Health Information (Ministerial) Regulation

(Consolidated up to 159/2026) ALBERTA REGULATION 106/2026 Health Information Act HEALTH INFORMATION (MINISTERIAL) REGULATION Table of Contents 1 Regulated member designated as custodian 2 Research ethics board 3 Disclosure of registration information 4 Restrictions on making accessible shared health information 5 Privacy impact assessment — general requirements 6 Subsequent change to privacy impact assessment for administrative practice or information system 7 Repeal 8 Expiry 9 Coming into force Regulated member designated as custodian 1 For the purpose of section 1(1)(f)(ix) of the Act, a regulated member of each of the following regulatory colleges established under the Health Professions Act is designated as a custodian: (a) Alberta College of Dental Hygienists; (b) Alberta College of Optometrists; (c) Alberta College of Pharmacy; (d) College of Alberta Denturists; (e) College of Chiropractors of Alberta; (f) College of Dental Surgeons of Alberta; (g) College of Dietitians of Alberta; (h) College of Midwives of Alberta; (i) College of Opticians of Alberta; (j) College of Physicians and Surgeons of Alberta; (k) College of Physiotherapists of Alberta; (l) College of Podiatric Physicians of Alberta; (m) College of Registered Nurses of Alberta. Research ethics board 2 For the purpose of section 1(1)(v.1) of the Act, each of the following is designated as a research ethics board: (a) the Health Research Ethics Board of Alberta established by Alberta Innovates under the Alberta Research and Innovation Act ; (b) the Health Research Ethics Board established by the University of Alberta; (c) the Conjoint Health Research Ethics Board established by the University of Calgary. Disclosure of registration information 3 (0.1) In this section, (a) “combined certificate” means a document deemed under section 23.7 of the Health Insurance Premiums Act to be a certificate of registration that is in the form of an identification card or an operator’s licence that displays a resident’s personal health number; (b) “identification card” means an identification card issued under section 17(2) of Schedule 12 to the Government Organization Act and includes a receipt issued on application for an identification card or a renewal of an identification card; (c) “operator’s licence” means an operator’s licence as defined in the Traffic Safety Act and includes an interim operator’s licence and a final operator’s licence issued under that Act; (d) “Registrar of Motor Vehicle Services” means the Registrar of Motor Vehicle Services appointed under the Traffic Safety Act and includes any person who, on the directions of the Registrar, is acting on behalf of the Registrar of Motor Vehicle Services. (1) For the purpose of section 36(c) of the Act, a custodian may only disclose individually identifying registration information to a person who is not a custodian if the disclosure is to the following: (a) an ambulance attendant for the purpose of the ambulance attendant exercising a power or performing a duty under the Emergency Health Services Act ; (b) the Minister of Service Alberta and Red Tape Reduction and the Registrar of Motor Vehicle Services for the purpose of determining if a combined certificate that is in the form of an identification card can be issued to an individual to whom the individually identifying registration information relates; (c) the Minister of Service Alberta and Red Tape Reduction, the Minister of Transportation and Economic Corridors and the Registrar of Motor Vehicle Services for the purpose of determining if a combined certificate that is in the form of an operator’s licence can be issued to an individual to whom the individually identifying registration information relates. (2) For the purpose of section 36(d) of the Act, a custodian must do the following in respect of a disclosure of individually identifying registration information to a foundation: (a) take reasonable measures to make publicly available the following in a statement: (i) the custodian is authorized under section 36(d) of the Act to disclose individually identifying registration information to a foundation; (ii) the name of each foundation to which the custodian may disclose the individually identifying registration information; (iii) a description of the process referred to in clause (b); (b) establish and maintain a process by which an individual may make a request that (i) the custodian not disclose their individually identifying registration information to a foundation, and (ii) a request referred to in subclause (i) be revoked; (c) make a record of each request referred to in clause (b); (d) not disclose individually identifying registration information to a foundation (i) if either of the following applies to an individual whose information is the subject of the disclosure: (A) the individual makes a request in accordance with clause (b)(i) that has not been revoked in accordance with clause (b)(ii); (B) the custodian reasonably believes that doing so would cause undue harm to the individual, and (ii) until after the expiry of a period of 60 days that starts on the day on which the custodian collected the information; (e) enter into a written agreement with each foundation referred to in clause (a)(ii) in which the foundation agrees (i) to use the individually identifying registration information provided to it only for its fundraising activities, (ii) not to make the individually identifying registration information publicly available, or otherwise