the matters referred to in

section 50(1)(b), (iii) if the custodian or re searcher has complied with or undertaken to comply with the conditions, if any, suggested by the research ethics board, and (iv) where the research ethics board recommends that consents should be obtained from the individuals who

RSA 2000

Section 28

Chapter H-5 HEALTH INFORMATION ACT 25 are the subjects of the health information to be used in the research, if those consents have been obtained; (

e) providing for health services provider education; (

f) carrying out any purpose authorized by an enactment of Alberta or Canada; (

g) for internal management purposes, including planning, resource allocation, policy development, quality improvement, monitoring, audit, evaluation, reporting, obtaining or processing payment for health services and human resource management.

(2) A custodian referred to in

section 1(1)(f)(iii), (iv), (ix.1), (ix.2), (xii), (xii.1), (xii.2), (xii.3), (xiii), (xiii.1), (xiii.2) and (xiii.3) may, in addition, use individually identifying health information in its custody or under its control to carry out the following functions within the geographic area in which the custodian has jurisdiction to promote the objectives for which the custodian is responsible: (

a) planning and resource allocation; (

b) health system management; (

c) public health surveillance; (

d) health policy development. RSA 2000 cH-5 s27;2006 c18 s4;2009 c25 s4;2011 cH-7.2 s26; 2020 c35 s41;2023 c9 s11;2024 c10 s20;2025 c10 s25 Use of health information by affiliate 28 An affiliate of a custodian must not use health information in any manner that is not in accordance with the affiliate’s duties to the custodian. 1999 cH-4.8 s28 Confidentiality of non-recorded information 29 A custodian that collects information described in

section 1(1)(i), (

o) or (

u) that is not written, photographed, recorded or stored in some manner in a record may use the information only for the purpose for which the information was provided to the custodian. 1999 cH-4.8 s29

RSA 2000

Section 30

Chapter H-5 HEALTH INFORMATION ACT 26 Use of personal health number by non-custodian 30(1) A person who is authorized to require an individual to provide a personal health number pursuant to

section 21(1)(

b) may use that information only for the purpose for which the information was collected.

(2) If there is an inconsistency or conflict between subsection (1) and a provision of the Personal Information Protection Act, subsection (1) prevails to the extent of that inconsistency or conflict. RSA 2000 cH-5 s30;2020 c35 s42;AR 141/2025

Part 5 Disclosure of Health Information Division 1 General Disclosure Rules Prohibition re disclosure of health information 31 No custodian shall disclose health information except in accordance with this Act. 1999 cH-4.8 s31 Disclosure of non-identifying health information 32(1) A custodian may disclose non-identifying health information for any purpose.

(2) If a disclosure under subsection (1) is to a person that is not a custodian, the custodian must inform the person that the person must notify the Commissioner of an intention to use the information for data matching before performing the data matching. 1999 cH-4.8 s32 Disclosure of information to individual who is subject of information 33 A custodian may disclose individually identifying health information to the individual who is the subject of the information or to a person referred to in

section 104(1)(

c) to (

i) who is acting on behalf of that individual. 1999 cH-4.8 s33 Disclosure of individually identifying health information to be with consent 34(1) Subject to sections 35 to 40, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure.

RSA 2000

Section 35

Chapter H-5 HEALTH INFORMATION ACT 27

(2) A consent referred to in subsection (1) must be provided in writing or electronically and must include (

a) an authorization for the custodian to disclose the health information specified in the consent, (

b) the purpose for which the health information may be disclosed, (

c) the identity of the person to whom the health information may be disclosed, (

d) an acknowledgment that the individual providing the consent has been made aware of the reasons why the health information is needed and the risks and benefits to the individual of consenting or refusing to consent, (

e) the date the consent is effective and the date, if any, on which the consent expires, and (

f) a statement that the consen t may be revoked at any time by the individual providing it.

(3) A disclosure of health information pursuant to this

section must be carried out in accordance with the terms of the consent.

(4) A revocation of a consent must be provided in writing or electronically.

(5) A consent or revocation of a consent that is provided in writing must be signed by the person providing it.

(6) A consent or revocation of a consent that is provided electronically is valid only if it complies with the requirements set out in the regulations. 1999 cH-4.8 s34 Disclosure of diagnostic, treatment and care information 35(1) A custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information (

a) to another custodian for any or all of the purposes listed in

section 27(1) or (2), as the case may be, (a.1) to the government of Canada or of another province or territory of Canada for that government’s use for health system planning and management and health policy development where

RSA 2000

Section 35

Chapter H-5 HEALTH INFORMATION ACT 28 (

i) the individual is a resident of that other province or territory, or (ii) that government is otherwise responsible for payment for health services provided to the individual, (

b) to a person who is responsible for providing continuing treatment and care to the individual, (

c) to family members of the individual or to another person with whom the individual is believed to have a close personal relationship, if the information is given in general terms and concerns the presence, location, condition, diagnosis, progress and prognosis of the individual on the day on which the information is disclosed and the disclosure is not contrary to the express request of the individual, (

d) where an individual is injured, ill or deceased, so that family members of the individual or another person with whom the individual is believed to have a close personal relationship or a friend of the individual can be contacted, if the disclosure is not contrary to the express request of the individual, (d.1) where an individual is d eceased, to family members of the individual or to another person with whom the individual is believed to have had a close personal relationship, if the information relates to circumstances surrounding the death of the individual or to health services recently received by the individual and the disclosure is not contrary to the express request of the individual, (

e) to an official of a penal or other custodial institution in which the individual is being lawfully detained if the purpose of the disclosure is to allow the provision of health services or continuing treatment and care to the individual, (

f) to a person authorized to conduct an audit of the information if the person agrees in writing (

i) to destroy the information at the earliest opportunity after the audit is concluded, and (ii) not to disclose the information to any other person, except as required to accomplish the audit or to report unlawful or improper conduct by the custodian or a health services provider,

RSA 2000

Section 35

Chapter H-5 HEALTH INFORMATION ACT 29 (

g) to a committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of

section 9 of the Alberta Evidence Act, (

h) for the purpose of a court proceeding or a proceeding before a quasi-judicial body to which the custodian is a party, (

i) for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body having jurisdiction in Alberta to compel the production of information or with a rule of court binding in Alberta that relates to the production of information, (

j) repealed 2006 c18 s5; (

k) to another custodian where the custodian disclosing the information has a reasonable expectation that disclosure will detect or prevent fraud, limit abuse in the use of health services or prevent the commission of an offence under an enactment of Alberta or Canada, (

l) to an officer of the Legi slature if the information is necessary for the performance of the officer’s duties, (

m) to any person if the custodian believes, on reasonable grounds, that the disclosure will avert or minimize (

i) a risk of harm to the heal th or safety of a minor, or (ii) a significant risk of harm to the health or safety of any person, (

n) if that individual lacks the mental capacity to provide a consent and, in the opinion of the custodian, disclosure is in the best interests of the individual, (

o) to a descendant of a deceas ed individual, a person referred to in

section 104(1)(

c) to (

i) who is acting on behalf of the descendant or a person who is providing health services to the descendant if, in the custodian’s opinion, (

i) the disclosure is necessary to provide health services to the descendant, and (ii) the disclosure is restricted sufficiently to protect the privacy of the deceased individual, (

p) if the disclosure is authori zed or required by an enactment of Alberta or Canada,

RSA 2000

Section 36

Chapter H-5 HEALTH INFORMATION ACT 30 (

q) to its successor where the successor is a custodian, (

r) for the purpose of obtaining or processing payment for health services provided to the individual by a person that is required under a contract to pay for those services for that individual, or (

s) to the College of Physicians and Surgeons of Alberta for the purpose of administering the Physician Prescribing Practices Program or any program to monitor prescribing practices that replaces it.

