Alberta HIA Compliance ServicesHealth Information Act - Protecting Patient Privacy

The Alberta Health Information Act (HIA) is provincial legislation that governs the collection, use, and disclosure of individually identifying health information by custodians in Alberta. Enacted in 2001, it establishes rules for health information custodians including physicians, pharmacists, Alberta Health Services, and other health care providers. The HIA is enforced by the Office of the Information and Privacy Commissioner (OIPC) of Alberta and sets out requirements for safeguards, consent, access, breach notification, and research use of health data.

Under the HIA, a custodian is a person or organization responsible for health information. Custodians include physicians, pharmacists, optometrists, dentists, chiropractors, midwives, registered nurses (when providing independent services), Alberta Health Services, Covenant Health, the Minister of Health, nursing homes, and other prescribed health service providers. Custodians may designate information managers to handle health information on their behalf, but the custodian retains overall responsibility for HIA compliance.

While Alberta PIPA governs private sector personal information generally, the HIA specifically covers individually identifying health information held by health custodians. The HIA has stricter safeguard requirements, specific rules for research use of health data, detailed consent and disclosure provisions tailored to healthcare settings, and mandatory breach notification to the OIPC. Organizations like health technology vendors may be subject to both the HIA (as information managers) and PIPA for their non-health business information.

Since August 31, 2018, section 60.1 of the HIA requires custodians to give notice of any breach of health information where there is a risk of harm to an individual — to the Information and Privacy Commissioner, to the Minister of Health, and to the affected individuals themselves. The risk-of-harm assessment must be documented even when you conclude notification is not required, and failing to report a notifiable breach is itself an offence under the Act.

Section 64 of the HIA requires custodians to prepare a Privacy Impact Assessment and submit it to the OIPC for review before implementing a new information system or administrative practice that collects, uses, or discloses individually identifying health information — or before making significant changes to an existing one. In practice that means a new or replacement EMR, a patient portal or online booking tool, an AI scribe, or a new connection to Alberta Netcare. We prepare PIAs structured to the OIPC's published requirements, including the data-flow mapping reviewers expect.

No — and the distinction matters. HIPAA is a United States federal law and does not apply to an Alberta clinic serving Alberta patients. The statute that does is Alberta's Health Information Act, enforced by the OIPC, with its own PIA submission process, breach-notification duties, and prosecution history. Buying a "HIPAA compliance package" from a US-oriented vendor leaves your actual Alberta legal obligations unaddressed. If you also serve US patients or contract with US covered entities, both regimes need scoping — but HIA comes first.

Yes. Alberta has an active enforcement record, particularly for "snooping" — affiliates looking up records of family members, ex-partners, or public figures without a work purpose. Healthcare workers have been charged and fined under the HIA. Custodians are expected to have audit-log monitoring capable of detecting snooping, and OIPC investigations routinely examine whether those controls existed and were reviewed.

Achieving HIA compliance typically takes 10-14 weeks depending on your custodian type and current privacy posture. The process includes readiness assessment (2-3 weeks), policy and procedure development (3-4 weeks), safeguard implementation (3-4 weeks), and training with ongoing compliance setup (2-3 weeks). Smaller custodians such as solo physician practices may achieve compliance in 6-8 weeks, while large organizations like regional health authorities may require 4-6 months for comprehensive implementation.