99 How to ask for a review
100 Notifying others of review
101 Conduct and outcome of review
Part 8
General Provisions
102 Oaths
103 Manner of giving notice
104 Exercise of rights by other persons
105 Immunity from suit
106 Protection of employee
107 Offences and penalties
108 Regulations
109 Review of Act
Part 9
Consequential Amendments,
Paramountcy and Coming into Force
110‑124 Consequential amendments
125 Coming into force
HER MAJESTY, by and with the advice
and consent of the Legislative Assembly of Alberta, enacts as follows:
Part 1
Introductory Matters
Interpretation
1(1) In this
Act,
(a) “affiliate”,
in relation to a custodian, means
(i) an
individual employed by the custodian,
(ii) a
person who performs a service for the custodian as an appointee, volunteer or
student or under a contract or agency relationship with the custodian,
(iii) a
health services provider who is exercising the right to admit and treat
patients at a hospital as defined in the Hospitals Act,
(iv) an
information manager as defined in section 66(1), and
(v) a
person who is designated under the regulations to be an affiliate,
but
does not include
(vi) an
agent as defined in the Health Insurance Premiums Act, or
(vii) a
health information repository other than a health information repository that
is designated in the regulations as an affiliate;
(b) “applicant”
means an individual who makes a request for access to a record under section
8(1) or for a correction or amendment of health information under section
13(1);
(c) “audit”
means a financial, clinical or other formal or systematic examination or review
of a program, activity or other matter under this Act;
(d) “collect”
means to gather, acquire, receive or obtain health information;
(e) “Commissioner”
means the Information and Privacy Commissioner appointed under Part 4 of the Freedom
of Information and Protection of Privacy Act;
(f) “custodian”
means
(i) the
board of an approved hospital as defined in the Hospitals Act other than
an approved hospital that is
(A) owned
and operated by a regional health authority established under the Regional
Health Authorities Act, or
(B) repealed
2008 cH‑4.3 s18;
(ii) the
operator of a nursing home as defined in the Nursing Homes Act other
than a nursing home that is owned and operated by a regional health authority
established under the Regional Health Authorities Act;
(ii.1) an
ambulance operator as defined in the Emergency Health Services Act;
(iii) a
provincial health board established pursuant to regulations made under section
17(1)(a) of the Regional Health Authorities Act;
(iv) a
regional health authority established under the Regional Health Authorities
Act;
(v) a
community health council as defined in the Regional Health Authorities Act;
(vi) a
subsidiary health corporation as defined in the Regional Health Authorities
Act;
(vii) repealed
2008 cH‑5.3 s18;
(viii) a
board, council, committee, commission, panel or agency that is created by a
custodian referred to in subclauses (i) to (vii), if all or a majority of its
members are appointed by, or on behalf of, that custodian, but does not include
a committee that has as its primary purpose the carrying out of quality
assurance activities within the meaning of section 9 of the Alberta Evidence
Act;
(ix) a
health services provider who is designated in the regulations as a custodian,
or who is within a class of health services providers that is designated in the
regulations for the purpose of this subclause;
(ix.1) the
Health Quality Council of Alberta;
(x) a
licensed pharmacy as defined in the Pharmacy and Drug Act;
(xi) repealed
2009 c25 s2;
(xii) the
Department;
(xiii) the
Minister;
(xiv) an
individual or board, council, committee, commission, panel, agency, corporation
or other entity designated in the regulations as a custodian,
(xv) repealed
2008 cH‑4.3 s18,
(xvi) repealed
2013 cB‑7.5 s11;
(g) “data
matching” means the creation of individually identifying health information by
combining individually identifying or non‑identifying health information
or other information from 2 or more electronic databases, without the consent
of the individuals who are the subjects of the information;
(h) “Department”
means the Department administered by the Minister;
(i) “diagnostic,
treatment and care information” means information about any of the following:
(i) the
physical and mental health of an individual;
(ii) a
health service provided to an individual, including the following information
respecting a health services provider who provides a health service to that
individual:
(A) name;
(B) business
title;
(C) business
mailing address and business electronic address;
(D) business
telephone number and business facsimile number;
(E) type
of health services provider;
(F) licence
number or any other number assigned to the health services provider by a health
professional body to identify that health services provider;
(G) profession;
(H) job
classification;
(I) employer;
(J) municipality
in which the health services provider’s practice is located;
(K) provincial
service provider identification number that is assigned to the health services
provider by the Minister to identify the health services provider;
(L) any
other information specified in the regulations;
(iii) the
donation by an individual of a body part or bodily substance, including
information derived from the testing or examination of a body part or bodily
substance;
(iv) a
drug as defined in the Pharmacy and Drug Act provided to an individual;
(v) a
health care aid, device, product, equipment or other item provided to an
individual pursuant to a prescription or other authorization;
(vi) the
amount of any benefit paid or payable under the Alberta Health Care
Insurance Act or any other amount paid or payable in respect of a health
service provided to an individual,
and
includes any other information about an individual that is collected when a
health service is provided to the individual, but does not include information that
is not written, photographed, recorded or stored in some manner in a record;
(j) repealed
2006 c18 s2;
(k) “health
information” means one or both of the following:
(i) diagnostic,
treatment and care information;
(ii) registration
information;
(k.1) “health
information repository” means an agency, corporation or other entity designated
by the Minister to act as a health information repository in accordance with
Part 6.1;
(l) “health
professional body” means a body that regulates the members of a health
profession or health discipline pursuant to an Act;
(m) “health
service” means a service that is provided to an individual for any of the
following purposes:
(i) protecting,
promoting or maintaining physical and mental health;
(ii) preventing
illness;
(iii) diagnosing
and treating illness;
(iv) rehabilitation;
(v) caring
for the health needs of the ill, disabled, injured or dying,
but
does not include a service excluded by the regulations;
(n) “health
services provider” means an individual who provides health services;
(o) repealed
2009 c25 s2;
(p) “individually
identifying”, when used to describe health information, means that the identity
of the individual who is the subject of the information can be readily
ascertained from the information;
(q) “Minister”
means the Minister determined under section 16 of the Government
Organization Act as the Minister responsible for this Act;
(r) “non‑identifying”,
when used to describe health information, means that the identity of the
individual who is the subject of the information cannot be readily ascertained
from the information;
(s) “personal
health number” means the number assigned to an individual by the Department to
uniquely identify the individual;
(t) “record”
means a record of health information in any form and includes notes, images,
audiovisual recordings, x‑rays, books, documents, maps, drawings,
photographs, letters, vouchers and papers and any other information that is
written, photographed, recorded or stored in any manner, but does not include
software or any mechanism that produces records;
(u) “registration
information” means information relating to an individual that falls within the
following general categories and is more specifically described in the
regulations:
(i) demographic
information, including the individual’s personal health number;
(ii) location
information;
(iii) telecommunications
information;
(iv) residency
information;
(v) health
service eligibility information;
(vi) billing
information,
but
does not include information that is not written, photographed, recorded or
stored in some manner in a record;
(v) “research”
means academic, applied or scientific research that necessitates the use of
individually identifying health information;
(v.1) “research
ethics board” means a body designated by the regulations as a research ethics
board;
(w) “use”
means to apply health information for a purpose and includes reproducing the
information, but does not include disclosing the information.
(2) Where a custodian provides services that are
not health services, this Act does not apply
(a) to
the custodian in respect of those other services, or
(b) to
information relating to those other services.
(3) A custodian who is an affiliate of another
custodian is deemed not to be a custodian while acting in the capacity of an
affiliate.
(4) For the purposes of this Act, the information
specified in subsection (1)(i)(ii) respecting a health services provider is
deemed to be individually identifying health information about the individual
who received the health service from the health services provider and not
individually identifying health information about the health services provider.
RSA 2000 cH‑5 s1;RSA 2000 cP‑13
s47.1;
2006 c18 s2;2006 c25 s24;2007 c18 s2;2008 cE‑6.6 s52;
2008 cH‑4.3 s18;2009 c25 s2;2011 cH‑7.2 s26;2013 cB‑7.5 s11
Purposes of Act
2 The purposes of this Act are
(a) to
establish strong and effective mechanisms to protect the privacy of individuals
with respect to their health information and to protect the confidentiality of
that information,
(b) to
enable health information to be shared and accessed, where appropriate, to
provide health services and to manage the health system,
(c) to
prescribe rules for the collection, use and disclosure of health information,
which are to be carried out in the most limited manner and with the highest
degree of anonymity that is possible in the circumstances,
(d) to
provide individuals with a right of access to health information about
themselves, subject to limited and specific exceptions as set out in this Act,
(e) to
provide individuals with a right to request correction or amendment of health
information about themselves,
(f) to
establish strong and effective remedies for contraventions of this Act, and
(g) to
provide for independent reviews of decisions made by custodians under this Act
and the resolution of complaints under this Act.
1999 cH‑4.8 s2
Scope of Act
3 This Act
(a) does
not limit the information otherwise available by law to a party to legal
proceedings,
(b) does
not affect the power of any court or tribunal in Canada to compel a witness to
testify or to compel the production of documents, and
(c) does
not prohibit the transfer, storage or destruction of a record in accordance
with an enactment of Alberta or Canada.
RSA 2000 cH‑5 s3;2006 c18 s3
Inconsistency or conflict with
another enactment
4 If a provision of this Act is
inconsistent or in conflict with a provision of another Act or of a regulation,
the provision of this Act prevails unless
(a) another
Act, or
(b) a
regulation under this Act
expressly
provides that the other Act or regulation, or a provision of it, prevails
despite this Act.
1999 cH‑4.8 s4
Application of Parts of Act
5(1) This
Act, except Part 3, applies in respect of health information collected before
or after the coming into force of this Act.
(2) Part 3 of this Act applies only in respect of
health information collected after the coming into force of this Act.
1999 cH‑4.8 s5
Act binds custodian acting under
another enactment
6 A custodian that collects, uses or
discloses health information pursuant to another enactment must comply with
this Act.
1999 cH‑4.8 s6
Part 2
Individual’s Right to Access Individual’s
Health Information
Right of individual to access
individual’s health information
7(1) An
individual has a right of access to any record containing health information
about the individual that is in the custody or under the control of a
custodian.
(2) The right of access to a record does not extend
to information in respect of which a custodian is authorized or required to
refuse access under section 11, but if that information can reasonably be
severed from a record, an individual has a right of access to the remainder of
the record.
(3) The right of access to a record is subject to
the payment of any fee required by the regulations.
1999 cH‑4.8 s7
How to make a request
8(1) To
obtain access to a record, an individual must make a request to the custodian
that the individual believes has custody or control of the record.
(2) A custodian that has received a request for
access to a record under subsection (1) may require the applicant to submit the
request in writing.
(3) In a request, the applicant may ask
(a) for
a copy of the record, or
(b) to
examine the record.
1999 cH‑4.8 s8
Abandoned request
9(1) Where a
custodian contacts an applicant in writing respecting the applicant’s request,
including
(a) seeking
further information from the applicant that is necessary to process the
request, or
(b) requesting
the applicant to pay a fee or to agree to pay a fee,
and the applicant fails to
respond to the custodian, as requested by the custodian, within 30 days after
being contacted, the custodian may, by notice in writing to the applicant,
declare the request abandoned.
(2) A notice declaring a request abandoned must
state that the applicant may ask for a review of that decision by the
Commissioner.
1999 cH‑4.8 s9
Duty to assist applicants
10 A custodian that has received a request
for access to a record under section 8(1)
(a) must
make every reasonable effort to assist the applicant and to respond to each
applicant openly, accurately and completely,
(b) must
create a record for an applicant if
(i) the
record can be created from information that is in electronic form and is in the
custody or under the control of the custodian, using its normal computer
hardware and software and technical expertise, and
(ii) creating
the record would not unreasonably interfere with the operations of the
custodian,
and
(c) must
provide, at the request of an applicant and if reasonably practicable, an
explanation of any term, code or abbreviation used in the record.
