Changes to the Health Information Act

As of August 31, 2018, the Health Information Act (HIA) has changed. As such, it requires a custodian to, as soon as practicable, give notice of a loss of or any unauthorized access to, or disclosure of individually identifying health information in the custody or control of the custodian if there is a risk of harm to an individual as a result of the loss or unauthorized access or disclosure. This must be done in accordance with the regulations.

Section 8.2 of the Health Information Regulation sets out the requirements for the notices and lists the factors that custodians must consider when determining whether the breach created any risk of harm to any individual.  When there is a risk of harm due to a breach, notice is to be given to the Information and Privacy Commissioner of Alberta, the Minister of Health and the affected individual(s).

Alberta Health has released a variety of materials to provide information and guidance on the notification requirements.  Information is available on the Health Information Act section of Alberta Health’s website – http://www.health.alberta.ca/about/Health-Information-Act.html.

Included in this guidance material is Chapter 14: Duty to Notify of the HIA Guidelines and Practices Manual.  “Risk of Harm” and “Notification to the Individual, Minister and Commissioner” checklists are also available for use.  Additionally, the form to be used for Notification to Alberta’s Health Minister is available on Alberta Health’s website.  Breaches may be reported to the Minister by emailing HIABreachReporting@gov.ab.ca.

Members with questions regarding mandatory breach reporting may contact the HIA Help Desk by telephone at 780.427.8089 or by email at hiahelpdesk@gov.ab.ca.