Alberta Electronic Health Record Regulation

(Consolidated up to 112/2026) ALBERTA REGULATION 118/2010 Health Information Act ALBERTA ELECTRONIC HEALTH RECORD REGULATION Table of Contents 1 Definitions 2 Designation of information manager 3 Eligibility requirements for authorized custodian 3.1 Access to Alberta EHR 3.2 Access to Alberta EHR by Office of the Chief Medical Examiner 3.3 Access to Alberta EHR by health services provider outside Alberta 4 Alberta EHR accessible health information 5 Direction to regulated health services provider 5.1 Making health information accessible — authorized custodian 5.2 Ministerial direction to authorized custodian other than regulated health services provider 5.3 Imposing limits on making information accessible 6 Logs to comply with Standard 6.1 Provincial Logging and Auditing Standard 7 Audit of access to Alberta EHR 7.1 Designation of director 7.2 Investigators 7.3 Investigations 7.4 Notice of investigation 7.5 Powers during investigation 7.6 Action after investigation 7.7 Limiting, revoking and prohibiting access to Alberta EHR 7.8 Immediate interim limitation, revocation or prohibition of access 9 Coming into force Definitions 1 In this Regulation, (a) “code of ethics” has the same meaning as in the Health Professions Act ; (b) “standards of practice” has the same meaning as in the Health Professions Act . AR 118/2010 s1;220/2025;112/2026 2 Repealed AR 220/2025 s3. Eligibility requirements for authorized custodian 3 (1) For the purpose of sections 1(1)(c.1)(iv) and 56.22 of the Act, the Minister may designate a custodian as an authorized custodian only if (a) the Department determines that the custodian meets the eligibility requirements set out in subsection (2), and (b) the Minister determines that designating the custodian as an authorized custodian (i) would not present a risk to the privacy, safety and confidentiality of the health information accessible via the Alberta EHR, or (ii) would otherwise not be contrary to the public interest. (2) For the purpose of subsection (1)(a), the eligibility requirements are each of the following: (a) the custodian has adopted or established policies, procedures, systems and practices sufficient to maintain administrative technical and physical safeguards that will protect the confidentiality and security of health information accessible via the Alberta EHR and the privacy of individuals who are the subjects of that information; (b) the custodian has prepared and submitted to the Commissioner a privacy impact assessment concerning the custodian becoming an authorized custodian and obtaining access to the Alberta EHR in accordance with section 64 of the Act; (c) the custodian has met the Department’s technical and security requirements; (d) in the case of a custodian who is a regulated health services provider, the health professional body of which the custodian is a member has adopted or established standards of practice or provisions in a code of ethics for its members respecting (i) the management of electronic records, including standards or provisions respecting the protection, privacy and security of electronic records, and (ii) within 12 months after the coming into force of this clause, the management of information in records, including standards or provisions respecting the appropriate use of health information. AR 118/2010 s3;220/2025;112/2026 Access to Alberta EHR 3.1 (1) Subject to sections 7.7 and 7.8, an authorized custodian may only access the Alberta EHR in accordance with (a) the policies, procedures, systems and practices referred to in section 3(2)(a), (b) the technical and security requirements referred to in section 3(2)(c), (c) the standards of practice or code of ethics referred to in section 3(2)(d), if applicable, and (d) any other applicable provisions of the Act, the regulations or a code, standard, guideline, schedule or body of rules incorporated, adopted or declared in force by this Regulation, including a code, standard, guideline, schedule or body of rules developed by the Minister. (2) Subject to sections 7.7 and 7.8, for the purposes of section 56.5(1) of the Act, an authorized custodian, other than a custodian described in section 1(1)(f)(xii), (xii.1), (xiii) or (xiii.1) of the Act, may only access an individual’s health information accessible via the Alberta EHR if the authorized custodian provides or has provided a health service to that individual. AR 220/2025 s4;112/2026 Access to Alberta EHR by Office of the Chief Medical Examiner 3.2 (1) Subject to subsection (2), the Department may grant access to the Alberta EHR to a medical examiner with the Office of the Chief Medical Examiner and staff working under the direction of a medical examiner with the Office of the Chief Medical Examiner for the purposes of conducting or assisting with investigations under the Fatality Inquiries Act if the Department is satisfied that all of the following requirements and obligations are met: (a) the Office of the Chief Medical Examiner (i) has established or adopted policies, procedures and practices