Health Information Act

HEALTH INFORMATION ACT Chapter H‑5 Table of Contents Part 1 Introductory Matters 1 Interpretation 2 Purposes of Act 3 Scope of Act 4 Inconsistency or conflict with another enactment 5 Application of Parts of Act 6 Act binds custodian acting under another enactment Part 2 Individual ’ s Right to Access Individual ’ s Health Information 7 Right of individual to access individual ’ s health information 8 How to make a request 9 Abandoned request 10 Duty to assist applicants 11 Right to refuse access to health information 12 Time limit for responding to a request for access 13 Correction or amendment of health information 14 Refusal to correct or amend information 15 Extending time 16 Request under s8 or s13 deemed to be a request under Access to Information Act or Protection of Privacy Act 17 Existing procedures still available Part 3 Collection of Health Information 18 Prohibition re collection of health information 19 Collection of non‑identifying health information 20 Collection of individually identifying health information 21 Collection of personal health number 22 Duty to collect health information from subject individual 23 Use of device to collect health information 24 Collection of health information by affiliate Part 4 Use of Health Information 25 Prohibition re use of health information 26 Use of non‑identifying health information 27 Use of individually identifying health information 28 Use of health information by affiliate 29 Confidentiality of non‑recorded information 30 Use of personal health number by non‑custodian Part 5 Disclosure of Health Information Division 1 General Disclosure Rules 31 Prohibition re disclosure of health information 32 Disclosure of non‑identifying health information 33 Disclosure of information to individual who is subject of information 34 Disclosure of individually identifying health information to be with consent 35 Disclosure of diagnostic, treatment and care information 36 Disclosure of registration information 37.1 Disclosure to prevent or limit fraud or abuse of health services 37.3 Disclosure to protect public health and safety 38 Disclosure for purpose of storage 39 Disclosure by Minister and Department 40 Disclosure to ministerial custodian 41 Maintaining certain disclosure information 42 Notification of purpose of and authority for disclosure 43 Disclosure of health information by affiliate 44 Confidentiality of non‑recorded information 45 Duty of custodian Division 2 Disclosure for Health System Purposes 46 Disclosure to Minister or Department 47 Disclosure to other custodians Division 3 Disclosure for Research Purposes 49 Proposed research protocol 50 Role of research ethics board 50.1 Publication of response 51 Bar to research 52 Application for disclosure of health information or to perform data matching 53 Conditions and consents 54 Agreement between custodian and researcher 55 Consent for additional information 56 Court order Part 5.1 Alberta Electronic Health Record 56.1 Definitions 56.2 Purpose 56.21 Department authorities and duties re Alberta EHR 56.3 Making health information accessible 56.4 Duties in making health information accessible via Alberta EHR 56.5 Accessing health information via the Alberta EHR 56.6 Maintaining record of Alberta EHR access 56.61 Access request for health information accessible via the Alberta EHR 56.62 Authorized custodian duties, authority 56.7 Multi‑disciplinary data stewardship committee 56.71 Termination of agreement and protocol 56.8 Regulations Part 6 Duties and Powers of Custodians Relating to Health Information Division 1 General Duties and Powers 57 Duty to collect, use or disclose health information with highest degree of anonymity possible 58 Duty to collect, use or disclose health information in a limited manner 60 Duty to protect health information 60.1 Duty to notify 61 Duty to ensure accuracy of health information 62 Duty to identify responsible affiliates 63 Duty to establish or adopt policies and procedures 64 Duty to prepare privacy impact assessment 65 Power to transform health information 66 Power to enter agreement with information manager 67 Power to charge fees Division 2 Data Matching 68 Prohibition 69 Data matching by custodian or health information repository 70 Data matching by custodians or health information repositories 71 Data matching by custodian or health information repository and non‑custodian 72 Data matching for research Part 6.1 Health Information Repository 72.1 Designation 72.2 Disclosure of information 72.3 Powers and duties of repository 72.4 Correction or amendment of health information by repository 72.5 Consultation with Commissioner Part 7 Commissioner Division 1 Reviews by Commissioner 73 Right to ask for a review 74 How to ask for a review 75 Notifying others of review 76 Mediation may be authorized 77 Inquiry by Commissioner 78 Refusal to conduct inquiry 79 Burden of proof 80 Commissioner ’ s orders 81 No appeal 82 Duty to comply with order Division 2 Disclosure to Commissioner 83 Disclosure to Commissioner Division 3 Additional Powers and Duties of Commissioner 84 General powers of Commissioner 85 Power to resolve complaints 85.1 Power to order notification under section 60.1 86 Advice and recommendations 87 Power to authorize a custodian to disregard requests 88 Powers of Commissioner in conducting investigations or inquiries 89 Statements made to Commissioner not admissible in evidence 90 Privileged information 91 Restrictions on disclosure of information by Commissioner and staff 92 Immunity from suit 93 Delegation by Commissioner 94 Role of Ombudsman 95 Annual report of Commissioner Division 4 Conflict of Interest of Commissioner 96 Adjudicator 97 Powers, duties and functions of adjudicator 98 Review where Commissioner in conflict 99 How to ask for a review 100 Notifying others of review 101 Conduct and outcome of review Part 8 General Provisions 102 Oaths 103 Manner of giving notice 104 Exercise of rights by other persons 105 Immunity from suit 106 Protection of employee 107 Offences and penalties 108 Regulations 109 Review of Act Part 9 Consequential Amendments, Paramountcy and Coming into Force 110‑124 Consequential amendments 125 Coming into force HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Alberta, enacts as follows: Part 1 Introductory Matters Interpretation 1 (1) In this Act, (a) “affiliate”, in relation to a custodian, means (i) an individual employed by the custodian, (ii) a person who performs a service for the custodian as an appointee, volunteer or student or under a contract or agency relationship with the custodian, (iii) a health services provider who is exercising the right to admit and treat patients at an approved hospital under the Provincial Health Agencies Act , (iv) an information manager as defined in section 66(1), and (v) a person who is designated under the regulations to be an affiliate, but does not include (vi) an agent as defined in the Health Insurance Premiums Act , or (vii) a health information repository other than a health information repository that is designated in the regulations as an affiliate; (b) “applicant” means an individual who makes a request for access to a record under section 8(1) or for a correction or amendment of health information under section 13(1); (c) “audit” means a financial, clinical or other formal or systematic examination or review of a program, activity or other matter under this Act; (d) “collect” means to gather, acquire, receive or obtain health information; (e) “Commissioner” means the Information and Privacy Commissioner appointed under Part 2 of the Access to Information Act ; (f) “custodian” means (i) a hospital operator of a health services sector in an approved hospital under the Provincial Health Agencies Act other than a hospital operator that is a provincial health agency, regional health authority or provincial health corporation under the Provincial Health Agencies Act ; (ii) the operator of a continuing care home as defined in the Continuing Care Act other than a continuing care home owned and operated by a provincial health agency, regional health authority or provincial health corporation under the Provincial Health Agencies Act ; (ii.1) an ambulance operator as defined in the Emergency Health Services Act ; (iii) a provincial health corporation as defined in the Provincial Health Agencies Act ; (iv) a provincial health agency, regional health authority or provincial health corporation under the Provincial Health Agencies Act ; (v) a community health council as defined in the Provincial Health Agencies Act ; (vi) a subsidiary health corporation as defined in the Provincial Health Agencies Act ; (vii) repealed 2008 cH‑4.3 s18; (viii) a board, council, committee, commission, panel or agency that is created by a custodian referred to in subclauses (i) to (vi), if all or a majority of its members are appointed by, or on behalf of, that custodian, but does not include a committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of section 9 of the Alberta Evidence Act ; (ix) a health services provider who is designated in the regulations as a custodian, or who is within a class of health services providers that is designated in the regulations for the purpose of this subclause; (ix.1) the Health Quality Council of Alberta; (ix.2) the Canadian Centre of Recovery Excellence; (x) a licensed pharmacy as defined in the Pharmacy and Drug Act ; (xi) repealed 2009 c25 s2; (xii) the Department; (xii.1) the department administered by the Minister referred to in subclause (xiii.1); (xii.2) the department administered by the Minister referred to in subclause (xiii.2); (xii.3) the department administered by the Minister referred to in subclause (xiii.3); (xiii) the Minister; (xiii.1) the Minister responsible for the Mental Health Services Protection Act ; (xiii.2) the Minister responsible for the Health Facilities Act ; (xiii.3) the Minister responsible for the Continuing Care Act ; (xiv) an individual or board, council, committee, commission, panel, agency, corporation or other entity designated in the regulations as a custodian, (xv) repealed 2008 cH‑4.3 s18, (xvi) repealed 2013 cB‑7.5 s11; (g) “data matching” means the creation of individually identifying health information by combining individually identifying or non‑identifying health information or other information from 2 or more electronic databases, without the consent of the individuals who are the subjects of the information; (h) “Department” means the Department administered by the Minister; (h.1) “departmental custodian” means a custodian referred to in clause (f)(xii), (xii.1), (xii.2) or (xii.3); (i) “diagnostic, treatment and care information” means information about any of the following: (i) the physical and mental health of an individual; (ii) a health service provided to an individual, including the following information respecting a health services provider who provides a health service to that individual: (A) name; (B) business title; (C) business mailing address and business electronic address; (D) business telephone number and business facsimile number; (E) type of health services provider; (F) licence number or any other number assigned to the health services provider by a health professional body to identify that health services provider; (G) profession; (H) job classification; (I) employer; (J) municipality in which the health services provider’s practice is located; (K) provincial service provider identification number that is assigned to the health services provider by the Minister to identify the health services provider; (L) any other information specified in the regulations; (iii) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance; (iv) a drug as defined in the Pharmacy and Drug Act provided to an individual; (v) a health care aid, device, product, equipment or other item provided to an individual pursuant to a prescription or other authorization; (vi) the amount of any benefit paid or payable under the Alberta Health Care Insurance Act or any other amount paid or payable in respect of a health service provided to an individual, and includes any other information about an individual that is collected when a health service is provided to the individual, but does not include information that is not written, photographed, recorded or stored in some manner in a record; (j) repealed 2006 c18 s2; (k) “health information” means one or both of the following: (i) diagnostic, treatment and care information; (ii) registration information; (k.1) “health information repository” means an agency, corporation or other entity designated by the Minister to act as a health information repository in accordance with Part 6.1; (l) “health professional body” means a body that regulates the members of a health profession or health discipline pursuant to an Act; (m) “health service” means a service that is provided to an individual for any of the following purposes: (i) protecting, promoting or maintaining physical and mental health; (ii) preventing illness; (iii) diagnosing and treating illness; (iv) rehabilitation; (v) caring for the health needs of the ill, disabled, injured or dying, but does not include a service excluded by the regulations; (n) “health services provider” means an individual who provides health services; (o) repealed 2009 c25 s2; (p) “individually identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information can be readily ascertained from the information; (q) “Minister” means the Minister of Primary and Preventative Health Services; (q.1) “ministerial custodian” means a custodian referred to in clause (f)(xiii), (xiii.1), (xiii.2) or (xiii.3); (r) “non‑identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information cannot be readily ascertained from the information; (s) “personal health number” means the number assigned to an individual by the Department to uniquely identify the individual; (t) “record” means a record of health information in any form and includes notes, images, audiovisual recordings, x‑rays, books, documents, maps, drawings, photographs, letters, vouchers and papers and any other information that is written, photographed, recorded or stored in any manner, but does not include software or any mechanism that produces records; (u) “registration information” means information relating to an individual that falls within the following general categories and is more specifically described in the regulations: (i) demographic information, including the individual’s personal health number; (ii) location information; (iii) telecommunications information; (iv) residency information; (v) health service eligibility information; (vi) billing information, but does not include information that is not written, photographed, recorded or stored in some manner in a record; (v) “research” means academic, applied or scientific research that necessitates the use of individually identifying health information; (v.1) “research ethics board” means a body designated by the regulations as a research ethics board; (w) “use” means to apply health information for a purpose and includes reproducing the information, but does not include disclosing the information. (2) Where a custodian provides services that are not health services, this Act does not apply (a) to the custodian in respect of those other services, or (b) to information relating to those other services. (3) A custodian who is an affiliate of another custodian is deemed not to be a custodian while acting in the capacity of an affiliate. (4) For the purposes of this Act, the information specified in subsection (1)(i)(ii) respecting a health services provider is deemed to be individually identifying health information about the individual who received the health service from the health services provider and not individually identifying health information about the health services provider. RSA 2000 cH‑5 s1;RSA 2000 cP‑13 s47.1;2006 c18 s2;2006 c25 s24; 2007 c18 s2;2008 cE‑6.6 s52;2008 cH‑4.3 s18;2009 c25 s2; 2011 cH‑7.2 s26;2013 cB‑7.5 s11;2022 cC‑26.7 s70;2023 c9 s11; 2024 c10 s20;2024 c16 s8;2025 c10 s25;2025 c21 s7(2);AR 141/2025 Purposes of Act 2 The purposes of this Act are (a) to establish strong and effective mechanisms to protect the privacy of individuals with respect to their health information and to protect the confidentiality of that information, (b) to enable health information to be shared and accessed, where appropriate, to provide health services and to manage the health system, (c) to prescribe rules for the collection, use and disclosure of health information, which are to be carried out in the most limited manner and with the highest degree of anonymity that is possible in the circumstances, (d) to provide individuals with a right of access to health information about themselves, subject to limited and specific exceptions as set out in this Act, (e) to provide individuals with a right to request correction or amendment of health information about themselves, (f) to establish strong and effective remedies for contraventions of this Act, and (g) to provide for independent reviews of decisions made by custodians under this Act and the resolution of complaints under this Act. 1999 cH‑4.8 s2 Scope of Act 3 This Act (a) does not limit the information otherwise available by law to a party to legal proceedings, (b) does not affect the power of any court or tribunal in Canada to compel a witness to testify or to compel the production of documents, and (c) does not prohibit the transfer, storage or destruction of a record in accordance with an enactment of Alberta or Canada. RSA 2000 cH‑5 s3;2006 c18 s3 Inconsistency or conflict with another enactment 4 If a provision of this Act is inconsistent or in conflict with a provision of another Act or of a regulation, the provision of this Act prevails unless (a) another Act, or (b) a regulation under this Act expressly provides that the other Act or regulation, or a provision of it, prevails despite this Act. 1999 cH‑4.8 s4 Application of Parts of Act 5 (1) This Act, except Part 3, applies in respect of health information collected before or after the coming into force of this Act. (2) Part 3 of this Act applies only in respect of health information collected after the coming into force of this Act. 1999 cH‑4.8 s5 Act binds custodian acting under another enactment 6 A custodian that collects, uses or discloses health information pursuant to another enactment must comply with this Act. 1999 cH‑4.8 s6 Part 2 Individual ’ s Right to Access Individual ’ s Health Information Right of individual to access individual ’ s health information 7 (1) An individual has a right of access to any record containing health information about the individual that is in the custody or under the control of a custodian. (2) The right of access to a record does not extend to information in respect of which a custodian is authorized or required to refuse access under section 11, but if that information can reasonably be severed from a record, an individual has a right of access to the remainder of the record. (3) The right of access to a record is subject to the payment of any fee required by the regulations. 