Written and maintained by CASRAI Editorial Board
Last updated
Alberta’s Health Information Act (HIA, RSA 2000, c H-5) is the province’s health-sector-specific privacy statute, overseen by the Office of the Information and Privacy Commissioner of Alberta (OIPC). It plays the same structural role in Alberta that PHIPA plays in Ontario — see CASRAI’s entry on PHIPA (Personal Health Information Protection Act) — but the two statutes are not interchangeable, and neither is HIA the same law as Alberta’s own Personal Information Protection Act (Alberta PIPA), which governs general commercial personal information rather than health records. A research administrator working across both provinces needs to keep three separate Alberta/Ontario statutes straight, not treat “the provincial health privacy law” as one thing.
Who HIA Applies To
HIA regulates “custodians” — a defined, largely enumerated category rather than a broad functional test, covering Alberta Health (the government department), Alberta Health Services (AHS, formed in 2008 when the province consolidated its nine regional health authorities into a single provincial health authority), physicians and other regulated health professionals, pharmacists, and other persons or organizations the Act or its regulations designate as custodians because they have custody or control of health information in the course of providing health services. Because AHS is now the single dominant custodian for most clinical data generated in the public system, Alberta’s custodian landscape is structurally more consolidated than Ontario’s, where many individual hospitals each remain their own separate PHIPA custodian. A university research unit that is not itself delivering health services is not normally a custodian in its own right — as with PHIPA, research access to clinical records flows through an agreement with the custodian (AHS, a physician’s practice, or another designated body) that actually holds the data, not through the researcher’s home institution.
The Research Disclosure Provision
HIA’s research-disclosure pathway — generally cited as section 50 of the Act — lets a custodian disclose individually identifying health information to a researcher without the individual’s consent, but only under conditions that parallel (without being identical to) PHIPA’s section 44: the custodian must be satisfied that the proposed research has been reviewed and approved by a research ethics board in accordance with the Act’s regulations, and the researcher must enter into a written agreement with the custodian committing to specific security, confidentiality, and use restrictions before any disclosure occurs. A disclosure that skips REB approval, or that proceeds without the researcher having signed the required agreement, is not a valid HIA research disclosure regardless of how the data is otherwise used. Because the exact prescribed contents of that agreement are set out in HIA’s regulations rather than the Act’s plain text, and because Alberta’s HIA Guidelines and Practices Manual is the primary practitioner reference for the precise mechanics, a research office relying on this pathway for a specific project should confirm current requirements directly with the custodian’s privacy office or OIPC Alberta rather than relying on a summary alone — section numbering in provincial health-privacy statutes is also periodically renumbered when regulations are amended.
How HIA Differs From PHIPA and From PIPEDA’s “Substantially Similar” Regime
The distinction that trips people up most is not HIA vs. Alberta PIPA (those are obviously different subject-matter statutes) but HIA’s relationship to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). CASRAI’s guide on PIPEDA and academic research data sets out which provincial statutes the Governor in Council has designated “substantially similar” to PIPEDA for personal health information specifically: Ontario’s PHIPA, New Brunswick’s Personal Health Information Privacy and Access Act, Newfoundland and Labrador’s Personal Health Information Act, and Nova Scotia’s Personal Health Information Act. Alberta’s HIA is not on that list. That means Alberta does not benefit from the same federal displacement of PIPEDA for health information that Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia do — in practice, most core clinical research conducted through a public custodian in Alberta is governed by HIA on its own terms (public-sector/health-sector activity, not “commercial activity” in PIPEDA’s sense), but the absence of a substantially-similar designation is a real structural difference from Ontario that a multi-site study spanning both provinces should not assume away.
Practical Checklist for Research Administrators
- Confirm which entity actually holds the data as custodian — for most Alberta public-system clinical data, this is now AHS rather than an individual hospital, which changes who signs the research agreement.
- Do not assume REB approval alone satisfies HIA — the written agreement between researcher and custodian is a separate, cumulative requirement under section 50, the same two-part structure PHIPA uses in Ontario.
- Do not conflate HIA with Alberta’s PIPA — a study that also handles non-health personal information (recruitment contact lists, survey platform accounts) may need to separately consider Alberta PIPA or the relevant public-sector FOIP legislation for that data, not HIA.
- For any multi-province study including an Ontario site, remember Alberta’s data is not carved out of PIPEDA’s federal reach the same way Ontario’s is — verify current designation status rather than assuming parity across provinces.
- Verify current section numbering and prescribed agreement contents directly against Alberta’s HIA Guidelines and Practices Manual or OIPC Alberta guidance before finalizing a research agreement, since regulatory detail below the Act’s own text is where implementation specifics live.
Frequently Asked Questions
Is Alberta’s Health Information Act the same as Alberta’s Personal Information Protection Act?
No. HIA governs health information held by defined “custodians” providing health services; Alberta PIPA is a separate statute governing general private-sector commercial personal information. A single research project can be subject to both, for different categories of information it collects.
Does REB approval alone authorize a custodian to disclose data under HIA?
No. Section 50’s research pathway requires REB approval of the research and a written agreement between the researcher and the custodian addressing security, confidentiality, and use restrictions — both conditions are cumulative, not alternatives.
Is Alberta’s HIA designated “substantially similar” to PIPEDA, the way Ontario’s PHIPA is?
No. The federal designation for health information specifically covers Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia. Alberta’s HIA is not on that list, which is a genuine structural difference from Ontario that matters for any research program spanning both provinces.
Who is the custodian for most public-system clinical data in Alberta?
Usually Alberta Health Services (AHS), which absorbed the province’s nine former regional health authorities in a 2008 consolidation. This is more centralized than Ontario, where many individual hospitals each remain separate PHIPA custodians.