(2) A committee to which health information is disclosed pursuant to subsection (1)(

g) must not disclose the information to any other person except in accordance with subsection (3).

(3) A committee referred to in subsection (2) may disclose non-identifying health information to another committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of

section 9 of the Alberta Evidence Act.

(4) A custodian may disclose individually identifying diagnostic, treatment and care information to a health professional body for the purpose of an investigation, a discipline proceeding, a practice visit or an inspection if (

a) the custodian has complie d with any other enactment authorizing or requiring the custodian to disclose that information for that purpose, and (

b) the health professional body agrees in writing (

i) not to disclose the information to any other person except as authorized by or under the Act governing the health professional body, and (ii) repealed 2006 c18 s5.

(5) A custodian may disclose individually identifying diagnostic, treatment and care information to a health professional body for the purpose of lodging a complaint with the health professional body. RSA 2000 cH-5 s35;2003 c23 s2;2006 c18 s5;2009 c25 s5; 2013 cC-12.5 s15;2016 c18 s8;2020 c35 s43 Disclosure of registration information 36 A custodian may disclose individually identifying registration information without the consent of the individual who is the subject of the information

RSA 2000

Section 37.1

Chapter H-5 HEALTH INFORMATION ACT 31 (

a) for any of the purposes for which diagnostic, treatment and care information may be disclosed under

section 35(1), (4) or (5), (

b) to any person for the purpos e of collecting or processing a fine or debt owing by the individual to the Government of Alberta or to a custodian, or (

c) to a person who is not a custodian if the disclosure is in accordance with the requirements set out in the regulations. RSA 2000 cH-5 s36;2020 c35 s44 37 Repealed 2009 c25 s6. Disclosure to prevent or limit fraud or abuse of health services 37.1(1) A custodian may disclose individually identifying health information referred to in subsection (2) without the consent of the individual who is the subject of the information to a police service or the Minister of Justice where the custodian reasonably believes (

a) that the information relates to the possible commission of an offence under a statute or regulation of Alberta or Canada, and (

b) that the disclosure will detect or prevent fraud or limit abuse in the use of health services.

(2) A custodian may disclose the following information under subsection (1): (

a) the name of an individual; (

b) the date of birth of an individual; (

c) the personal health number of an individual; (

d) the nature of any injury or illness of an individual; (

e) the date on which a health service was sought or received by an individual; (

f) the location where an indivi dual sought or received a health service; (

g) the name of any drug, as defined in the Pharmacy and Drug Act, provided to or prescribed for an individual and the date the drug was provided or prescribed;

RSA 2000

Section 37.3

Chapter H-5 HEALTH INFORMATION ACT 32 (

h) information specified in

section 1(1)(i)(ii) about a health services provider who provided a health service to an individual referred to in subsection (1). (3),

(4) Repealed 2009 c25 s7. RSA 2000 cP-13 s47.1;2006 c18 s7;2009 c25 s7; 2013 c10 s34;2022 c21 s37 37.2 Repealed 2009 c25 s8. Disclosure to protect public health and safety 37.3(1) A custodian may disclose individually identifying health information referred to in subsection (2) without the consent of the individual who is the subject of the information to a police service or the Minister of Justice where the custodian reasonably believes (

a) that the information relates to the possible commission of an offence under a statute or regulation of Alberta or Canada, and (

b) that the disclosure will protect the health and safety of Albertans.

(2) A custodian may disclose the following information under subsection (1): (

a) the name of an individual; (

b) the date of birth of an individual; (

c) the nature of any injury or illness of an individual; (

d) the date on which a health service was sought or received by an individual; (

e) the location where an indivi dual sought or received a health service; (

f) whether any samples of bodily substances were taken from an individual; (

g) information specified in

section 1(1)(i)(ii) about a health services provider who provided a health service to an individual referred to in subsection (1). (3),

(4) Repealed 2009 c25 s9. 2006 c18 s7;2009 c25 s9;2013 c10 s34;2022 c21 s37

RSA 2000

Section 38

Chapter H-5 HEALTH INFORMATION ACT 33 Disclosure for purpose of storage 38 A custodian may disclose individually identifying health information without the consent of the individual who is the subject of the information to the Provincial Archives of Alberta or to any other archives that is subject to this Act, the Access to Information Act or the Protection of Privacy Act, for the purposes of permanent preservation and historical research if, in the opinion of the custodian, the information has enduring value.

RSA 2000 cH-5 s38;AR 141/2025 Disclosure by Minister and Department 39(1) A ministerial custodian or departmental custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information to another Minister of the Government of Alberta for the purpose of developing public policy.

(2) A ministerial custodian or departmental custodian may enter into an agreement with (

a) another Minister of the Government of Alberta or a Minister of the Government of Canada or of any other province or territory, or (

b) a person or entity in accordance with the regulations made pursuant to the Alberta Health Care Insurance Act, respecting the disclosure to the person referred to in clause (

a) or (b), as the case may be, of individually identifying registration information without the consent of the individual who is the subject of the information. RSA 2000 cH-5 s39;2024 c10 s20;2025 c10 s25 Disclosure to ministerial custodian 40 A custodian other than a ministerial custodian may disclose individually identifying health information to a ministerial custodian without the consent of the individual who is the subject of the information if the disclosure is necessary or desirable in the opinion of the custodian to enable the ministerial custodian to carry out its duties.

RSA 2000 cH-5 s40;2024 c10 s20;2025 c10 s25 Maintaining certain disclosure information 41(1) Subject to subsection (1.1), a custodian that discloses a record containing individually identifying diagnostic, treatment and care information under

section 35(1), (4) or (5) must make a note of the following information:

RSA 2000

Section 42

Chapter H-5 HEALTH INFORMATION ACT 34 (

a) the name of the person to whom the custodian discloses the information; (

b) the date and purpose of the disclosure; (

c) a description of the information disclosed.

(1.1) The requirement to make a note under subsection (1) does not apply to a custodian that permits other custodians electronic access to individually identifying diagnostic, treatment and care information stored in an electronic system if, when the information is disclosed, the electronic system automatically keeps an electronic log of the following information: (

a) a name or number that identifies the custodian to whom the information is disclosed; (

b) the date and time that the information is disclosed; (

c) a description of the information that is disclosed.

(2) The information referred to in subsections (1) and (1.1) must be retained by the custodian for a period of 10 years following the date of the disclosure.

(3) An individual who is the subject of information referred to in subsection (1) or (1.1) may ask a custodian for access to and a copy of the information, and

Part 2 applies to the request. RSA 2000 cH-5 s41;2006 c18 s8;2009 c25 s10;2016 c18 s8; 2020 c35 s45 Notification of purpose of and authority for disclosure 42(1) A custodian that discloses individually identifying diagnostic, treatment and care information must inform the recipient in writing of the purpose of the disclosure and the authority under which the disclosure is made. (2) Subsection (1) does not apply where the disclosure is (

a) to another custodian under

section 35(1)(a), (

b) to a ministerial custodian or departmental custodian under

section 46, (

c) to another custodian under

section 47, (

d) to a police service or the Mi nister of Justice under

section 37.1, 37.2 or 37.3, or (

e) to the individual who is the subject of the information. RSA 2000 cH-5 s42;2006 c18 s9;2013 c10 s34;2022 c21 s37; 2024 c10 s20;2025 c10 s25