1999 cH‑4.8 s7 How to make a request 8 (1) To obtain access to a record, an individual must make a request to the custodian that the individual believes has custody or control of the record. (2) A custodian that has received a request for access to a record under subsection (1) may require the applicant to submit the request in writing. (3) In a request, the applicant may ask (a) for a copy of the record, or (b) to examine the record. 1999 cH‑4.8 s8 Abandoned request 9 (1) Where a custodian contacts an applicant in writing respecting the applicant’s request, including (a) seeking further information from the applicant that is necessary to process the request, or (b) requesting the applicant to pay a fee or to agree to pay a fee, and the applicant fails to respond to the custodian, as requested by the custodian, within 30 days after being contacted, the custodian may, by notice in writing to the applicant, declare the request abandoned. (2) A notice declaring a request abandoned must state that the applicant may ask for a review of that decision by the Commissioner. 1999 cH‑4.8 s9 Duty to assist applicants 10 A custodian that has received a request for access to a record under section 8(1) (a) must make every reasonable effort to assist the applicant and to respond to each applicant openly, accurately and completely, (b) must create a record for an applicant if (i) the record can be created from information that is in electronic form and is in the custody or under the control of the custodian, using its normal computer hardware and software and technical expertise, and (ii) creating the record would not unreasonably interfere with the operations of the custodian, and (c) must provide, at the request of an applicant and if reasonably practicable, an explanation of any term, code or abbreviation used in the record. 1999 cH‑4.8 s10 Right to refuse access to health information 11 (1) A custodian may refuse to disclose health information to an applicant (a) if the disclosure could reasonably be expected (i) to result in immediate and grave harm to the applicant’s mental or physical health or safety, (ii) to threaten the mental or physical health or safety of another individual, or (iii) to pose a threat to public safety, (b) if the disclosure could reasonably lead to the identification of a person who provided health information to the custodian explicitly or implicitly in confidence and in circumstances in which it was appropriate that the name of the person who provided the information be kept confidential, (c) if the disclosure could reasonably be expected to reveal (i) advice, proposals, recommendations, analyses or policy options developed by or for a member of the Executive Council, or (ii) consultations or deliberations involving a member of the Executive Council or the member’s staff, (d) if the disclosure could reasonably be expected to reveal advice, proposals, recommendations, analyses or policy options developed by or for a custodian referred to in section 1(1)(f)(iii) or (iv), or (e) if the information relates to (i) procedures or techniques relating to audits to be conducted or diagnostic tests or assessments to be given, (ii) details of specific audits to be conducted or of specific tests or assessments to be given, or (iii) standardized diagnostic tests or assessments used by a custodian, including intelligence tests, and disclosure of the information could reasonably be expected to prejudice the use or results of particular audits, diagnostic tests or assessments. (2) A custodian must refuse to disclose health information to an applicant (a) if the health information is about an individual other than the applicant, unless the health information was originally provided by the applicant in the context of a health service being provided to the applicant, (b) if the health information sets out procedures or contains results of an investigation, a discipline proceeding, a practice visit or an inspection relating to a health services provider, (c) if the health information would reveal the substance of deliberations of the Executive Council or any of its committees or of the Treasury Board or any of its committees, including any advice, recommendation, policy considerations or draft legislation or regulations submitted or prepared for submission to the Executive Council or any of its committees or to the Treasury Board or any of its committees, unless the health information (i) has been in existence for 15 years or more, (ii) is part of a record of a decision made by the Executive Council or any of its committees on an appeal under an Act, or (iii) is part of a record the purpose of which is to present background facts to the Executive Council or any of its committees or to the Treasury Board or any of its committees for consideration in making a decision where (A) the decision has been made public, (B) the decision has been implemented, or (C) 5 years or more have passed since the decision was made or considered, or (d) if the disclosure is prohibited by another enactment of Alberta. RSA 2000 cH‑5 s11;2020 c35 s38;2023 c9 s11 Time limit for responding to a request for access 12 (1) A custodian must make every reasonable effort to respond to a request under section 8(1) within 30 days after receiving the request or within any extended period under section 15. (2) In a response under subsection (1), the custodian must tell the applicant (a) whether access to a record or part of it is granted or refused, (b) if access to the record or part of it is granted, where, when and how access will be given, and (c) if access to the record or part of it is refused, (i) the reasons for the refusal and the provision of this Act on which the refusal is based, (ii) the name, title, business address and business telephone number of an affiliate of the custodian who can answer the applicant’s questions about the refusal, and (iii) that the applicant may ask for a review of that decision by the Commissioner. (3) The failure of the custodian to respond to a request under section 8(1) within the 30‑day period or any extended period referred to in subsection (1) is to be treated as a decision to refuse access to the record. 1999 cH‑4.8 s12 Correction or amendment of health information 13 (1) An individual who believes there is an error or omission in the individual’s health information may in writing request the custodian that has the information in its custody or under its control to correct or amend the information. (2) Within 30 days after receiving a request under subsection (1) or within any extended period under section 15, the custodian must decide whether it will make or refuse to make the correction or amendment. (3) If the custodian agrees to make the correction or amendment, the custodian must within the 30‑day period or any extended period referred to in subsection (2) (a) make the correction or amendment, (b) give written notice to the applicant that the correction or amendment has been made, and (c) notify any person to whom that information has been disclosed during the one‑year period before the correction or amendment was requested that the correction or amendment has been made. (4) The custodian is not required to provide the notification referred to in subsection (3)(c) where (a) the custodian agrees to make the correction or amendment but believes that the applicant will not be harmed if the notification under subsection (3)(c) is not provided, and (b) the applicant agrees. (5) If the custodian refuses to make the correction or amendment, the custodian must within the 30‑day period or any extended period referred to in subsection (2) give written notice to the applicant that the custodian refuses to make the correction or amendment and of the reasons for the refusal. (6) A custodian may refuse to make a correction or amendment that has been requested in respect of (a) a professional opinion or observation made by a health services provider about the applicant, or (b) a record that was not originally created by that custodian. (7) The failure of the custodian to respond to a request in accordance with this section within the 30‑day period or any extended period referred to in subsection (2) is to be treated as a decision to refuse to make the correction or amendment. 1999 cH‑4.8 s13 Refusal to correct or amend information 14 (1) Where a custodian refuses to make a correction or amendment under section 13, the custodian must tell the applicant that the applicant may elect to do either of the following, but may not elect both: (a) ask for a review of the custodian’s decision by the Commissioner; (b) submit a statement of disagreement setting out in 500 words or less the requested correction or amendment and the applicant’s reasons for disagreeing with the decision of the custodian. (2) An applicant who elects to submit a statement of disagreement must submit the statement to the custodian within 30 days after the written notice of refusal has been given to the applicant under section 13(5) or within any extended period under section 15(3). (3) On receiving the statement of disagreement, the custodian must (a) if reasonably practicable, attach the statement to the record that is the subject of the requested correction or amendment, and (b) provide a copy of the statement of disagreement to any person to whom the custodian has disclosed the record in the year preceding the applicant’s request for the correction or amendment. 1999 cH‑4.8 s14 Extending time 15 (1) The custodian may extend the time for responding to a request under section 8(1) or 13(1) for an additional period of up to 30 days or, with the Commissioner’s permission, for a longer period if (a) the request does not give enough detail to enable the custodian to identify the record that is requested or to be corrected or amended, (b) a large number of records are involved in the request and responding within the period set out in section 12(1) or 13(2), as the case may be, would unreasonably interfere with the operations of the custodian, or (c) more time is needed to consult with another custodian before deciding whether to grant access to a record or to make the correction or amendment requested. (2) If the time is extended under subsection (1), the custodian must tell the applicant (a) the reason for the extension, (b) when a response can be expected, and (c) that the applicant may make a complaint to the Commissioner about the extension. (3) The Commissioner may extend the time within which an applicant must submit the statement of disagreement under section 14(2) if in the opinion of the Commissioner (a) it is unreasonable to expect the applicant to submit the statement within the period set out in section 14(2), or (b) it is fair to extend the time for any other reason. 1999 cH‑4.8 s15 Request under s8 or s13 deemed to be a request under Access to Information Act or Protection of Privacy Act 16 (1) If a written request is made under section 8(1) for access to a record that contains information to which the Access to Information Act applies, the part of the request that relates to that information is deemed to be a request under section 7(1) of the Access to Information Act and that Act applies to that part of the request as if it had been made under section 7(1) of that Act. (2) If a written request is made under section 13(1) to correct or amend information to which the Protection of Privacy Act applies, the request is deemed to be a request under section 7(1) of the Protection of Privacy Act and that Act applies to the request as if it had been made under section 7(1) of that Act. (3) This section does not apply if the custodian that receives the request is not a public body as defined in the Protection of Privacy Act . RSA 2000 cH-5 s16;AR 141/2025 Existing procedures still available 17 An individual is not limited to the procedure set out in this Part to request access to health information about the individual if another procedure is available. 1999 cH‑4.8 s17 Part 3 Collection of Health Information Prohibition re collection of health information 18 No custodian shall collect health information except in accordance with this Act. 1999 cH‑4.8 s18 Collection of non‑identifying health information 19 A custodian may collect non‑identifying health information for any purpose. 1999 cH‑4.8 s19 Collection of individually identifying health information 20 A custodian may collect individually identifying health information (a) if the collection of that information is expressly authorized by an enactment of Alberta or Canada, or (b) if that information relates directly to and is necessary to enable the custodian to carry out a purpose that is authorized under section 27. 1999 cH‑4.8 s20 Collection of personal health number 21 (1) Only the following have the right to require an individual to provide the individual’s personal health number: (a) custodians; (b) persons authorized by the regulations to do so. (2) When requesting a personal health number from an individual, the person referred to in subsection (1) must advise the individual of the person’s authority under subsection (1). (3) An individual may refuse to provide the individual’s personal health number where the person requesting it is not a person referred to in subsection (1). 1999 cH‑4.8 s21 Duty to collect health information from subject individual 22 (1) A custodian must collect individually identifying health information directly from the individual who is the subject of the information unless subsection (2) applies. (2) A custodian may collect individually identifying health information from a person other than the individual who is the subject of the information in the following circumstances: (a) where the individual who is the subject of the information authorizes collection of the information from someone else; (b) where the individual who is the subject of the information is unable to provide the information and the custodian collects the information from a person referred to in section 104(1)(c) to (i) who is acting on behalf of that individual; (c) where the custodian believes, on reasonable grounds, that collection from the individual who is the subject of the information would prejudice (i) the interests of the individual, (ii) the purposes of collection, or (iii) the safety of any other individual, or would result in the collection of inaccurate information; (d) where collection from the individual who is the subject of the information is not reasonably practicable; (e) where collection is for any of the following purposes: (i) assembling a family or genetic history where the information collected is to be used in the context of providing a health service to the individual who is the subject of the information; (ii) determining the eligibility of an individual to participate in a program of or to receive a benefit, product or health service from a custodian and the information is collected in the course of processing an application made by or for the individual who is the subject of the information; (iii) verifying the eligibility of an individual who is participating in a program of or receiving a benefit, product or health service from a custodian to participate in the program or to receive the benefit, product or service; (iv) informing the Public Trustee or a Public Guardian about clients or potential clients; (e.1) where use of the information is authorized by section 27(1)(d); (e.2) where the custodian is conducting data matching for a purpose authorized under section 27; (f) where the information is available to the public; (g) where disclosure of the information is authorized under Part 5; (h) where disclosure of the information is authorized by an enactment of Alberta or Canada. (3) When collecting individually identifying health information about an individual directly from the individual, the custodian must take reasonable steps to inform the individual (a) of the purpose for which the information is collected, (b) of the specific legal authority for the collection, and (c) of the title, business address and business telephone number of an affiliate of the custodian who can answer the individual’s questions about the collection. RSA 2000 cH‑5 s22;2008 cA‑4.2 s131;2009 c25 s3; 2020 c35 s39 Use of device to collect health information 23 A custodian that collects health information from an individual using any device that may not be visible to the individual must, before collecting the health information, obtain the written consent of the individual to use the device. RSA 2000 cH-5 s23;2020 c35 s40 Collection of health information by affiliate 24 An affiliate of a custodian must not collect health information in any manner that is not in accordance with the affiliate’s duties to the custodian. 