Using AI Referral and Phone Tools in Alberta: What the Health Information Act Means for Your Clinic
Quick answer
In Alberta, physicians and other regulated health professionals in designated colleges are custodians under the Health Information Act (HIA). A vendor that handles health information for your clinic, such as an AI referral or phone tool, acts as your affiliate, so your clinic remains responsible for how that information is handled. Before introducing a new information system that collects, uses or discloses individually identifying health information, custodians are required to submit a privacy impact assessment (PIA) to the Information and Privacy Commissioner for review and comment.
Who is a custodian under the HIA?
According to the Office of the Information and Privacy Commissioner of Alberta (OIPC), custodians include regulated members of designated health profession colleges, such as physicians and surgeons, registered nurses, pharmacists, physiotherapists, dietitians and midwives, as well as provincial health bodies, approved hospitals and licensed pharmacies. For a community clinic, that usually means the physicians, and other regulated professionals, are the custodians.
Where does a software vendor fit?
The OIPC explains that the HIA also applies to the actions of affiliates of custodians, and that affiliates include employees, contractors, agents and information managers. A company that processes referrals or patient calls for your clinic falls into that group. In practice, that means:
Your clinic stays accountable for the health information the vendor handles.
You should have a written agreement that sets out what the vendor may do with the information, how it is protected and what happens at the end of the relationship.
The vendor’s safeguards become part of your own: access controls, logging, storage location and breach response.
Do we need a privacy impact assessment?
The OIPC states that section 64 of the HIA requires custodians to submit PIAs to the Commissioner for review and comment before implementing administrative practices or information systems, or changes to them, that collect, use or disclose individually identifying health information. The OIPC publishes a PIA Submission Assessment Tool and a PIA Requirements Guide to help clinics decide whether a submission is needed and what it must contain. Plan for this step before go-live, not after.
What changed in 2026?
The OIPC notes that amendments made by the Health Statutes Amendment Act, 2025 (No. 2) came into force on June 22, 2026, with further amendments in force on July 2, 2026. Its overview describes the HIA as requiring custodians to establish a privacy management program, to submit PIAs before introducing or changing information systems or administrative practices, and to notify the Commissioner, the Minister and affected individuals of a loss of, or unauthorized access to or disclosure of, individually identifying health information where there is a risk of harm. The overview also notes that the HIA sets rules for the use of automated systems. If you are evaluating AI tools, review the amended Act with your privacy officer.
What should you ask an AI vendor?
Where is health information stored and processed? Is it all in Canada?
Who at the vendor can access it, and is every access logged?
Can we limit access by role inside our clinic?
How are call recordings, transcripts and referral documents retained and deleted?
What is your breach notification process, and how fast will you tell us?
Will you sign a written agreement and help us prepare our PIA?
Where is AI used, and what decisions, if any, does it make without a person?
Does Alberta’s PIPA apply instead?
The Office of the Privacy Commissioner of Canada notes that Alberta has its own private-sector Personal Information Protection Act. For health information held by custodians, the HIA is the law clinics usually work under, which is why custodians face specific PIA requirements that do not apply to private organizations under PIPA.
Key takeaways
Physicians are custodians; your vendor is your affiliate, and you stay accountable.
Put a written agreement in place before any health information flows.
Expect to submit a PIA to the OIPC before go-live.
Review the 2026 amendments, including the rules on automated systems.
Frequently asked questions
Can our clinic use eReferral and an AI intake tool together?
Yes. Alberta Netcare eReferral lets clinics create, submit, track and manage referrals online, and an intake tool can work alongside it for referrals that still arrive by fax.
Who submits the PIA, us or the vendor?
The custodian is responsible for the PIA. A good vendor should provide the technical and security details you need to complete it.
Do patients have the right to know who accessed their information?
The OIPC notes that individuals can request access logs showing who accessed their health information via the Alberta EHR. Logging access in every system you use makes such requests easier to answer.
This article is general information, not legal advice. Confirm your obligations with your privacy officer, college or legal counsel.
How Ample helps
Ample stores and processes patient data in Canada, limits access by role, logs every access and signs privacy agreements before any data flows. For clinics outside Ontario and British Columbia, we review your province’s health privacy requirements with you during onboarding, including the information you need for a PIA.
Ample is built in Canada for specialty, multi-specialty and family medicine clinics. Patient data is stored and processed in Canada, Ample is PHIPA and PIPA compliant for clinics in Ontario and British Columbia, and it works with Accuro, OSCAR Pro, PS Suite, Med Access, Juno and virtually any other EMR. More than 100 clinics use it today. Book a 30-minute walkthrough to see it with your own referrals and calls.
