Health Information Act, automated systems
R.S.A. 2000, c. H-5, ss. 22 (3), 27 (1.1), 27.1
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://kings-printer.alberta.ca/documents/Acts/H05.pdfIn force.
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Alberta
- Obligation class
- Governance, Retention, Disclosure, Data subject rights
As of .
What it requires
- These duties bind a custodian.
- When collecting individually identifying health information directly from the individual, take reasonable steps to inform the individual of your intention, if any, at that time to input the information into an automated system.
- Input individually identifying health information into, or use it in, an automated system only in accordance with the regulations, if any.
- Where you input health information into or use it in an automated system for a purpose authorized by section 27, record your name or number, the name of the individual, the date and purpose of the input or use, and a description of the health information, unless an electronic system, including the automated system, automatically logs your name or number, the individual's name, the date and time of the input or use, and a description of the health information.
- Keep the record or log for at least one year following the date of the input or use of the automated system.
- On an individual's request, give the individual access to and a copy of the information recorded or logged about the individual, under Part 2 of the Act.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 107(2)(a) makes it an offence for a person to knowingly collect, use, disclose or create health information in contravention of the Act, and section 107(6) sets the fine.
Penalty structure
Section 107(6) sets the fine for an offence under section 107 at not more than $1,000,000 for a person other than an individual and not more than $200,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 1,000,000
What it makes you log
Who may demand the log
Data subject
What the log must hold
Actor identity, Affected person reference, Event time, Input reference
Log retention
The record or log is kept for at least one year following the date of input or use of the automated system.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 1
Logging duty
A custodian that inputs health information into or uses it in an automated system for a purpose authorized by section 27 records who, whose information, when and why, unless an electronic system automatically logs the same items. The section applies whether or not the automated system makes a decision.
- Kind
- Explicit
- As of
- Provision
- Health Information Act, section 27.1(1) to (3)
- Trigger
- personal_data_processing
What this law does
The Act defines an automated system as any technology that assists or replaces the judgment of human decision makers using a rules-based system, regression analysis, predictive analytics, machine learning, deep learning, a neural network or another technique.
A custodian that collects individually identifying health information directly from the individual must take reasonable steps to inform the individual of the custodian's intention, if any, at that time to input the information into an automated system. A custodian that inputs individually identifying health information into or uses it in an automated system must do so in accordance with the regulations, if any.
A custodian that inputs health information into or uses health information in an automated system for a purpose authorized by section 27 must record the custodian's name or number, the name of the individual, the date and purpose of the input or use, and a description of the health information.
The recording requirement does not apply if an electronic system, including the automated system, automatically keeps an electronic log of the custodian's name or number, the individual's name, the date and time of the input or use, and a description of the health information. The information recorded or logged must be retained by the custodian for at least one year following the date of input or use of the automated system.
An individual may ask the custodian for access to and a copy of the information recorded or logged about the individual, and Part 2 of the Act applies to the request. The Lieutenant Governor in Council may make regulations respecting the input and use of individually identifying health information in an automated system, automated systems and their safeguards, and the building and training of automated systems.
Amendments made by the Health Statutes Amendment Act, 2025 (No. 2) came into force on , with further amendments in force on . Section 27.1 was added by section 7(10) of the Health Statutes Amendment Act, 2025 (No. 2).
When LexLint raises it
When your app profile says your app handles health records or makes health care decisions.