1999 cH‑4.8 s24 Part 4 Use of Health Information Prohibition re use of health information 25 No custodian shall use health information except in accordance with this Act. 1999 cH‑4.8 s25 Use of non‑identifying health information 26 A custodian may use non‑identifying health information for any purpose. 1999 cH‑4.8 s26 Use of individually identifying health information 27 (1) A custodian may use individually identifying health information in its custody or under its control for the following purposes: (a) providing health services; (b) determining or verifying the eligibility of an individual to receive a health service; (c) conducting investigations, discipline proceedings, practice visits or inspections relating to the members of a health profession or health discipline; (d) conducting research or performing data matching or other services to facilitate another person’s research (i) if the custodian or researcher has submitted a proposed research protocol to a research ethics board in accordance with section 49, (ii) if the research ethics board is satisfied as to the matters referred to in section 50(1)(b), (iii) if the custodian or researcher has complied with or undertaken to comply with the conditions, if any, suggested by the research ethics board, and (iv) where the research ethics board recommends that consents should be obtained from the individuals who are the subjects of the health information to be used in the research, if those consents have been obtained; (e) providing for health services provider education; (f) carrying out any purpose authorized by an enactment of Alberta or Canada; (g) for internal management purposes, including planning, resource allocation, policy development, quality improvement, monitoring, audit, evaluation, reporting, obtaining or processing payment for health services and human resource management. (2) A custodian referred to in section 1(1)(f)(iii), (iv), (ix.1), (ix.2), (xii), (xii.1), (xii.2), (xii.3), (xiii), (xiii.1), (xiii.2) and (xiii.3) may, in addition, use individually identifying health information in its custody or under its control to carry out the following functions within the geographic area in which the custodian has jurisdiction to promote the objectives for which the custodian is responsible: (a) planning and resource allocation; (b) health system management; (c) public health surveillance; (d) health policy development. RSA 2000 cH‑5 s27;2006 c18 s4;2009 c25 s4;2011 cH‑7.2 s26; 2020 c35 s41;2023 c9 s11;2024 c10 s20;2025 c10 s25 Use of health information by affiliate 28 An affiliate of a custodian must not use health information in any manner that is not in accordance with the affiliate’s duties to the custodian. 1999 cH‑4.8 s28 Confidentiality of non‑recorded information 29 A custodian that collects information described in section 1(1)(i), (o) or (u) that is not written, photographed, recorded or stored in some manner in a record may use the information only for the purpose for which the information was provided to the custodian. 1999 cH‑4.8 s29 Use of personal health number by non‑custodian 30 (1) A person who is authorized to require an individual to provide a personal health number pursuant to section 21(1)(b) may use that information only for the purpose for which the information was collected. (2) If there is an inconsistency or conflict between subsection (1) and a provision of the Personal Information Protection Act , subsection (1) prevails to the extent of that inconsistency or conflict. RSA 2000 cH‑5 s30;2020 c35 s42;AR 141/2025 Part 5 Disclosure of Health Information Division 1 General Disclosure Rules Prohibition re disclosure of health information 31 No custodian shall disclose health information except in accordance with this Act. 1999 cH‑4.8 s31 Disclosure of non‑identifying health information 32 (1) A custodian may disclose non‑identifying health information for any purpose. (2) If a disclosure under subsection (1) is to a person that is not a custodian, the custodian must inform the person that the person must notify the Commissioner of an intention to use the information for data matching before performing the data matching. 1999 cH‑4.8 s32 Disclosure of information to individual who is subject of information 33 A custodian may disclose individually identifying health information to the individual who is the subject of the information or to a person referred to in section 104(1)(c) to (i) who is acting on behalf of that individual. 1999 cH‑4.8 s33 Disclosure of individually identifying health information to be with consent 34 (1) Subject to sections 35 to 40, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure. (2) A consent referred to in subsection (1) must be provided in writing or electronically and must include (a) an authorization for the custodian to disclose the health information specified in the consent, (b) the purpose for which the health information may be disclosed, (c) the identity of the person to whom the health information may be disclosed, (d) an acknowledgment that the individual providing the consent has been made aware of the reasons why the health information is needed and the risks and benefits to the individual of consenting or refusing to consent, (e) the date the consent is effective and the date, if any, on which the consent expires, and (f) a statement that the consent may be revoked at any time by the individual providing it. (3) A disclosure of health information pursuant to this section must be carried out in accordance with the terms of the consent. (4) A revocation of a consent must be provided in writing or electronically. (5) A consent or revocation of a consent that is provided in writing must be signed by the person providing it. (6) A consent or revocation of a consent that is provided electronically is valid only if it complies with the requirements set out in the regulations. 1999 cH‑4.8 s34 Disclosure of diagnostic, treatment and care information 35 (1) A custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information (a) to another custodian for any or all of the purposes listed in section 27(1) or (2), as the case may be, (a.1) to the government of Canada or of another province or territory of Canada for that government’s use for health system planning and management and health policy development where (i) the individual is a resident of that other province or territory, or (ii) that government is otherwise responsible for payment for health services provided to the individual, (b) to a person who is responsible for providing continuing treatment and care to the individual, (c) to family members of the individual or to another person with whom the individual is believed to have a close personal relationship, if the information is given in general terms and concerns the presence, location, condition, diagnosis, progress and prognosis of the individual on the day on which the information is disclosed and the disclosure is not contrary to the express request of the individual, (d) where an individual is injured, ill or deceased, so that family members of the individual or another person with whom the individual is believed to have a close personal relationship or a friend of the individual can be contacted, if the disclosure is not contrary to the express request of the individual, (d.1) where an individual is deceased, to family members of the individual or to another person with whom the individual is believed to have had a close personal relationship, if the information relates to circumstances surrounding the death of the individual or to health services recently received by the individual and the disclosure is not contrary to the express request of the individual, (e) to an official of a penal or other custodial institution in which the individual is being lawfully detained if the purpose of the disclosure is to allow the provision of health services or continuing treatment and care to the individual, (f) to a person authorized to conduct an audit of the information if the person agrees in writing (i) to destroy the information at the earliest opportunity after the audit is concluded, and (ii) not to disclose the information to any other person, except as required to accomplish the audit or to report unlawful or improper conduct by the custodian or a health services provider, (g) to a committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of section 9 of the Alberta Evidence Act , (h) for the purpose of a court proceeding or a proceeding before a quasi‑judicial body to which the custodian is a party, (i) for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body having jurisdiction in Alberta to compel the production of information or with a rule of court binding in Alberta that relates to the production of information, (j) repealed 2006 c18 s5; (k) to another custodian where the custodian disclosing the information has a reasonable expectation that disclosure will detect or prevent fraud, limit abuse in the use of health services or prevent the commission of an offence under an enactment of Alberta or Canada, (l) to an officer of the Legislature if the information is necessary for the performance of the officer’s duties, (m) to any person if the custodian believes, on reasonable grounds, that the disclosure will avert or minimize (i) a risk of harm to the health or safety of a minor, or (ii) a significant risk of harm to the health or safety of any person, (n) if that individual lacks the mental capacity to provide a consent and, in the opinion of the custodian, disclosure is in the best interests of the individual, (o) to a descendant of a deceased individual, a person referred to in section 104(1)(c) to (i) who is acting on behalf of the descendant or a person who is providing health services to the descendant if, in the custodian’s opinion, (i) the disclosure is necessary to provide health services to the descendant, and (ii) the disclosure is restricted sufficiently to protect the privacy of the deceased individual, (p) if the disclosure is authorized or required by an enactment of Alberta or Canada, (q) to its successor where the successor is a custodian, (r) for the purpose of obtaining or processing payment for health services provided to the individual by a person that is required under a contract to pay for those services for that individual, or (s) to the College of Physicians and Surgeons of Alberta for the purpose of administering the Physician Prescribing Practices Program or any program to monitor prescribing practices that replaces it. (2) A committee to which health information is disclosed pursuant to subsection (1)(g) must not disclose the information to any other person except in accordance with subsection (3). (3) A committee referred to in subsection (2) may disclose non‑identifying health information to another committee that has as its primary purpose the carrying out of quality assurance activities within the meaning of section 9 of the Alberta Evidence Act .

(4) A custodian may disclose individually identifying diagnostic, treatment and care information to a health professional body for the purpose of an investigation, a discipline proceeding, a practice visit or an inspection if (a) the custodian has complied with any other enactment authorizing or requiring the custodian to disclose that information for that purpose, and (b) the health professional body agrees in writing (i) not to disclose the information to any other person except as authorized by or under the Act governing the health professional body, and (ii) repealed 2006 c18 s5. (5) A custodian may disclose individually identifying diagnostic, treatment and care information to a health professional body for the purpose of lodging a complaint with the health professional body. RSA 2000 cH‑5 s35;2003 c23 s2;2006 c18 s5;2009 c25 s5; 2013 cC‑12.5 s15;2016 c18 s8;2020 c35 s43 Disclosure of registration information 36 A custodian may disclose individually identifying registration information without the consent of the individual who is the subject of the information (a) for any of the purposes for which diagnostic, treatment and care information may be disclosed under section 35(1), (4) or (5), (b) to any person for the purpose of collecting or processing a fine or debt owing by the individual to the Government of Alberta or to a custodian, or (c) to a person who is not a custodian if the disclosure is in accordance with the requirements set out in the regulations. RSA 2000 cH‑5 s36;2020 c35 s44 37 Repealed 2009 c25 s6. Disclosure to prevent or limit fraud or abuse of health services 37.1 (1) A custodian may disclose individually identifying health information referred to in subsection (2) without the consent of the individual who is the subject of the information to a police service or the Minister of Justice where the custodian reasonably believes (a) that the information relates to the possible commission of an offence under a statute or regulation of Alberta or Canada, and (b) that the disclosure will detect or prevent fraud or limit abuse in the use of health services. (2) A custodian may disclose the following information under subsection (1): (a) the name of an individual; (b) the date of birth of an individual; (c) the personal health number of an individual; (d) the nature of any injury or illness of an individual; (e) the date on which a health service was sought or received by an individual; (f) the location where an individual sought or received a health service; (g) the name of any drug, as defined in the Pharmacy and Drug Act , provided to or prescribed for an individual and the date the drug was provided or prescribed; (h) information specified in section 1(1)(i)(ii) about a health services provider who provided a health service to an individual referred to in subsection (1). (3) , (4) Repealed 2009 c25 s7. RSA 2000 cP‑13 s47.1;2006 c18 s7;2009 c25 s7; 2013 c10 s34;2022 c21 s37 37.2 Repealed 2009 c25 s8. Disclosure to protect public health and safety 37.3 (1) A custodian may disclose individually identifying health information referred to in subsection (2) without the consent of the individual who is the subject of the information to a police service or the Minister of Justice where the custodian reasonably believes (a) that the information relates to the possible commission of an offence under a statute or regulation of Alberta or Canada, and (b) that the disclosure will protect the health and safety of Albertans. (2) A custodian may disclose the following information under subsection (1): (a) the name of an individual; (b) the date of birth of an individual; (c) the nature of any injury or illness of an individual; (d) the date on which a health service was sought or received by an individual; (e) the location where an individual sought or received a health service; (f) whether any samples of bodily substances were taken from an individual; (g) information specified in section 1(1)(i)(ii) about a health services provider who provided a health service to an individual referred to in subsection (1). (3) , (4) Repealed 2009 c25 s9. 