1999 cH‑4.8 s10
Right to refuse access to health
information
11(1) A
custodian may refuse to disclose health information to an applicant
(a) if
the disclosure could reasonably be expected
(i) to
result in immediate and grave harm to the applicant’s mental or physical health
or safety,
(ii) to
threaten the mental or physical health or safety of another individual, or
(iii) to
pose a threat to public safety,
(b) if
the disclosure could reasonably lead to the identification of a person who
provided health information to the custodian explicitly or implicitly in
confidence and in circumstances in which it was appropriate that the name of
the person who provided the information be kept confidential,
(c) if
the disclosure could reasonably be expected to reveal
(i) advice,
proposals, recommendations, analyses or policy options developed by or for a
member of the Executive Council, or
(ii) consultations
or deliberations involving a member of the Executive Council or the member’s
staff,
(d) if
the disclosure could reasonably be expected to reveal advice, proposals,
recommendations, analyses or policy options developed by or for a custodian
referred to in section 1(1)(f)(iii), (iv) or (vii), or
(e) if
the information relates to
(i) procedures
or techniques relating to audits to be conducted or diagnostic tests or
assessments to be given,
(ii) details
of specific audits to be conducted or of specific tests or assessments to be
given, or
(iii) standardized
diagnostic tests or assessments used by a custodian, including intelligence
tests,
and
disclosure of the information could reasonably be expected to prejudice the use
or results of particular audits, diagnostic tests or assessments.
(2) A custodian must refuse to disclose health
information to an applicant
(a) if
the health information is about an individual other than the applicant, unless
the health information was originally provided by the applicant in the context
of a health service being provided to the applicant,
(b) if
the health information sets out procedures or contains results of an
investigation, a discipline proceeding, a practice review or an inspection
relating to a health services provider,
(c) if
the health information would reveal the substance of deliberations of the
Executive Council or any of its committees or of the Treasury Board or any of
its committees, including any advice, recommendation, policy considerations or
draft legislation or regulations submitted or prepared for submission to the
Executive Council or any of its committees or to the Treasury Board or any of
its committees, unless the health information
(i) has
been in existence for 15 years or more,
(ii) is
part of a record of a decision made by the Executive Council or any of its
committees on an appeal under an Act, or
(iii) is
part of a record the purpose of which is to present background facts to the
Executive Council or any of its committees or to the Treasury Board or any of
its committees for consideration in making a decision where
(A) the
decision has been made public,
(B) the
decision has been implemented, or
(C) 5
years or more have passed since the decision was made or considered,
or
(d) if
the disclosure is prohibited by another enactment of Alberta.
1999 cH‑4.8 s11
Time limit for responding to a
request for access
12(1) A
custodian must make every reasonable effort to respond to a request under
section 8(1) within 30 days after receiving the request or within any extended
period under section 15.
(2) In a response under subsection (1), the
custodian must tell the applicant
(a) whether
access to a record or part of it is granted or refused,
(b) if
access to the record or part of it is granted, where, when and how access will
be given, and
(c) if
access to the record or part of it is refused,
(i) the
reasons for the refusal and the provision of this Act on which the refusal is
based,
(ii) the
name, title, business address and business telephone number of an affiliate of
the custodian who can answer the applicant’s questions about the refusal, and
(iii) that
the applicant may ask for a review of that decision by the Commissioner.
(3) The failure of the custodian to respond to a
request under section 8(1) within the 30‑day period or any extended
period referred to in subsection (1) is to be treated as a decision to refuse
access to the record.
1999 cH‑4.8 s12
Correction or amendment of health
information
13(1) An
individual who believes there is an error or omission in the individual’s
health information may in writing request the custodian that has the
information in its custody or under its control to correct or amend the
information.
(2) Within 30 days after receiving a request under
subsection (1) or within any extended period under section 15, the custodian
must decide whether it will make or refuse to make the correction or amendment.
(3) If the custodian agrees to make the correction
or amendment, the custodian must within the 30‑day period or any extended
period referred to in subsection (2)
(a) make
the correction or amendment,
(b) give
written notice to the applicant that the correction or amendment has been made,
and
(c) notify
any person to whom that information has been disclosed during the one‑year
period before the correction or amendment was requested that the correction or
amendment has been made.
(4) The custodian is not required to provide the
notification referred to in subsection (3)(c) where
(a) the
custodian agrees to make the correction or amendment but believes that the
applicant will not be harmed if the notification under subsection (3)(c) is not
provided, and
(b) the
applicant agrees.
(5) If the custodian refuses to make the correction
or amendment, the custodian must within the 30‑day period or any extended
period referred to in subsection (2) give written notice to the applicant that
the custodian refuses to make the correction or amendment and of the reasons
for the refusal.
(6) A custodian may refuse to make a correction or
amendment that has been requested in respect of
(a) a
professional opinion or observation made by a health services provider about
the applicant, or
(b) a
record that was not originally created by that custodian.
(7) The failure of the custodian to respond to a
request in accordance with this section within the 30‑day period or any
extended period referred to in subsection (2) is to be treated as a decision to
refuse to make the correction or amendment.
1999 cH‑4.8 s13
Refusal to correct or amend
information
14(1) Where a
custodian refuses to make a correction or amendment under section 13, the
custodian must tell the applicant that the applicant may elect to do either of
the following, but may not elect both:
(a) ask
for a review of the custodian’s decision by the Commissioner;
(b) submit
a statement of disagreement setting out in 500 words or less the requested
correction or amendment and the applicant’s reasons for disagreeing with the
decision of the custodian.
(2) An applicant who elects to submit a statement
of disagreement must submit the statement to the custodian within 30 days after
the written notice of refusal has been given to the applicant under section
13(5) or within any extended period under section 15(3).
(3) On receiving the statement of disagreement, the
custodian must
(a) if
reasonably practicable, attach the statement to the record that is the subject
of the requested correction or amendment, and
(b) provide
a copy of the statement of disagreement to any person to whom the custodian has
disclosed the record in the year preceding the applicant’s request for the
correction or amendment.
1999 cH‑4.8 s14
Extending time
15(1) The
custodian may extend the time for responding to a request under section 8(1) or
13(1) for an additional period of up to 30 days or, with the Commissioner’s permission,
for a longer period if
(a) the
request does not give enough detail to enable the custodian to identify the
record that is requested or to be corrected or amended,
(b) a
large number of records are involved in the request and responding within the
period set out in section 12(1) or 13(2), as the case may be, would
unreasonably interfere with the operations of the custodian, or
(c) more
time is needed to consult with another custodian before deciding whether to
grant access to a record or to make the correction or amendment requested.
(2) If the time is extended under subsection (1),
the custodian must tell the applicant
(a) the
reason for the extension,
(b) when
a response can be expected, and
(c) that
the applicant may make a complaint to the Commissioner about the extension.
(3) The Commissioner may extend the time within
which an applicant must submit the statement of disagreement under section
14(2) if in the opinion of the Commissioner
(a) it
is unreasonable to expect the applicant to submit the statement within the
period set out in section 14(2), or
(b) it
is fair to extend the time for any other reason.
1999 cH‑4.8 s15
Request under s8 or s13 deemed to
be a request under FOIP
16(1) If a
written request is made under section 8(1) for access to a record that contains
information to which the Freedom of Information and Protection of Privacy
Act applies, the part of the request that relates to that information is
deemed to be a request under section 7(1) of the Freedom of Information and
Protection of Privacy Act and that Act applies to that part of the request
as if it had been made under section 7(1) of that Act.
(2) If a written request is made under section
13(1) to correct or amend information to which the Freedom of Information and
Protection of Privacy Act applies, the request is deemed to be a request
under section 36(1) of the Freedom of Information and Protection of Privacy
Act and that Act applies to the request as if it had been made under
section 36(1) of that Act.
(3) This section does not apply if the custodian
that receives the request is not a public body as defined in the Freedom of
Information and Protection of Privacy Act.
1999 cH‑4.8 s16
Existing procedures still available
17 An individual is not limited to the procedure
set out in this Part to request access to health information about the
individual if another procedure is available.
1999 cH‑4.8 s17
Part 3
Collection of Health Information
Prohibition re collection of health
information
18 No custodian shall collect health
information except in accordance with this Act.
1999 cH‑4.8 s18
Collection of non‑identifying
health information
19 A custodian may collect non‑identifying
health information for any purpose.
1999 cH‑4.8 s19
Collection of individually identifying
health information
20 A custodian may collect individually
identifying health information
(a) if
the collection of that information is expressly authorized by an enactment of
Alberta or Canada, or
(b) if
that information relates directly to and is necessary to enable the custodian
to carry out a purpose that is authorized under section 27.
1999 cH‑4.8 s20
Collection of personal health
number
21(1) Only
the following have the right to require an individual to provide the
individual’s personal health number:
(a) custodians;
(b) persons
authorized by the regulations to do so.
(2) When requesting a personal health number from
an individual, the person referred to in subsection (1) must advise the
individual of the person’s authority under subsection (1).
(3) An individual may refuse to provide the
individual’s personal health number where the person requesting it is not a
person referred to in subsection (1).
1999 cH‑4.8 s21
Duty to collect health information
from subject individual
22(1) A
custodian must collect individually identifying health information directly
from the individual who is the subject of the information unless subsection (2)
applies.
(2) A custodian may collect individually
identifying health information from a person other than the individual who is
the subject of the information in the following circumstances:
(a) where
the individual who is the subject of the information authorizes collection of
the information from someone else;
(b) where
the individual who is the subject of the information is unable to provide the
information and the custodian collects the information from a person referred
to in section 104(1)(c) to (i) who is acting on behalf of that individual;
(c) where
the custodian believes, on reasonable grounds, that collection from the
individual who is the subject of the information would prejudice
(i) the
interests of the individual,
(ii) the
purposes of collection, or
(iii) the
safety of any other individual,
or
would result in the collection of inaccurate information;
(d) where
collection from the individual who is the subject of the information is not
reasonably practicable;
(e) where
collection is for any of the following purposes:
(i) assembling
a family or genetic history where the information collected is to be used in
the context of providing a health service to the individual who is the subject
of the information;
(ii) determining
the eligibility of an individual to participate in a program of or to receive a
benefit, product or health service from a custodian and the information is
collected in the course of processing an application made by or for the
individual who is the subject of the information;
(iii) verifying
the eligibility of an individual who is participating in a program of or
receiving a benefit, product or health service from a custodian to participate
in the program or to receive the benefit, product or service;
(iv) informing
the Public Trustee or a Public Guardian about clients or potential clients;
(e.1) where
use of the information is authorized by section 27(1)(d);
(e.2) where
the custodian is conducting data matching for a purpose authorized under
section 27;
(f) where
the information is available to the public;
(g) where
disclosure of the information is authorized under Part 5.
(3) When collecting individually identifying health
information about an individual directly from the individual, the custodian
must take reasonable steps to inform the individual
(a) of
the purpose for which the information is collected,
(b) of
the specific legal authority for the collection, and
(c) of
the title, business address and business telephone number of an affiliate of
the custodian who can answer the individual’s questions about the collection.
RSA 2000 cH‑5 s22;2008 cA‑4.2
s131;2009 c25 s3
Use of recording device or camera
23 A custodian that collects health
information from an individual using a recording device or camera or any other
device that may not be obvious to the individual must, before collecting the
information, obtain the written consent of the individual to the use of the
device or camera.
1999 cH‑4.8 s23
Collection of health information by
affiliate
24 An affiliate of a custodian must not
collect health information in any manner that is not in accordance with the
affiliate’s duties to the custodian.
1999 cH‑4.8 s24
Part 4
Use of Health Information
Prohibition re use of health
information
25 No custodian shall use health information
except in accordance with this Act.
1999 cH‑4.8 s25
Use of non‑identifying health
information
26 A custodian may use non‑identifying
health information for any purpose.
