Last verified: October 23, 2026, against Alberta King's Printer consolidations of the Health Information Act (current as of July 2, 2026) and PIPA, and the Government of Alberta's HIA page. General information, not legal advice. Provincial rules vary; confirm with your privacy officer or counsel.
Alberta's Health Information Act (HIA) works differently from privacy laws elsewhere in Canada. Instead of asking whether you have consent to market with patient information, it lists the purposes for which a custodian may use identifying health information, and marketing isn't one of them. This guide covers who is a custodian under the Health Information Act Alberta clinics follow, where Alberta's PIPA takes over, and what both mean for your website, outreach and vendors.
The search volume is small but steady: "health information act alberta" gets about 210 searches a month in Canada (Google Ads Keyword Planner data via DataForSEO, Canada, 12-month average to Sep 2026). The people searching are usually clinic owners and managers trying to work out which rules apply to them.
Who is a custodian under Alberta's HIA
The HIA applies to custodians, listed in section 1(1)(f) of the Act (opens in a new tab). For independent clinics, the key entry is a "health services provider who is designated in the regulations as a custodian, or who is within a class of health services providers that is designated." Licensed pharmacies, continuing care home operators, ambulance operators and provincial health bodies are also custodians.
The Government of Alberta's HIA page (opens in a new tab) gives physicians, chiropractors and registered nurses as examples of custodians. Which other professions are designated depends on the regulations, so confirm your own status with your college or counsel.
Around each custodian sit its affiliates (s. 1(1)(a)): employees, people who provide services under a contract or agency relationship, and information managers. The province's example of an affiliate is a physician's office receptionist. Under section 62(3), anything an affiliate collects, uses or discloses counts as the custodian's own action.
An information manager (s. 1(1)(p.1)) is a person or body that "processes, stores, retrieves or disposes of health information" or provides IT services that require using it. Your EMR vendor, form tool, CRM and patient-messaging platform can all fit. Section 66(2) requires a written agreement with each one, in accordance with the regulations.
What counts as health information is broad. Section 1(1)(k) covers diagnostic, treatment and care information and registration information, which includes demographic, location and telecommunications information. A patient's phone number and email in your system are health information under the HIA.
HIA vs PIPA vs PIPEDA for an Alberta clinic
Three laws can touch the same clinic.
| Law | Covers | At a typical Alberta clinic |
|---|---|---|
| Health Information Act | Health information held by custodians and their affiliates | Charts, appointment requests, patient contact details, patient lists |
| Alberta PIPA | Personal information held by private organizations, except HIA health information | Non-patient newsletter subscribers, job applicants, records at clinics not run by a custodian |
| PIPEDA | Personal information in commercial activity crossing provincial or national borders | Data flows that leave Alberta |
PIPA. Section 4(3)(f) of the Personal Information Protection Act (opens in a new tab) says it does not apply to "health information as defined in the Health Information Act to which that Act applies." Everything else a private organization holds falls to PIPA. Two PIPA rules matter online: section 13.1 requires notice when you use a service provider outside Canada to collect or hold personal information, and section 34.1 requires notifying the Commissioner "without unreasonable delay" of a loss or unauthorized access where "a reasonable person would consider that there exists a real risk of significant harm."
PIPEDA. The OPC lists Alberta's PIPA as substantially similar to PIPEDA, so PIPEDA generally steps back inside Alberta, but it still applies to information crossing borders. See PIPEDA for the federal rules.
Illustrative example: A physician-owned family clinic in Calgary holds patient appointment requests under the HIA. Its list of people who signed up for a community flu-season talk, and never became patients, is personal information under PIPA.
If you also practise in Ontario, note the contrast with Ontario's PHIPA, which allows marketing with express consent. For a side-by-side with US rules, see HIPAA vs Canadian laws.
Using health information for marketing and outreach
Section 27(1) says a custodian may use individually identifying health information "only for the following purposes":
- providing health services;
- determining or verifying eligibility for a health service;
- investigations, discipline, practice visits or inspections relating to health professions;
- responding to complaints or legal actions against the custodian;
- approved research;
- health services provider education;
- any purpose authorized by an Alberta or federal enactment;
- internal management purposes, such as planning, quality improvement, audit, and obtaining or processing payment for health services.
Marketing is not on the list. Because patient contact details are registration information, and so health information, a clinic that pulls patient emails from its system to promote a new service is using health information outside the listed purposes.