2006 c18 s7;2009 c25 s9;2013 c10 s34;2022 c21 s37 Disclosure for purpose of storage 38 A custodian may disclose individually identifying health information without the consent of the individual who is the subject of the information to the Provincial Archives of Alberta or to any other archives that is subject to this Act, the Access to Information Act or the Protection of Privacy Act , for the purposes of permanent preservation and historical research if, in the opinion of the custodian, the information has enduring value. RSA 2000 cH-5 s38;AR 141/2025 Disclosure by Minister and Department 39 (1) A ministerial custodian or departmental custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information to another Minister of the Government of Alberta for the purpose of developing public policy. (2) A ministerial custodian or departmental custodian may enter into an agreement with (a) another Minister of the Government of Alberta or a Minister of the Government of Canada or of any other province or territory, or (b) a person or entity in accordance with the regulations made pursuant to the Alberta Health Care Insurance Act , respecting the disclosure to the person referred to in clause (a) or (b), as the case may be, of individually identifying registration information without the consent of the individual who is the subject of the information. RSA 2000 cH-5 s39;2024 c10 s20;2025 c10 s25 Disclosure to ministerial custodian 40 A custodian other than a ministerial custodian may disclose individually identifying health information to a ministerial custodian without the consent of the individual who is the subject of the information if the disclosure is necessary or desirable in the opinion of the custodian to enable the ministerial custodian to carry out its duties. RSA 2000 cH-5 s40;2024 c10 s20;2025 c10 s25 Maintaining certain disclosure information 41 (1) Subject to subsection (1.1), a custodian that discloses a record containing individually identifying diagnostic, treatment and care information under section 35(1), (4) or (5) must make a note of the following information: (a) the name of the person to whom the custodian discloses the information; (b) the date and purpose of the disclosure; (c) a description of the information disclosed. (1.1) The requirement to make a note under subsection (1) does not apply to a custodian that permits other custodians electronic access to individually identifying diagnostic, treatment and care information stored in an electronic system if, when the information is disclosed, the electronic system automatically keeps an electronic log of the following information: (a) a name or number that identifies the custodian to whom the information is disclosed; (b) the date and time that the information is disclosed; (c) a description of the information that is disclosed. (2) The information referred to in subsections (1) and (1.1) must be retained by the custodian for a period of 10 years following the date of the disclosure. (3) An individual who is the subject of information referred to in subsection (1) or (1.1) may ask a custodian for access to and a copy of the information, and Part 2 applies to the request. RSA 2000 cH‑5 s41;2006 c18 s8;2009 c25 s10;2016 c18 s8; 2020 c35 s45 Notification of purpose of and authority for disclosure 42 (1) A custodian that discloses individually identifying diagnostic, treatment and care information must inform the recipient in writing of the purpose of the disclosure and the authority under which the disclosure is made. (2) Subsection (1) does not apply where the disclosure is (a) to another custodian under section 35(1)(a), (b) to a ministerial custodian or departmental custodian under section 46, (c) to another custodian under section 47, (d) to a police service or the Minister of Justice under section 37.1, 37.2 or 37.3, or (e) to the individual who is the subject of the information. RSA 2000 cH‑5 s42;2006 c18 s9;2013 c10 s34;2022 c21 s37; 2024 c10 s20;2025 c10 s25 Disclosure of health information by affiliate 43 An affiliate of a custodian must not disclose health information in any manner that is not in accordance with the affiliate’s duties to the custodian. 1999 cH‑4.8 s43 Confidentiality of non‑recorded information 44 A custodian that collects information described in section 1(1)(i), (o) or (u) that is not written, photographed, recorded or stored in some manner in a record may disclose the information only for the purpose for which the information was provided to the custodian. 1999 cH‑4.8 s44 Duty of custodian 45 A custodian that discloses health information must make a reasonable effort to ensure that the person to whom the disclosure is made is the person intended and authorized to receive the information. 1999 cH‑4.8 s45 Division 2 Disclosure for Health System Purposes Disclosure to Minister or Department 46 (1) A ministerial custodian or departmental custodian may request another custodian to disclose individually identifying health information to them for any of the purposes listed in section 27(2) if (a) the ministerial custodian or departmental custodian, as the case may be, is authorized by an enactment of Alberta or Canada to obtain the information from the other custodian, or (b) the information requested relates to a health service provided by the other custodian and (i) the health service is fully or partially paid for by the department of the ministerial custodian requesting the information or by the departmental custodian, as the case may be, or is provided using financial, physical or human resources provided, administered or paid for by the department of the ministerial custodian requesting the information or by the departmental custodian, as the case may be, or (ii) the information is prescribed in the regulations as information a ministerial custodian or departmental custodian may request under this section. (2) If the requirements of subsection (1) are met, the custodian must disclose the information to the ministerial custodian or departmental custodian, as the case may be. (3) Repealed 2009 c25 s11. (4) Individually identifying health information may be disclosed under this section without the consent of the individual who is the subject of the information. (5) Where health information is requested under subsection (1)(b), the departmental custodian (a) must prepare a privacy impact assessment describing how disclosure of the health information may affect the privacy of the individual who is the subject of the information, and submit the privacy impact assessment to the Commissioner for review and comment, and (b) must consider the comments of the Commissioner, if any, made in response to the privacy impact assessment before disclosing the health information to a custodian referred to in section 1(1)(f)(iii) or (iv). RSA 2000 cH‑5 s46;2006 c18 s10;2009 c25 s11;2024 c10 s20; 2025 c10 s25 Disclosure to other custodians 47 (1) A custodian referred to in section 1(1)(f)(iii) or (iv) may request another custodian to disclose to the requesting custodian individually identifying health information for any of the purposes listed in section 27(2) (a) if the requesting custodian is authorized by an enactment of Alberta or Canada to obtain the information from the other custodian, or (b) if the information requested relates to a health service provided by the other custodian (i) that is fully or partially paid for by the requesting custodian, or (ii) that is provided using financial, physical or human resources provided or administered by the requesting custodian. (2) Where a request relates to information described in subsection (1)(b), the custodian receiving the request may refuse to disclose the information if disclosure could reasonably be expected (a) to result in immediate and grave harm to the mental or physical health or safety of the individual who is the subject of the information, (b) to threaten the mental or physical health or safety of another individual, or (c) to pose a threat to public safety. (3) If a custodian refuses to disclose information in accordance with subsection (2), (a) the custodian must provide the requesting custodian with non‑identifying health information in the form requested by that custodian, and (b) the requesting custodian may ask for a review of that refusal by the Commissioner. (4) In making a decision on a review under subsection (3)(b), the Commissioner must, if the custodian is a member of a health professional body, inform the health professional body of the review and provide an opportunity for that body to make comments to the Commissioner relating to the review. (5) Repealed 2009 c25 s12. (6) Individually identifying health information may be disclosed under this section without the consent of the individual who is the subject of the information. RSA 2000 cH‑5 s47;2009 c25 s12;2020 c35 s46 Division 3 Research 48 Repealed 2009 c25 s13. Proposed research protocol 49 A person who intends to conduct research using health information in the custody or under the control of a custodian or health information repository must submit a proposed research protocol to a research ethics board for review by that board containing (a) the information specified by the regulations, and (b) any other information required by the research ethics board. RSA 2000 cH‑5 s49;2006 c18 s11;2009 c25 s14; 2020 c35 s48 Role of research ethics board 50 (1) The research ethics board must (a) consider whether the researcher should be required to obtain consents for the disclosure of the health information to be used in the research from the individuals who are the subjects of the information, and (b) assess whether, in the opinion of the research ethics board, (i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest in protecting the privacy of the individuals who are the subjects of the health information to be used in the research, (ii) the researcher is qualified to carry out the research, (iii) adequate safeguards will be in place at the time the research will be carried out to protect the privacy of the individuals who are the subjects of the health information to be used in the research and the confidentiality of that information, and (iv) obtaining the consents referred to in clause (a) is unreasonable, impractical or not feasible. (2) In making an assessment under subsection (1)(b), the research ethics board must consider the degree to which the proposed research may contribute to (a) identification, prevention or treatment of illness or disease, (b) scientific understanding relating to health, (c) promotion and protection of the health of individuals and communities, (d) improved delivery of health services, or (e) improvements in health system management. (3) The research ethics board must prepare a response setting out (a) its recommendation under subsection (1)(a), (b) its assessment of the matters set out in subsection (1)(b), and (c) any conditions that the research ethics board considers should be imposed on the researcher. (4) The research ethics board must send a copy of the response required in subsection (3) to the Commissioner. RSA 2000 cH‑5 s50;2006 c18 s12 Publication of response 50.1 If the response of the research ethics board sent to the Commissioner under section 50(4) indicates that the research ethics board is satisfied as to the matters referred to in section 50(1)(b), the Commissioner may publish the response in any manner the Commissioner considers appropriate. 2006 c18 s13 Bar to research 51 If the research ethics board is not satisfied as to any of the matters referred to in section 50(1)(b), the researcher may not apply to a custodian or health information repository under section 52. RSA 2000 cH‑5 s51;2006 c18 s14;2009 c25 s15 Application for disclosure of health information or to perform data matching 52 If the research ethics board is satisfied as to the matters referred to in section 50(1)(b), the researcher may forward to one or more custodians or health information repositories (a) the researcher’s research protocol referred to in section 49, (b) the response of the research ethics board to the researcher’s research protocol, and (c) a written application for one or more of the following: (i) disclosure of the health information to be used in the research; (ii) performance of data matching; (iii) performance of any other service to facilitate the research. RSA 2000 cH‑5 s52;2006 c18 s14;2009 c25 s16; 2020 c35 s49 Conditions and consents 53 (1) A custodian who has received the documents referred to in section 52 may, but is not required to, disclose the health information or perform data matching or other services to facilitate the research. (2) If the custodian decides to disclose the health information or perform data matching or other services to facilitate the research, (a) the custodian (i) must impose on the researcher the conditions suggested by the research ethics board, and (ii) may impose other conditions on the researcher, and (b) if the research ethics board recommended that consents referred to in section 50(1)(a) be obtained, the researcher must obtain the consents before the disclosure of the health information or performance of data matching or other services. (3) A health information repository that has received the documents referred to in section 52 may disclose the health information or perform data matching or other services to facilitate the research only in accordance with the regulations. RSA 2000 cH‑5 s53;2006 c18 s14;2009 c25 s17 Agreement between custodian and researcher 54 (1) If the custodian decides to disclose health information to a researcher or perform data matching or other services to facilitate the research, the researcher must enter into an agreement with the custodian in which the researcher agrees (a) to comply with (i) this Act and the regulations made under this Act, (ii) any conditions imposed by the custodian relating to the use, protection, disclosure, return or disposal of the health information, and (iii) any requirement imposed by the custodian to provide safeguards against the identification, direct or indirect, of an individual who is the subject of the health information, (b) to use the health information only for the purpose of conducting the research in accordance with the research protocol, (c) not to publish the health information in a form that could reasonably enable the identity of an individual who is the subject of the information to be readily ascertained, (d) not to make any attempt to contact an individual who is the subject of the health information to obtain additional health information unless the individual has provided the custodian with the consent referred to in section 55, (e) to allow the custodian to access or inspect the researcher’s premises to confirm that the researcher is complying with the enactments, conditions and requirements referred to in clause (a), and (f) to pay the costs referred to in subsection (3). (2) When an agreement referred to in subsection (1) has been entered into, the custodian may disclose to the researcher the health information requested under section 52 or perform data matching or other services to facilitate the research (a) with the consent of the individuals who are the subjects of the information, where the research ethics board recommends that consents should be obtained, or (b) without the consent of the individuals who are the subjects of the information, where the research ethics board does not recommend that consents be obtained. (3) The custodian may set the costs of (a) preparing information for disclosure, or performing data matching or other services (b) making copies of health information, and (c) obtaining the consents referred to in section 55, which must not exceed the actual cost of providing that service. (3.1) A researcher that enters into an agreement under this section must (a) comply with the terms and conditions of the agreement and the conditions set out in the research ethics board’s response to the research protocol, and (b) collect, use and disclose health information only in accordance with the agreement and the research protocol. (4) If a researcher contravenes or fails to comply with the terms and conditions of an agreement under this section, or the conditions set out in the research ethics board’s response to the research protocol, (a) the agreement is cancelled, and (b) the researcher is no longer authorized to use the health information for any purpose and must destroy the health information or return it to the custodian. RSA 2000 cH‑5 s54;2006 c18 s14;2009 c25 s18; 2020 c35 s50 Consent for additional information 55 If the researcher wishes to contact the individuals who are the subjects of the information disclosed under section 54(2) to obtain additional health information, the custodian or an affiliate of the custodian must first obtain consents from those individuals to their being contacted for that purpose. 1999 cH‑4.8 s55 Court order 56 (1) If a researcher refuses to allow a custodian or health information repository to access or inspect its premises in accordance with the agreement referred to in section 54, the custodian or health information repository may apply to the Court of King’s Bench for an order under subsection (2). (2) If the Court is satisfied that there are reasonable and probable grounds to believe that access to premises or the production or removal of documents is necessary for the purpose of determining whether an agreement referred to in section 54 is being complied with, the Court may make any order it considers necessary to enforce compliance with the agreement. (3) Where authorized to do so by an order under subsection (2), a custodian or health information repository may (a) enter and search any premises of the researcher where the research is conducted, (b) operate or cause to be operated any computer system of the researcher to search any data contained in or available to the system and produce a document from the data, and (c) seize and make copies of any documents of the researcher that are or may be relevant to the investigation. (4) An application for an order under this section may be made ex parte unless the Court orders otherwise. (5) The custodian or health information repository must return any documents seized pursuant to a court order within 60 days after the conclusion of the investigation that gave rise to the seizure, including any hearing or appeal. (6) In this section, “document” includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microfilm, sound recording, videotape, machine readable record or other material or thing, regardless of physical form or characteristics. RSA 2000 cH‑5 s56;2009 c25 s19;2009 c53 s77; AR 217/2022 Part 5.1 Alberta Electronic Health Record Definitions 56.1 In this Part, (a) “Alberta EHR” means the integrated electronic health information system established to provide shared access to health information in a secure environment as may be further defined or described in the regulations; (b) “authorized custodian” means (i) a custodian referred to in section 1(1)(f)(iii), (iv), (xii), (xii.1), (xii.2), (xiii), (xiii.1) or (xiii.2), and (ii) any other custodian that meets the eligibility requirements of the regulations to be an authorized custodian; (c) repealed 2020 c35 s51; (d) “regulated health professional” means a regulated member under the Health Professions Act . 