1999 cH‑4.8 s26
Use of individually identifying
health information
27(1) A
custodian may use individually identifying health information in its custody or
under its control for the following purposes:
(a) providing
health services;
(b) determining
or verifying the eligibility of an individual to receive a health service;
(c) conducting
investigations, discipline proceedings, practice reviews or inspections
relating to the members of a health profession or health discipline;
(d) conducting
research or performing data matching or other services to facilitate another
person’s research
(i) if
the custodian or researcher has submitted a proposal to a research ethics board
in accordance with section 49,
(ii) if
the research ethics board is satisfied as to the matters referred to in section
50(1)(b),
(iii) if
the custodian or researcher has complied with or undertaken to comply with the
conditions, if any, suggested by the research ethics board, and
(iv) where
the research ethics board recommends that consents should be obtained from the
individuals who are the subjects of the health information to be used in the
research, if those consents have been obtained;
(e) providing
for health services provider education;
(f) carrying
out any purpose authorized by an enactment of Alberta or Canada;
(g) for
internal management purposes, including planning, resource allocation, policy
development, quality improvement, monitoring, audit, evaluation, reporting,
obtaining or processing payment for health services and human resource
management.
(2) A custodian referred to in section
1(1)(f)(iii), (iv), (vii), (ix.1), (xii) or (xiii) may, in addition, use individually
identifying health information in its custody or under its control to carry out
the following functions within the geographic area in which the custodian has
jurisdiction to promote the objectives for which the custodian is responsible:
(a) planning
and resource allocation;
(b) health
system management;
(c) public
health surveillance;
(d) health
policy development.
RSA 2000 cH‑5 s27;2006 c18
s4;2009 c25 s4;2011 cH‑7.2 s26
Use of health information by
affiliate
28 An affiliate of a custodian must not use
health information in any manner that is not in accordance with the affiliate’s
duties to the custodian.
1999 cH‑4.8 s28
Confidentiality of non‑recorded
information
29 A custodian that collects information
described in section 1(1)(i), (o) or (u) that is not written, photographed,
recorded or stored in some manner in a record may use the information only for
the purpose for which the information was provided to the custodian.
1999 cH‑4.8 s29
Use of personal health number by
non‑custodian
30 A
person who is authorized to require an individual to provide a personal health
number pursuant to section 21(1)(b) may use that information only for the
purpose for which the information was collected.
1999 cH‑4.8 s30
Part 5
Disclosure of Health Information
Division 1
General Disclosure Rules
Prohibition re disclosure of health
information
31 No custodian shall disclose health
information except in accordance with this Act.
1999 cH‑4.8 s31
Disclosure of non‑identifying
health information
32(1) A custodian
may disclose non‑identifying health information for any purpose.
(2) If a disclosure under subsection (1) is to a
person that is not a custodian, the custodian must inform the person that the
person must notify the Commissioner of an intention to use the information for
data matching before performing the data matching.
1999 cH‑4.8 s32
Disclosure of information to
individual who is subject
of information
33 A custodian may disclose individually
identifying health information to the individual who is the subject of the
information or to a person referred to in section 104(1)(c) to (i) who is
acting on behalf of that individual.
1999 cH‑4.8 s33
Disclosure of individually
identifying health information
to be with consent
34(1) Subject
to sections 35 to 40, a custodian may disclose individually identifying health
information to a person other than the individual who is the subject of the
information if the individual has consented to the disclosure.
(2) A consent referred to in subsection (1) must be
provided in writing or electronically and must include
(a) an
authorization for the custodian to disclose the health information specified in
the consent,
(b) the
purpose for which the health information may be disclosed,
(c) the
identity of the person to whom the health information may be disclosed,
(d) an
acknowledgment that the individual providing the consent has been made aware of
the reasons why the health information is needed and the risks and benefits to
the individual of consenting or refusing to consent,
(e) the
date the consent is effective and the date, if any, on which the consent
expires, and
(f) a
statement that the consent may be revoked at any time by the individual
providing it.
(3) A disclosure of health information pursuant to
this section must be carried out in accordance with the terms of the consent.
(4) A revocation of a consent must be provided in
writing or electronically.
(5) A consent or revocation of a consent that is
provided in writing must be signed by the person providing it.
(6) A consent or revocation of a consent that is
provided electronically is valid only if it complies with the requirements set
out in the regulations.
1999 cH‑4.8 s34
Disclosure of diagnostic, treatment
and care information
35(1) A
custodian may disclose individually identifying diagnostic, treatment and care
information without the consent of the individual who is the subject of the
information
(a) to
another custodian for any or all of the purposes listed in section 27(1) or
(2), as the case may be,
(a.1) to
the government of Canada or of another province or territory of Canada for that
government’s use for health system planning and management and health policy
development where
(i) the
individual is a resident of that other province or territory, or
(ii) that
government is otherwise responsible for payment for health services provided to
the individual,
(b) to
a person who is responsible for providing continuing treatment and care to the
individual,
(c) to
family members of the individual or to another person with whom the individual
is believed to have a close personal relationship, if the information is given
in general terms and concerns the presence, location, condition, diagnosis,
progress and prognosis of the individual on the day on which the information is
disclosed and the disclosure is not contrary to the express request of the
individual,
(d) where
an individual is injured, ill or deceased, so that family members of the
individual or another person with whom the individual is believed to have a
close personal relationship or a friend of the individual can be contacted, if
the disclosure is not contrary to the express request of the individual,
(d.1) where
an individual is deceased, to family members of the individual or to another
person with whom the individual is believed to have had a close personal
relationship, if the information relates to circumstances surrounding the death
of the individual or to health services recently received by the individual and
the disclosure is not contrary to the express request of the individual,
(e) to
an official of a penal or other custodial institution in which the individual
is being lawfully detained if the purpose of the disclosure is to allow the
provision of health services or continuing treatment and care to the
individual,
(f) to
a person authorized to conduct an audit of the information if the person agrees
in writing
(i) to
destroy the information at the earliest opportunity after the audit is
concluded, and
(ii) not
to disclose the information to any other person, except as required to
accomplish the audit or to report unlawful or improper conduct by the custodian
or a health services provider,
(g) to
a committee that has as its primary purpose the carrying out of quality
assurance activities within the meaning of section 9 of the Alberta Evidence
Act,
(h) for
the purpose of a court proceeding or a proceeding before a quasi‑judicial
body to which the custodian is a party,
(i) for
the purpose of complying with a subpoena, warrant or order issued or made by a
court, person or body having jurisdiction in Alberta to compel the production
of information or with a rule of court binding in Alberta that relates to the
production of information,
(j) repealed
2006 c18 s5;
(k) to
another custodian where the custodian disclosing the information has a
reasonable expectation that disclosure will detect or prevent fraud, limit
abuse in the use of health services or prevent the commission of an offence
under an enactment of Alberta or Canada,
(l) to
an officer of the Legislature if the information is necessary for the
performance of the officer’s duties,
(m) to
any person if the custodian believes, on reasonable grounds, that the
disclosure will avert or minimize
(i) a
risk of harm to the health or safety of a minor, or
(ii) an
imminent danger to the health or safety of any person,
(n) if
that individual lacks the mental capacity to provide a consent and, in the
opinion of the custodian, disclosure is in the best interests of the
individual,
(o) to
a descendant of a deceased individual, a person referred to in section
104(1)(c) to (i) who is acting on behalf of the descendant or a person who is
providing health services to the descendant if, in the custodian’s opinion,
(i) the
disclosure is necessary to provide health services to the descendant, and
(ii) the
disclosure is restricted sufficiently to protect the privacy of the deceased
individual,
(p) if
the disclosure is authorized or required by an enactment of Alberta or Canada,
(q) to
its successor where
(i) the
custodian is transferring its records to the successor as a result of the
custodian
(A) ceasing
to be a custodian, or
(B) ceasing
to provide health services within the geographic area in which the successor provides
health services,
and
(ii) the
successor is a custodian,
(r) for
the purpose of obtaining or processing payment for health services provided to
the individual by a person that is required under a contract to pay for those
services for that individual, or
(s) to
the College of Physicians and Surgeons of Alberta for the purpose of
administering the Physician Prescribing Practices Program or any program to
monitor prescribing practices that replaces it.
(2) A committee to which health information is
disclosed pursuant to subsection (1)(g) must not disclose the information to
any other person except in accordance with subsection (3).
(3) A committee referred to in subsection (2) may
disclose non‑identifying health information to another committee that has
as its primary purpose the carrying out of quality assurance activities within
the meaning of section 9 of the Alberta Evidence Act.
(4) A custodian may disclose individually
identifying diagnostic, treatment and care information to a health professional
body for the purpose of an investigation, a discipline proceeding, a practice
review or an inspection if
(a) the
custodian has complied with any other enactment authorizing or requiring the
custodian to disclose that information for that purpose, and
(b) the
health professional body agrees in writing
(i) not
to disclose the information to any other person except as authorized by or
under the Act governing the health professional body, and
(ii) repealed
2006 c18 s5.
(5) A custodian may disclose individually
identifying diagnostic, treatment and care information to a health professional
body for the purpose of lodging a complaint with the health professional body.
RSA 2000 cH‑5 s35;2003 c23
s2;2006 c18 s5;2009 c25 s5;
2013 cC‑12.5 s15;2016 c18 s8
Disclosure of registration
information
36 A custodian may disclose individually
identifying registration information without the consent of the individual who
is the subject of the information
(a) for
any of the purposes for which diagnostic, treatment and care information may be
disclosed under section 35(1) or (4),
(b) to
any person for the purpose of collecting or processing a fine or debt owing by
the individual to the Government of Alberta or to a custodian, or
(c) to
a person who is not a custodian if the disclosure is in accordance with the
requirements set out in the regulations.
1999 cH‑4.8 s36
37 Repealed 2009 c25 s6.
Disclosure to prevent or limit
fraud or abuse
of health services
37.1(1) A
custodian may disclose individually identifying health information referred to
in subsection (2) without the consent of the individual who is the subject of
the information to a police service or the Minister of Justice and Solicitor
General where the custodian reasonably believes
(a) that
the information relates to the possible commission of an offence under a
statute or regulation of Alberta or Canada, and
(b) that
the disclosure will detect or prevent fraud or limit abuse in the use of health
services.
(2) A custodian may disclose the following
information under subsection (1):
(a) the
name of an individual;
(b) the
date of birth of an individual;
(c) the
personal health number of an individual;
(d) the
nature of any injury or illness of an individual;
(e) the
date on which a health service was sought or received by an individual;
(f) the
location where an individual sought or received a health service;
(g) the
name of any drug, as defined in the Pharmacy and Drug Act, provided to
or prescribed for an individual and the date the drug was provided or
prescribed;
(h) information
specified in section 1(1)(i)(ii) about a health services provider who provided
a health service to an individual referred to in subsection (1).
(3), (4) Repealed 2009 c25 s7.
RSA 2000 cP‑13 s47.1;2006 c18
s7;2009 c25 s7;
2013 c10 s34
37.2 Repealed
2009 c25 s8.
Disclosure to protect public health
and safety
37.3(1) A
custodian may disclose individually identifying health information referred to
in subsection (2) without the consent of the individual who is the subject of
the information to a police service or the Minister of Justice and Solicitor
General where the custodian reasonably believes
(a) that
the information relates to the possible commission of an offence under a
statute or regulation of Alberta or Canada, and
(b) that
the disclosure will protect the health and safety of Albertans.
(2) A custodian may disclose the following
information under subsection (1):
(a) the
name of an individual;
(b) the
date of birth of an individual;
(c) the
nature of any injury or illness of an individual;
(d) the
date on which a health service was sought or received by an individual;
(e) the
location where an individual sought or received a health service;
(f) whether
any samples of bodily substances were taken from an individual;
(g) information
specified in section 1(1)(i)(ii) about a health services provider who provided
a health service to an individual referred to in subsection (1).
(3), (4) Repealed 2009 c25 s9.