sufficient to maintain administrative, technical and physical safeguards that will protect the confidentiality and security of health information accessible via the Alberta EHR and the privacy of the individuals who are the subjects of that information, (ii) has met the Department’s technical and security requirements, (iii) has a privacy training program for all medical examiners and staff for whom it will be requesting access to the Alberta EHR, (iv) has confirmed the medical examiner and staff have determined health information accessible via the Alberta EHR is essential for the purpose of conducting or assisting with investigations under the Fatality Inquiries Act , and (v) has prepared and submitted to the Commissioner a privacy impact assessment concerning the Office of the Chief Medical Examiner obtaining access to the Alberta EHR that describes how proposed administrative practices and information systems relating to the use of health information accessible via the Alberta EHR may affect the privacy of the individual who is the subject of the information; (b) the medical examiner and staff have completed the Office of the Chief Medical Examiner’s privacy training program referred to in clause (a)(iii). (2) Notwithstanding that the Department is satisfied that the Office of the Chief Medical Examiner, a medical examiner and staff meet all applicable requirements and obligations referred to in subsection (1), the Department may choose not to grant access to the Alberta EHR to a medical examiner or staff if the Department is of the opinion that doing so would present a risk to the privacy, safety and confidentiality of the health information accessible via the Alberta EHR, or it would otherwise not be in the public interest to do so. (3) Subject to sections 7.7 and 7.8, the medical examiners and staff granted access to the Alberta EHR may only access the Alberta EHR in accordance with (a) the policies, procedures and practices referred to in subsection (1)(a)(i), (b) the technical and security requirements referred to in subsection (1)(a)(ii), and (c) any other applicable provisions in the Act, the regulations or a code, standard, guideline, schedule or body of rules incorporated, adopted or declared in force by this Regulation, including a code, standard, guideline, schedule or body of rules developed by the Minister. AR 220/2025 s4;112/2026 Access to Alberta EHR by health services provider outside Alberta 3.3 (1) In this section, (a) “eligible community” means a community referred to in the Schedule of Communities Outside of Alberta Eligible for Alberta Electronic Health Record Access developed by the Minister and as amended from time to time and declared in force by this Regulation; (b) “health services provider outside of Alberta” means a health services provider who (i) is a registered, regulated or licensed member of a health professional body in a province other than Alberta, and (ii) has the same National Occupational Classification as a health services provider eligible to become an authorized custodian under section 3; (c) “National Occupational Classification” means the National Occupational Classification developed and published by the Government of Canada, as amended or replaced from time to time. (2) The Schedule of Communities Outside of Alberta Eligible for Alberta Electronic Health Record Access developed by the Minister and published by the Department, as amended from time to time, is hereby declared in force and forms part of this Regulation. (3) Subject to subsection (4), the Department may enter into an agreement with a health services provider outside of Alberta to grant access to the Alberta EHR to the health services provider outside of Alberta for the purpose of the health services provider outside of Alberta providing continuing treatment and care outside of Alberta to an individual who is a resident of Alberta if the Department is satisfied that the following criteria are met: (a) the health services provider outside of Alberta must practise in an eligible community; (b) the health professional body referred to in subsection (1)(b)(i) must have in place (i) provisions in a code of ethics equivalent to a code of ethics referred to in section 1(a) or standards of practice equivalent to the standards of practice referred to in section 1(b) respecting (A) the management of electronic records, including, without limitation, standards related to the protection, privacy and security of electronic records, and (B) the management of information in records, including, without limitation, standards respecting the appropriate use of health information, and (ii) a disciplinary process for members who breach such a code of ethics or standards of practice; (c) the health services provider outside of Alberta must have established or adopted policies, procedures and practices sufficient to maintain administrative, technical and physical safeguards that will protect the confidentiality and security of health information accessible via the Alberta EHR and the privacy of the individuals who are the