disclose it, without the consent of the individual whose information is the subject of the disclosure, (iii) to establish and maintain administrative, technical and physical safeguards for the purpose of protecting the individually identifying registration information that it receives, (iv) to establish and make publicly available a process by which an individual may make a request to the foundation that the foundation not use their individually identifying registration information, (v) not to use the individually identifying registration information that is the subject of a request made in accordance with subclause (iv), and (vi) on contacting an individual in respect of whom the foundation has their individually identifying registration information, to inform the individual that (A) the foundation is authorized to use their individually identifying registration information only for its fundraising activities, and (B) the individual may make a request in accordance with the process referred to in subclause (iv) that the foundation not use their information. AR 106/2026 s3;159/2026 Restrictions on making accessible shared health information 4 For the purpose of section 56.203 of the Act, a sharing custodian may not make health information accessible to another sharing custodian or an authorized user unless the sharing custodians have each adopted common policies and procedures that set out the role of each sharing custodian in relation to all of the sharing custodians’ duties under the Act, including (a) the process by which a sharing custodian may cease to be a sharing custodian, (b) the manner in which an affiliate of each sharing custodian is to be identified as an affiliate of that sharing custodian, (c) the manner in which a sharing custodian is to ensure that its affiliates comply with the Act and regulations as it relates to the use of the shared health information, and (d) the manner in which sharing custodians will address the following: (i) a request made under section 8(1) of the Act; (ii) a request made under section 13(1) of the Act; (iii) a disclosure of shared health information made under the following provisions in response to a request for disclosure of health information made by a researcher under section 52(c)(i) or 52.1(5)(d)(i) of the Act: (A) section 53(1) or (2) of the Act; (B) section 54(1), (2) or (3) of the Act; (iv) an expressed wish referred to in section 56.206 of the Act. Privacy impact assessment — general requirements 5 (1) A privacy impact assessment required to be submitted in accordance with section 64 of the Act must, in the form determined by the custodian submitting the privacy impact assessment, set out each of the following in sufficient detail considering the complexity of the privacy impact assessment: (a) a summary of each type of health information that is the subject of the privacy impact assessment and the purposes for which it is to be collected, used or disclosed; (b) the legal authority for the collection, use and disclosure of the health information; (c) the associated risks to the privacy of an individual whose health information is the subject of the privacy impact assessment; (d) the strategies to mitigate the risks referred to in clause (c); (e) the administrative, physical and technical safeguards implemented to protect the health information that is the subject of the privacy impact assessment, including the manner in which that information is to be securely transmitted, matched or linked with other health information; (f) in the case of a custodian required to enter into an agreement under section 54 or 66 of the Act, a copy of the provisions of the agreement that relate to the privacy impact assessment. (2) For the purposes of section 56.204(2) of the Act, a custodian required to submit a privacy impact assessment under section 56.204(1) of the Act must, in addition to the requirements set out in subsection (1), include in the privacy impact assessment a description of the adopted common policies and procedures referred to in section 4. (3) A custodian who is required to submit a privacy impact assessment under section 64.1 of the Act must, in addition to the requirements set out in subsection (1), include in the privacy impact assessment a description of a governance structure respecting the role of each custodian and public body engaging in the common or integrated program or service. Subsequent change to privacy impact assessment for administrative practice or information system 6 If, in respect of a privacy impact assessment for a change to an existing administrative practice referred to in section 64(2) of the Act or for a change to an existing information system referred to in section 64(3) of the Act, a custodian had previously submitted a privacy impact assessment for that existing practice or system, as the case may be, the custodian (a) is not required to prepare and submit a new privacy impact assessment for the change, and (b) is required to prepare and submit an amendment to the previously submitted privacy impact assessment that addresses the change. Repeal 7 The Designation Regulation (AR 69/2001) is repealed. Expiry 8 For the purpose of ensuring that this Regulation is reviewed for ongoing relevancy and necessity, with the option that it may be repassed in its present or an amended form following a review, this Regulation expires on November 30, 2031. Coming into force 9 This Regulation comes into force on the coming into force of section 7(58) of the Health Statutes Amendment Act, 2025 (No. 2) .