2006 c18 s7;2009 c25 s9;2013 c10
s34
Disclosure for purpose of storage
38 A custodian may disclose individually
identifying health information without the consent of the individual who is the
subject of the information to the Provincial Archives of Alberta or to any
other archives that is subject to this Act or the Freedom of Information and
Protection of Privacy Act, for the purposes of permanent preservation and
historical research if, in the opinion of the custodian, the information has
enduring value.
1999 cH‑4.8 s38
Disclosure by Minister and
Department
39(1) The
Minister or the Department may disclose individually identifying diagnostic,
treatment and care information without the consent of the individual who is the
subject of the information to another Minister of the Government of Alberta for
the purpose of developing public policy.
(2) The Minister or the Department may enter into
an agreement with
(a) another
Minister of the Government of Alberta or a Minister of the Government of Canada
or of any other province or territory, or
(b) a
person or entity in accordance with the regulations made pursuant to the Alberta
Health Care Insurance Act,
respecting
the disclosure to the person referred to in clause (a) or (b), as the case may
be, of individually identifying registration information without the consent of
the individual who is the subject of the information.
1999 cH‑4.8 s39
Disclosure to Minister
40 A custodian other than the Minister may
disclose individually identifying health information to the Minister without
the consent of the individual who is the subject of the information if the
disclosure is necessary or desirable in the opinion of the custodian to enable
the Minister to carry out the duties of the Minister.
1999 cH‑4.8 s40
Maintaining certain disclosure
information
41(1) Subject
to subsection (1.1), a custodian that discloses a record containing
individually identifying diagnostic, treatment and care information under
section 35(1), (4) or (5) must make a note of the following information:
(a) the
name of the person to whom the custodian discloses the information;
(b) the
date and purpose of the disclosure;
(c) a
description of the information disclosed.
(1.1) The requirement to make a note under subsection
(1) does not apply to a custodian that permits other custodians electronic
access to individually identifying diagnostic, treatment and care information
stored in a database if, when the information is disclosed, the database
automatically keeps an electronic log of the following information:
(a) a
name or number that identifies the custodian to whom the information is
disclosed;
(b) the
date and time that the information is disclosed;
(c) a
description of the information that is disclosed.
(2) The information referred to in subsections (1)
and (1.1) must be retained by the custodian for a period of 10 years following
the date of the disclosure.
(3) An individual who is the subject of information
referred to in subsection (1) or (1.1) may ask a custodian for access to and a
copy of the information, and Part 2 applies to the request.
RSA 2000 cH‑5 s41;2006 c18
s8;2009 c25 s10;2016 c18 s8
Notification of purpose of and
authority for disclosure
42(1) A
custodian that discloses individually identifying diagnostic, treatment and
care information must inform the recipient in writing of the purpose of the
disclosure and the authority under which the disclosure is made.
(2) Subsection (1) does not apply where the
disclosure is
(a) to
another custodian under section 35(1)(a),
(b) to
the Minister or the Department under section 46,
(c) to
another custodian under section 47,
(d) to
a police service or the Minister of Justice and Solicitor General under section
37.1, 37.2 or 37.3, or
(e) to
the individual who is the subject of the information.
RSA 2000 cH‑5 s42;2006 c18
s9;2013 c10 s34
Disclosure of health information by
affiliate
43 An affiliate of a custodian must not
disclose health information in any manner that is not in accordance with the
affiliate’s duties to the custodian.
1999 cH‑4.8 s43
Confidentiality of non‑recorded
information
44 A custodian that collects information
described in section 1(1)(i), (o) or (u) that is not written, photographed,
recorded or stored in some manner in a record may disclose the information only
for the purpose for which the information was provided to the custodian.
1999 cH‑4.8 s44
Duty of custodian
45 A custodian that discloses health
information must make a reasonable effort to ensure that the person to whom the
disclosure is made is the person intended and authorized to receive the
information.
1999 cH‑4.8 s45
Division 2
Disclosure for Health System Purposes
Disclosure to Minister or
Department
46(1) The
Minister or the Department may request another custodian to disclose to the
Minister or the Department individually identifying health information for any
of the purposes listed in section 27(2)
(a) if
the Minister or the Department, as the case may be, is authorized by an
enactment of Alberta or Canada to obtain the information from the other
custodian, or
(b) if
the information requested relates to a health service provided by the other
custodian and
(i) the
health service is fully or partially paid for by the Department or is provided
using financial, physical or human resources provided, administered or paid for
by the Department, or
(ii) the
information is prescribed in the regulations as information the Minister or the
Department may request under this section.
(2) If the requirements of subsection (1) are met,
the custodian must disclose the information to the Minister or the Department,
as the case may be.
(3) Repealed 2009 c25 s11.
(4) Individually identifying health information may
be disclosed under this section without the consent of the individual who is
the subject of the information.
(5) Where health information is requested under subsection
(1)(b), the Department
(a) must
prepare a privacy impact assessment describing how disclosure of the health
information may affect the privacy of the individual who is the subject of the
information, and submit the privacy impact assessment to the Commissioner for
review and comment, and
(b) must
consider the comments of the Commissioner, if any, made in response to the
privacy impact assessment before disclosing the health information to a
custodian referred to in section 1(1)(f)(iii) or (iv).
RSA 2000 cH‑5 s46;2006 c18
s10;2009 c25 s11
Disclosure to other custodians
47(1) A
custodian referred to in section 1(1)(f)(iii), (iv) or (vii) may request
another custodian to disclose to the requesting custodian individually
identifying health information for any of the purposes listed in section 27(2)
(a) if
the requesting custodian is authorized by an enactment of Alberta or Canada to
obtain the information from the other custodian, or
(b) if
the information requested relates to a health service provided by the other
custodian
(i) that
is fully or partially paid for by the requesting custodian, or
(ii) that
is provided using financial, physical or human resources provided or
administered by the requesting custodian.
(2) Where a request relates to information
described in subsection (1)(b), the custodian receiving the request may refuse
to disclose the information if disclosure could reasonably be expected
(a) to
result in immediate and grave harm to the mental or physical health or safety
of the individual who is the subject of the information,
(b) to
threaten the mental or physical health or safety of another individual, or
(c) to
pose a threat to public safety.
(3) If a custodian refuses to disclose information
in accordance with subsection (2),
(a)
the custodian must provide the requesting custodian with non‑identifying
health information in the form requested by that custodian, and
(b) the
requesting custodian may ask for a review of that refusal by the Commissioner.
(4) In making a decision on a review under
subsection (3)(b), the Commissioner must, if the custodian is a member of a
health professional body, inform the health professional body of the review and
provide an opportunity for that body to make comments to the Commissioner relating
to the review.
(5) Repealed 2009 c25 s12.
(6) Individually identifying health information may
be disclosed under this section without the consent of the individual who is
the subject of the information.
RSA 2000 cH‑5 s47;2009 c25
s12
Division 3
Disclosure for Research Purposes
48 Repealed 2009 c25 s13.
Research proposal
49 A person who intends to conduct research
using health information in the custody or under the control of a custodian or
health information repository must submit a proposal to a research ethics board
for review by that board containing
(a) the
information specified by the regulations, and
(b) any
other information required by the research ethics board.
RSA 2000 cH‑5 s49;2006 c18
s11;2009 c25 s14
Role of research ethics board
50(1) The
research ethics board must
(a) consider
whether the researcher should be required to obtain consents for the disclosure
of the health information to be used in the research from the individuals who
are the subjects of the information, and
(b) assess
whether, in the opinion of the research ethics board,
(i) the
proposed research is of sufficient importance that the public interest in the
proposed research outweighs to a substantial degree the public interest in
protecting the privacy of the individuals who are the subjects of the health
information to be used in the research,
(ii) the
researcher is qualified to carry out the research,
(iii) adequate
safeguards will be in place at the time the research will be carried out to
protect the privacy of the individuals who are the subjects of the health
information to be used in the research and the confidentiality of that
information, and
(iv) obtaining
the consents referred to in clause (a) is unreasonable, impractical or not
feasible.
(2) In making an assessment under subsection
(1)(b), the research ethics board must consider the degree to which the
proposed research may contribute to
(a) identification,
prevention or treatment of illness or disease,
(b) scientific
understanding relating to health,
(c) promotion
and protection of the health of individuals and communities,
(d) improved
delivery of health services, or
(e) improvements
in health system management.
(3) The research ethics board must prepare a
response setting out
(a) its
recommendation under subsection (1)(a),
(b) its
assessment of the matters set out in subsection (1)(b), and
(c) any
conditions that the research ethics board considers should be imposed on the
researcher.
(4) The research ethics board must send a copy of
the response required in subsection (3) to the Commissioner.
RSA 2000 cH‑5 s50;2006 c18
s12
Publication of response
50.1 If the response of the research ethics
board sent to the Commissioner under section 50(4) indicates that the research
ethics board is satisfied as to the matters referred to in section 50(1)(b),
the Commissioner may publish the response in any manner the Commissioner
considers appropriate.
2006 c18 s13
Bar to research
51 If the research ethics board is not
satisfied as to any of the matters referred to in section 50(1)(b), the
researcher may not apply to a custodian or health information repository under
section 52.
RSA 2000 cH‑5 s51;2006 c18
s14;2009 c25 s15
Application for disclosure of
health information or to perform data matching
52 If the research ethics board is satisfied
as to the matters referred to in section 50(1)(b), the researcher may forward
to one or more custodians or health information repositories
(a) the
researcher’s proposal referred to in section 49,
(b) the
response of the research ethics board to the researcher’s proposal, and
(c) a
written application for one or more of the following:
(i) disclosure
of the health information to be used in the research;
(ii) performance
of data matching;
(iii) performance
of any other service to facilitate the research.
RSA 2000 cH‑5 s52;2006 c18
s14;2009 c25 s16
Conditions and consents
53(1) A
custodian who has received the documents referred to in section 52 may, but is
not required to, disclose the health information or perform data matching or
other services to facilitate the research.
(2) If the custodian decides to disclose the health
information or perform data matching or other services to facilitate the
research,
(a) the
custodian
(i) must
impose on the researcher the conditions suggested by the research ethics board,
and
(ii) may
impose other conditions on the researcher,
and
(b) if
the research ethics board recommended that consents referred to in section
50(1)(a) be obtained, the researcher must obtain the consents before the
disclosure of the health information or performance of data matching or other
services.
(3) A health information repository that has
received the documents referred to in section 52 may disclose the health
information or perform data matching or other services to facilitate the
research only in accordance with the regulations.
RSA 2000 cH‑5 s53;2006 c18
s14;2009 c25 s17
Agreement between custodian and
researcher
54(1) If the
custodian decides to disclose health information to a researcher or perform
data matching or other services to facilitate the research, the researcher must
enter into an agreement with the custodian in which the researcher agrees
(a) to
comply with
(i) this
Act and the regulations made under this Act,
(ii) any
conditions imposed by the custodian relating to the use, protection,
disclosure, return or disposal of the health information, and
(iii) any
requirement imposed by the custodian to provide safeguards against the
identification, direct or indirect, of an individual who is the subject of the
health information,
(b) to
use the health information only for the purpose of conducting the proposed
research,
(c) not
to publish the health information in a form that could reasonably enable the
identity of an individual who is the subject of the information to be readily
ascertained,
(d) not
to make any attempt to contact an individual who is the subject of the health
information to obtain additional health information unless the individual has
provided the custodian with the consent referred to in section 55,
(e) to
allow the custodian to access or inspect the researcher’s premises to confirm
that the researcher is complying with the enactments, conditions and
requirements referred to in clause (a), and
(f) to
pay the costs referred to in subsection (3).
(2) When an agreement referred to in subsection (1)
has been entered into, the custodian may disclose to the researcher the health
information requested under section 52 or perform data matching or other
services to facilitate the research
(a) with
the consent of the individuals who are the subjects of the information, where
the research ethics board recommends that consents should be obtained, or
(b) without
the consent of the individuals who are the subjects of the information, where
the research ethics board does not recommend that consents be obtained.
(3) The custodian may set the costs of
(a) preparing
information for disclosure, or performing data matching or other services
(b) making
copies of health information, and
(c) obtaining
the consents referred to in section 55,
which must not exceed the actual
cost of providing that service.
