Health Information Act, breach notification by custodians and affiliates
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://kings-printer.alberta.ca/documents/Acts/H05.pdfIn force since .
A breach notification rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Alberta
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- As a custodian, give notice as soon as practicable of any loss of individually identifying health information, or any unauthorized access to or disclosure of it, in your custody or under your control, if there is a risk of harm to an individual as a result. Give the notice to the Commissioner, the Minister and the individual who is the subject of the information.
- In assessing whether there is a risk of harm to an individual, consider all relevant factors, including the factors prescribed by the regulations.
- If you decide not to give notice to the individual because it could reasonably be expected to result in a risk of harm to the individual's mental or physical health, immediately give notice to the Commissioner of that decision and the reasons for it.
- As an affiliate of a custodian, notify the custodian as soon as practicable of any loss of individually identifying health information, or any unauthorized access to or disclosure of it, in the custody or under the control of the custodian.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 107(1.1)(b) makes it an offence for a custodian to fail to comply with section 60.1(2), (3), (4) or (5), section 107(1.2) does the same for an affiliate that fails to comply with section 60.1(1), and section 107(6) sets the fine.
Penalty structure
Section 107(6) sets the fine for an offence under section 107 at not more than $1,000,000 for a person other than an individual and not more than $200,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 1,000,000
What this law does
A custodian must, as soon as practicable, give notice of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in its custody or under its control if there is a risk of harm to an individual as a result. The notice must be given to the Commissioner, the Minister and the individual who is the subject of the individually identifying health information.
A custodian must consider all relevant factors, including the factors prescribed by the regulations, in assessing whether there is a risk of harm to an individual. If a custodian considers that giving notice to the individual could reasonably be expected to result in a risk of harm to the individual's mental or physical health, the custodian may decide not to give notice to the individual, and it must then immediately give notice to the Commissioner of the decision and the reasons.
An affiliate of a custodian must, as soon as practicable, notify the custodian of any loss of individually identifying health information or any unauthorized access to or disclosure of it in the custody or under the control of the custodian. A custodian that fails to comply with section 60.1(2), (3), (4) or (5), and an affiliate that fails to comply with section 60.1(1), commits an offence under section 107. The Act's breach reporting and notification amendments came into force on .
When LexLint raises it
When your app profile says your app handles health records.