2009 c25 s20;2016 c9 s26;2016 c18 s8;2023 c9 s11;2024 c10 s20; 2025 c10 s25;2020 c35 s51 Purpose 56.2 (1) The purpose of this Part is to enable access to and use of health information via the Alberta EHR. (2) Only the health information that is of a class or type prescribed by the regulations may be accessible via the Alberta EHR. (3) Unless otherwise specified, nothing in this Part affects the application or operation of any provision in another Part of this Act respecting collection, use or disclosure of health information. 2009 c25 s20;2020 c35 s52 Department authorities and duties re Alberta EHR 56.21 (1) The Department shall manage and operate the Alberta EHR. (2) For the purpose of fulfilling the duties under subsection (1), the Department shall do all of the following: (a) take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will protect the confidentiality and security of health information accessible via the Alberta EHR and the privacy of the individuals who are the subjects of that information; (b) determine eligibility for access to the Alberta EHR, grant access to the Alberta EHR, and limit, revoke or prohibit access by authorized custodians and their affiliates and other authorized users to the Alberta EHR and health information accessible via the Alberta EHR, in accordance with the regulations; (c) respond to access requests under section 56.6 or 56.61 for health information accessible via the Alberta EHR, in accordance with the regulations, if any; (d) provide reports to authorized custodians and other authorized users related to their access to the Alberta EHR and to authorized custodians related to the access to the Alberta EHR by their affiliates. (3) For the purpose of fulfilling the duties under subsection (1), the Department may do any or all of the following: (a) in accordance with the regulations, audit and investigate matters relating to the Alberta EHR in respect of (i) unauthorized access to, use or disclosure of health information accessible via the Alberta EHR, (ii) data integrity, (iii) patient safety, or (iv) other matters prescribed in the regulations; (b) subject to subsection (4) and in accordance with the regulations, provide access to health information accessible via the Alberta EHR to a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner; (c) provide access, in accordance with the regulations, if any, to health information accessible via the Alberta EHR to a health services provider who provides a health service outside Alberta to a resident of Alberta for the purposes of providing continuing treatment and care; (d) exercise any other power, duty or function that the Department considers necessary in order to manage and operate the Alberta EHR. (4) The Department may provide a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner with access to health information accessible via the Alberta EHR for the purpose of conducting investigations under the Fatality Inquiries Act , only if (a) the Office of the Chief Medical Examiner has submitted a privacy impact assessment respecting the access to the Commissioner, and (b) the medical examiner with the Office of the Chief Medical Examiner and the staff working under the direction of a medical examiner meet all eligibility requirements and obligations imposed by the regulations. (5) For greater certainty, the Department is not an information manager for authorized custodians by virtue of managing and operating the Alberta EHR. 2020 c35 s53 Making health information accessible 56.3 (1) The health professional body of a regulated health professional may in writing direct the regulated health professional to make health information that is in the custody or under the control of the regulated health professional accessible via the Alberta EHR in accordance with the regulations. (2) If (a) the Minister or the Minister of Mental Health and Addiction determines that it is in the public interest to have certain health information that is in the custody or under the control of one or more regulated health professionals made accessible via the Alberta EHR, and (b) the health professional body of the regulated health professionals has not directed the regulated health professionals to make that health information accessible via the Alberta EHR, the Minister or the Minister of Mental Health and Addiction may, subject to subsection (3), in writing direct the regulated health professionals to make the health information accessible via the Alberta EHR in accordance with the regulations. (3) Before giving a direction under subsection (2), the Minister or the Minister of Mental Health and Addiction must (a) consult with the health professional body referred to in subsection (2)(b), (b) prepare a privacy impact assessment describing how making the health information accessible via the Alberta EHR may affect the privacy of the individual who is the subject of the information and submit the privacy impact assessment to the Commissioner for review and comment, and (c) consider the comments of the Commissioner, if any, made in response to the privacy impact assessment. (4) A failure by a regulated health professional to comply with a direction of the health professional body under subsection (1) or of a Minister under subsection (2) constitutes unprofessional conduct by the regulated health professional under the Health Professions Act . (5) An authorized custodian may make the health information prescribed in the regulations that is in its custody or under its control accessible via the Alberta EHR in accordance with the regulations. (6) An authorized custodian, other than a regulated health professional, must, if the Minister or the Minister of Mental Health and Addiction requests in writing, make the health information prescribed in the regulations that is in its custody or under its control accessible via the Alberta EHR in accordance with the regulations. (7) The making of health information accessible pursuant to this section does not (a) constitute a disclosure of that information by any person, or (b) require the consent of the individual who is the subject of the information. 2009 c25 s20;2016 c9 s26;2016 c18 s8;2023 c9 s11;2024 c10 s20; 2020 c35 s54 Duties in making health information accessible via Alberta EHR 56.4 (1) In deciding how much health information to make accessible via the Alberta EHR, a regulated health professional or an authorized custodian must consider as an important factor any expressed wishes of the individual who is the subject of the health information relating to access to that information, together with any other factors the regulated health professional or authorized custodian considers important. (2) If a regulated health professional or an authorized custodian decides to limit the health information that is to be made accessible via the Alberta EHR under subsection (1), it must impose the limitations in accordance with the regulations. 2009 c25 s20;2020 c35 s55 Accessing health information via the Alberta EHR 56.5 (1) Subject to the regulations, an authorized custodian may access health information via the Alberta EHR for all the purposes and functions for which that authorized custodian may use health information under section 27. (2) A medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner may access health information via the Alberta EHR only for the purpose of conducting investigations under the Fatality Inquiries Act . (3) The use of health information that is accessed via the Alberta EHR does not constitute collection of that information under this Act. (4) The use of health information that is accessed via the Alberta EHR does not constitute disclosure of that information by any person under this Act. (5) For greater certainty, if the Department grants access to the Alberta EHR to other authorized users outside Alberta in accordance with the regulations, the accessing of health information via the Alberta EHR by an authorized user outside Alberta does not constitute disclosure of that information by any person under this Act. 2009 c25 s20;2020 c35 s56 56.51 Repealed RSA 2000 cH‑5 s56.51. Maintaining record of Alberta EHR access 56.6 (1) The Department must keep an electronic log of the following for each time the Alberta EHR is accessed: (a) the name or number that identifies the authorized custodian or other authorized user who accessed the Alberta EHR; (b) the date and time that the Alberta EHR was accessed; (c) a description of the health information that was accessed; (d) any other information prescribed in the regulations. (2) The information referred to in subsection (1) must be retained by the Department for a period of 10 years following the date of the access. (3) An individual who is the subject of information referred to in subsection (1) may ask the Department for access to and a copy of the information, and Part 2 applies to the request. (4) If, pursuant to subsection (3), an individual asks the Department for access to and a copy of the information referred to in subsection (1), the Department must, in accordance with Part 2, provide that information in respect of all authorized custodians and other authorized users who have accessed that individual’s health information pursuant to this Part. 2009 c25 s20;2020 c35 s58 Access request for health information accessible via the Alberta EHR 56.61 (1) An individual may make a request to access the individual’s health information accessible via the Alberta EHR (a) to an authorized custodian who (i) is a health services provider described in section 1(1)(f)(ix), and (ii) has provided health services to the individual, or (b) to a custodian described in section 1(1)(f)(iv) and Part 2 applies in respect of the request. (2) If an authorized custodian or a custodian described in section 1(1)(f)(iv) responds that it is unable to provide access to health information requested by an individual under subsection (1), the individual may make a request to the Department for access to the individual’s health information accessible via the Alberta EHR, and Part 2 applies in respect of the request. 2020 c35 s59 Authorized custodian duties, authority 56.62 An authorized custodian shall (a) comply with an audit or investigation conducted by the Department in respect of the Alberta EHR, and (b) carry out any duty or function specified in the regulations. 2020 c35 s59 Multi‑disciplinary data stewardship committee 56.7 (1) The Minister shall establish a multi-disciplinary data stewardship committee. (1.1) The function of the multi-disciplinary data stewardship committee is to provide advice and make recommendations to the Minister and the Department respecting the Alberta EHR. (2) At least 2 members of the multi‑disciplinary data stewardship committee must be members of the public. (3) Section 7(2) to (5) of the Government Organization Act apply with respect to the multi‑disciplinary data stewardship committee. 2009 c25 s20;2020 c35 s60 Termination of agreement and protocol 56.71 (1) Despite any other provision of this Act or regulations or any information manager agreements entered into under section 3(1)(d) of the Alberta Electronic Health Record Regulation (AR 118/2010) or entered into with custodians described in section 3(3) of that regulation or the Alberta Netcare Electronic Health Record Information Exchange Protocol referred to in those information manager agreements, the Department may access and use health information that is accessible via the Alberta EHR for any purpose or function that is authorized by section 27. (2) All information manager agreements entered into under section 3(1)(d) of the Alberta Electronic Health Record Regulation (AR 118/2010) or entered into with custodians described in section 3(3) of that regulation and the Alberta Netcare Electronic Health Record Information Exchange Protocol referred to in those information manager agreements are terminated effective on the coming into force of this subsection. (3) Subsection (1) is repealed on Proclamation. 2020 c35 s61 Regulations 56.8 (1) The Lieutenant Governor in Council may make regulations (a) defining or otherwise describing the Alberta EHR; (b) respecting the eligibility requirements for a custodian to become and remain an authorized custodian for the purposes of this Part, including, without limitation, regulations requiring an authorized custodian to enter into an agreement with respect to the authorized custodian’s powers, duties and functions under this Part; (c) prescribing classes or types of health information that may or must be made accessible via the Alberta EHR; (c.1) respecting administrative, technical and physical safeguards in respect of the health information accessible via the Alberta EHR; (d) respecting the manner in which a regulated health professional or an authorized custodian may or must make health information prescribed in the regulations that is in its custody or under its control accessible via the Alberta EHR; (d.1) respecting the granting of access to the Alberta EHR, including, without limitation, respecting eligibility for access to the Alberta EHR; (e) respecting the purposes and functions for which an authorized custodian may access and use health information via the Alberta EHR; (f) respecting the governance, operation, management and structure of the Alberta EHR, including, without limitation, regulations (i) repealed 2020 c35 s62, (ii) respecting the powers, duties and functions of the Department; (g) respecting the procedures, systems and safeguards that an authorized custodian must maintain in respect of health information that is accessible via the Alberta EHR; (g.1) respecting the manner in which a regulated health professional or an authorized custodian may limit the health information that is to be made accessible via the Alberta EHR; (g.2) respecting access to the Alberta EHR by a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner or by a health services provider outside of Alberta to provide continuing treatment and care to an individual who is a resident of Alberta; (g.3) limiting, revoking or prohibiting (i) access to the Alberta EHR by an authorized custodian or its affiliate, a medical examiner with the Office of the Chief Medical Examiner or staff working under the direction of a medical examiner, or by a health services provider outside of Alberta providing continuing treatment and care to an individual who is a resident of Alberta, or (ii) use of health information accessible via the Alberta EHR by an authorized custodian or its affiliate, by a medical examiner with the Office of the Chief Medical Examiner or staff working under the direction of a medical examiner, or by a health services provider outside of Alberta providing continuing treatment and care to an individual who is a resident of Alberta; (g.4) respecting technical or security standards, specifications or requirements in respect of the Alberta EHR, including, without limitation, interoperability specifications and standards; (g.5) respecting electronic logging for the purposes of section 56.6 and reporting in respect of the logging; (g.6) respecting access requests under sections 56.6 and 56.61 for health information accessible via the Alberta EHR; (g.7) respecting the reasons for which an authorized custodian is unable to provide access to health information requested by an individual; (h) respecting the audit or investigation of any matter related to the Alberta EHR, including, without limitation, regulations (i) setting out or establishing an auditing regime, and (ii) setting out powers and duties to be exercised concerning audits and investigations; (i) respecting any other matter the Lieutenant Governor in Council considers necessary or advisable to carry out the intent of this Part. (2) A regulation made under subsection (1) may incorporate, adopt or declare in force a code, standard, guideline, schedule or body of rules, including a code, standard, guideline, schedule or body of rules developed by the Minister, relating to any matter in respect of which a regulation may be made under subsection (1). (3) Where a code, standard, guideline, schedule or body of rules is incorporated, adopted or declared in force by a regulation made under subsection (1), the Minister shall ensure that a copy of the code, standard, guideline, schedule or body of rules is readily available to the public. (4) The Regulations Act does not apply to a code, standard, guideline, schedule or body of rules incorporated, adopted or declared in force by a regulation made under subsection (1). (5) A code, standard, guideline, schedule or body of rules may be incorporated, adopted or declared in force by a regulation made under subsection (1) (a) in whole or in part or with modifications, and (b) as it reads on a specific day or as amended from time to time. 2009 c25 s20;2020 c35 s62 Part 6 Duties and Powers of Custodians Relating to Health Information Division 1 General Duties and Powers Duty to collect, use or disclose health information with highest degree of anonymity possible 57 (1) In this section, “aggregate health information” means non‑identifying health information about groups of individuals. (2) A custodian that intends to collect, use or disclose health information must first consider whether collection, use or disclosure of aggregate health information is adequate for the intended purpose, and if so, the custodian must collect, use or disclose only aggregate health information. (3) If the custodian believes that collecting, using or disclosing aggregate health information is not adequate for the custodian’s intended purpose, the custodian must then consider whether collection, use or disclosure of other non‑identifying health information is adequate for the intended purpose, and if so, the custodian may collect, use or disclose other non‑identifying health information. (4) If the custodian believes that collecting, using or disclosing aggregate and other non‑identifying health information is not adequate for the custodian’s intended purpose, the custodian may collect, use or disclose individually identifying health information if the collection, use or disclosure (a) is authorized by this Act, and (b) is carried out in accordance with this Act. (5) This section does not apply where the collection, use or disclosure is for the purpose of (a) providing health services, or (b) determining or verifying the eligibility of an individual to receive a health service. 