(4) If the researcher contravenes or fails to meet
the terms and conditions of an agreement under this section, the agreement is
cancelled.
RSA 2000 cH‑5 s54;2006 c18
s14;2009 c25 s18
Consent for additional information
55 If the researcher wishes to contact the
individuals who are the subjects of the information disclosed under section
54(2) to obtain additional health information, the custodian or an affiliate of
the custodian must first obtain consents from those individuals to their being
contacted for that purpose.
1999 cH‑4.8 s55
Court order
56(1) If a
researcher refuses to allow a custodian or health information repository to
access or inspect its premises in accordance with the agreement referred to in
section 54, the custodian or health information repository may apply to the
Court of Queen’s Bench for an order under subsection (2).
(2) If the Court is satisfied that there are
reasonable and probable grounds to believe that access to premises or the
production or removal of documents is necessary for the purpose of determining
whether an agreement referred to in section 54 is being complied with, the
Court may make any order it considers necessary to enforce compliance with the
agreement.
(3) Where authorized to do so by an order under
subsection (2), a custodian or health information repository may
(a) enter
and search any premises of the researcher where the research is conducted,
(b) operate
or cause to be operated any computer system of the researcher to search any
data contained in or available to the system and produce a document from the
data, and
(c) seize
and make copies of any documents of the researcher that are or may be relevant
to the investigation.
(4) An application for an order under this section
may be made ex parte unless the Court orders otherwise.
(5) The custodian or health information repository
must return any documents seized pursuant to a court order within 60 days after
the conclusion of the investigation that gave rise to the seizure, including
any hearing or appeal.
(6) In this section, “document” includes any correspondence,
memorandum, book, plan, map, drawing, diagram, pictorial or graphic work,
photograph, film, microfilm, sound recording, videotape, machine readable
record or other material or thing, regardless of physical form or
characteristics.
RSA 2000 cH‑5 s56;2009 c25
s19;2009 c53 s77
Part 5.1
Alberta Electronic
Health Record
Definitions
56.1 In
this Part,
(a) “Alberta
EHR” means the integrated electronic health information system established to
provide shared access by authorized custodians to prescribed health information
in a secure environment as may be further defined or described in the
regulations;
(b) “authorized
custodian” means
(i) a
custodian referred to in section 1(1)(f)(iii), (iv), (vii), (xii) or (xiii),
other than the Health Quality Council of Alberta, and
(ii) any
other custodian that meets the eligibility requirements of the regulations to
be an authorized custodian;
(c) “prescribed
health information” means health information about an individual that is of a
class or type prescribed by the regulations that a regulated health professional
or an authorized custodian may or must make accessible to authorized custodians
via the Alberta EHR;
(d) “regulated
health professional” means
(i) a
regulated member under the Health Professions Act, or
(ii) a
person registered under the Health Disciplines Act.
2009 c25 s20;2016 c9 s26;2016 c18
s8
Purpose
56.2 The purpose of this Part is to enable the
sharing and use, via the Alberta EHR, of prescribed health information among
authorized custodians.
2009 c25 s20
Making prescribed health
information accessible
56.3(1) The
health professional body of a regulated health professional may in writing
direct the regulated health professional to make prescribed health information
that is in the custody or under the control of the regulated health
professional accessible to authorized custodians via the Alberta EHR in
accordance with the regulations.
(2) If
(a) the
Minister determines that it is in the public interest to have certain prescribed
health information that is in the custody or under the control of one or more
regulated health professionals made accessible to authorized custodians via the
Alberta EHR, and
(b) the
health professional body of the regulated health professionals has not directed
the regulated health professionals to make that prescribed health information
accessible via the Alberta EHR,
the Minister may, subject to
subsection (3), in writing direct the regulated health professionals to make
the prescribed health information accessible to authorized custodians via the
Alberta EHR in accordance with the regulations.
(3) Before giving a direction under subsection (2),
the Minister must
(a) consult
with the health professional body referred to in subsection (2)(b),
(b) prepare
a privacy impact assessment describing how making the information accessible
may affect the privacy of the individual who is the subject of the information
and submit the privacy impact assessment to the Commissioner for review and
comment, and
(c) consider
the comments of the Commissioner, if any, made in response to the privacy
impact assessment.
(4) A failure by a regulated health professional to
comply with a direction of the health professional body under subsection (1) or
of the Minister under subsection (2) constitutes
(a) in
the case of a regulated member under the Health Professions Act,
unprofessional conduct;
(b) in
the case of a person registered under the Health Disciplines Act, professional
misconduct.
(5) An authorized custodian may make prescribed
health information in its custody or under its control accessible to authorized
custodians via the Alberta EHR in accordance with the regulations.
(6) An authorized custodian, other than a regulated
health professional, must, if the Minister requests in writing, make prescribed
health information in its custody or under its control accessible to authorized
custodians via the Alberta EHR in accordance with the regulations.
(7) For greater certainty, the making of prescribed
health information accessible pursuant to this section does not
(a) constitute
a disclosure of that information, or
(b) require
the consent of the individual who is the subject of the information.
2009 c25 s20;2016 c9 s26;2016 c18
s8
Duty to consider expressed wishes
of individual
who is the subject of prescribed health information
56.4 In deciding how much prescribed health
information to make accessible via the Alberta EHR, a regulated health professional
or an authorized custodian must consider as an important factor any expressed
wishes of the individual who is the subject of the prescribed health
information relating to access to that information, together with any other
factors the regulated health professional or authorized custodian considers
important.
2009 c25 s20
Using prescribed health information
56.5(1) Subject
to the regulations,
(a) an
authorized custodian referred to in section 56.1(b)(i) may use prescribed
health information that is accessible via the Alberta EHR for any purpose that
is authorized by section 27;
(b) an
authorized custodian referred to in section 56.1(b)(ii) may use prescribed
health information that is accessible via the Alberta EHR, and that is not
otherwise in the custody or under the control of that authorized custodian,
only for a purpose that is authorized by
(i) section
27(1)(a), (b) or (f), or
(ii) section
27(1)(g), but only to the extent necessary for obtaining or processing payment
for health services.
(2) For greater certainty, the use pursuant to
subsection (1) of prescribed health information that is accessible via the
Alberta EHR does not constitute collection of that information under this Act.
(3) For greater certainty, the use pursuant to
subsection (1) of prescribed health information that is accessible via the
Alberta EHR does not constitute a disclosure of that information by
(a) the
regulated health professional or authorized custodian who originally made that
information accessible via the Alberta EHR pursuant to section 56.3,
(b) any
other authorized custodian,
(c) the
information manager of the Alberta EHR, or
(d) any
other person.
2009 c25 s20
Maintaining record of Alberta EHR
information
56.6(1) If an
authorized custodian uses prescribed health information pursuant to section
56.5, the authorized custodian must keep an electronic log of the following
information:
(a) a
name or number that identifies the custodian who uses the information;
(b) the
date and time that the information is used;
(c) a
description of the information that is used.
(2) The information referred to in subsection (1)
must be retained by the authorized custodian for a period of 10 years following
the date of the use.
(3) An individual who is the subject of information
referred to in subsection (1) may ask the authorized custodian or the
information manager of the Alberta EHR for access to and a copy of the
information, and Part 2 applies to the request.
(4) If, pursuant to subsection (3), an individual
asks the information manager of the Alberta EHR for access to and a copy of the
information referred to in subsection (1), the information manager of the
Alberta EHR must, in accordance with Part 2, provide that information in
respect of all custodians who have used that individual’s prescribed health
information pursuant to section 56.5.
2009 c25 s20
Multi‑disciplinary data
stewardship committee
56.7(1) The
Minister shall establish a multi‑disciplinary data stewardship committee
whose function is to make recommendations to the Minister with respect to rules
related to access, use, disclosure and retention of prescribed health
information that is accessible via the Alberta EHR.
(2) At least 2 members of the multi‑disciplinary
data stewardship committee must be members of the public.
(3) Section 7(2) to (5) of the Government
Organization Act apply with respect to the multi‑disciplinary data
stewardship committee.
2009 c25 s20
Regulations
56.8 The Lieutenant Governor in Council may
make regulations
(a) defining
or otherwise describing the Alberta EHR;
(b) respecting
the eligibility requirements for a custodian to become and remain an authorized
custodian for the purposes of this Part, including, without limitation,
regulations requiring an authorized custodian to enter into an agreement with
respect to the authorized custodian’s powers, duties and functions under this
Part;
(c) prescribing
classes or types of health information as prescribed health information;
(d) respecting
the manner in which a regulated health professional or an authorized custodian
must make prescribed health information in its custody or under its control
accessible to an authorized custodian via the Alberta EHR;
(e) respecting
the purposes for which an authorized custodian may use prescribed health
information;
(f) respecting
the governance, management and structure of the Alberta EHR, including, without
limitation, regulations
(i) designating
an information manager of the Alberta EHR, and
(ii) respecting
the powers, duties and functions of the information manager;
(g) respecting
the procedures, systems and safeguards that an authorized custodian must
maintain in respect of prescribed health information that is accessible via the
Alberta EHR;
(h) respecting
the audit or monitoring of any matter related to the Alberta EHR;
(i) respecting
any other matter the Lieutenant Governor in Council considers necessary or
advisable to carry out the intent of this Part.
2009 c25 s20
Part 6
Duties and Powers of Custodians Relating to Health Information
Division 1
General Duties and Powers
Duty to collect, use or disclose
health information
with highest degree of anonymity possible
57(1) In this
section, “aggregate health information” means non‑identifying health
information about groups of individuals.
(2) A custodian that intends to collect, use or
disclose health information must first consider whether collection, use or
disclosure of aggregate health information is adequate for the intended
purpose, and if so, the custodian must collect, use or disclose only aggregate
health information.
(3) If the custodian believes that collecting,
using or disclosing aggregate health information is not adequate for the
custodian’s intended purpose, the custodian must then consider whether
collection, use or disclosure of other non‑identifying health information
is adequate for the intended purpose, and if so, the custodian may collect, use
or disclose other non‑identifying health information.
(4) If the custodian believes that collecting,
using or disclosing aggregate and other non‑identifying health
information is not adequate for the custodian’s intended purpose, the custodian
may collect, use or disclose individually identifying health information if the
collection, use or disclosure
(a) is
authorized by this Act, and
(b) is
carried out in accordance with this Act.
(5) This section does not apply where the
collection, use or disclosure is for the purpose of
(a) providing
health services, or
(b) determining
or verifying the eligibility of an individual to receive a health service.
1999 cH‑4.8 s57
Duty to collect, use or disclose
health information
in a limited manner
58(1) When
collecting, using or disclosing health information, a custodian must, in
addition to complying with section 57, collect, use or disclose only the amount
of health information that is essential to enable the custodian or the
recipient of the information, as the case may be, to carry out the intended
purpose.
(2) In deciding how much health information to
disclose, a custodian must consider as an important factor any expressed wishes
of the individual who is the subject of the information relating to disclosure
of the information, together with any other factors the custodian considers
relevant.
1999 cH‑4.8 s58
Duty to
protect health information
60(1) A
custodian must take reasonable steps in accordance with the regulations to
maintain administrative, technical and physical safeguards that will
(a) protect
the confidentiality of health information that is in its custody or under its
control and the privacy of the individuals who are the subjects of that
information,
(b) protect
the confidentiality of health information that is to be stored or used in a
jurisdiction outside Alberta or that is to be disclosed by the custodian to a
person in a jurisdiction outside Alberta and the privacy of the individuals who
are the subjects of that information,
(c) protect
against any reasonably anticipated
(i) threat
or hazard to the security or integrity of the health information or of loss of
the health information, or
(ii) unauthorized
use, disclosure or modification of the health information or unauthorized
access to the health information,
and
(d) otherwise
ensure compliance with this Act by the custodian and its affiliates.
