Privacy Impact Assessments - What has Changed?

What’s new?

As of October 1, 2024, Alberta’s Office of the Information and Privacy Commissioner (OIPC) will review privacy impact assessments (PIAs) submitted under the Health Information Act (HIA) but will no longer approve or conditionally accept them. Instead, custodians will receive a closing letter with comments and recommendations. Previously, the OIPC would accept, conditionally accept, or reject PIAs.

Who needs to submit a PIA?

Denturists are designated as custodians under the HIA, which means there is still an obligation to submit a PIA. This requirement has not changed.

What is a PIA?

A PIA identifies and addresses potential privacy risks in projects involving health and personal information. It is necessary for systems, administrative practices, or policy proposals related to collecting, using, or disclosing health or personal information.

When should you submit a PIA?

There are various situations that would give rise to the submission of a PIA. A few examples are listed below:

• Moving patient records from paper to an electronic platform for storing or sharing health information.
• Updating an existing electronic health record system, such as adding portable devices with wireless connections.
• Partnering with a new vendor who will access health information.

What does this mean to you?

If you’ve submitted a PIA and are awaiting feedback, expect a letter with comments and recommendations, not approval. Future PIAs will be reviewed under the new process and responses from the OIPC will be timelier.

Why is this changing?

PIA submissions have surged since the publication of the OIPC’s 2010 Privacy Impact Assessment Guide, making the review process unsustainable. The new approach will streamline feedback and reduce processing delays.

Learn more

For additional details, visit the OIPC website, where you can access the current PIA Requirements Guide (2010). Updates to the guide are underway.