What does Alberta's Health Information Act ask a custodian to do after a breach?

When must a breach be reported?

When individually identifying health information a custodian holds or controls is lost, accessed without authority or disclosed without authority, and there is a risk of harm to an individual as a result. The test in the Act is a risk of harm to an individual, not a real risk of significant harm. The custodian weighs all relevant factors, including those the regulations list.

a custodian must as soon as practicable give notice in accordance with the regulations and subsection (3) of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in the custody or under the control of the custodian if there is a risk of harm to an individual as a result of the loss or unauthorized access or disclosure.

A custodian must consider all relevant factors, including the factors prescribed by the regulations, in assessing for the purposes of subsection (2) whether there is a risk of harm to an individual.

Who must be told?

The notice goes to three parties: the Commissioner, the Minister, and the individual the information is about. The Act lets a custodian skip the notice to the individual where it could harm their mental or physical health, but the custodian must then tell the Commissioner at once.

The notice required by subsection (2) must be given to (a) the Commissioner, (b) the Minister, and (c) the individual who is the subject of the individually identifying health information.

What if an affiliate finds the breach?

An affiliate of a custodian must tell the custodian as soon as practicable of any loss of, or unauthorized access to or disclosure of, the information.

Subject to the regulations, an affiliate of a custodian must as soon as practicable notify the custodian in accordance with the regulations of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in the custody or under the control of the custodian.

How fast?

The Act's words are "as soon as practicable". It gives no fixed number of days.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.