Alberta · Health Information Act

Health-record access and privacy for Alberta custodians

AccessPoint manages Health Information Act access and correction requests, mandatory breach notification, and privacy impact assessments — pre-configured for Alberta and running inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

Alberta — HIA at a glance

Access deadline
Every reasonable effort to respond within 30 days to a request for one's own record (s. 12), extendable by 30 days or longer with the Commissioner's permission
Correction
Custodians decide a correction request within 30 days (s. 13); a refused correction carries a statement of disagreement (s. 14)
Access fees
A $25 basic fee under the Health Information Regulation, with additional cost-based fees per the schedule and a fee estimate given first
Breach notification
Notify the Commissioner, the Minister, and the affected individual as soon as practicable where there is a risk of harm (s. 60.1, since August 31, 2018)
Oversight
Office of the Information and Privacy Commissioner of Alberta (binding orders)
Languages
English

Built for Alberta — HIA

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

HIA access and correction

Intake to disclosure on Alberta's 30-day clock — access to a patient's own record, correction requests with a statement of disagreement where refused, the HIA rules, and defensible records, all on Microsoft 365.

Mandatory breach notification

Log a breach, assess the risk of harm, and get a live checklist of what must go to the Commissioner, the Minister of Health, and the affected individual — and by when — a duty in force since August 31, 2018.

The $25 basic fee, computed

Apply the $25 basic access fee and the Health Information Regulation schedule, produce the required fee estimate, and track deposits and waivers against every request.

PIAs submitted to the Commissioner

Alberta custodians must prepare a privacy impact assessment and submit it to the Commissioner for review before a new practice or information system goes live (s. 64). AccessPoint runs the PIA end to end — questionnaire, risk register, and an exportable submission.

OIPC reviews and binding orders

Track reviews to the Information and Privacy Commissioner with an investigation workspace — and because Alberta's Commissioner issues binding orders, keep a record that stands on its own.

In your own Alberta tenant

Every request, assessment, and record stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no cross-border transfers, no per-user fees.

2025: FOIP became two new laws

Alberta rewrote its privacy laws in 2025 — but the HIA still governs health records. AccessPoint runs it.

On June 11, 2025, Alberta replaced FOIP with two new statutes — the Protection of Privacy Act and the Access to Information Act. Health custodians felt the tremor, but the Health Information Act was not folded in: it remains the separate, governing law for health information, now cross-referenced to the new public-sector Acts. Under the HIA, the Office of the Information and Privacy Commissioner makes binding orders, custodians must submit privacy impact assessments to the Commissioner before new systems go live, and a breach that poses a risk of harm must be reported to the Commissioner, the Minister, and the affected individual. AccessPoint runs access, correction, breach notification, and PIAs on one platform, in your own tenant.

Binding orders Alberta's Commissioner issues binding orders under the HIA; ignoring one is an offence.
PIAs to the Commissioner Submit privacy impact assessments for review before a new system goes live (s. 64).
Breach to three recipients Notice to the Commissioner, the Minister, and the individual where there is a risk of harm.

Configured out of the box

Installing the ca-ab-hia configuration pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check
  • The Health Information Act as the legal-authority and citation spine, with the new Protection of Privacy Act and Access to Information Act shipped as separate configurations
  • Alberta statutory-holiday calendar and 30-day due-date rules
  • Access, correction, and disclosure grounds mapped to the HIA, with the statement-of-disagreement workflow
  • The $25 basic access fee and the Health Information Regulation fee schedule, with estimates, deposits, and waivers
  • Mandatory breach-notification workflow for the Commissioner, the Minister, and affected individuals
  • Privacy impact assessments prepared for submission to the Commissioner under s. 64
  • OIPC review grounds, binding orders, and dispositions
  • Consent and affiliate-handling rules for uses and disclosures

Alberta — HIA Questions

How long does an Alberta custodian have to respond to an access request?
Under the HIA, a custodian must make every reasonable effort to respond within 30 days to a request for an individual's own health information, with an extension of up to 30 days — or longer with the Commissioner's permission. AccessPoint computes the due date on Alberta's calendar and tracks every request against it.

What does it cost to access your own record, and does AccessPoint handle fees?
The Health Information Regulation sets a $25 basic fee for an access request, with additional cost-based fees under the schedule for copying and processing. AccessPoint applies the basic fee, builds the required fee estimate, and tracks deposits and any waiver.

Does the HIA require breaches to be reported?
Yes. Since August 31, 2018, a custodian that experiences a loss of, or unauthorized access to or disclosure of, individually identifying health information must, as soon as practicable, give notice to the Information and Privacy Commissioner, the Minister of Health, and the affected individual where there is a risk of harm. AccessPoint assesses the risk of harm and computes all three notifications.

Where does Alberta health data reside?
Entirely within your own Microsoft 365 and Azure tenant. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers.

Run HIA Access, Breach, and Assessments in One Platform

Try AccessPoint free for 30 days, pre-configured for Alberta. No credit card required.

Start Free Trial