RSA 2000

Section 43

Chapter H-5 HEALTH INFORMATION ACT 35 Disclosure of health information by affiliate 43 An affiliate of a custodian must not disclose health information in any manner that is not in accordance with the affiliate’s duties to the custodian. 1999 cH-4.8 s43 Confidentiality of non-recorded information 44 A custodian that collects information described in

section 1(1)(i), (

o) or (

u) that is not written, photographed, recorded or stored in some manner in a record may disclose the information only for the purpose for which the information was provided to the custodian. 1999 cH-4.8 s44 Duty of custodian 45 A custodian that discloses health information must make a reasonable effort to ensure that the person to whom the disclosure is made is the person intended and authorized to receive the information. 1999 cH-4.8 s45 Division 2 Disclosure for Health System Purposes Disclosure to Minister or Department 46(1) A ministerial custodian or departmental custodian may request another custodian to disclose individually identifying health information to them for any of the purposes listed in

section 27(2) if (

a) the ministerial custodian or departmental custodian, as the case may be, is authorized by an enactment of Alberta or Canada to obtain the information from the other custodian, or (

b) the information requested relates to a health service provided by the other custodian and (

i) the health service is fully or partially paid for by the department of the ministerial custodian requesting the information or by the departmental custodian, as the case may be, or is provided using financial, physical or human resources provided, administered or paid for by the department of the ministerial custodian requesting the information or by the departmental custodian, as the case may be, or

RSA 2000

Section 47

Chapter H-5 HEALTH INFORMATION ACT 36 (ii) the information is prescribed in the regulations as information a ministerial custodian or departmental custodian may request under this section.

(2) If the requirements of subsection (1) are met, the custodian must disclose the information to the ministerial custodian or departmental custodian, as the case may be.

(3) Repealed 2009 c25 s11.

(4) Individually identifying health information may be disclosed under this

section without the consent of the individual who is the subject of the information.

(5) Where health information is requested under subsection (1)(b), the departmental custodian (

a) must prepare a privacy im pact assessment describing how disclosure of the health information may affect the privacy of the individual who is the subject of the information, and submit the privacy impact assessment to the Commissioner for review and comment, and (

b) must consider the comments of the Commissioner, if any, made in response to the privacy impact assessment before disclosing the health information to a custodian referred to in

section 1(1)(f)(iii) or (iv). RSA 2000 cH-5 s46;2006 c18 s10;2009 c25 s11;2024 c10 s20; 2025 c10 s25 Disclosure to other custodians 47(1) A custodian referred to in

section 1(1)(f)(iii) or (iv) may request another custodian to disclose to the requesting custodian individually identifying health information for any of the purposes listed in

section 27(2) (

a) if the requesting custodian is authorized by an enactment of Alberta or Canada to obtain the information from the other custodian, or (

b) if the information requested relates to a health service provided by the other custodian (

i) that is fully or partially paid for by the requesting custodian, or (ii) that is provided using financial, physical or human resources provided or administered by the requesting custodian.

RSA 2000

Section 49

Chapter H-5 HEALTH INFORMATION ACT 37

(2) Where a request relates to information described in subsection (1)(b), the custodian receiving the request may refuse to disclose the information if disclosure could reasonably be expected (

a) to result in immediate and grave harm to the mental or physical health or safety of the individual who is the subject of the information, (

b) to threaten the mental or phys ical health or safety of another individual, or (

c) to pose a threat to public safety.

(3) If a custodian refuses to disclose information in accordance with subsection (2), (

a) the custodian must provide the requesting custodian with non-identifying health information in the form requested by that custodian, and (

b) the requesting custodian may ask for a review of that refusal by the Commissioner.

(4) In making a decision on a review under subsection (3)(b), the Commissioner must, if the custodian is a member of a health professional body, inform the health professional body of the review and provide an opportunity for that body to make comments to the Commissioner relating to the review.

(5) Repealed 2009 c25 s12.

(6) Individually identifying health information may be disclosed under this

section without the consent of the individual who is the subject of the information. RSA 2000 cH-5 s47;2009 c25 s12;2020 c35 s46 Division 3 Research 48 Repealed 2009 c25 s13. Proposed research protocol 49 A person who intends to conduct research using health information in the custody or under the control of a custodian or health information repository must submit a proposed research protocol to a research ethics board for review by that board containing (

a) the information specified by the regulations, and

RSA 2000

Section 50

Chapter H-5 HEALTH INFORMATION ACT 38 (

b) any other information required by the research ethics board. RSA 2000 cH-5 s49;2006 c18 s11;2009 c25 s14; 2020 c35 s48 Role of research ethics board 50(1) The research ethics board must (

a) consider whether the researcher should be required to obtain consents for the disclosure of the health information to be used in the research from the individuals who are the subjects of the information, and (

b) assess whether, in the opinion of the research ethics board, (

i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest in protecting the privacy of the individuals who are the subjects of the health information to be used in the research, (ii) the researcher is qualif ied to carry out the research, (iii) adequate safeguards w ill be in place at the time the research will be carried out to protect the privacy of the individuals who are the subjects of the health information to be used in the research and the confidentiality of that information, and (iv) obtaining the consents referred to in clause (

a) is unreasonable, impractical or not feasible.

(2) In making an assessment under subsection (1)(b), the research ethics board must consider the degree to which the proposed research may contribute to (

a) identification, prevention or treatment of illness or disease, (

b) scientific understanding relating to health, (

c) promotion and protection of the health of individuals and communities, (

d) improved delivery of health services, or (

e) improvements in health system management.

(3) The research ethics board must prepare a response setting out (

a) its recommendation under subsection (1)(a),

RSA 2000

Section 50.1

Chapter H-5 HEALTH INFORMATION ACT 39 (

b) its assessment of the matters set out in subsection (1)(b), and (

c) any conditions that the re search ethics board considers should be imposed on the researcher.

(4) The research ethics board must send a copy of the response required in subsection (3) to the Commissioner. RSA 2000 cH-5 s50;2006 c18 s12 Publication of response 50.1 If the response of the research ethics board sent to the Commissioner under

section 50(4) indicates that the research ethics board is satisfied as to the matters referred to in

section 50(1)(b), the Commissioner may publish the response in any manner the Commissioner considers appropriate. 2006 c18 s13 Bar to research 51 If the research ethics board is not satisfied as to any of the matters referred to in

section 50(1)(b), the researcher may not apply to a custodian or health information repository under

section 52. RSA 2000 cH-5 s51;2006 c18 s14;2009 c25 s15 Application for disclosure of health information or to perform data matching 52 If the research ethics board is satisfied as to the matters referred to in

section 50(1)(b), the researcher may forward to one or more custodians or health information repositories (

a) the researcher’s research protocol referred to in

section 49, (

b) the response of the research ethics board to the researcher’s research protocol, and (

c) a written application for one or more of the following: (

i) disclosure of the health information to be used in the research; (ii) performance of data matching; (iii) performance of any other service to facilitate the research. RSA 2000 cH-5 s52;2006 c18 s14;2009 c25 s16; 2020 c35 s49 Conditions and consents 53(1) A custodian who has received the documents referred to in

section 52 may, but is not required to, disclose the health

RSA 2000

Section 54

Chapter H-5 HEALTH INFORMATION ACT 40 information or perform data matching or other services to facilitate the research.

(2) If the custodian decides to disclose the health information or perform data matching or other services to facilitate the research, (

a) the custodian (

i) must impose on the rese archer the conditions suggested by the research ethics board, and (ii) may impose other conditions on the researcher, and (

b) if the research ethics bo ard recommended that consents referred to in

section 50(1)(

a) be obtained, the researcher must obtain the consents before the disclosure of the health information or performance of data matching or other services.

