Framework Healthcare & Human Services
Alberta's Health Information Act is the provincial law that governs how health information is collected, used, disclosed, and protected by custodians (physicians, pharmacists, dentists, Alberta Health Services, the Minister of Health, and other listed bodies) and by their affiliates and information managers.
It gives individuals a right of access to their own health information and requires custodians to keep it secure. The Office of the Information and Privacy Commissioner of Alberta oversees the Act, investigates complaints and breaches, and reviews privacy impact assessments.
The Act is unusually explicit about paperwork. A custodian must have written policies and procedures for the administrative, technical, and physical safeguards it uses, must submit a privacy impact assessment to the Commissioner before implementing or changing an administrative practice or information system that handles individually identifying health information, must have written agreements with information managers, and must notify the Commissioner, the Minister, and affected individuals of breaches that pose a risk of harm.
Amendments passed in late 2025 and proclaimed in 2026 add provisions on shared custody, artificial intelligence, and the ability of information managers to submit their own security policies for review (verify proclamation dates and the final text).
Custodians as defined in the Act and its regulation, including physicians and other regulated health professionals in private practice, pharmacies, hospitals and Alberta Health Services, nursing homes, and the provincial health department, together with their affiliates (employees, contractors) and information managers (EMR vendors, AI scribe providers, billing agents).
In a review or investigation the Commissioner asks for the current PIA and any amendments, written privacy and security policies and procedures, the information manager agreements, staff confidentiality oaths and training records, access logs and audit reports for the EMR, breach records and notifications, the process for handling access requests and complaints, and records of how consent and disclosure decisions were made.
The Health Statutes Amendment Act, 2025 (No. 2) received Royal Assent in December 2025 and, according to reporting, its HIA provisions came into force in June 2026. Earlier amendments on breach notification and safeguards came into force on a September 1 proclamation date.
Verify both dates on oipc.ab.ca or alberta.ca before quoting them; the Commissioner's pages could not be retrieved when this profile was written.
Assessors
The Office of the Information and Privacy Commissioner of Alberta reviews PIAs, investigates complaints and breach reports, conducts audits and inquiries, and issues orders. There is no certification and no third-party assessor role in the Act.
No firm has claimed a Health Information Act (HIA) assessor listing yet. Claim yours →
Consultants
A regional ecosystem of privacy consultants and the Alberta Medical Association's practice support program help clinics prepare PIAs, policy sets, and information manager agreements. Engagements are typically a PIA package for a new clinic or system, with a policy manual and staff training, and updates when systems change.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
No firm has claimed a Health Information Act (HIA) tool listing yet. Claim yours →
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.