subjects of that information; (d) the health services provider outside of Alberta must meet the Department’s technical and security requirements. (4) An agreement referred to in subsection (3) must contain provisions (a) requiring the health services provider outside of Alberta to (i) implement and maintain the policies, procedures and practices referred to in subsection (3)(c), (ii) meet the technical and security requirements referred to in subsection (3)(d), (iii) only access the Alberta EHR for the purpose of providing continuing treatment and care in an eligible community to an individual who is a resident of Alberta, (iv) comply with any code, standard, guideline, schedule or body of rules incorporated, adopted or declared in force by this Regulation and as amended from time to time, including a code, standard, guideline, schedule or body of rules developed by the Minister, (v) only access the Alberta EHR in compliance with (A) any code, standard, guideline, schedule or body of rules referred to in subclause (iv), (B) the policies, procedures and practices referred to in subsection (3)(c), and (C) the technical and security requirements referred to in subsection (3)(d), (vi) comply with the governing legislation in its jurisdiction in respect of any health information accessed via the Alberta EHR, (vii) cooperate with any activities undertaken by the Department under clause (b), (viii) as soon as practicable, notify the Department of (A) any loss of individually identifying health information that was accessed via the Alberta EHR, or (B) any unauthorized access to, use or disclosure of individually identifying health information that was accessed via the Alberta EHR, (b) authorizing the Department to monitor and audit compliance with the terms and conditions of the agreement, (c) prohibiting the health services provider outside of Alberta from authorizing any other person, including staff, agents, employees or contractors, to access the Alberta EHR for any purpose, and (d) authorizing the Department to limit the health services provider outside of Alberta’s access to the Alberta EHR or terminate the agreement if the health services provider outside of Alberta fails to comply with the agreement. (5) Notwithstanding that the health services provider outside of Alberta meets or may meet the criteria referred to in subsection (3)(a) to (d), the Department may choose not to enter into an agreement to grant access to the Alberta EHR if the Department is of the opinion that doing so would present a risk to the privacy, safety and confidentiality of the health information accessible via the Alberta EHR, or it would otherwise not be in the public interest to do so. AR 220/2025 s4;112/2026 Alberta EHR accessible health information 4 For the purpose of section 56.21(4.3) of the Act, each of the following is a class or type of an individual’s health information accessible via the Alberta EHR: (a) personal demographic information that uniquely identifies the individual; (b) information that uniquely identifies health services providers who provide health services to the individual; (c) information about where health services are performed on and delivered to the individual; (d) information about key clinical events at the point of care of the individual; (e) information about the individual in respect of the following: (i) diagnostic imaging digital images; (ii) diagnostic imaging reports and tests; (iii) drug‑to‑drug interaction alerts; (iv) immunizations; (v) known allergies and intolerances; (vi) laboratory results; (vii) prescriptions, including dispensing information related to those prescriptions; (f) the individual’s health care related records other than the medical reports referred to in clause (g); (g) any other medical report of the individual. AR 118/2010 s4;220/2025;112/2026 Direction to regulated health services provider 5 For the purpose of section 56.3 of the Act, if the health professional body of a regulated health services provider, the Minister or the Minister referred to in section 1(1)(f)(xiii.1) of the Act, as the case may be, directs a regulated health services provider to make accessible health information referred to in that section, the information must be made accessible (a) within 30 days of the date of the direction, and (b) in accordance with the Department’s technical and security requirements. AR 118/2010 s5;220/2025;112/2026 Making health information accessible — authorized custodian 5.1 For the purpose of section 56.31 of the Act, health information referred to in that section may only be made accessible in accordance with the Department’s technical and security requirements. AR 220/2020 s7;112/2026 Ministerial direction to authorized custodian other than regulated health services provider 5.2 For the purpose of section 56.32(1) of the Act, if the Minister directs an authorized custodian other than a regulated health services provider to make accessible health information referred to in that section, the information must be made accessible (a) within 30 days of the date of the direction, and (b) in accordance with the Department’s technical and security requirements. AR 112/2026 s8 Imposing limits on making information accessible 5.3 For the purpose of section 56.4(2) of the Act, a limit on health information referred to in that section may only be imposed in accordance with the Department’s technical and security requirements. AR 112/2026 s8 Logs to comply with Standard 6 An authorized custodian must ensure the system the authorized custodian uses to access the Alberta EHR creates and maintains logs in accordance with the Provincial Logging and Auditing Standard v. 2.0 developed by the Minister and published by the Department, as amended from time to time. AR 118/2010 s6;220/2025 Provincial Logging and Auditing Standard 6.1 The Provincial Logging and Auditing Standard v. 2.0 developed by the Minister and published by the Department is declared in force as amended from time to time and forms part of this Regulation. AR 220/2025 s8 Audit of access to Alberta EHR 7 (1) The Department (a) shall conduct an audit of access to the Alberta EHR at least once each month, and (b) may conduct an audit referred to in clause (a) at any reasonable time. (2) An audit under subsection (1)(a) shall be conducted through a review of the electronic logs referred to in section 56.6(1) of the Act. AR 118/2010 s7;220/2025;112/2026 Designation of director 7.1 (1) The Department may designate a director for the purposes of this section and sections 7.2 to 7.8. (2) The director designated under subsection (1) may, in writing, delegate to any person any of the duties imposed or powers conferred on the director under this section and sections 7.2 to 7.8, including the power to commence an investigation under section 7.3 and make a decision under section 7.7. (3) The director has all the powers of an investigator under section 7.5. AR 220/2025 s8 Investigators 7.2 The director may designate one or more individuals as investigators for the purposes of conducting investigations under section 7.3. AR 220/2025 s8 Investigations 7.3 The director may commence an investigation related to the Alberta EHR if the director has reasonable grounds to suspect that a person, including the Department or an affiliate of the Department, has (a) failed to comply with section 3.1, 3.2 or 3.3, whichever is applicable, (b) used or disclosed health information accessed via the Alberta EHR for a purpose contrary to the Act, (c) made false or incorrect information accessible via the Alberta EHR, (d) accessed the Alberta EHR for a purpose not authorized by the Act, (e) used Alberta EHR login credentials for a purpose other than facilitating the person’s own authorized access to the Alberta EHR, (f) facilitated access to the Alberta EHR by a person not authorized to access the Alberta EHR, (g) compromised or disabled Alberta EHR safeguards or facilitated the compromising or disabling of Alberta EHR safeguards by any other person, or (h) failed to cooperate with an investigation referred to in this section. AR 220/2025 s8;112/2026 Notice of investigation 7.4 Before an investigation is conducted under section 7.3, the director must provide notice of the investigation in writing to the persons being investigated, subject to the following: (a) if the person is an affiliate of a custodian, by also sending a copy of the notice to the custodian or custodians of the affiliate; (b) if the person is authorized to access the Alberta EHR under section 3.2, by also sending a copy of the notice to the Office of the Chief Medical Examiner. AR 220/2025 s8 Powers during investigation 7.5 (1) During an investigation, an investigator, in respect of a person who received notice under section 7.4, at any reasonable time, may (a) require the production of any records relevant to the investigation within a period of time specified by the investigator and examine them, make copies of them or remove them temporarily for the purpose of making copies, (b) require any person to answer any questions with respect to matters relevant to the investigation and direct the person to answer the questions under oath, (c) enter any clinic, facility or other location relevant to the investigation, other than a private dwelling, to conduct an investigation, (d) enter a private dwelling relevant to the investigation to conduct an investigation only with a court order obtained under subsection (6) unless the owner or occupant of the private dwelling consents, and (e) access the electronic data processing equipment at the clinic, facility, private dwelling or other location, and any person who has custody or control of the equipment shall assist the investigator with the use of the equipment. (2) On entering any clinic, facility, private dwelling or other location relevant to the investigation to conduct an investigation, an investigator must carry identification in the form established by the Minister and present it on request to the owner or occupant of the premises and to any person who received notice under section 7.4. (3) No person shall (a) hinder, obstruct or interfere with or attempt