(3) A health information repository that has received the documents referred to in

section 52 may disclose the health information or perform data matching or other services to facilitate the research only in accordance with the regulations. RSA 2000 cH-5 s53;2006 c18 s14;2009 c25 s17 Agreement between custodian and researcher 54(1) If the custodian decides to disclose health information to a researcher or perform data matching or other services to facilitate the research, the researcher must enter into an agreement with the custodian in which the researcher agrees (

a) to comply with (

i) this Act and the regulations made under this Act, (ii) any conditions imposed by the custodian relating to the use, protection, disclosure, return or disposal of the health information, and (iii) any requirement imposed by the custodian to provide safeguards against the identification, direct or indirect, of an individual who is the subject of the health information, (

b) to use the health information only for the purpose of conducting the research in accordance with the research protocol,

RSA 2000

Section 54

Chapter H-5 HEALTH INFORMATION ACT 41 (

c) not to publish the health information in a form that could reasonably enable the identity of an individual who is the subject of the information to be readily ascertained, (

d) not to make any attempt to contact an individual who is the subject of the health information to obtain additional health information unless the individual has provided the custodian with the consent referred to in

section 55, (

e) to allow the custodian to access or inspect the researcher’s premises to confirm that the researcher is complying with the enactments, conditions and requirements referred to in clause (a), and (

f) to pay the costs referred to in subsection (3).

(2) When an agreement referred to in subsection (1) has been entered into, the custodian may disclose to the researcher the health information requested under

section 52 or perform data matching or other services to facilitate the research (

a) with the consent of the individuals who are the subjects of the information, where the research ethics board recommends that consents should be obtained, or (

b) without the consent of the individuals who are the subjects of the information, where the research ethics board does not recommend that consents be obtained.

(3) The custodian may set the costs of (

a) preparing information for disclosure, or performing data matching or other services (

b) making copies of health information, and (

c) obtaining the consents referred to in

section 55, which must not exceed the actual cost of providing that service.

(3.1) A researcher that enters into an agreement under this

section must (

a) comply with the terms and conditions of the agreement and the conditions set out in the research ethics board’s response to the research protocol, and (

b) collect, use and disclose health information only in accordance with the agreement and the research protocol.

RSA 2000

Section 55

Chapter H-5 HEALTH INFORMATION ACT 42

(4) If a researcher contravenes or fails to comply with the terms and conditions of an agreement under this section, or the conditions set out in the research ethics board’s response to the research protocol, (

a) the agreement is cancelled, and (

b) the researcher is no longer authorized to use the health information for any purpose and must destroy the health information or return it to the custodian. RSA 2000 cH-5 s54;2006 c18 s14;2009 c25 s18; 2020 c35 s50 Consent for additional information 55 If the researcher wishes to contact the individuals who are the subjects of the information disclosed under

section 54(2) to obtain additional health information, the custodian or an affiliate of the custodian must first obtain consents from those individuals to their being contacted for that purpose. 1999 cH-4.8 s55 Court order 56(1) If a researcher refuses to allow a custodian or health information repository to access or inspect its premises in accordance with the agreement referred to in

section 54, the custodian or health information repository may apply to the Court of King’s Bench for an order under subsection (2).

(2) If the Court is satisfied that there are reasonable and probable grounds to believe that access to premises or the production or removal of documents is necessary for the purpose of determining whether an agreement referred to in

section 54 is being complied with, the Court may make any order it considers necessary to enforce compliance with the agreement.

(3) Where authorized to do so by an order under subsection (2), a custodian or health information repository may (

a) enter and search any premises of the researcher where the research is conducted, (

b) operate or cause to be operated any computer system of the researcher to search any data contained in or available to the system and produce a document from the data, and (

c) seize and make copies of any documents of the researcher that are or may be relevant to the investigation.

(4) An application for an order under this

section may be made ex parte unless the Court orders otherwise.

RSA 2000

Section 56.1

Chapter H-5 HEALTH INFORMATION ACT 43

(5) The custodian or health information repository must return any documents seized pursuant to a court order within 60 days after the conclusion of the investigation that gave rise to the seizure, including any hearing or appeal.

(6) In this section, “document” includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microfilm, sound recording, videotape, machine readable record or other material or thing, regardless of physical form or characteristics. RSA 2000 cH-5 s56;2009 c25 s19;2009 c53 s77; AR 217/2022

Part 5.1 Alberta Electronic Health Record

Definitions 56.1 In this Part, (a) “Alberta EHR” means the integrated electronic health information system established to provide shared access to health information in a secure environment as may be further defined or described in the regulations; (b) “authorized custodian” means (

i) a custodian referred to in

section 1(1)(f)(iii), (iv), (xii), (xii.1), (xii.2), (xiii), (xiii.1) or (xiii.2), and (ii) any other custodian that meets the eligibility requirements of the regulations to be an authorized custodian; (

c) repealed 2020 c35 s51; (d) “regulated health professi onal” means a regulated member under the Health Professions Act. 2009 c25 s20;2016 c9 s26;2016 c18 s8;2023 c9 s11;2024 c10 s20; 2025 c10 s25;2020 c35 s51 Purpose 56.2(1) The purpose of this

Part is to enable access to and use of health information via the Alberta EHR.

(2) Only the health information that is of a class or type prescribed by the regulations may be accessible via the Alberta EHR.

RSA 2000

Section 56.21

Chapter H-5 HEALTH INFORMATION ACT 44

(3) Unless otherwise specified, nothing in this Part affects the application or operation of any provision in another Part of this Act respecting collection, use or disclosure of health information. 2009 c25 s20;2020 c35 s52 Department authorities and duties re Alberta EHR 56.21(1) The Department shall manage and operate the Alberta EHR.

(2) For the purpose of fulfilling the duties under subsection (1), the Department shall do all of the following: (

a) take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will protect the confidentiality and security of health information accessible via the Alberta EHR and the privacy of the individuals who are the subjects of that information; (

b) determine eligibility for a ccess to the Alberta EHR, grant access to the Alberta EHR, and limit, revoke or prohibit access by authorized custodians and their affiliates and other authorized users to the Alberta EHR and health information accessible via the Alberta EHR, in accordance with the regulations; (

c) respond to access requests under

section 56.6 or 56.61 for health information accessible via the Alberta EHR, in accordance with the regulations, if any; (

d) provide reports to authorized custodians and other authorized users related to their access to the Alberta EHR and to authorized custodians related to the access to the Alberta EHR by their affiliates.

(3) For the purpose of fulfilling the duties under subsection (1), the Department may do any or all of the following: (

a) in accordance with the re gulations, audit and investigate matters relating to the Alberta EHR in respect of (

i) unauthorized access to, use or disclosure of health information accessible via the Alberta EHR, (ii) data integrity, (iii) patient safety, or (iv) other matters prescribed in the regulations;

RSA 2000

Section 56.3

Chapter H-5 HEALTH INFORMATION ACT 45 (

b) subject to subsection (4) and in accordance with the regulations, provide access to health information accessible via the Alberta EHR to a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner; (

c) provide access, in accordance w ith the regulations, if any, to health information accessible via the Alberta EHR to a health services provider who provides a health service outside Alberta to a resident of Alberta for the purposes of providing continuing treatment and care; (

d) exercise any other power, duty or function that the Department considers necessary in order to manage and operate the Alberta EHR.

(4) The Department may provide a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner with access to health information accessible via the Alberta EHR for the purpose of conducting investigations under the Fatality Inquiries Act, only if (

a) the Office of the Chief Medical Examiner has submitted a privacy impact assessment respecting the access to the Commissioner, and (

b) the medical examiner with the Office of the Chief Medical Examiner and the staff working under the direction of a medical examiner meet all eligibility requirements and obligations imposed by the regulations.