1999 cH‑4.8 s57 Duty to collect, use or disclose health information in a limited manner 58 (1) When collecting, using or disclosing health information, a custodian must, in addition to complying with section 57, collect, use or disclose only the amount of health information that is essential to enable the custodian or the recipient of the information, as the case may be, to carry out the intended purpose. (2) In deciding how much health information to disclose, a custodian must consider as an important factor any expressed wishes of the individual who is the subject of the information relating to disclosure of the information, together with any other factors the custodian considers relevant. 1999 cH‑4.8 s58 59 Repealed 2003 c23 s3. Duty to protect health information 60 (1) A custodian must take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will (a) protect the confidentiality of health information that is in its custody or under its control and the privacy of the individuals who are the subjects of that information, (b) protect the confidentiality of health information that is to be stored or used in a jurisdiction outside Alberta or that is to be disclosed by the custodian to a person in a jurisdiction outside Alberta and the privacy of the individuals who are the subjects of that information, (c) protect against any reasonably anticipated (i) threat or hazard to the security or integrity of the health information or of loss of the health information, or (ii) unauthorized use, disclosure or modification of the health information or unauthorized access to the health information, and (d) otherwise ensure compliance with this Act by the custodian and its affiliates. (2) The safeguards to be maintained under subsection (1) must include appropriate measures (a) for the security and confidentiality of records, which measures must address the risks associated with electronic health records, and (b) for the proper disposal of records to prevent any reasonably anticipated unauthorized use or disclosure of the health information or unauthorized access to the health information following its disposal. (3) In subsection (2)(a), “electronic health records” means records of health information in electronic form. RSA 2000 cH‑5 s60;2003 c23 s4 Duty to notify 60.1 (1) Subject to the regulations, an affiliate of a custodian must as soon as practicable notify the custodian in accordance with the regulations of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in the custody or control of the custodian. (2) Subject to the regulations, subsections (4) and (5) and section 85.1, a custodian must as soon as practicable give notice in accordance with the regulations and subsection (3) of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in the custody or control of the custodian if there is a risk of harm to an individual as a result of the loss or unauthorized access or disclosure. (3) The notice required by subsection (2) must be given to (a) the Commissioner, (b) the Minister, and (c) the individual who is the subject of the individually identifying health information. (4) A custodian must consider all relevant factors, including the factors prescribed by the regulations, in assessing for the purposes of subsection (2) whether there is a risk of harm to an individual. (5) If a custodian considers that giving notice under subsection (2) to an individual who is the subject of individually identifying health information could reasonably be expected to result in a risk of harm to the individual’s mental or physical health, the custodian may decide not to give notice to the individual, in which case the custodian must immediately give notice to the Commissioner of the decision not to give notice to the individual, and the reasons for the decision, in accordance with the regulations. 2014 c8 s4 Duty to ensure accuracy of health information 61 Before using or disclosing health information that is in its custody or under its control, a custodian must make a reasonable effort to ensure that the information is accurate and complete. 1999 cH‑4.8 s61 Duty to identify responsible affiliates 62 (1) Each custodian must identify its affiliates who are responsible for ensuring that this Act, the regulations and the policies and procedures established or adopted under section 63 are complied with. (2) Any collection, use or disclosure of health information by an affiliate of a custodian is considered to be collection, use or disclosure by the custodian. (3) Any disclosure of health information to an affiliate of a custodian is considered to be disclosure to the custodian. (4) Each affiliate of a custodian must comply with (a) this Act and the regulations, and (b) the policies and procedures established or adopted under section 63.

1999 cH‑4.8 s62 Duty to establish or adopt policies and procedures 63 (1) Each custodian must establish or adopt policies and procedures that will facilitate the implementation of this Act and the regulations. (2) A custodian must at the request of the Minister or the Department provide the Minister or the Department, as the case may be, with a copy of the policies and procedures established or adopted under this section. 1999 cH‑4.8 s63 Duty to prepare privacy impact assessment 64 (1) Subject to subsection (3), each custodian must prepare a privacy impact assessment that describes how proposed administrative practices and information systems relating to the collection, use and disclosure of individually identifying health information may affect the privacy of the individual who is the subject of the information. (2) Subject to subsection (3), the custodian must submit the privacy impact assessment to the Commissioner for review and comment before implementing any proposed new practice or system described in subsection (1) or any proposed change to existing practices and systems described in subsection (1). (3) Subsections (1) and (2) do not apply to custodians described in section 1(1)(f)(iv), (ix.1), (ix.2), (xii), (xii.1), (xii.2) and (xii.3) in the collection, use or disclosure of health information between or among these custodians for a function set out in section 27(2), unless the custodians will implement a new information system or change an existing information system in conjunction with the collection, use or disclosure. RSA 2000 cH‑5 s64;2020 c35 s63;2024 c10 s20;2025 c10 s25 Power to transform health information 65 A custodian may, in accordance with the regulations, strip, encode or otherwise transform individually identifying health information to create non‑identifying health information. 1999 cH‑4.8 s65 Power to enter agreement with information manager 66 (1) In this section, “information manager” means a person or body that (a) processes, stores, retrieves or disposes of health information, (b) in accordance with the regulations, strips, encodes or otherwise transforms individually identifying health information to create non‑identifying health information, or (c) provides information management or information technology services in a manner that requires the use of health information but does not include an individual employed by a custodian who performs any of the functions listed in clauses (a) to (c). (2) A custodian must enter into a written agreement with an information manager in accordance with the regulations for the provision of any or all of the services described in subsection (1). (3) A custodian that has entered into an agreement with an information manager may provide health information to the information manager without the consent of the individuals who are the subjects of the information for the purposes authorized by the agreement. (4) An information manager to which information is provided pursuant to subsection (3) may use or disclose that information only for the purposes authorized by the agreement. (5) An information manager must comply with (a) this Act and the regulations, and (b) the agreement entered into with a custodian in respect of information provided to it pursuant to subsection (3). (6) Despite subsection (5)(a), a custodian continues to be responsible for compliance with this Act and the regulations in respect of the information provided by the custodian to the information manager. (7) A custodian that is an information manager for another custodian does not become a custodian of the health information provided to it in its capacity as an information manager, but nothing in this section prevents the custodian from otherwise collecting, using or disclosing that same health information in accordance with this Act. RSA 2000 cH‑5 s66;2009 c25 s21;2020 c35 s64 Power to charge fees 67 (1) A custodian may charge the fees provided for in the regulations for services provided under Part 2. (2) Subsection (1) does not permit a custodian to charge a fee in respect of a request for access to an applicant’s own health information, except for the cost of producing the copy. (3) A custodian must give an applicant an estimate of the total fee for its services before providing the services. (4) A custodian may excuse an applicant from paying all or part of a fee if, in the opinion of the custodian, the applicant cannot afford the fee or in any other circumstances provided for in the regulations. (5) If an applicant has requested a custodian to excuse the applicant from paying all or part of a fee and the custodian has refused the applicant’s request, the custodian must notify the applicant that the applicant may ask for a review by the Commissioner. (6) The fees referred to in subsection (1) must not exceed the actual cost of the services. 1999 cH‑4.8 s67 Division 2 Data Matching Prohibition 68 A custodian or health information repository must not (a) collect the health information to be used in data matching, or (b) use or disclose the health information to be used in data matching or created through data matching in contravention of this Act. RSA 2000 cH‑5 s68;2009 c25 s26 Data matching by custodian or health information repository 69 A custodian or health information repository may perform data matching using information that is in its custody or under its control. RSA 2000 cH‑5 s69;2009 c25 s26 Data matching by custodians or health information repository 70 (1) A custodian or health information repository may perform data matching by combining information that is in its custody or under its control with information that is in the custody or under the control of another custodian or health information repository. (2) Before performing data matching under this section, the custodian or health information repository in whose custody and control the information that is created through data matching will be stored must prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment. (3) A privacy impact assessment referred to in subsection (2) must (a) describe how the information to be used in the data matching is to be collected, and (b) set out how the information that is created through data matching is to be used or disclosed. RSA 2000 cH‑5 s70;2009 c25 s26 Data matching by custodian or health information repository and non‑custodian 71 (1) A custodian or health information repository may perform data matching by combining information that is in its custody or under its control with information that is in the custody or under the control of a person that is not a custodian or health information repository. (2) Before performing data matching under this section, the custodian or health information repository must prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment. (3) A privacy impact assessment referred to in subsection (2) must meet the requirements of section 70(3). RSA 2000 cH‑5 s71;2009 c25 s26 Data matching for research 72 If data matching is performed for the purpose of conducting research, sections 48 to 56 must be complied with before the data matching is performed. 1999 cH‑4.8 s72 Part 6.1 Health Information Repository Designation 72.1 (1) The Minister may, in accordance with the regulations, designate an agency, corporation or other entity to act as a health information repository. (2) The Minister of Mental Health and Addiction may, in accordance with the regulations, designate the Canadian Centre of Recovery Excellence to act as a health information repository. 2009 c25 s22;2024 c10 s20 Disclosure of information 72.2 A custodian may, in accordance with the regulations, disclose individually identifying health information to a health information repository. 2009 c25 s22 Powers and duties of repository 72.3 A health information repository has the powers, duties and functions given to it by this Act and the regulations. 2009 c25 s22 Correction or amendment of health information by repository 72.4 (1) Where a custodian has made a correction or amendment to health information pursuant to section 13, the custodian must notify a health information repository to which the custodian has disclosed the information that a correction or amendment has been made and advise the repository of the manner in which the health information must be corrected or amended. (2) A health information repository that is notified pursuant to subsection (1) must, within 30 days, (a) make the correction or amendment according to the advice of the custodian, and (b) provide written notice that the correction or amendment has been made to the custodian, and the custodian shall then notify the individual who is the subject of the health information. (3) An individual who is the subject of health information to which a correction or amendment is made pursuant to subsection (1) may ask the Commissioner to review a failure of a custodian to notify a health information repository of the correction or amendment or a failure of a health information repository to make the correction or amendment pursuant to subsection (2). (4) Sections 74 to 82 apply with all necessary modifications to a request to the Commissioner for a review under subsection (3). (5) For greater clarity, the duties and responsibilities of a custodian as outlined in sections 74 to 82 also apply to a health information repository for the purposes of this section. 2009 c25 s22 Consultation with Commissioner 72.5 (1) Subject to subsection (2), the Minister must consult with the Commissioner in the preparation of the regulations under this Part. (2) The Minister of Mental Health and Addiction must consult with the Commissioner in respect of the regulations under section 72.1(2). 2009 c25 s22;2024 c10 s20 Part 7 Commissioner Division 1 Reviews by Commissioner Right to ask for a review 73 (1) An individual who makes a request to a custodian for access to or for correction or amendment of health information may ask the Commissioner to review any decision, act or failure to act of the custodian that relates to the request. (2) An individual who believes that the individual’s own health information has been collected, used or disclosed in contravention of this Act may ask the Commissioner to review that matter. (3) A custodian may ask the Commissioner to review the decision of another custodian to refuse to disclose health information pursuant to section 47(2). 1999 cH‑4.8 s73 How to ask for a review 74 (1) To ask for a review under this Division, a written request must be delivered to the Commissioner. (2) A request under section 73 for a review of a decision of a custodian must be delivered to the Commissioner within (a) sixty days after the person asking for the review is notified of the decision, or (b) any longer period allowed by the Commissioner. (3) The failure of a custodian to respond in time to a request for access to a record is to be treated as a decision to refuse access, but the time limit in subsection (2)(a) for delivering a request for a review does not apply. 1999 cH‑4.8 s74 Notifying others of review 75 (1) On receiving a request for a review, the Commissioner must as soon as practicable (a) give a copy of the request (i) to the custodian concerned, and (ii) to any other person who in the opinion of the Commissioner is affected by the request, and (b) provide a summary of the review procedures and an anticipated date for a decision in respect of the review (i) to the person who asked for the review, (ii) to the custodian concerned, and (iii) to any other person who in the opinion of the Commissioner is affected by the request. (2) Despite subsection (1)(a), the Commissioner may sever any information in the request that the Commissioner considers appropriate before giving a copy of the request to the custodian or any other person affected by the request. 