(2) The safeguards to be maintained under
subsection (1) must include appropriate measures
(a) for
the security and confidentiality of records, which measures must address the
risks associated with electronic health records, and
(b) for
the proper disposal of records to prevent any reasonably anticipated
unauthorized use or disclosure of the health information or unauthorized access
to the health information following its disposal.
(3) In subsection (2)(a), “electronic health
records” means records of health information in electronic form.
RSA 2000 cH‑5 s60;2003 c23 s4
Duty to ensure accuracy of health
information
61 Before using or disclosing health
information that is in its custody or under its control, a custodian must make
a reasonable effort to ensure that the information is accurate and complete.
1999 cH‑4.8 s61
Duty to identify responsible
affiliates
62(1) Each
custodian must identify its affiliates who are responsible for ensuring that
this Act, the regulations and the policies and procedures established or
adopted under section 63 are complied with.
(2) Any collection, use or disclosure of health
information by an affiliate of a custodian is considered to be collection, use
or disclosure by the custodian.
(3) Any disclosure of health information to an
affiliate of a custodian is considered to be disclosure to the custodian.
(4) Each affiliate of a custodian must comply with
(a) this
Act and the regulations, and
(b) the
policies and procedures established or adopted under section 63.
1999 cH‑4.8 s62
Duty to establish or adopt policies
and procedures
63(1) Each
custodian must establish or adopt policies and procedures that will facilitate
the implementation of this Act and the regulations.
(2) A custodian must at the request of the Minister
or the Department provide the Minister or the Department, as the case may be,
with a copy of the policies and procedures established or adopted under this
section.
1999 cH‑4.8 s63
Duty to prepare privacy impact
assessment
64(1) Each
custodian must prepare a privacy impact assessment that describes how proposed
administrative practices and information systems relating to the collection,
use and disclosure of individually identifying health information may affect
the privacy of the individual who is the subject of the information.
(2) The custodian must submit the privacy impact
assessment to the Commissioner for review and comment before implementing any
proposed new practice or system described in subsection (1) or any proposed
change to existing practices and systems described in subsection (1).
1999 cH‑4.8 s64
Power to transform health
information
65 A custodian may, in accordance with the
regulations, strip, encode or otherwise transform individually identifying
health information to create non‑identifying health information.
1999 cH‑4.8 s65
Power to enter agreement with
information manager
66(1) In this
section, “information manager” means a person or body that
(a) processes,
stores, retrieves or disposes of health information,
(b) in
accordance with the regulations, strips, encodes or otherwise transforms
individually identifying health information to create non‑identifying
health information, or
(c) provides
information management or information technology services.
(2) A custodian must enter into a written agreement
with an information manager in accordance with the regulations for the
provision of any or all of the services described in subsection (1).
(3) A custodian that has entered into an agreement
with an information manager may provide health information to the information
manager without the consent of the individuals who are the subjects of the
information for the purposes authorized by the agreement.
(4) An information manager to which information is
provided pursuant to subsection (3) may use or disclose that information only
for the purposes authorized by the agreement.
(5) An information manager must comply with
(a) this
Act and the regulations, and
(b) the
agreement entered into with a custodian
in respect of information
provided to it pursuant to subsection (3).
(6) Despite subsection (5)(a), a custodian
continues to be responsible for compliance with this Act and the regulations in
respect of the information provided by the custodian to the information
manager.
(7) A custodian that is an information manager for
another custodian does not become a custodian of the health information
provided to it in its capacity as an information manager, but nothing in this
section prevents the custodian from otherwise collecting, using or disclosing
that same health information in accordance with this Act.
RSA 2000 cH‑5 s66;2009 c25
s21
Power to charge fees
67(1) A
custodian may charge the fees provided for in the regulations for services
provided under Part 2.
(2) Subsection (1) does not permit a custodian to
charge a fee in respect of a request for access to an applicant’s own health
information, except for the cost of producing the copy.
(3) A custodian must give an applicant an estimate
of the total fee for its services before providing the services.
(4) A custodian may excuse an applicant from paying
all or part of a fee if, in the opinion of the custodian, the applicant cannot
afford the fee or in any other circumstances provided for in the regulations.
(5) If an applicant has requested a custodian to
excuse the applicant from paying all or part of a fee and the custodian has
refused the applicant’s request, the custodian must notify the applicant that
the applicant may ask for a review by the Commissioner.
(6) The fees referred to in subsection (1) must not
exceed the actual cost of the services.
1999 cH‑4.8 s67
Division 2
Data Matching
Prohibition
68 A custodian or health information
repository must not
(a) collect
the health information to be used in data matching, or
(b) use
or disclose the health information to be used in data matching or created
through data matching
in
contravention of this Act.
RSA 2000 cH‑5 s68;2009 c25
s26
Data matching by custodian or
health information repository
69 A custodian or health information
repository may perform data matching using information that is in its custody
or under its control.
RSA 2000 cH‑5 s69;2009 c25
s26
Data matching by custodians or
health information repository
70(1) A custodian
or health information repository may perform data matching by combining
information that is in its custody or under its control with information that
is in the custody or under the control of another custodian or health
information repository.
(2) Before performing data matching under this
section, the custodian or health information repository in whose custody and
control the information that is created through data matching will be stored
must prepare a privacy impact assessment and submit the assessment to the
Commissioner for review and comment.
(3) A privacy impact assessment referred to in
subsection (2) must
(a) describe
how the information to be used in the data matching is to be collected, and
(b) set
out how the information that is created through data matching is to be used or
disclosed.
RSA 2000 cH‑5 s70;2009 c25
s26
Data matching by custodian or
health information repository and non‑custodian
71(1) A
custodian or health information repository may perform data matching by
combining information that is in its custody or under its control with
information that is in the custody or under the control of a person that is not
a custodian or health information repository.
(2) Before performing data matching under this
section, the custodian or health information repository must prepare a privacy
impact assessment and submit the assessment to the Commissioner for review and
comment.
(3) A privacy impact assessment referred to in
subsection (2) must meet the requirements of section 70(3).
RSA 2000 cH‑5 s71;2009 c25
s26
Data matching for research
72 If data matching is performed for the
purpose of conducting research, sections 48 to 56 must be complied with before
the data matching is performed.
1999 cH‑4.8 s72
Part 6.1
Health Information Repository
Designation
72.1 The Minister may, in accordance with the
regulations, designate an agency, corporation or other entity to act as a
health information repository.
2009 c25 s22
Disclosure of information
72.2 A custodian may, in accordance with the
regulations, disclose individually identifying health information to a health
information repository.
2009 c25 s22
Powers and duties of repository
72.3 A health information repository has the
powers, duties and functions given to it by this Act and the regulations.
2009 c25 s22
Correction or amendment of health
information by repository
72.4(1) Where a
custodian has made a correction or amendment to health information pursuant to
section 13, the custodian must notify a health information repository to which
the custodian has disclosed the information that a correction or amendment has
been made and advise the repository of the manner in which the health
information must be corrected or amended.
(2) A health information repository that is
notified pursuant to subsection (1) must, within 30 days,
(a) make
the correction or amendment according to the advice of the custodian, and
(b) provide
written notice that the correction or amendment has been made to the custodian,
and the custodian shall then notify the individual who is the subject of the
health information.
(3) An individual who is the subject of health
information to which a correction or amendment is made pursuant to subsection
(1) may ask the Commissioner to review a failure of a custodian to notify a
health information repository of the correction or amendment or a failure of a
health information repository to make the correction or amendment pursuant to
subsection (2).
(4) Sections 74 to 82 apply with all necessary
modifications to a request to the Commissioner for a review under subsection
(3).
(5) For greater clarity, the duties and
responsibilities of a custodian as outlined in sections 74 to 82 also apply to
a health information repository for the purposes of this section.
2009 c25 s22
Consultation with Commissioner
72.5 The Minister must consult with the
Commissioner in the preparation of the regulations under this Part.
2009 c25 s22
Part 7
Commissioner
Division 1
Reviews by Commissioner
Right to ask for a review
73(1) An
individual who makes a request to a custodian for access to or for correction
or amendment of health information may ask the Commissioner to review any
decision, act or failure to act of the custodian that relates to the request.
(2) An individual who believes that the
individual’s own health information has been collected, used or disclosed in
contravention of this Act may ask the Commissioner to review that matter.
(3) A custodian may ask the Commissioner to review
the decision of another custodian to refuse to disclose health information
pursuant to section 47(2).
1999 cH‑4.8 s73
How to ask for a review
74(1) To ask
for a review under this Division, a written request must be delivered to the
Commissioner.
(2) A request under section 73 for a review of a
decision of a custodian must be delivered to the Commissioner within
(a) sixty
days after the person asking for the review is notified of the decision, or
(b) any
longer period allowed by the Commissioner.
(3) The failure of a custodian to respond in time
to a request for access to a record is to be treated as a decision to refuse
access, but the time limit in subsection (2)(a) for delivering a request for a
review does not apply.
1999 cH‑4.8 s74
Notifying others of review
75(1) On
receiving a request for a review, the Commissioner must as soon as practicable
(a) give
a copy of the request
(i) to
the custodian concerned, and
(ii) to
any other person who in the opinion of the Commissioner is affected by the
request,
and
(b) provide
a summary of the review procedures and an anticipated date for a decision in
respect of the review
(i) to
the person who asked for the review,
(ii) to
the custodian concerned, and
(iii) to
any other person who in the opinion of the Commissioner is affected by the
request.
(2) Despite subsection (1)(a), the Commissioner may
sever any information in the request that the Commissioner considers
appropriate before giving a copy of the request to the custodian or any other
person affected by the request.
1999 cH‑4.8 s75
Mediation may be authorized
76 The Commissioner may authorize a mediator
to investigate and attempt to settle any matter that is the subject of a
request for a review.
1999 cH‑4.8 s76
Inquiry by Commissioner
77(1) Unless
section 78 applies, if a matter is not settled under section 76, the
Commissioner must conduct an inquiry and may decide all questions of fact and
law arising in the course of the inquiry.
(2) An inquiry under subsection (1) may be
conducted in private.
(3) The person who asked for the review, the
custodian concerned and any other person given a copy of the request for the
review must be given an opportunity to make representations to the Commissioner
during the inquiry, but no one is entitled to be present during, to have access
to or to comment on representations made to the Commissioner by another person.
(4) The Commissioner may decide whether the
representations are to be made orally or in writing.
(5) The person who asked for the review, the
custodian concerned and any other person given a copy of the request for the
review may be represented at the inquiry by counsel or an agent.
(6) An inquiry under this section must be completed
within 90 days after the Commissioner receives the request for the review
unless the Commissioner
(a) notifies
the person who asked for the review, the custodian concerned and any other
person given a copy of the request for the review that the Commissioner is
extending that period, and
(b) provides
an anticipated date for the completion of the review.
1999 cH‑4.8 s77
Refusal to conduct inquiry
78 The Commissioner may refuse to conduct an
inquiry pursuant to section 77 if in the opinion of the Commissioner the
subject of a request for a review under section 73 has been dealt with in an
order or investigation report of the Commissioner.
1999 cH‑4.8 s78
Burden of proof
79 If an inquiry relates to a decision to
refuse access to all or part of a record, the onus is on the custodian to prove
that the person asking for the review has no right of access to the record or
part of the record.
1999 cH‑4.8 s79
Commissioner’s orders
80(1) On
completing an inquiry under section 77, the Commissioner must dispose of the
issues by making an order under this section.
(2) If the inquiry relates to a decision to grant
or to refuse access to all or part of a record, the Commissioner may, by order,
do the following:
(a) require
the custodian to grant access to all or part of the record, if the Commissioner
determines that the custodian is not authorized or required to refuse access;
(b) either
confirm the decision of the custodian or require the custodian to reconsider
it, if the Commissioner determines that the custodian is authorized to refuse
access;
(c) require
the custodian to refuse access to all or part of the record, if the
Commissioner determines that the custodian is required to refuse access.