(5) For greater certainty, the Department is not an information manager for authorized custodians by virtue of managing and operating the Alberta EHR. 2020 c35 s53 Making health information accessible 56.3(1) The health professional body of a regulated health professional may in writing direct the regulated health professional to make health information that is in the custody or under the control of the regulated health professional accessible via the Alberta EHR in accordance with the regulations.

(2) If (

a) the Minister or the Minister of Mental Health and Addiction determines that it is in the public interest to have certain health information that is in the custody or under the control

RSA 2000

Section 56.3

Chapter H-5 HEALTH INFORMATION ACT 46 of one or more regulated health professionals made accessible via the Alberta EHR, and (

b) the health professional body of the regulated health professionals has not directed the regulated health professionals to make that health information accessible via the Alberta EHR, the Minister or the Minister of Mental Health and Addiction may, subject to subsection (3), in writing direct the regulated health professionals to make the health information accessible via the Alberta EHR in accordance with the regulations.

(3) Before giving a direction under subsection (2), the Minister or the Minister of Mental Health and Addiction must (

a) consult with the health professional body referred to in subsection (2)(b), (

b) prepare a privacy impact assessment describing how making the health information accessible via the Alberta EHR may affect the privacy of the individual who is the subject of the information and submit the privacy impact assessment to the Commissioner for review and comment, and (

c) consider the comments of the Commissioner, if any, made in response to the privacy impact assessment.

(4) A failure by a regulated health professional to comply with a direction of the health professional body under subsection (1) or of a Minister under subsection (2) constitutes unprofessional conduct by the regulated health professional under the Health Professions Act.

(5) An authorized custodian may make the health information prescribed in the regulations that is in its custody or under its control accessible via the Alberta EHR in accordance with the regulations.

(6) An authorized custodian, other than a regulated health professional, must, if the Minister or the Minister of Mental Health and Addiction requests in writing, make the health information prescribed in the regulations that is in its custody or under its control accessible via the Alberta EHR in accordance with the regulations.

(7) The making of health information accessible pursuant to this

section does not (

a) constitute a disclosure of that information by any person, or

RSA 2000

Section 56.4

Chapter H-5 HEALTH INFORMATION ACT 47 (

b) require the consent of the in dividual who is the subject of the information. 2009 c25 s20;2016 c9 s26;2016 c18 s8;2023 c9 s11;2024 c10 s20; 2020 c35 s54 Duties in making health information accessible via Alberta EHR 56.4(1) In deciding how much health information to make accessible via the Alberta EHR, a regulated health professional or an authorized custodian must consider as an important factor any expressed wishes of the individual who is the subject of the health information relating to access to that information, together with any other factors the regulated health professional or authorized custodian considers important.

(2) If a regulated health professional or an authorized custodian decides to limit the health information that is to be made accessible via the Alberta EHR under subsection (1), it must impose the limitations in accordance with the regulations. 2009 c25 s20;2020 c35 s55 Accessing health information via the Alberta EHR 56.5(1) Subject to the regulations, an authorized custodian may access health information via the Alberta EHR for all the purposes and functions for which that authorized custodian may use health information under

section 27.

(2) A medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner may access health information via the Alberta EHR only for the purpose of conducting investigations under the Fatality Inquiries Act.

(3) The use of health information that is accessed via the Alberta EHR does not constitute collection of that information under this Act.

(4) The use of health information that is accessed via the Alberta EHR does not constitute disclosure of that information by any person under this Act.

(5) For greater certainty, if the Department grants access to the Alberta EHR to other authorized users outside Alberta in accordance with the regulations, the accessing of health information via the Alberta EHR by an authorized user outside Alberta does not constitute disclosure of that information by any person under this Act. 2009 c25 s20;2020 c35 s56 56.51 Repealed RSA 2000 cH-5 s56.51.

RSA 2000

Section 56.6

Chapter H-5 HEALTH INFORMATION ACT 48 Maintaining record of Alberta EHR access 56.6(1) The Department must keep an electronic log of the following for each time the Alberta EHR is accessed: (

a) the name or number that iden tifies the authorized custodian or other authorized user who accessed the Alberta EHR; (

b) the date and time that the Alberta EHR was accessed; (

c) a description of the health information that was accessed; (

d) any other information prescribed in the regulations.

(2) The information referred to in subsection (1) must be retained by the Department for a period of 10 years following the date of the access.

(3) An individual who is the subject of information referred to in subsection (1) may ask the Department for access to and a copy of the information, and

Part 2 applies to the request.

(4) If, pursuant to subsection (3), an individual asks the Department for access to and a copy of the information referred to in subsection (1), the Department must, in accordance with

Part 2, provide that information in respect of all authorized custodians and other authorized users who have accessed that individual’s health information pursuant to this Part. 2009 c25 s20;2020 c35 s58 Access request for health information accessible via the Alberta EHR 56.61(1) An individual may make a request to access the individual’s health information accessible via the Alberta EHR (

a) to an authorized custodian who (

i) is a health services provider described in

section 1(1)(f)(ix), and (ii) has provided health services to the individual, or (

b) to a custodian described in

section 1(1)(f)(iv) and

Part 2 applies in respect of the request.

(2) If an authorized custodian or a custodian described in

section 1(1)(f)(iv) responds that it is unable to provide access to health information requested by an individual under subsection (1), the

RSA 2000

Section 56.62

Chapter H-5 HEALTH INFORMATION ACT 49 individual may make a request to the Department for access to the individual’s health information accessible via the Alberta EHR, and

Part 2 applies in respect of the request. 2020 c35 s59 Authorized custodian duties, authority 56.62 An authorized custodian shall (

a) comply with an audit or investigation conducted by the Department in respect of the Alberta EHR, and (

b) carry out any duty or function specified in the regulations. 2020 c35 s59 Multi-disciplinary data stewardship committee 56.7(1) The Minister shall establish a multi-disciplinary data stewardship committee.

(1.1) The function of the multi-disciplinary data stewardship committee is to provide advice and make recommendations to the Minister and the Department respecting the Alberta EHR.

(2) At least 2 members of the multi-disciplinary data stewardship committee must be members of the public.

(3) Section 7(2) to (5) of the Government Organization Act apply with respect to the multi-disciplinary data stewardship committee. 2009 c25 s20;2020 c35 s60 Termination of agreement and protocol 56.71(1) Despite any other provision of this Act or regulations or any information manager agreements entered into under

section 3(1)(

d) of the Alberta Electronic Health Record Regulation (AR 118/2010) or entered into with custodians described in

section 3(3) of that regulation or the Alberta Netcare Electronic Health Record Information Exchange Protocol referred to in those information manager agreements, the Department may access and use health information that is accessible via the Alberta EHR for any purpose or function that is authorized by

section 27.

