Handles health records, in Alberta

Health Information Act, R.S.A. 2000, c. H-5 · Read the law's page

• These duties bind a custodian, which the Act defines to include a licensed pharmacy, an ambulance operator, a provincial health agency and a health services provider designated in the regulations, and they bind the custodian's affiliates.
• Collect individually identifying health information only if an enactment of Alberta or Canada expressly authorizes it, or if it relates directly to and is necessary to enable you to carry out a purpose authorized under section 27.
• Use individually identifying health information only for a purpose section 27 lists, such as providing health services, determining or verifying eligibility to receive a health service, research that meets the Act's requirements, and internal management.
• Disclose health information only as the Act permits. To disclose individually identifying health information to a person other than the individual on the individual's consent, provide the individual the information section 34(2) lists, obtain the individual's authorization and acknowledgment, and disclose only in accordance with the terms of the consent.
• Before collecting health information from an individual with a device that may not be visible to the individual, obtain the individual's written consent to use the device.
• When collecting individually identifying health information directly from the individual, take reasonable steps to inform the individual of the purpose of the collection, the specific legal authority for it, and the title, business address and business telephone number of an affiliate who can answer the individual's questions.
• Take reasonable steps, in accordance with the regulations, to maintain administrative, technical and physical safeguards that protect the confidentiality of health information, including health information stored or used outside Alberta or disclosed to a person outside Alberta, and make appropriate provision for the proper disposal of records.
• Make a reasonable effort to ensure that health information is accurate and complete before using or disclosing it.
• Identify the affiliates responsible for complying with the Act and establish a privacy management program that all your affiliates follow.
• Prepare a privacy impact assessment and submit it to the Commissioner for review and comment before introducing or changing an administrative practice or information system relating to the collection, use and disclosure of individually identifying health information.
• Respond to a request for access to a record containing an individual's health information within 30 days after receiving the request or within an extended period, and decide a request to correct or amend health information within 30 days or an extended period.
• Do not use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual has specifically consented to its use for that purpose.

R.S.A. 2000, c. H-5, s. 60.1 · Read the law's page

• As a custodian, give notice as soon as practicable of any loss of individually identifying health information, or any unauthorized access to or disclosure of it, in your custody or under your control, if there is a risk of harm to an individual as a result. Give the notice to the Commissioner, the Minister and the individual who is the subject of the information.
• In assessing whether there is a risk of harm to an individual, consider all relevant factors, including the factors prescribed by the regulations.
• If you decide not to give notice to the individual because it could reasonably be expected to result in a risk of harm to the individual's mental or physical health, immediately give notice to the Commissioner of that decision and the reasons for it.
• As an affiliate of a custodian, notify the custodian as soon as practicable of any loss of individually identifying health information, or any unauthorized access to or disclosure of it, in the custody or under the control of the custodian.

R.S.A. 2000, c. H-5, ss. 22 (3), 27 (1.1), 27.1 · Read the law's page

• These duties bind a custodian.
• When collecting individually identifying health information directly from the individual, take reasonable steps to inform the individual of your intention, if any, at that time to input the information into an automated system.
• Input individually identifying health information into, or use it in, an automated system only in accordance with the regulations, if any.
• Where you input health information into or use it in an automated system for a purpose authorized by section 27, record your name or number, the name of the individual, the date and purpose of the input or use, and a description of the health information, unless an electronic system, including the automated system, automatically logs your name or number, the individual's name, the date and time of the input or use, and a description of the health information.
• Keep the record or log for at least one year following the date of the input or use of the automated system.
• On an individual's request, give the individual access to and a copy of the information recorded or logged about the individual, under Part 2 of the Act.