Under the Health Information Act (HIA), third parties in Alberta cannot lawfully obtain Personal Health Information (PHI), or disclose obtained information, without the owner’s (individual’s) consent. The legislation begins with a duty of confidentiality and prohibition against disclosure unless consent is received.
It is important to note that not all circumstances recognized under the HIA require disclosure, and not all Canadian provinces require explicit consent to disclose. A comprehensive list of specific circumstances which permit disclosure without consent can be online. Saskatchewan, for example, is a province which uses an alternative approach known as inferred or implied consent. This allows information to be “used for the same purposes as the purpose for which the information was collected or for a purpose that is consistent with that purpose.”
Section 34(1) of Alberta’s HIA reads, “subject to sections 35 to 40, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure”. A form for individuals to provide this consent is available for download at Alberta Health’s website.
Sections 35-40 of the HIA cover an array of purposes which require consent to disclose:
Section 35: Disclosure of diagnostic, treatment, and care information;
Section 36: Disclosure of registration information (address/contact #);
Section 37: Disclosure to prevent/limit fraud or abuse of health services; Disclosure to protect public body and safety;
Section 38: Disclosure for purpose of storage;
Section 39: Disclosure by Minister and Department;
Section 40: Disclosure by Minister
EXIAPP8174: Privacy Applications: Issues and Practices, Module 5 FALL 2018, Page 13 & 14 of 22