(2) All information manager agreements entered into under

section 3(1)(

d) of the Alberta Electronic Health Record Regulation (AR 118/2010) or entered into with custodians described in

section 3(3) of that regulation and the Alberta Netcare Electronic Health Record Information Exchange Protocol referred to in those information manager agreements are terminated effective on the coming into force of this subsection. (3) Subsection (1) is repealed on Proclamation. 2020 c35 s61

RSA 2000

Section 56.8

Chapter H-5 HEALTH INFORMATION ACT 50 Regulations 56.8(1) The Lieutenant Governor in Council may make regulations (

a) defining or otherwise describing the Alberta EHR; (

b) respecting the eligibility requirements for a custodian to become and remain an authorized custodian for the purposes of this Part, including, without limitation, regulations requiring an authorized custodian to enter into an agreement with respect to the authorized custodian’s powers, duties and functions under this Part; (

c) prescribing classes or types of health information that may or must be made accessible via the Alberta EHR; (c.1) respecting administrative, technical and physical safeguards in respect of the health information accessible via the Alberta EHR; (

d) respecting the manner in which a regulated health professional or an authorized custodian may or must make health information prescribed in the regulations that is in its custody or under its control accessible via the Alberta EHR; (d.1) respecting the granting of access to the Alberta EHR, including, without limitation, respecting eligibility for access to the Alberta EHR; (

e) respecting the purposes and functions for which an authorized custodian may access and use health information via the Alberta EHR; (

f) respecting the governance, operation, management and structure of the Alberta EHR, including, without limitation, regulations (

i) repealed 2020 c35 s62, (ii) respecting the powers, duties and functions of the Department; (

g) respecting the procedures, systems and safeguards that an authorized custodian must maintain in respect of health information that is accessible via the Alberta EHR; (g.1) respecting the manner in which a regulated health professional or an authorized custodian may limit the health information that is to be made accessible via the Alberta EHR;

RSA 2000

Section 56.8

Chapter H-5 HEALTH INFORMATION ACT 51 (g.2) respecting access to the Al berta EHR by a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner or by a health services provider outside of Alberta to provide continuing treatment and care to an individual who is a resident of Alberta; (g.3) limiting, revoking or prohibiting (

i) access to the Alberta EHR by an authorized custodian or its affiliate, a medical examiner with the Office of the Chief Medical Examiner or staff working under the direction of a medical examiner, or by a health services provider outside of Alberta providing continuing treatment and care to an individual who is a resident of Alberta, or (ii) use of health informa tion accessible via the Alberta EHR by an authorized custodian or its affiliate, by a medical examiner with the Office of the Chief Medical Examiner or staff working under the direction of a medical examiner, or by a health services provider outside of Alberta providing continuing treatment and care to an individual who is a resident of Alberta; (g.4) respecting technical or security standards, specifications or requirements in respect of the Alberta EHR, including, without limitation, interoperability specifications and standards; (g.5) respecting electronic loggi ng for the purposes of

section 56.6 and reporting in respect of the logging; (g.6) respecting access requests under sections 56.6 and 56.61 for health information accessible via the Alberta EHR; (g.7) respecting the reasons for wh ich an authorized custodian is unable to provide access to health information requested by an individual; (

h) respecting the audit or investigation of any matter related to the Alberta EHR, including, without limitation, regulations (

i) setting out or establishing an auditing regime, and (ii) setting out powers and duties to be exercised concerning audits and investigations;

RSA 2000

Section 57

Chapter H-5 HEALTH INFORMATION ACT 52 (

i) respecting any other matter the Lieutenant Governor in Council considers necessary or advisable to carry out the intent of this Part.

(2) A regulation made under subsection (1) may incorporate, adopt or declare in force a code, standard, guideline,

schedule or body of rules, including a code, standard, guideline,

schedule or body of rules developed by the Minister, relating to any matter in respect of which a regulation may be made under subsection (1).

(3) Where a code, standard, guideline,

schedule or body of rules is incorporated, adopted or declared in force by a regulation made under subsection (1), the Minister shall ensure that a copy of the code, standard, guideline,

schedule or body of rules is readily available to the public.

(4) The Regulations Act does not apply to a code, standard, guideline,

schedule or body of rules incorporated, adopted or declared in force by a regulation made under subsection (1).

(5) A code, standard, guideline,

schedule or body of rules may be incorporated, adopted or declared in force by a regulation made under subsection (1) (

a) in whole or in part or with modifications, and (

b) as it reads on a specific day or as amended from time to time. 2009 c25 s20;2020 c35 s62

Part 6 Duties and Powers of Custodians Relating to Health Information Division 1 General Duties and Powers Duty to collect, use or disclose health information with highest degree of anonymity possible 57(1) In this section, “aggregate health information” means non-identifying health information about groups of individuals.

(2) A custodian that intends to collect, use or disclose health information must first consider whether collection, use or disclosure of aggregate health information is adequate for the intended purpose, and if so, the custodian must collect, use or disclose only aggregate health information.

RSA 2000

Section 58

Chapter H-5 HEALTH INFORMATION ACT 53

(3) If the custodian believes that collecting, using or disclosing aggregate health information is not adequate for the custodian’s intended purpose, the custodian must then consider whether collection, use or disclosure of other non-identifying health information is adequate for the intended purpose, and if so, the custodian may collect, use or disclose other non-identifying health information.

(4) If the custodian believes that collecting, using or disclosing aggregate and other non-identifying health information is not adequate for the custodian’s intended purpose, the custodian may collect, use or disclose individually identifying health information if the collection, use or disclosure (

a) is authorized by this Act, and (

b) is carried out in accordance with this Act.

(5) This

section does not apply where the collection, use or disclosure is for the purpose of (

a) providing health services, or (

b) determining or verifying the eligibility of an individual to receive a health service. 1999 cH-4.8 s57 Duty to collect, use or disclose health information in a limited manner 58(1) When collecting, using or disclosing health information, a custodian must, in addition to complying with

section 57, collect, use or disclose only the amount of health information that is essential to enable the custodian or the recipient of the information, as the case may be, to carry out the intended purpose.

(2) In deciding how much health information to disclose, a custodian must consider as an important factor any expressed wishes of the individual who is the subject of the information relating to disclosure of the information, together with any other factors the custodian considers relevant. 1999 cH-4.8 s58 59 Repealed 2003 c23 s3. Duty to protect health information 60(1) A custodian must take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will

RSA 2000

Section 60.1

Chapter H-5 HEALTH INFORMATION ACT 54 (

a) protect the confidentiality of health information that is in its custody or under its control and the privacy of the individuals who are the subjects of that information, (

b) protect the confidentiality of health information that is to be stored or used in a jurisdiction outside Alberta or that is to be disclosed by the custodian to a person in a jurisdiction outside Alberta and the privacy of the individuals who are the subjects of that information, (

c) protect against any reasonably anticipated (

i) threat or hazard to the security or integrity of the health information or of loss of the health information, or (ii) unauthorized use, disclosure or modification of the health information or unauthorized access to the health information, and (

d) otherwise ensure compliance with this Act by the custodian and its affiliates.

(2) The safeguards to be maintained under subsection (1) must include appropriate measures (

a) for the security and conf identiality of records, which measures must address the risks associated with electronic health records, and (

b) for the proper disposal of records to prevent any reasonably anticipated unauthorized use or disclosure of the health information or unauthorized access to the health information following its disposal.

(3) In subsection (2)(a), “electronic health records” means records of health information in electronic form. RSA 2000 cH-5 s60;2003 c23 s4 Duty to notify 60.1(1) Subject to the regulations, an affiliate of a custodian must as soon as practicable notify the custodian in accordance with the regulations of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in the custody or control of the custodian.

(2) Subject to the regulations, subsections (4) and (5) and

section 85.1, a custodian must as soon as practicable give notice in

RSA 2000

Section 61

Chapter H-5 HEALTH INFORMATION ACT 55 accordance with the regulations and subsection (3) of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in the custody or control of the custodian if there is a risk of harm to an individual as a result of the loss or unauthorized access or disclosure.

(3) The notice required by subsection (2) must be given to (

a) the Commissioner, (

b) the Minister, and (

c) the individual who is the subject of the individually identifying health information.

(4) A custodian must consider all relevant factors, including the factors prescribed by the regulations, in assessing for the purposes of subsection (2) whether there is a risk of harm to an individual.