Where the line falls in practice:
| Outreach | How it relates to s. 27 |
|---|---|
| Appointment reminder for a booked visit | Closely tied to providing health services |
| Recall for care the patient is due for | Ask your privacy officer whether it falls within providing health services |
| Newsletter to all patients | Hard to fit within the listed purposes |
| Promotion of a new or cosmetic service to patients | Hard to fit within the listed purposes |
| Marketing to the public (ads, website, social posts) | Uses no patient information, so s. 27 isn't engaged |
The practical answer for most clinics is to build marketing on information that isn't patient health information: a website, search visibility, a Google listing, ads aimed at the public, and a newsletter people sign up to directly. Federal anti-spam rules apply to any commercial email or text you send.
Privacy impact assessments and website tools
Section 64(1) requires a custodian to "prepare a privacy impact assessment and submit the privacy impact assessment to the Commissioner for review and comment" before:
- introducing a new administrative practice or information system relating to the collection, use and disclosure of individually identifying health information; or
- changing an existing one.
For a new information system, the assessment must identify the privacy risks, the measures that protect individuals, and how security and confidentiality are handled (s. 64(3)).
Website tools that collect patient information are information systems in plain terms: an online appointment-request form, a patient chat widget, a new CRM or patient inbox, a switch to a new email platform for patient messages. A brochure page with no forms collects no health information.
The 2025 amendments added two related duties. Section 63 requires every custodian to have a privacy management program of policies and procedures and to submit it to the Commissioner within 30 days of a request. Section 64.1 lets an information manager prepare an information security policy for its system; if it hasn't submitted one to the Commissioner, it must give the custodian a plain-language description detailed enough to prepare the assessment.
Section 60(1)(b) also requires safeguards for health information "stored or used in a jurisdiction outside Alberta," which belongs in the assessment for any vendor hosting data elsewhere. Data residency lists the questions to ask.
Medfy's facts, for your assessment, without a legal label: for Canadian practices, patient information from forms, chat and the CRM is stored in a separate, encrypted Canadian database, with role-based access and an audit log, and ad platforms never receive patient data.
Breach notification requirements
Section 60.1 sets two layers of notice.
- Affiliate to custodian. An affiliate, including an information manager, must notify the custodian "as soon as practicable" of any loss of, or unauthorized access to or disclosure of, individually identifying health information.
- Custodian to three parties. If there is a risk of harm to an individual, the custodian must give notice as soon as practicable to the Commissioner, the Minister and the individual.
In assessing risk of harm, the custodian considers all relevant factors, including those set out in section 8.1 of the Health Information Regulation (opens in a new tab), which also specifies what the notice contains. The Government of Alberta says notice is given in writing.
There is one narrow exception. If notifying the individual could reasonably be expected to harm their mental or physical health, the custodian may decide not to, but must immediately tell the Commissioner of that decision and why (s. 60.1(5)).
Illustrative example: A Red Deer clinic's new chat vendor misconfigures access, exposing transcripts with names and symptoms. The vendor tells the clinic as soon as practicable; the clinic assesses risk of harm, then notifies the Commissioner, the Minister and each affected patient in writing.
Organizations under PIPA instead notify the Commissioner when there is a real risk of significant harm (s. 34.1).
Before you add any new tool, see what your public site already exposes. A free marketing audit flags privacy risks such as tracking pixels on patient forms. For the rules in other provinces, start at healthcare marketing in Canada.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Who is a custodian under Alberta's Health Information Act?
Custodians are listed in section 1(1)(f) of the Act and include health services providers designated by regulation, licensed pharmacies, continuing care operators and provincial health bodies. The Government of Alberta gives physicians, chiropractors and registered nurses as examples. Staff, contractors and information managers working for a custodian are affiliates, and what they do counts as the custodian's action. Confirm your own profession's status with your college or counsel.
Can an Alberta clinic use patient information for marketing?
Generally not. Section 27 lists the only purposes for which a custodian may use identifying health information, such as providing health services and internal management, and marketing isn't among them. Patient contact details count as health information. Reminders tied to care are different from promotions; ask your privacy officer where recalls fall. Build marketing on public channels and on newsletter lists people join directly, which Alberta's PIPA governs.
Do Alberta clinics need a privacy impact assessment for new software?
Yes, if the software is a new or changed information system that collects, uses or discloses identifying health information. Section 64 requires the custodian to prepare the assessment and submit it to the Information and Privacy Commissioner for review and comment before introducing the system. An online appointment form, patient chat, CRM or patient-messaging platform usually qualifies. Vendors acting as information managers must describe their safeguards to you in plain language if they haven't filed a security policy.