Understanding Alberta's Health Information Act and why it matters
As healthcare embraces digital transformation, a clear understanding of Alberta’s Health Information Act is more important than ever.
Understanding the Health Information Act (HIA) is more critical than ever as technological advancements are optimizing access, increasing risk, and reshaping privacy considerations. To support legal professionals with navigating this evolving landscape, Tory Hibbitt and Amanda Cramm co-authored the first-ever Annotated HIA. This comprehensive resource, set to be published by LexisNexis later this year, provides legal commentary, case law summaries, practice tips, and expert insights to clarify rights and responsibilities under the HIA. Legal professionals can draw on it to advise clients on compliance and risk management within this multilayered regulatory framework.
Alberta’s privacy laws are being amended to keep pace with our increasingly complex digital ecosystem (i.e., Bills 33 and 34), and amendments to Alberta’s Health Information Act are expected to follow. These changes to modernize privacy laws, particularly in the field of health privacy, will affect a wide range of stakeholders. It is crucial for privacy lawyers to understand the HIA as it stands today while anticipating how future amendments may impact their clients.
Why understanding the HIA is critical
The HIA governs the collection, use, and disclosure of health information in Alberta, affecting everyone from healthcare providers and administrators to patients and innovators in digital health. Originally enacted to protect patient privacy while ensuring appropriate access to health information, the HIA now faces academic scrutiny and new pressures from digital transformation and emerging healthcare technologies.
Although the HIA primarily applies to custodians (e.g., healthcare organizations and regulated health professionals) and their affiliates, its impact extends far beyond these groups. Patients, businesses developing health-related technologies, and privacy professionals all need a clear understanding of how personal health information is protected, used, accessed and shared under Alberta law.
As privacy legislation undergoes modernization, a lack of clarity can lead to compliance risks, regulatory challenges, and barriers to innovation. The Annotated HIA was developed to bridge this gap, providing practical guidance to those navigating Alberta’s health privacy framework.
Key legal and compliance challenges in digital healthcare
As technology advances at an exponential pace, legal and regulatory frameworks notoriously struggle to keep up. This is particularly true in digital healthcare, where organizations are increasingly transitioning between being governed by Alberta’s Personal Information Protection Act (PIPA) and the HIA.
For example, a technology provider may initially fall under PIPA and, in partnering with a healthcare organization, become subject to the HIA as an “affiliate” or an “information manager”. This shift introduces compliance obligations, requiring organizations to understand their legal responsibilities and those of custodians, before entering into agreements that involve handling personal health information.
Privacy lawyers and advisors play a critical role in supporting their organizations to understand and comply with the law. To do this effectively, they must:
- Monitor legislative developments to ensure ongoing compliance.
- Assist clients in operationalizing privacy laws within healthcare settings.
- Address regulatory gaps and anticipate risks associated with data sharing, cybersecurity, and digital innovation.
This role requires a practical, well-informed approach to health privacy law – one that the Annotated HIA is designed to support.
How the Annotated HIA helps
To provide clarity on rights, obligations, and best practices, the Annotated HIA is structured into four sections.
- The history and evolution of the HIA – an overview of why the law was created and how it has been amended since its enactment.
- Annotations of the HIA – including:
- Case law: provides summaries of decisions demonstrating how the courts and OIPC have interpreted the law.
- Commentary: explains and clarifies the application of the law, drawing on jurisprudence and guidance issued by the OIPC, the Government of Alberta, and other scholarly sources.
- Practice Tips: offer guidance for implementation and compliance, incorporating best practices as informed by the experience and expertise of contributors.
- Expert Insights: add perspectives on health privacy issues, historical context, and valuable insights for evaluating the HIA as the legislation evolves.
- Regulations – high level commentary on the regulations under the HIA and notable sections.
- Resource Materials – a curated compilation of various practical tools, including tables, checklists, templates, and flowcharts, to support compliance efforts.
Looking ahead: Staying informed in an evolving legal landscape
The Annotated HIA was written as a resource to facilitate understanding of the HIA in its current form, with the aim of providing a useful reference as health privacy law evolves.
As Alberta’s privacy laws change to achieve a modernized, cohesive, and effective regulatory framework, it is important for stakeholders to stay informed. Healthcare providers, privacy professionals, and health technology innovators need to prioritize compliance, implementing a “privacy by design” approach to foster responsible innovation. Privacy lawyers can assist with this mandate by translating and simplifying what this means from a legal perspective.