(5) If a custodian considers that giving notice under subsection (2) to an individual who is the subject of individually identifying health information could reasonably be expected to result in a risk of harm to the individual’s mental or physical health, the custodian may decide not to give notice to the individual, in which case the custodian must immediately give notice to the Commissioner of the decision not to give notice to the individual, and the reasons for the decision, in accordance with the regulations. 2014 c8 s4 Duty to ensure accuracy of health information 61 Before using or disclosing health information that is in its custody or under its control, a custodian must make a reasonable effort to ensure that the information is accurate and complete. 1999 cH-4.8 s61 Duty to identify responsible affiliates 62(1) Each custodian must identify its affiliates who are responsible for ensuring that this Act, the regulations and the policies and procedures established or adopted under

section 63 are complied with.

(2) Any collection, use or disclosure of health information by an affiliate of a custodian is considered to be collection, use or disclosure by the custodian.

(3) Any disclosure of health information to an affiliate of a custodian is considered to be disclosure to the custodian.

(4) Each affiliate of a custodian must comply with

RSA 2000

Section 63

Chapter H-5 HEALTH INFORMATION ACT 56 (

a) this Act and the regulations, and (

b) the policies and procedures established or adopted under

section 63. 1999 cH-4.8 s62 Duty to establish or adopt policies and procedures 63(1) Each custodian must establish or adopt policies and procedures that will facilitate the implementation of this Act and the regulations.

(2) A custodian must at the request of the Minister or the Department provide the Minister or the Department, as the case may be, with a copy of the policies and procedures established or adopted under this section. 1999 cH-4.8 s63 Duty to prepare privacy impact assessment 64(1) Subject to subsection (3), each custodian must prepare a privacy impact assessment that describes how proposed administrative practices and information systems relating to the collection, use and disclosure of individually identifying health information may affect the privacy of the individual who is the subject of the information.

(2) Subject to subsection (3), the custodian must submit the privacy impact assessment to the Commissioner for review and comment before implementing any proposed new practice or system described in subsection (1) or any proposed change to existing practices and systems described in subsection (1). (3) Subsections (1) and (2) do not apply to custodians described in

section 1(1)(f)(iv), (ix.1), (ix.2), (xii), (xii.1), (xii.2) and (xii.3) in the collection, use or disclosure of health information between or among these custodians for a function set out in

section 27(2), unless the custodians will implement a new information system or change an existing information system in conjunction with the collection, use or disclosure. RSA 2000 cH-5 s64;2020 c35 s63;2024 c10 s20;2025 c10 s25 Power to transform health information 65 A custodian may, in accordance with the regulations, strip, encode or otherwise transform individually identifying health information to create non-identifying health information. 1999 cH-4.8 s65 Power to enter agreement with information manager 66(1) In this section, “information manager” means a person or body that

RSA 2000

Section 66

Chapter H-5 HEALTH INFORMATION ACT 57 (

a) processes, stores, retrieves or disposes of health information, (

b) in accordance with the re gulations, strips, encodes or otherwise transforms individually identifying health information to create non-identifying health information, or (

c) provides information management or information technology services in a manner that requires the use of health information but does not include an individual employed by a custodian who performs any of the functions listed in clauses (

a) to (c).

(2) A custodian must enter into a written agreement with an information manager in accordance with the regulations for the provision of any or all of the services described in subsection (1).

(3) A custodian that has entered into an agreement with an information manager may provide health information to the information manager without the consent of the individuals who are the subjects of the information for the purposes authorized by the agreement.

(4) An information manager to which information is provided pursuant to subsection (3) may use or disclose that information only for the purposes authorized by the agreement.

(5) An information manager must comply with (

a) this Act and the regulations, and (

b) the agreement entered into with a custodian in respect of information provided to it pursuant to subsection (3).

(6) Despite subsection (5)(a), a custodian continues to be responsible for compliance with this Act and the regulations in respect of the information provided by the custodian to the information manager.

(7) A custodian that is an information manager for another custodian does not become a custodian of the health information provided to it in its capacity as an information manager, but nothing in this

section prevents the custodian from otherwise collecting, using or disclosing that same health information in accordance with this Act. RSA 2000 cH-5 s66;2009 c25 s21;2020 c35 s64

RSA 2000

Section 67

Chapter H-5 HEALTH INFORMATION ACT 58 Power to charge fees 67(1) A custodian may charge the fees provided for in the regulations for services provided under

Part 2. (2) Subsection (1) does not permit a custodian to charge a fee in respect of a request for access to an applicant’s own health information, except for the cost of producing the copy.

(3) A custodian must give an applicant an estimate of the total fee for its services before providing the services.

(4) A custodian may excuse an applicant from paying all or part of a fee if, in the opinion of the custodian, the applicant cannot afford the fee or in any other circumstances provided for in the regulations.

(5) If an applicant has requested a custodian to excuse the applicant from paying all or part of a fee and the custodian has refused the applicant’s request, the custodian must notify the applicant that the applicant may ask for a review by the Commissioner.

(6) The fees referred to in subsection (1) must not exceed the actual cost of the services. 1999 cH-4.8 s67 Division 2 Data Matching Prohibition 68 A custodian or health information repository must not (

a) collect the health information to be used in data matching, or (

b) use or disclose the health information to be used in data matching or created through data matching in contravention of this Act. RSA 2000 cH-5 s68;2009 c25 s26 Data matching by custodian or health information repository 69 A custodian or health information repository may perform data matching using information that is in its custody or under its control. RSA 2000 cH-5 s69;2009 c25 s26 Data matching by custodians or health information repository 70(1) A custodian or health information repository may perform data matching by combining information that is in its custody or

RSA 2000

Section 71

Chapter H-5 HEALTH INFORMATION ACT 59 under its control with information that is in the custody or under the control of another custodian or health information repository.

(2) Before performing data matching under this section, the custodian or health information repository in whose custody and control the information that is created through data matching will be stored must prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment.

(3) A privacy impact assessment referred to in subsection (2) must (

a) describe how the information to be used in the data matching is to be collected, and (

b) set out how the information that is created through data matching is to be used or disclosed. RSA 2000 cH-5 s70;2009 c25 s26 Data matching by custodian or health information repository and non-custodian 71(1) A custodian or health information repository may perform data matching by combining information that is in its custody or under its control with information that is in the custody or under the control of a person that is not a custodian or health information repository.

(2) Before performing data matching under this section, the custodian or health information repository must prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment.

(3) A privacy impact assessment referred to in subsection (2) must meet the requirements of

section 70(3). RSA 2000 cH-5 s71;2009 c25 s26 Data matching for research 72 If data matching is performed for the purpose of conducting research, sections 48 to 56 must be complied with before the data matching is performed. 1999 cH-4.8 s72

Part 6.1 Health Information Repository Designation 72.1(1) The Minister may, in accordance with the regulations, designate an agency, corporation or other entity to act as a health information repository.

RSA 2000

Section 72.2

Chapter H-5 HEALTH INFORMATION ACT 60

(2) The Minister of Mental Health and Addiction may, in accordance with the regulations, designate the Canadian Centre of Recovery Excellence to act as a health information repository. 2009 c25 s22;2024 c10 s20 Disclosure of information 72.2 A custodian may, in accordance with the regulations, disclose individually identifying health information to a health information repository. 2009 c25 s22 Powers and duties of repository 72.3 A health information repository has the powers, duties and functions given to it by this Act and the regulations. 2009 c25 s22 Correction or amendment of health information by repository 72.4(1) Where a custodian has made a correction or amendment to health information pursuant to

section 13, the custodian must notify a health information repository to which the custodian has disclosed the information that a correction or amendment has been made and advise the repository of the manner in which the health information must be corrected or amended.

(2) A health information repository that is notified pursuant to subsection (1) must, within 30 days, (

a) make the correction or amendment according to the advice of the custodian, and (

b) provide written notice that the correction or amendment has been made to the custodian, and the custodian shall then notify the individual who is the subject of the health information.

