Health Information Act, custodian duties
Also known as HIA.
Health Information Act, R.S.A. 2000, c. H-5
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://kings-printer.alberta.ca/documents/Acts/H05.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Alberta
- Obligation class
- Consent, Disclosure, Security, Governance, Data subject rights, Prohibition
As of .
What it requires
- These duties bind a custodian, which the Act defines to include a licensed pharmacy, an ambulance operator, a provincial health agency and a health services provider designated in the regulations, and they bind the custodian's affiliates.
- Collect individually identifying health information only if an enactment of Alberta or Canada expressly authorizes it, or if it relates directly to and is necessary to enable you to carry out a purpose authorized under section 27.
- Use individually identifying health information only for a purpose section 27 lists, such as providing health services, determining or verifying eligibility to receive a health service, research that meets the Act's requirements, and internal management.
- Disclose health information only as the Act permits. To disclose individually identifying health information to a person other than the individual on the individual's consent, provide the individual the information section 34(2) lists, obtain the individual's authorization and acknowledgment, and disclose only in accordance with the terms of the consent.
- Before collecting health information from an individual with a device that may not be visible to the individual, obtain the individual's written consent to use the device.
- When collecting individually identifying health information directly from the individual, take reasonable steps to inform the individual of the purpose of the collection, the specific legal authority for it, and the title, business address and business telephone number of an affiliate who can answer the individual's questions.
- Take reasonable steps, in accordance with the regulations, to maintain administrative, technical and physical safeguards that protect the confidentiality of health information, including health information stored or used outside Alberta or disclosed to a person outside Alberta, and make appropriate provision for the proper disposal of records.
- Make a reasonable effort to ensure that health information is accurate and complete before using or disclosing it.
- Identify the affiliates responsible for complying with the Act and establish a privacy management program that all your affiliates follow.
- Prepare a privacy impact assessment and submit it to the Commissioner for review and comment before introducing or changing an administrative practice or information system relating to the collection, use and disclosure of individually identifying health information.
- Respond to a request for access to a record containing an individual's health information within 30 days after receiving the request or within an extended period, and decide a request to correct or amend health information within 30 days or an extended period.
- Do not use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual has specifically consented to its use for that purpose.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 107 makes it an offence for a person to knowingly collect, use, disclose or create health information in contravention of the Act, to gain or attempt to gain access to health information in contravention of the Act, and to use individually identifying health information to market a service or solicit money without specific consent, and section 107(6) sets a fine for each.
Penalty structure
Section 107(6) sets the fine for an offence under section 107 at not more than $1,000,000 for a person other than an individual and not more than $200,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 1,000,000
What this law does
The Act binds a custodian, which it defines to include a licensed pharmacy, an ambulance operator, a provincial health agency and a health services provider designated in the regulations as a custodian or as within a class of custodians. No custodian may collect health information except in accordance with the Act.
A custodian may collect individually identifying health information only if the collection is expressly authorized by an enactment of Alberta or Canada, or if the information relates directly to and is necessary to enable the custodian to carry out a purpose authorized under section 27.
A custodian may use individually identifying health information only for the purposes section 27 lists, including providing health services, determining or verifying the eligibility of an individual to receive a health service, research that meets the Act's requirements, and internal management purposes. No custodian may disclose health information except in accordance with the Act.
A custodian may disclose individually identifying health information to a person other than the individual with the individual's consent, which is valid only if the custodian provides the information that section 34 lists and the individual authorizes the disclosure and acknowledges the risks and benefits.
A custodian that collects health information from an individual using a device that may not be visible to the individual must, before collecting it, obtain the individual's written consent to use the device.
A custodian must take reasonable steps, in accordance with the regulations, to maintain administrative, technical and physical safeguards that protect the confidentiality of health information, including health information that is to be stored or used in a jurisdiction outside Alberta or disclosed to a person in a jurisdiction outside Alberta. Before using or disclosing health information, a custodian must make a reasonable effort to ensure that it is accurate and complete.
A custodian must establish a privacy management program, and each affiliate of a custodian must comply with the Act and the program. A custodian must prepare a privacy impact assessment and submit it to the Commissioner for review and comment before introducing a new administrative practice or information system relating to the collection, use and disclosure of individually identifying health information, or before changing an existing one.
An individual has a right of access to any record containing health information about the individual that is in the custody or under the control of a custodian, subject to the Act's exceptions. A custodian must make every reasonable effort to respond to a request for access within 30 days after receiving the request or within any extended period.
An individual who believes there is an error or omission in the individual's health information may request in writing that the custodian correct or amend it, and the custodian must decide within 30 days or any extended period. No person may knowingly use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual has specifically consented to its use for that purpose.
A person who contravenes section 107 is guilty of an offence and is liable to a fine of not more than $200,000 if an individual and not more than $1,000,000 if any other person.
When LexLint raises it
When your app profile says your app handles health records.