to hinder, obstruct or interfere with an investigator conducting an investigation under section 7.3, or (b) provide an investigator with false information on matters relevant to an investigation under section 7.3. (4) If any person prevents an investigator from exercising powers under this section or hinders, interferes with or obstructs the investigator in the exercise of those powers, a judge of the Court of King’s Bench may, on the application of the investigator, make any order that the judge considers necessary to permit the investigator to conduct an investigation or exercise those powers. (5) An application under subsection (4) may be made without notice if the judge considers it appropriate in the circumstances. (6) If the owner or occupant of a private dwelling refuses consent for an investigator to enter a private dwelling, the investigator may apply on notice to a judge of the Court of King’s Bench for an order allowing an investigator to enter a private dwelling for the purposes of the investigation. AR 220/2025 s8 Action after investigation 7.6 (1) Following the conclusion of the investigation and prior to preparing an investigation report, the investigator must (a) give any person who received notice under section 7.4 an opportunity to make submissions within 30 calendar days of receipt of the notice respecting the matter being investigated, and (b) consider the submissions received in accordance with clause (a), including answers to any follow-up questions in respect of the submissions and any other information gathered in the investigation. (2) The director may decide whether the submissions referred to in subsection (1)(a) are to be made orally or in writing, which may include electronic means. (3) After an investigator concludes an investigation, the investigator must make an investigation report within a reasonable time and, if the investigator is not the director, submit the report to the director. AR 220/2025 s8 Limiting, revoking and prohibiting access to Alberta EHR 7.7 (1) Subject to section 7.8, if, on reviewing a report made under section 7.6(3), the director determines that one or more of section 7.3(a) to (h) apply in respect of a person, the director may, for a period of time set by the director or indefinitely, decide to limit, revoke or prohibit access to the Alberta EHR or the use of health information accessed via the Alberta EHR, or both, by (a) the person, and (b) where the person referred to in clause (a) is an affiliate of a custodian, the custodian. (2) The limitation, revocation or prohibition referred to in subsection (1) may include (a) repealed AR 112/2026 s11, (b) where the person referred to in subsection (1)(a) is authorized to access the Alberta EHR under section 3.2, limiting, revoking or prohibiting the access to the Alberta EHR granted under section 3.2 to a medical examiner with the Office of the Chief Medical Examiner or staff working under the direction of the medical examiner. (3) The director shall provide notice in writing of the director’s decision under subsection (1), including reasons, to any person who received notice under section 7.4. (4) The director may provide a copy of a decision and reasons, including any individually identifying health information or personal information without the consent of the individual to whom that information relates, to anyone who in the director’s opinion needs to know about the decision, including (a) the Office of the Information and Privacy Commissioner, and (b) the health professional body of a regulated health services provider. (5) Any person receiving notice under this section or section 7.8 that the person’s access to the Alberta EHR is being limited, revoked or prohibited must comply with the decision. AR 220/2025 s8;112/2026 Immediate interim limitation, revocation or prohibition of access 7.8 (1) After commencing an investigation under section 7.3 and before making a decision under section 7.7, the director may temporarily limit, revoke or prohibit a person’s access to the Alberta EHR pending a decision under section 7.7 where (a) the director has reasonable grounds to believe there is a risk of harm to an individual as a result of a loss of, an unauthorized access to or a disclosure of individually identifying health information, or (b) the director is of the opinion that it is in the public interest to do so. (2) Where the person referred to in subsection (1) is an affiliate of a custodian, the director’s power under subsection (1) includes the power to limit, revoke or prohibit access to the Alberta EHR or the use of health information accessed via the Alberta EHR, or both, by the custodian for a period of time set by the director or indefinitely. (3) The director shall provide notice in writing of the action taken under subsection (1) or (2) to any person who received notice under section 7.4. AR 220/2025 s8 7.9 Repealed AR 112/2026 s12. 8 Repealed AR 17/2018 s2. Coming into force 9 This Regulation comes into force on the coming into force of section 20 of the Health Information Amendment Act, 2009 .