(3) If the inquiry relates to any other matter, the
Commissioner may, by order, do one or more of the following:
(a) require
that a duty imposed by this Act or the regulations be performed;
(b) confirm
or reduce the extension of a time limit under section 15;
(c) confirm
or reduce a fee required to be paid under this Act or order a refund, in the
appropriate circumstances, including if a time limit is not met;
(d) confirm
a decision not to correct or amend health information or specify how health
information is to be corrected or amended;
(e) require
a person to stop collecting, using, disclosing or creating health information
in contravention of this Act;
(f) require
a person to destroy health information collected or created in contravention of
this Act.
(4) The Commissioner may specify any terms or
conditions in an order made under this section.
(5) The Commissioner must give a copy of an order
made under this section
(a) to
the person who asked for the review,
(b) to
the custodian concerned,
(c) to
any other person given a copy of the request for the review, and
(d) to
the Minister.
(6) A copy of an order made by the Commissioner
under this section may be filed with a clerk of the Court of Queen’s Bench and,
after filing, the order is enforceable as a judgment or order of that Court.
1999 cH‑4.8 s80
No appeal
81 An order made by the Commissioner under
this Act is final.
1999 cH‑4.8 s81
Duty to comply with order
82(1) Subject
to subsection (2), not later than 50 days after being given a copy of an order
of the Commissioner, the custodian concerned must comply with the order.
(2) A custodian must not take any steps to comply
with a Commissioner’s order until the period for bringing an application for
judicial review under subsection (3) ends.
(3) An application for judicial review of a
Commissioner’s order must be made not later than 45 days after the person
making the application is given a copy of the order.
(4) If an application for judicial review is made
pursuant to subsection (3), the Commissioner’s order is stayed until the
application is dealt with by the Court of Queen’s Bench.
(5) Despite subsection (3), the Court may, on
application made either before or after the expiry of the period referred to in
subsection (3), extend that period if it considers it appropriate to do so.
1999 cH‑4.8 s82
Division 2
Disclosure to Commissioner
Disclosure to Commissioner
83(1) An
affiliate of a custodian may disclose to the Commissioner any health
information that the affiliate is required to keep confidential and that the
affiliate, acting in good faith, believes is being collected, used or disclosed
in contravention of this Act.
(2) The Commissioner must investigate and review
any disclosure made under subsection (1).
(3) If an affiliate makes a disclosure under
subsection (1), the Commissioner must not disclose the identity of the
affiliate to any person without the affiliate’s consent.
(4) An affiliate is not liable to a prosecution for
an offence under any Act for disclosing health information to the Commissioner
unless the affiliate was acting in bad faith.
(5) In carrying out an investigation and review
under this section, the Commissioner has all of the powers and duties set out
in sections 76, 77, 80(1) to (5), 88 and 91, and sections 89, 90, 92 and 94
apply.
1999 cH‑4.8 s83
Division 3
Additional Powers and Duties
of Commissioner
General powers of Commissioner
84(1) In
addition to the Commissioner’s powers and duties under Divisions 1 and 2 with
respect to reviews, the Commissioner is generally responsible for monitoring
how this Act is administered to ensure its purposes are achieved, and may
(a) at
the request of the Minister or otherwise, conduct investigations to ensure
compliance with any provision of this Act or compliance with rules relating to
the destruction of records set out in an enactment of Alberta,
(b) make
an order described in section 80 whether or not a review is requested,
(c) inform
the public about this Act,
(d) receive
comments from the public concerning the administration of this Act,
(e) engage
in or commission a study of anything affecting the achievement of the purposes
of this Act,
(f) comment
on the implications for access to health information or for protection of
health information of privacy impact assessments submitted to the Commissioner
under section 46(5), 64, 70 or 71,
(g) comment
on the implications for protection of health information of using or disclosing
health information for the purpose of performing data matching,
(h) give
advice and recommendations of general application to a custodian on matters
respecting the rights or obligations of custodians under this Act,
(i) bring
to the attention of a custodian any failure by the custodian to assist
applicants under section 10, and
(j) exchange
information with an extra‑provincial commissioner and enter into
information sharing and other agreements with extra‑provincial
commissioners for the purpose of co‑ordinating activities and handling
complaints involving 2 or more jurisdictions.
(2) For the purposes of subsection (1)(j), “extra‑provincial
commissioner” means a person who, in respect of Canada or in respect of another
province or territory of Canada, has duties, powers and functions similar to
those of the Commissioner.
RSA 2000 cH‑5 s84;2009 c25
s23
Power to resolve complaints
85 Without limiting section 84, the
Commissioner may investigate and attempt to resolve a complaint that
(a) a
duty imposed by section 10 has not been performed,
(b) an
extension of time for responding to a request is not in accordance with section
15,
(c) a
fee charged under this Act is inappropriate,
(d) a
correction or amendment of health information requested under section 13 has
been refused without justification, or
(e) health
information has been collected, used, disclosed or created by a custodian in
contravention of this Act.
1999 cH‑4.8 s85
Advice and recommendations
86(1) A
custodian may ask the Commissioner to give advice and recommendations on any
matter respecting any rights or duties under this Act.
(2) The Commissioner may in writing provide the
custodian with advice and recommendations that
(a) state
the material facts either expressly or by incorporating facts stated by the
custodian,
(b) are
based on the facts referred to in clause (a), and
(c) may
be based on any other considerations the Commissioner considers appropriate.
1999 cH‑4.8 s86
Power to authorize a custodian to
disregard requests
87(1) At the
request of a custodian, the Commissioner may authorize the custodian to
disregard one or more requests under section 8(1) or 13(1) if
(a) because
of their repetitious or systematic nature, the requests would unreasonably
interfere with the operations of the custodian or amount to an abuse of the
right to make those requests, or
(b) one
or more of the requests are frivolous or vexatious.
(2) The processing of a request under section 8(1)
or 13(1) ceases when a custodian has made a request under subsection (1) and
(a) if
the Commissioner authorizes the custodian to disregard the request, does not
resume;
(b) if
the Commissioner does not authorize the custodian to disregard the request,
does not resume until the Commissioner advises the custodian of the
Commissioner’s decision.
RSA 2000 cH‑5 s87;2006 c18
s15
Powers of Commissioner in
conducting investigations
or inquiries
88(1) In
conducting an inquiry under section 77 or an investigation under section 84(a)
or in giving advice and recommendations under section 86, the Commissioner has
all the powers, privileges and immunities of a commissioner under the Public
Inquiries Act and the powers given by subsection (2) of this section.
(2) The Commissioner may require any relevant
record to be produced to the Commissioner and may examine any information in
the record, whether or not the record is subject to the provisions of this Act.
(3) Despite any other enactment or any privilege of
the law of evidence, a custodian must produce to the Commissioner within 10
days any record or a copy of any record required under subsection (1) or (2).
(4) If a custodian is required to produce a record
under subsection (1) or (2) and it is not practical to make a copy of the
record, the custodian may require the Commissioner to examine the original at
its site.
(5) After completing a review or investigating a
complaint, the Commissioner must return any record or any copy of any record
produced.
1999 cH‑4.8 s88
Statements made to Commissioner not
admissible
in evidence
89(1) A
statement made or an answer given by a person during an investigation or
inquiry by the Commissioner is inadmissible in evidence in court or in any
other proceeding, except
(a) in
a prosecution for perjury in respect of sworn testimony,
(b) in
a prosecution for an offence under this Act, or
(c) in
an application for judicial review or an appeal from a decision with respect to
that application.
(2) Subsection (1) applies also in respect of
evidence of the existence of proceedings conducted before the Commissioner.
1999 cH‑4.8 s89
Privileged information
90 Anything said, any information supplied
or any record produced by a person during an investigation or inquiry by the
Commissioner is privileged in the same manner as if the investigation or
inquiry were a proceeding in a court.
1999 cH‑4.8 s90
Restrictions on disclosure of
information by Commissioner
and staff
91(1) The
Commissioner and anyone acting for or under the direction of the Commissioner
must not disclose any information obtained in performing their duties, powers
and functions under this Act, except as provided in subsections (2) to (5) and
section 50.1.
(2) The Commissioner may disclose, or may authorize
anyone acting for or under the direction of the Commissioner to disclose,
information that is necessary
(a) to
conduct an investigation or inquiry under this Act, or
(b) to
establish the grounds for findings and recommendations contained in a report
under this Act.
(3) In conducting an investigation or inquiry under
this Act and in a report under this Act, the Commissioner and anyone acting for
or under the direction of the Commissioner must take every reasonable
precaution to avoid disclosing and must not disclose
(a) any
health information a custodian would be required or authorized to refuse to
disclose if it were contained in a record requested under section 8(1), or
(b) whether
health information exists, if a custodian in refusing to grant access does not
indicate whether the information exists.
(3.1) The Commissioner may disclose any information
to the Minister if in the opinion of the Commissioner the disclosure is
necessary to enable the Minister to exercise the powers or carry out the duties
or functions of the Minister in respect of any matter under the Minister’s
administration.
(3.2) The Commissioner may disclose any information
to any person where the Commissioner reasonably believes the disclosure of the
information to that person
(a) is
necessary to protect the privacy, health or safety of an individual, or
(b) is
in the public interest.
(4) The Commissioner may disclose to the Minister
of Justice and Solicitor General information relating to the commission of an
offence under an enactment of Alberta or Canada if the Commissioner considers
there is evidence of an offence.
(5) The Commissioner may disclose, or may authorize
anyone acting for or under the direction of the Commissioner to disclose,
information in the course of a prosecution, application or appeal referred to
in section 89(1).
RSA 2000 cH‑5 s91;2006 c18
s16;2013 c10 s34;2014 c8 s4
Immunity from suit
92 No action lies and no proceeding may be
brought against the Commissioner, or against a person acting for or under the
direction of the Commissioner, for anything done, reported or said in good
faith in the exercise or performance or the intended exercise or performance of
a duty, power or function under this Part.
1999 cH‑4.8 s92
Delegation by Commissioner
93(1) The
Commissioner may delegate to any person any duty, power or function of the
Commissioner under this Act except the power to delegate.
(2) A delegation under subsection (1) must be in
writing and may contain any conditions or restrictions the Commissioner
considers appropriate.
1999 cH‑4.8 s93
Role of Ombudsman
94 The Ombudsman may not investigate any
matter that the Commissioner has the power to investigate or review under this
Part unless the Commissioner agrees.
1999 cH‑4.8 s94
Annual report of Commissioner
95(1) The
Commissioner must report annually to the Speaker of the Legislative Assembly on
(a) the
work of the Commissioner’s office, and
(b) any
other matters relating to the protection of health information that the
Commissioner considers appropriate.
(2) On receiving a report from the Commissioner,
the Speaker must lay the report before the Legislative Assembly
(a) as
soon as possible, if the Legislature is then sitting, or
(b) if
the Legislature is not then sitting, within 15 days after the commencement of
the next sitting.
1999 cH‑4.8 s95
Division 4
Conflict of Interest of Commissioner
Adjudicator
96(1) The
Lieutenant Governor in Council may designate a judge of the Court of Queen’s
Bench of Alberta to act as an adjudicator
(a) to
investigate complaints respecting any matter referred to in section 85 made
against a custodian where the Commissioner has been a member, employee or
administrator of that custodian or where, in the Commissioner’s opinion, the
Commissioner has a conflict with respect to that custodian;
(b) to
review, if requested under section 98, a decision, act or failure to act of a
custodian where the Commissioner has been a member, employee or administrator
of that custodian or where, in the Commissioner’s opinion, the Commissioner has
a conflict with respect to that custodian.
(2) An adjudicator must not review an order of the
Commissioner made under this Act.
(3) An adjudicator may retain the services of any
persons necessary to assist in performing the adjudicator’s functions under
this Act.
(4) The Government of Alberta may pay out of the
General Revenue Fund
(a) to
an adjudicator, the expenses a judge is entitled to receive under section 57(3)
of the Judges Act (Canada) while acting as an adjudicator, and
(b) to
a person whose services are retained under subsection (3), remuneration for
those services.
