Health Information Breach Notification Obligations Under Alberta's Health Information Act

Commencing August 31, 2018, Alberta's Health Information Act (the "HIA") will require custodians of personal health information to give notice of any health information security breach that presents a risk of harm to an individual. The security breach obligations under the HIA join an increasing number of Canadian statutory regimes that impose information security breach reporting and notification obligations. Custodians subject to the HIA should assess their readiness to comply with the security breach obligations, and make appropriate changes to prepare for compliance.

Background

The HIA regulates the collection, use and disclosure of health information that is in the custody, or under the control, of a "custodian" (including an ambulance or nursing home operator, a provincial health board, a regional health authority or a community health council) or an "affiliate" of a custodian (including an individual employed by, or performing services for, a custodian or a