1999 cH‑4.8 s75 Mediation may be authorized 76 The Commissioner may authorize a mediator to investigate and attempt to settle any matter that is the subject of a request for a review. 1999 cH‑4.8 s76 Inquiry by Commissioner 77 (1) Unless section 78 applies, if a matter is not settled under section 76, the Commissioner must conduct an inquiry and may decide all questions of fact and law arising in the course of the inquiry. (2) An inquiry under subsection (1) may be conducted in private. (3) The person who asked for the review, the custodian concerned and any other person given a copy of the request for the review must be given an opportunity to make representations to the Commissioner during the inquiry, but no one is entitled to be present during, to have access to or to comment on representations made to the Commissioner by another person. (4) The Commissioner may decide whether the representations are to be made orally or in writing. (5) The person who asked for the review, the custodian concerned and any other person given a copy of the request for the review may be represented at the inquiry by counsel or an agent. (6) An inquiry under this section must be completed within 90 days after the Commissioner receives the request for the review unless the Commissioner (a) notifies the person who asked for the review, the custodian concerned and any other person given a copy of the request for the review that the Commissioner is extending that period, and (b) provides an anticipated date for the completion of the review. 1999 cH‑4.8 s77 Refusal to conduct inquiry 78 The Commissioner may refuse to conduct an inquiry pursuant to section 77 if in the opinion of the Commissioner (a) the subject of the request for a review under section 73 has been dealt with in an order or investigation report of the Commissioner, or (b) the circumstances warrant deciding not to conduct an inquiry. RSA 2000 cH‑5 s78;2020 c35 s65 Burden of proof 79 If an inquiry relates to a decision to refuse access to all or part of a record, the onus is on the custodian to prove that the person asking for the review has no right of access to the record or part of the record. 1999 cH‑4.8 s79 Commissioner ’ s orders 80 (1) On completing an inquiry under section 77, the Commissioner must dispose of the issues by making an order under this section. (2) If the inquiry relates to a decision to grant or to refuse access to all or part of a record, the Commissioner may, by order, do the following: (a) require the custodian to grant access to all or part of the record, if the Commissioner determines that the custodian is not authorized or required to refuse access; (b) either confirm the decision of the custodian or require the custodian to reconsider it, if the Commissioner determines that the custodian is authorized to refuse access; (c) require the custodian to refuse access to all or part of the record, if the Commissioner determines that the custodian is required to refuse access. (3) If the inquiry relates to any other matter, the Commissioner may, by order, do one or more of the following: (a) require that a duty imposed by this Act or the regulations be performed; (b) confirm or reduce the extension of a time limit under section 15; (c) confirm or reduce a fee required to be paid under this Act or order a refund, in the appropriate circumstances, including if a time limit is not met; (d) confirm a decision not to correct or amend health information or specify how health information is to be corrected or amended; (e) require a person to stop collecting, using, disclosing or creating health information in contravention of this Act; (f) require a person to destroy health information collected or created in contravention of this Act. (4) The Commissioner may specify any terms or conditions in an order made under this section. (5) The Commissioner must give a copy of an order made under this section (a) to the person who asked for the review, (b) to the custodian concerned, (c) to any other person given a copy of the request for the review, and (d) to the Minister. (6) A copy of an order made by the Commissioner under this section may be filed with a clerk of the Court of King’s Bench and, after filing, the order is enforceable as a judgment or order of that Court. RSA 2000 cH-5 s80;AR 217/2022 No appeal 81 An order made by the Commissioner under this Act is final. 1999 cH‑4.8 s81 Duty to comply with order 82 (1) Subject to subsection (2), not later than 50 days after being given a copy of an order of the Commissioner, other than an order made under section 85.1, the custodian concerned must comply with the order. (2) A custodian must not take any steps to comply with a Commissioner’s order, other than an order made under section 85.1, until the period for bringing an application for judicial review under subsection (3) ends. (3) An application for judicial review of a Commissioner’s order, other than an order made under section 85.1, must be made not later than 45 days after the person making the application is given a copy of the order. (4) If an application for judicial review is made pursuant to subsection (3), the Commissioner’s order is stayed until the application is dealt with by the Court of King’s Bench. (5) Despite subsection (3), the Court may, on application made either before or after the expiry of the period referred to in subsection (3), extend that period if it considers it appropriate to do so. RSA 2000 cH‑5 s82;2014 c8 s4;AR 217/2022 Division 2 Disclosure to Commissioner Disclosure to Commissioner 83 (1) An affiliate of a custodian may disclose to the Commissioner any health information that the affiliate is required to keep confidential and that the affiliate, acting in good faith, believes is being collected, used or disclosed in contravention of this Act. (2) The Commissioner must investigate and review any disclosure made under subsection (1). (3) If an affiliate makes a disclosure under subsection (1), the Commissioner must not disclose the identity of the affiliate to any person without the affiliate’s consent. (4) An affiliate is not liable to a prosecution for an offence under any Act for disclosing health information to the Commissioner unless the affiliate was acting in bad faith. (5) In carrying out an investigation and review under this section, the Commissioner has all of the powers and duties set out in sections 76, 77, 80(1) to (5), 88 and 91, and sections 89, 90, 92 and 94 apply. 1999 cH‑4.8 s83 Division 3 Additional Powers and Duties of Commissioner General powers of Commissioner 84 (1) In addition to the Commissioner’s powers and duties under Divisions 1 and 2 with respect to reviews, the Commissioner is generally responsible for monitoring how this Act is administered to ensure its purposes are achieved, and may (a) at the request of the Minister or otherwise, conduct investigations to ensure compliance with any provision of this Act or compliance with rules relating to the destruction of records set out in an enactment of Alberta, (b) make an order described in section 80 whether or not a review is requested, (c) inform the public about this Act, (d) receive comments from the public concerning the administration of this Act, (e) engage in or commission a study of anything affecting the achievement of the purposes of this Act, (f) comment on the implications for access to health information or for protection of health information of privacy impact assessments submitted to the Commissioner under section 46(5), 64, 70 or 71, (g) comment on the implications for protection of health information of using or disclosing health information for the purpose of performing data matching, (h) give advice and recommendations of general application to a custodian on matters respecting the rights or obligations of custodians under this Act, (i) bring to the attention of a custodian any failure by the custodian to assist applicants under section 10, and (j) exchange information with an extra‑provincial commissioner and enter into information sharing and other agreements with extra‑provincial commissioners for the purpose of co‑ordinating activities and handling complaints involving 2 or more jurisdictions. (2) For the purposes of subsection (1)(j), “extra‑provincial commissioner” means a person who, in respect of Canada or in respect of another province or territory of Canada, has duties, powers and functions similar to those of the Commissioner. RSA 2000 cH‑5 s84;2009 c25 s23 Power to resolve complaints 85 Without limiting section 84, the Commissioner may investigate and attempt to resolve a complaint that (a) a duty imposed by section 10 has not been performed, (b) an extension of time for responding to a request is not in accordance with section 15, (c) a fee charged under this Act is inappropriate, (d) a correction or amendment of health information requested under section 13 has been refused without justification, or (e) health information has been collected, used, disclosed or created by a custodian in contravention of this Act. 1999 cH‑4.8 s85 Power to order notification under section 60.1 85.1 (1) On receiving a notice under section 60.1(5), the Commissioner may require the custodian to provide any additional information the Commissioner considers necessary to determine whether to make an order under subsection (2)(b). (2) On considering the notice under section 60.1(5), the reasons the custodian provided for the decision not to notify the individual and any information provided under subsection (1), the Commissioner may (a) confirm the decision of the custodian, or (b) by order require the custodian to provide a notice that contains the information specified in the order, in the form, manner and within the time specified in the order. (3) The Commissioner may (a) specify any terms or conditions in an order made under subsection (2)(b), and (b) amend an order made under subsection (2)(b). (4) The custodian must comply with a requirement to provide information under subsection (1), and if the custodian does not comply, the Commissioner may apply to the Court of King’s Bench for an order to compel the custodian to provide the information. (5) On the application of the Commissioner under subsection (4), the Court of King’s Bench may make an order requiring the custodian to provide information to the Commissioner in accordance with a requirement under subsection (1). (6) The Commissioner must give a copy of an order made under subsection (2)(b) (a) to the custodian, and (b) to the Minister. (7) After being given a copy of an order under subsection (2)(b) the custodian must comply with the order. (8) An order under subsection (2)(b) may only be stayed by an order of the Court of King’s Bench. (9) A copy of an order made by the Commissioner under subsection (2)(b) may be filed with a clerk of the Court of King’s Bench and, after filing, the order is enforceable as a judgment or order of that Court. 2014 c8 s4;AR 217/2022 Advice and recommendations 86 (1) A custodian may ask the Commissioner to give advice and recommendations on any matter respecting any rights or duties under this Act. (2) The Commissioner may in writing provide the custodian with advice and recommendations that (a) state the material facts either expressly or by incorporating facts stated by the custodian, (b) are based on the facts referred to in clause (a), and (c) may be based on any other considerations the Commissioner considers appropriate. 1999 cH‑4.8 s86 Power to authorize a custodian to disregard requests 87 (1) At the request of a custodian, the Commissioner may authorize the custodian to disregard one or more requests under section 8(1) or 13(1) if (a) because of their repetitious or systematic nature, the requests would unreasonably interfere with the operations of the custodian or amount to an abuse of the right to make those requests, or (b) one or more of the requests are frivolous or vexatious. (2) The processing of a request under section 8(1) or 13(1) ceases when a custodian has made a request under subsection (1) and (a) if the Commissioner authorizes the custodian to disregard the request, does not resume; (b) if the Commissioner does not authorize the custodian to disregard the request, does not resume until the Commissioner advises the custodian of the Commissioner’s decision. RSA 2000 cH‑5 s87;2006 c18 s15 Powers of Commissioner in conducting investigations or inquiries 88 (1) In conducting an inquiry under section 77 or an investigation under section 84(a) or in giving advice and recommendations under section 86, the Commissioner has all the powers, privileges and immunities of a commissioner under the Public Inquiries Act and the powers given by subsection (2) of this section. (2) The Commissioner may require any relevant record to be produced to the Commissioner and may examine any information in the record, whether or not the record is subject to the provisions of this Act. (3) Despite any other enactment or any privilege of the law of evidence, a custodian must produce to the Commissioner within 10 days any record or a copy of any record required under subsection (1) or (2). (4) If a custodian is required to produce a record under subsection (1) or (2) and it is not practical to make a copy of the record, the custodian may require the Commissioner to examine the original at its site. (5) After completing a review or investigating a complaint, the Commissioner must return any record or any copy of any record produced. 1999 cH‑4.8 s88 Statements made to Commissioner not admissible in evidence 89 (1) A statement made or an answer given by a person to the Commissioner under section 85.1 or during an investigation or inquiry by the Commissioner is inadmissible in evidence in court or in any other proceeding, except (a) in a prosecution for perjury in respect of sworn testimony, (b) in a prosecution for an offence under this Act, (c) in an application for judicial review or an appeal from a decision with respect to that application, or (d) in an application for a stay of an order made under section 85.1(2)(b). (2) Subsection (1) applies also in respect of evidence of the existence of proceedings conducted before the Commissioner. RSA 2000 cH‑5 s89;2014 c8 s4 Privileged information 90 Anything said, any information supplied or any record produced by a person to the Commissioner under section 85.1 or during an investigation or inquiry by the Commissioner is privileged in the same manner as if the matter, investigation or inquiry were a proceeding in a court. RSA 2000 cH‑5 s90;2014 c8 s4 Restrictions on disclosure of information by Commissioner and staff 91 (1) The Commissioner and anyone acting for or under the direction of the Commissioner must not disclose any information obtained in performing their duties, powers and functions under this Act, except as provided in subsections (2) to (5) and section 50.1. (2) The Commissioner may disclose, or may authorize anyone acting for or under the direction of the Commissioner to disclose, information that is necessary (a) to conduct an investigation or inquiry under this Act, or (b) to establish the grounds for findings and recommendations contained in a report under this Act. (3) In conducting an investigation or inquiry under this Act and in a report under this Act, the Commissioner and anyone acting for or under the direction of the Commissioner must take every reasonable precaution to avoid disclosing and must not disclose (a) any health information a custodian would be required or authorized to refuse to disclose if it were contained in a record requested under section 8(1), or (b) whether health information exists, if a custodian in refusing to grant access does not indicate whether the information exists. (3.1) The Commissioner may disclose any information to a ministerial custodian if in the opinion of the Commissioner the disclosure is necessary to enable the ministerial custodian to exercise the powers or carry out the duties and functions of the ministerial custodian in respect of any matter under that Minister’s administration. (3.2) The Commissioner may disclose any information to any person where the Commissioner reasonably believes the disclosure of the information to that person (a) is necessary to protect the privacy, health or safety of an individual, or (b) is in the public interest. (4) The Commissioner may disclose to the Minister of Justice information relating to the commission of an offence under an enactment of Alberta or Canada if the Commissioner considers there is evidence of an offence. (5) The Commissioner may disclose, or may authorize anyone acting for or under the direction of the Commissioner to disclose, information in the course of a prosecution, application or appeal referred to in section 89(1). RSA 2000 cH‑5 s91;2006 c18 s16;2013 c10 s34;2014 c8 s4; 2022 c21 s37;2024 c10 s20;2025 c10 s25 Immunity from suit 92 No action lies and no proceeding may be brought against the Commissioner, or against a person acting for or under the direction of the Commissioner, for anything done, reported or said in good faith in the exercise or performance or the intended exercise or performance of a duty, power or function under this Part. 1999 cH‑4.8 s92 Delegation by Commissioner 93 (1) The Commissioner may delegate to any person any duty, power or function of the Commissioner under this Act except the power to delegate. (2) A delegation under subsection (1) must be in writing and may contain any conditions or restrictions the Commissioner considers appropriate. 