1999 cH‑4.8 s96
Powers, duties and functions of adjudicator
97(1) For the
purposes of section 96, an adjudicator has the powers, duties and functions
given to the Commissioner by sections 85(a) to (d), 87, 88 and 91(1), (2)(a)
and (3) to (5).
(2) Sections 89, 90, 92 and 94 apply for the
purposes of an investigation, inquiry or review by an adjudicator.
1999 cH‑4.8 s97
Review where Commissioner in
conflict
98(1) This
section applies where the Commissioner is asked under section 73 to review a
decision, act or failure to act of a custodian and the Commissioner had been a
member, employee or administrator of that custodian or, in the Commissioner’s
opinion, the Commissioner has a conflict with respect to that custodian.
(2) An individual who makes a request to a
custodian for access to or for correction or amendment of health information
may ask an adjudicator to review any decision, act or failure to act of the
custodian that relates to the request.
(3) An individual who believes that the
individual’s own health information has been collected, used or disclosed in
contravention of this Act may ask an adjudicator to review that matter.
(4) A custodian may ask an adjudicator to review
the decision of another custodian to refuse to disclose health information
pursuant to section 47(2).
1999 cH‑4.8 s98
How to ask for a review
99(1) To ask
for a review under this Division, a written request must be delivered to the
Minister.
(2) A request for a review of a decision must be
delivered to the Minister within
(a) sixty
days after the person asking for the review is notified of the decision, or
(b) any
longer period allowed by the adjudicator.
1999 cH‑4.8 s99
Notifying others of review
100 On receiving a request for a review, the
Minister must as soon as practicable
(a) give
the request to an adjudicator,
(b) give
a copy of the request
(i) to
the Commissioner, and
(ii) to
any other person who in the opinion of the Minister is affected by the request,
and
(c) provide
a summary of the review procedures
(i) to
the person who asked for the review,
(ii) to
the Commissioner, and
(iii) to
any other person who in the opinion of the Minister is affected by the request.
1999 cH‑4.8 s100
Conduct and outcome of review
101(1) An
adjudicator has the powers and duties given to the Commissioner by sections 76
and 77(1) and (2), and sections 77(3) to (6) and 79 apply to an inquiry
conducted by an adjudicator.
(2) On completing an inquiry, an adjudicator has
the same duty to dispose of the issues, the same power to make orders and the
same duty to notify others of those orders as the Commissioner has under
section 80(1) to (5).
(3) An adjudicator must give a copy of an order
made by the adjudicator under this Act to the Commissioner.
(4) A copy of an order made by an adjudicator under
this Act may be filed with a clerk of the Court of Queen’s Bench and, after
filing, the order is enforceable as a judgment or order of that Court.
(5) Section 82 applies to an order of an
adjudicator.
(6) An order made by an adjudicator under this Act
is final.
1999 cH‑4.8 s101
Part 8
General Provisions
Oaths
102(1) Before
beginning to perform duties under this Act, the Commissioner must take an oath
to faithfully and impartially perform the duties of the Commissioner under this
Act and not to disclose any information received by the office of the
Commissioner under this Act, except as provided for in this Act.
(2) Every person employed or engaged by the office
of the Commissioner must, before beginning to perform duties under this Act,
take an oath not to disclose any information received by that person under this
Act, except as provided for in this Act.
(3) The oath referred to
(a) in
subsection (1) must be administered by the Speaker of the Legislative Assembly
or the Clerk of the Legislative Assembly, and
(b) in
subsection (2) must be administered by the Commissioner.
1999 cH‑4.8 s102
Manner of giving notice
103 Where this Act requires any notice or
other document to be given to a person, it is to be given
(a) by
sending it to that person by prepaid mail to the last known address of that
person,
(b) by
personal service,
(c) by
substitutional service if so authorized by the Commissioner, or
(d) by
means of a machine or device that electronically transmits a copy of a
document, picture or other printed material by means of a telecommunications
system.
1999 cH‑4.8 s103
Exercise of rights by other persons
104(1) Any
right or power conferred on an individual by this Act may be exercised
(a) if
the individual is 18 years of age or older, by the individual,
(b) if
the individual is under 18 years of age and understands the nature of the right
or power and the consequences of exercising the right or power, by the
individual,
(c) if
the individual is under 18 years of age but does not meet the criterion in
clause (b), by the guardian of the individual,
(d) if
the individual is deceased, by the individual’s personal representative if the
exercise of the right or power relates to the administration of the
individual’s estate,
(e) if
a guardian or trustee has been appointed for the individual under the Adult
Guardianship and Trusteeship Act, by the guardian or trustee if the
exercise of the right or power relates to the powers and duties of the guardian
or trustee,
(f) if
an agent has been designated under a personal directive under the Personal
Directives Act, by the agent if the directive so authorizes,
(g) if
a power of attorney has been granted by the individual, by the attorney if the
exercise of the right or power relates to the powers and duties conferred by
the power of attorney,
(h) by
the individual’s nearest relative as defined in the Mental Health Act if
the exercise of the right or power is necessary to carry out the obligations of
the nearest relative under that Act, or
(i) by
any person with written authorization from the individual to act on the
individual’s behalf.
(2) Any notice required to be given to an
individual under this Act may be given to the person entitled to exercise the
individual’s rights or powers referred to in subsection (1).
RSA 2000 cH‑5 s104;2003 c23
s5;2007 c35 s25;
2008 cA‑4.2 s131
Immunity from suit
105 No action lies and no proceeding may be
brought against the Crown, a custodian or any person acting for or under the
direction of a custodian for damages resulting from anything done or not done
by that person in good faith while carrying out duties or exercising powers
under this Act including, without limitation, any failure to do something where
a person has discretionary authority to do something but does not do it.
1999 cH‑4.8 s105
Protection of employee
106(1) A
custodian or a person acting on behalf of a custodian must not take any action
against its affiliate to negatively affect its status as an affiliate of the
custodian because the affiliate, acting in good faith,
(a) has
exercised or may exercise a right under section 83, or
(b) has
properly disclosed information in accordance with this Act.
(2) A person who contravenes subsection (1) is
guilty of an offence and liable to a fine of not more than $10 000.
1999 cH‑4.8 s106
Offences and penalties
107(1) No
custodian or affiliate of a custodian shall knowingly
(a) alter,
falsify or conceal any record, or direct another person to do so, with the
intent to evade a request for access to the record, or
(b) destroy
any record that is subject to this Act, or direct another person to do so, with
the intent to evade a request for access to the record.
(2) No person shall knowingly
(a) collect,
use, disclose or create health information in contravention of this Act,
(b) gain
or attempt to gain access to health information in contravention of this Act,
(c) make
a false statement to, or mislead or attempt to mislead, the Commissioner or
another person performing the duties, powers or functions of the Commissioner
or other person under this Act,
(d) obstruct
the Commissioner or another person in the performance of the duties, powers or
functions of the Commissioner or other person under this Act,
(e) fail
to comply with an order made by the Commissioner under section 80 or by an
adjudicator under section 101, or
(f) use
individually identifying health information to market any service for a
commercial purpose or to solicit money unless the individual who is the subject
of the health information has specifically consented to its use for that
purpose.
(3) No researcher shall knowingly breach the terms
and conditions of an agreement entered into with a custodian pursuant to
section 54.
(4) No information manager shall knowingly breach
the terms and conditions of an agreement entered into with a custodian pursuant
to section 66.
(5) No person to whom non‑identifying health
information is disclosed and who intends to use the information to perform data
matching shall fail to comply with section 32(2).
(5.1) No person shall knowingly disclose health
information to which this Act applies pursuant to a subpoena, warrant or order
issued or made by a court, person or body having no jurisdiction in Alberta to
compel the production of information or pursuant to a rule of court that is not
binding in Alberta.
(6) A person who contravenes this section, except
subsection (5.1), is guilty of an offence and liable to a fine of not more than
$50 000.
(6.1) Despite subsection (6), a person who uses
prescribed health information in contravention of section 56.4 is guilty of an
offence and liable to a fine of not more than $100 000.
(7) A person who contravenes subsection (5.1) is
guilty of an offence and liable
(a) in
the case of an individual, to a fine of not less than $2000 and not more than
$10 000, and
(b) in
the case of any other person, to a fine of not less than $200 000 and not
more than $500 000.
(8) A prosecution under this Act may be commenced
within 2 years after the commission of the alleged offence, but not afterwards.
RSA 2000 cH‑5 s107;2006 c18
s17;2009 c25 s24
Regulations
108(1) The
Lieutenant Governor in Council may make regulations
(a) respecting
the designation of an affiliate for the purposes of section 1(1)(a)(v);
(b) designating
a health information repository as an affiliate for the purposes of section
1(1)(a)(vii);
(c) designating
a health services provider as a custodian, or a class of health services
providers, the members of which are to be custodians, for the purposes of
section 1(1)(f)(ix);
(d) designating
individuals, boards, councils, committees, commissions, panels, agencies,
corporations or other entities as custodians for the purposes of section
1(1)(f)(xiv);
(e) designating
a Community Board as a custodian for the purposes of section 1(1)(f)(xvi);
(f) specifying
information respecting a health services provider for the purposes of section
1(1)(i)(ii)(L);
(g) excluding
a service from the definition of health service for the purposes of section
1(1)(m);
(h) describing
registration information for the purposes of section 1(1)(u);
(i) for
the purposes of section 4, expressly providing that another Act or a
regulation, or a provision of it, prevails despite this Act;
(j) authorizing
persons other than custodians to require individuals to provide their personal
health numbers;
(k) respecting
the requirements of a consent or a revocation of a consent that is provided
electronically for the purposes of section 34;
(l) respecting
the disclosure of individually identifying registration information by
custodians to persons who are not custodians for the purposes of section 36(c);
(m) prescribing
information for the purposes of section 46(1)(b)(ii);
(n) respecting
the disclosure of health information or the performance of data matching or
other services by a health information repository under section 53(3);
(o) respecting
the retention, disposal and archival storage of records for the purposes of
section 60;
(p) respecting
the administrative, technical and physical safeguards that a custodian must
maintain in respect of health information pursuant to section 60;
(q) respecting
the stripping, encoding or other transformation of individually identifying
health information to create non‑identifying health information pursuant
to section 65;
(r) respecting
an agreement referred to in section 66;
(s) respecting
the designation of an agency, corporation or other entity as a health
information repository;
(t) respecting
the disclosure of individually identifying health information by a custodian to
a health information repository under section 72.2;
(u) respecting
the powers, duties and functions of a health information repository;
(v) respecting
fees payable for services provided under Part 2 and providing for circumstances
in which applicants may be excused from paying all or part of a fee;
(w) defining
terms and phrases that are used but not defined in this Act.
(2) The Minister may make regulations
(a) designating
bodies as research ethics boards for the purposes of sections 48 to 56;
(a.1) specifying
the information that is to be included in a research proposal under section 49;
(b) respecting
agreements to be entered into by custodians and information managers pursuant
to section 66.
RSA 2000 cH‑5 s108;2006 c18
s18;2009 c25 s25
Review of Act
109(1) A
special committee of the Legislative Assembly must begin a comprehensive review
of this Act within 3 years after the coming into force of this section and must
submit to the Legislative Assembly, within one year after beginning the review,
a report that includes the committee’s recommended amendments.
(2) The review referred to in subsection (1) must
include a review of the application of this Act
(a) to
departments of the Government of Alberta,
(b) to
local public bodies as defined in the Freedom of Information and Protection
of Privacy Act, and
(c) to
any other entity that is not a custodian and has information about the health
of an individual in its custody or under its control.
1999 cH‑4.8 s109
Part 9
Consequential Amendments, Paramountcy and Coming into Force
110 to 124 (These
sections make consequential amendments to other Acts. The amendments have been
incorporated in those Acts.)
Coming into force
125 This Act comes into force on Proclamation.
1999 cH‑4.8 s125
(NOTE: Proclaimed in force
April 25, 2001.)