(3) An individual who is the subject of health information to which a correction or amendment is made pursuant to subsection (1) may ask the Commissioner to review a failure of a custodian to notify a health information repository of the correction or amendment or a failure of a health information repository to make the correction or amendment pursuant to subsection (2).

(4) Sections 74 to 82 apply with all necessary modifications to a request to the Commissioner for a review under subsection (3).

(5) For greater clarity, the duties and responsibilities of a custodian as outlined in sections 74 to 82 also apply to a health information repository for the purposes of this section. 2009 c25 s22

RSA 2000

Section 72.5

Chapter H-5 HEALTH INFORMATION ACT 61 Consultation with Commissioner 72.5(1) Subject to subsection (2), the Minister must consult with the Commissioner in the preparation of the regulations under this Part.

(2) The Minister of Mental Health and Addiction must consult with the Commissioner in respect of the regulations under

section 72.1(2). 2009 c25 s22;2024 c10 s20

Part 7 Commissioner Division 1 Reviews by Commissioner Right to ask for a review 73(1) An individual who makes a request to a custodian for access to or for correction or amendment of health information may ask the Commissioner to review any decision, act or failure to act of the custodian that relates to the request.

(2) An individual who believes that the individual’s own health information has been collected, used or disclosed in contravention of this Act may ask the Commissioner to review that matter.

(3) A custodian may ask the Commissioner to review the decision of another custodian to refuse to disclose health information pursuant to

section 47(2). 1999 cH-4.8 s73 How to ask for a review 74(1) To ask for a review under this Division, a written request must be delivered to the Commissioner.

(2) A request under

section 73 for a review of a decision of a custodian must be delivered to the Commissioner within (

a) sixty days after the person asking for the review is notified of the decision, or (

b) any longer period allowed by the Commissioner.

(3) The failure of a custodian to respond in time to a request for access to a record is to be treated as a decision to refuse access, but the time limit in subsection (2)(

a) for delivering a request for a review does not apply. 1999 cH-4.8 s74

RSA 2000

Section 75

Chapter H-5 HEALTH INFORMATION ACT 62 Notifying others of review 75(1) On receiving a request for a review, the Commissioner must as soon as practicable (

a) give a copy of the request (

i) to the custodian concerned, and (ii) to any other person who in the opinion of the Commissioner is affected by the request, and (

b) provide a

summary of th e review procedures and an anticipated date for a decision in respect of the review (

i) to the person wh o asked for the review, (ii) to the custodian concerned, and (iii) to any other person who in the opinion of the Commissioner is affected by the request.

(2) Despite subsection (1)(a), the Commissioner may sever any information in the request that the Commissioner considers appropriate before giving a copy of the request to the custodian or any other person affected by the request. 1999 cH-4.8 s75 Mediation may be authorized 76 The Commissioner may authorize a mediator to investigate and attempt to settle any matter that is the subject of a request for a review. 1999 cH-4.8 s76 Inquiry by Commissioner 77(1) Unless

section 78 applies, if a matter is not settled under

section 76, the Commissioner must conduct an inquiry and may decide all questions of fact and law arising in the course of the inquiry.

(2) An inquiry under subsection (1) may be conducted in private.

(3) The person who asked for the review, the custodian concerned and any other person given a copy of the request for the review must be given an opportunity to make representations to the Commissioner during the inquiry, but no one is entitled to be present during, to have access to or to comment on representations made to the Commissioner by another person.

RSA 2000

Section 78

Chapter H-5 HEALTH INFORMATION ACT 63

(4) The Commissioner may decide whether the representations are to be made orally or in writing.

(5) The person who asked for the review, the custodian concerned and any other person given a copy of the request for the review may be represented at the inquiry by counsel or an agent.

(6) An inquiry under this

section must be completed within 90 days after the Commissioner receives the request for the review unless the Commissioner (

a) notifies the person who asked for the review, the custodian concerned and any other person given a copy of the request for the review that the Commissioner is extending that period, and (

b) provides an anticipated date for the completion of the review. 1999 cH-4.8 s77 Refusal to conduct inquiry 78 The Commissioner may refuse to conduct an inquiry pursuant to

section 77 if in the opinion of the Commissioner (

a) the subject of the request fo r a review under

section 73 has been dealt with in an order or investigation report of the Commissioner, or (

b) the circumstances warrant deciding not to conduct an inquiry. RSA 2000 cH-5 s78;2020 c35 s65 Burden of proof 79 If an inquiry relates to a decision to refuse access to all or part of a record, the onus is on the custodian to prove that the person asking for the review has no right of access to the record or part of the record. 1999 cH-4.8 s79 Commissioner’s orders 80(1) On completing an inquiry under

section 77, the Commissioner must dispose of the issues by making an order under this section.

(2) If the inquiry relates to a decision to grant or to refuse access to all or part of a record, the Commissioner may, by order, do the following:

RSA 2000

Section 80

Chapter H-5 HEALTH INFORMATION ACT 64 (

a) require the custodian to gr ant access to all or part of the record, if the Commissioner determines that the custodian is not authorized or required to refuse access; (

b) either confirm the decision of the custodian or require the custodian to reconsider it, if the Commissioner determines that the custodian is authorized to refuse access; (

c) require the custodian to refuse access to all or part of the record, if the Commissioner determines that the custodian is required to refuse access.

(3) If the inquiry relates to any other matter, the Commissioner may, by order, do one or more of the following: (

a) require that a duty imposed by this Act or the regulations be performed; (

b) confirm or redu ce the extension of a time limit under

section 15; (

c) confirm or reduce a fee required to be paid under this Act or order a refund, in the appropriate circumstances, including if a time limit is not met; (

d) confirm a decision not to correct or amend health information or specify how health information is to be corrected or amended; (

e) require a person to stop collecting, using, disclosing or creating health information in contravention of this Act; (

f) require a person to destroy health information collected or created in contravention of this Act.

(4) The Commissioner may specify any terms or conditions in an order made under this section.

(5) The Commissioner must give a copy of an order made under this

section (

a) to the person wh o asked for the review, (

b) to the custodian concerned, (

c) to any other person given a copy of the request for the review, and (

d) to the Minister.

RSA 2000

Section 81

Chapter H-5 HEALTH INFORMATION ACT 65

(6) A copy of an order made by the Commissioner under this

section may be filed with a clerk of the Court of King’s Bench and, after filing, the order is enforceable as a judgment or order of that Court. RSA 2000 cH-5 s80;AR 217/2022 No appeal 81 An order made by the Commissioner under this Act is final. 1999 cH-4.8 s81 Duty to comply with order 82(1) Subject to subsection (2), not later than 50 days after being given a copy of an order of the Commissioner, other than an order made under

section 85.1, the custodian concerned must comply with the order.

(2) A custodian must not take any steps to comply with a Commissioner’s order, other than an order made under

section 85.1, until the period for bringing an application for judicial review under subsection (3) ends.

(3) An application for judicial review of a Commissioner’s order, other than an order made under

section 85.1, must be made not later than 45 days after the person making the application is given a copy of the order.

(4) If an application for judicial review is made pursuant to subsection (3), the Commissioner’s order is stayed until the application is dealt with by the Court of King’s Bench.

(5) Despite subsection (3), the Court may, on application made either

Document details

Collection	Alberta — Consolidated Statutes
Citation	RSA 2000 cH-5
Type	statute
Volume / chapter	RSA 2000 cH-5
Language	en
Format	pdf
Source	PROVINCIAL
Identifier	5dc02946ab4f154cf273af9cf256311f2ee24cab

Source file is stored in the law ingest library (pdf).