1999 cH‑4.8 s93 Role of Ombudsman 94 The Ombudsman may not investigate any matter that the Commissioner has the power to investigate or review under this Part unless the Commissioner agrees. 1999 cH‑4.8 s94 Annual report of Commissioner 95 (1) The Commissioner must report annually to the Speaker of the Legislative Assembly on (a) the work of the Commissioner’s office, and (b) any other matters relating to the protection of health information that the Commissioner considers appropriate. (2) On receiving a report from the Commissioner, the Speaker must lay the report before the Legislative Assembly (a) as soon as possible, if the Legislature is then sitting, or (b) if the Legislature is not then sitting, within 15 days after the commencement of the next sitting. 1999 cH‑4.8 s95 Division 4 Conflict of Interest of Commissioner Adjudicator 96 (1) The Lieutenant Governor in Council may designate a judge of the Court of King’s Bench of Alberta to act as an adjudicator (a) to investigate complaints respecting any matter referred to in section 85 made against a custodian where the Commissioner has been a member, employee or administrator of that custodian or where, in the Commissioner’s opinion, the Commissioner has a conflict with respect to that custodian; (b) to review, if requested under section 98, a decision, act or failure to act of a custodian where the Commissioner has been a member, employee or administrator of that custodian or where, in the Commissioner’s opinion, the Commissioner has a conflict with respect to that custodian. (2) An adjudicator must not review an order of the Commissioner made under this Act. (3) An adjudicator may retain the services of any persons necessary to assist in performing the adjudicator’s functions under this Act. (4) The Government of Alberta may pay out of the General Revenue Fund (a) to an adjudicator, the expenses a judge is entitled to receive under section 57(3) of the Judges Act (Canada) while acting as an adjudicator, and (b) to a person whose services are retained under subsection (3), remuneration for those services. RSA 2000 cH-5 s96;AR 217/2022 Powers, duties and functions of adjudicator 97 (1) For the purposes of section 96, an adjudicator has the powers, duties and functions given to the Commissioner by sections 85(a) to (d), 87, 88 and 91(1), (2)(a) and (3) to (5). (2) Sections 89, 90, 92 and 94 apply for the purposes of an investigation, inquiry or review by an adjudicator. 1999 cH‑4.8 s97 Review where Commissioner in conflict 98 (1) This section applies where the Commissioner is asked under section 73 to review a decision, act or failure to act of a custodian and the Commissioner had been a member, employee or administrator of that custodian or, in the Commissioner’s opinion, the Commissioner has a conflict with respect to that custodian. (2) An individual who makes a request to a custodian for access to or for correction or amendment of health information may ask an adjudicator to review any decision, act or failure to act of the custodian that relates to the request. (3) An individual who believes that the individual’s own health information has been collected, used or disclosed in contravention of this Act may ask an adjudicator to review that matter. (4) A custodian may ask an adjudicator to review the decision of another custodian to refuse to disclose health information pursuant to section 47(2). 1999 cH‑4.8 s98 How to ask for a review 99 (1) To ask for a review under this Division, a written request must be delivered to the Minister. (2) A request for a review of a decision must be delivered to the Minister within (a) sixty days after the person asking for the review is notified of the decision, or (b) any longer period allowed by the adjudicator. 1999 cH‑4.8 s99 Notifying others of review 100 On receiving a request for a review, the Minister must as soon as practicable (a) give the request to an adjudicator, (b) give a copy of the request (i) to the Commissioner, and (ii) to any other person who in the opinion of the Minister is affected by the request, and (c) provide a summary of the review procedures (i) to the person who asked for the review, (ii) to the Commissioner, and (iii) to any other person who in the opinion of the Minister is affected by the request. 1999 cH‑4.8 s100 Conduct and outcome of review 101 (1) An adjudicator has the powers and duties given to the Commissioner by sections 76 and 77(1) and (2), and sections 77(3) to (6) and 79 apply to an inquiry conducted by an adjudicator. (2) On completing an inquiry, an adjudicator has the same duty to dispose of the issues, the same power to make orders and the same duty to notify others of those orders as the Commissioner has under section 80(1) to (5). (3) An adjudicator must give a copy of an order made by the adjudicator under this Act to the Commissioner. (4) A copy of an order made by an adjudicator under this Act may be filed with a clerk of the Court of King’s Bench and, after filing, the order is enforceable as a judgment or order of that Court. (5) Section 82 applies to an order of an adjudicator. (6) An order made by an adjudicator under this Act is final. RSA 2000 cH-5 s101;AR 217/2022 Part 8 General Provisions Oaths 102 (1) Before beginning to perform duties under this Act, the Commissioner must take an oath to faithfully and impartially perform the duties of the Commissioner under this Act and not to disclose any information received by the office of the Commissioner under this Act, except as provided for in this Act. (2) Every person employed or engaged by the office of the Commissioner must, before beginning to perform duties under this Act, take an oath not to disclose any information received by that person under this Act, except as provided for in this Act. (3) The oath referred to (a) in subsection (1) must be administered by the Speaker of the Legislative Assembly or the Clerk of the Legislative Assembly, and (b) in subsection (2) must be administered by the Commissioner. 1999 cH‑4.8 s102 Manner of giving notice 103 Where this Act requires any notice or other document to be given to a person, it is to be given (a) by sending it to that person by prepaid mail to the last known address of that person, (b) by personal service, (c) by substitutional service if so authorized by the Commissioner, or (d) by means of a machine or device that electronically transmits a copy of a document, picture or other printed material by means of a telecommunications system. 1999 cH‑4.8 s103 Exercise of rights by other persons 104 (1) Any right or power conferred on an individual by this Act may be exercised (a) if the individual is 18 years of age or older, by the individual, (b) if the individual is under 18 years of age and understands the nature of the right or power and the consequences of exercising the right or power, by the individual, (c) if the individual is under 18 years of age but does not meet the criterion in clause (b), by the guardian of the individual, (d) if the individual is deceased, (i) by the individual’s personal representative, if the exercise of the right or power relates to the administration of the individual’s estate, or (ii) by the individual’s nearest relative as defined in the Personal Directives Act , if the exercise of the right or power is for the purpose of processing an insurance claim, (e) if a guardian or trustee has been appointed for the individual under the Adult Guardianship and Trusteeship Act , by the guardian or trustee if the exercise of the right or power relates to the powers and duties of the guardian or trustee, (f) if an agent has been designated under a personal directive under the Personal Directives Act , by the agent if the directive so authorizes, (g) if a power of attorney has been granted by the individual, by the attorney if the exercise of the right or power relates to the powers and duties conferred by the power of attorney, (h) by the individual’s nearest relative as defined in the Mental Health Act if the exercise of the right or power is necessary to carry out the obligations of the nearest relative under that Act, or (i) by any person with written authorization from the individual to act on the individual’s behalf. (2) Any notice required to be given to an individual under this Act may be given to the person entitled to exercise the individual’s rights or powers referred to in subsection (1). RSA 2000 cH‑5 s104;2003 c23 s5;2007 c35 s25; 2008 cA‑4.2 s131;2020 c35 s66 Immunity from suit 105 No action lies and no proceeding may be brought against the Crown, a custodian or any person acting for or under the direction of a custodian for damages resulting from anything done or not done by that person in good faith while carrying out duties or exercising powers under this Act. RSA 2000 cH‑5 s105;2020 c35 s67 Protection of employee 106 (1) A custodian or a person acting on behalf of a custodian must not take any action against its affiliate to negatively affect its status as an affiliate of the custodian because the affiliate, acting in good faith, (a) has exercised or may exercise a right under section 83, or (b) has properly disclosed information in accordance with this Act. (2) A person who contravenes subsection (1) is guilty of an offence and liable to a fine of not more than $10 000. 1999 cH‑4.8 s106 Offences and penalties 107 (1) No custodian or affiliate of a custodian shall knowingly (a) alter, falsify or conceal any record, or direct another person to do so, with the intent to evade a request for access to the record, or (b) destroy any record that is subject to this Act, or direct another person to do so, with the intent to evade a request for access to the record. (1.1) No custodian shall (a) fail to take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will protect against any reasonably anticipated threat or hazard to the security or integrity of health information or of loss of health information, (b) fail to comply with section 60.1(2), (3), (4) or (5), or (c) fail to comply with an order made by the Commissioner under section 85.1(2)(b). (1.2) No affiliate of a custodian shall fail to comply with section 60.1(1). (2) No person shall knowingly (a) collect, use, disclose or create health information in contravention of this Act, (b) gain or attempt to gain access to health information in contravention of this Act, (c) make a false statement to, or mislead or attempt to mislead, the Commissioner or another person performing the duties, powers or functions of the Commissioner or other person under this Act, (d) obstruct the Commissioner or another person in the performance of the duties, powers or functions of the Commissioner or other person under this Act, (e) fail to comply with an order made by the Commissioner under section 80 or by an adjudicator under section 101, or (f) use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual who is the subject of the health information has specifically consented to its use for that purpose. (3) No researcher shall knowingly breach the terms and conditions of an agreement entered into with a custodian pursuant to section 54. (4) No information manager as defined in section 66(1) shall knowingly breach the terms and conditions of an agreement entered into with a custodian pursuant to section 66. (5) No person to whom non‑identifying health information is disclosed and who intends to use the information to perform data matching shall fail to comply with section 32(2). (5.1) No person shall knowingly disclose health information to which this Act applies pursuant to a subpoena, warrant or order issued or made by a court, person or body having no jurisdiction in Alberta to compel the production of information or pursuant to a rule of court that is not binding in Alberta. (6) A person who contravenes this section is guilty of an offence and is liable (a) in the case of an individual, to a fine of not more than $200 000, and (b) in the case of any other person, to a fine of not more than $1 000 000. (6.1), (7), (8) Repealed 2020 c35 s68. (9) A prosecution for an offence under this section may be commenced within 2 years after the day on which evidence of the alleged offence first came to the attention of the Commissioner, but not afterwards. (10) In respect of offences other than those under subsection (1.1)(b) or (c) or (1.2), subsection (9) applies to offences committed after this subsection comes into force. (11) In respect of offences other than those under subsection (1.1)(b) or (c) or (1.2), notwithstanding the repeal of subsection (8), subsection (8) continues in effect and applies to offences committed before this subsection comes into force. RSA 2000 cH‑5 s107;2006 c18 s17;2009 c25 s24;2014 c8 s4; 2020 c35 s68 Regulations 108 (1) The Lieutenant Governor in Council may make regulations (a) respecting the designation of an affiliate for the purposes of section 1(1)(a)(v); (b) designating a health information repository as an affiliate for the purposes of section 1(1)(a)(vii); (c) designating a health services provider as a custodian, or a class of health services providers, the members of which are to be custodians, for the purposes of section 1(1)(f)(ix); (d) designating individuals, boards, councils, committees, commissions, panels, agencies, corporations or other entities as custodians for the purposes of section 1(1)(f)(xiv); (e) designating a Community Board as a custodian for the purposes of section 1(1)(f)(xvi); (f) specifying information respecting a health services provider for the purposes of section 1(1)(i)(ii)(L); (g) excluding a service from the definition of health service for the purposes of section 1(1)(m); (h) describing registration information for the purposes of section 1(1)(u); (i) for the purposes of section 4, expressly providing that another Act or a regulation, or a provision of it, prevails despite this Act; (j) authorizing persons other than custodians to require individuals to provide their personal health numbers; (k) respecting the requirements of a consent or a revocation of a consent that is provided electronically for the purposes of section 34; (l) respecting the disclosure of individually identifying registration information by custodians to persons who are not custodians for the purposes of section 36(c); (m) prescribing information for the purposes of section 46(1)(b)(ii); (n) respecting the disclosure of health information or the performance of data matching or other services by a health information repository under section 53(3); (o) respecting the retention, disposal and archival storage of records for the purposes of section 60; (p) respecting the administrative, technical and physical safeguards that a custodian must maintain in respect of health information pursuant to section 60; (p.1) respecting the duty to give notice and the giving of notice under section 60.1, including, without limitation, regulations (i) respecting which custodian is obligated to give notice with respect to individually identifying health information that is or was in the custody or control of more than one custodian, (ii) prescribing the factors that must be considered for the purposes of section 60.1(4), (iii) respecting the form and contents of notices under section 60.1(1), (2) and (5); (q) respecting the stripping, encoding or other transformation of individually identifying health information to create non‑identifying health information pursuant to section 65; (r) respecting an agreement referred to in section 66; (s) respecting the designation of an agency, corporation or other entity as a health information repository; (t) respecting the disclosure of individually identifying health information by a custodian to a health information repository under section 72.2; (u) respecting the powers, duties and functions of a health information repository; (v) respecting fees payable for services provided under Part 2 and providing for circumstances in which applicants may be excused from paying all or part of a fee; (w) defining terms and phrases that are used but not defined in this Act. (2) The Minister may make regulations (a) designating bodies as research ethics boards for the purposes of sections 48 to 56; (a.1) specifying the information that is to be included in a proposed research protocol under section 49. (b) repealed 2020 c35 s69. RSA 2000 cH‑5 s108;2006 c18 s18;2009 c25 s25; 2014 c8 s4;2020 c35 s69 Review of Act 109 (1) A special committee of the Legislative Assembly must begin a comprehensive review of this Act within 3 years after the coming into force of this section and must submit to the Legislative Assembly, within one year after beginning the review, a report that includes the committee’s recommended amendments. (2) The review referred to in subsection (1) must include a review of the application of this Act (a) to departments of the Government of Alberta, (b) to local public bodies as defined in the Access to Information Act , and (c) to any other entity that is not a custodian and has information about the health of an individual in its custody or under its control. RSA 2000 cH-5 s109;AR 141/2025 Part 9 Consequential Amendments, Paramountcy and Coming into Force 110 to 124 (These sections make consequential amendments to other Acts. The amendments have been incorporated in those Acts.) Coming into force 125 This Act comes into force on Proclamation. 1999 cH‑4.8 s125 (NOTE: Proclaimed in force April 25, 2001.)