{"id":26559,"date":"2021-02-23T12:40:20","date_gmt":"2021-02-23T12:40:20","guid":{"rendered":"https:\/\/www.syscreations.ca\/blog\/?p=26559"},"modified":"2021-02-23T12:40:21","modified_gmt":"2021-02-23T12:40:21","slug":"hia-compliance-consulting-alberta","status":"publish","type":"post","link":"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/","title":{"rendered":"What are Alberta Health Information Act Regulations? [+ How Compliance Consulting Helps to be HIA Compliant?]"},"content":{"rendered":"\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\"><strong>If you\u2019re a healthcare provider practicing in Alberta or you are working with or for a healthcare provider, this blog is for you!<\/strong>\u00a0<\/span><\/p>\n\n\n\n<p>Our most experienced compliance consultants offering HIA compliance consulting for 7 years are here sharing everything about Alberta Health Information Act (HIA).&nbsp;<\/p>\n\n\n\n<h2><strong>What is HIA?<\/strong><strong>&nbsp;<\/strong><\/h2>\n\n\n\n<p>HIA is the healthcare-specific data privacy law imposed by the provincial government.&nbsp;<\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">It governs the collection, usage and disclosure of personal information of the patients in Alberta.\u00a0<\/span><\/p>\n\n\n\n<p>It also offers ultimate control to residents of Alberta over their data collected by healthcare providers.&nbsp;&nbsp;<\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">If any healthcare provider does not adhere to the HIA requirements, he can be liable for a fine of up to $200,000.\u00a0<\/span><\/p>\n\n\n\n<h2><strong>Does the Act Apply to You?<\/strong><strong>&nbsp;<\/strong><\/h2>\n\n\n\n<p>Yes, HIA applies to everybody living in Alberta. After all, it gives the right to access to all Albertans.&nbsp;<\/p>\n\n\n\n<p>However, talking about the HIA regulations, <span style=\"color:#7b68ee\" class=\"has-inline-color\">it applies to individual health services providers and organizations in Alberta.<\/span>\u00a0<\/p>\n\n\n\n<p>Most of these people fall under two major categories &#8211; Custodians and Affiliates.&nbsp;<\/p>\n\n\n\n<p>Meaning, every Custodian and Affiliate should adhere to HIA.&nbsp;<\/p>\n\n\n\n<p><strong><u>List of Custodians:<\/u><\/strong><\/p>\n\n\n\n<ul><li>Nursing home operators&nbsp;<\/li><li>Licensed pharmacies<\/li><li>Physicians<\/li><li>Dentists&nbsp;<\/li><li>Denturists<\/li><li>Dental hygienists<\/li><li>Optometrists<\/li><li>Opticians<\/li><li>Chiropractors<\/li><li>Podiatrists<\/li><li>Registered nurses<\/li><\/ul>\n\n\n\n<p><strong><u>List of Affiliates:<\/u><\/strong><\/p>\n\n\n\n<p>HIA considers an individual or organization as an affiliate if he is,&nbsp;<\/p>\n\n\n\n<ul><li>Employed by custodian&nbsp;<\/li><li>Performing service for a custodian as an appointee, volunteer or student<\/li><li>Performing service for custodian under contracts as business partner or service provider&nbsp;<\/li><\/ul>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">For example, if you as the healthcare provider (custodian) sign a contract with Amazon to use its cloud service &#8211; AWS, Amazon is called an affiliate.\u00a0<\/span><\/p>\n\n\n\n<p>Here, it is worth mentioning that insurance companies are neither custodians nor affiliates.<br><\/p>\n\n\n\n<h2><strong>Types of Information\/Data Protected by Health Information Act Alberta&nbsp;<\/strong><\/h2>\n\n\n\n<p><strong>1)<\/strong> <strong><u>Diagnostic, Treatment and Care Information<\/u><\/strong><\/p>\n\n\n\n<ul><li>Physical and mental health information of the patients&nbsp;<\/li><li>The treatment patients are receiving through healthcare providers<\/li><li>Patients\u2019 data related to medication and drugs&nbsp;<\/li><li>Data related to healthcare products they are using&nbsp;<\/li><li>The free and paid healthcare services or benefits of patients&nbsp;<\/li><li>Donation of body parts&nbsp;<\/li><\/ul>\n\n\n\n<p><strong>2)<\/strong> <strong><u>Registration Information<\/u><\/strong><\/p>\n\n\n\n<ul><li>Patients\u2019 name, address, signature, gender, photos, health card number<\/li><li>Citizenship&nbsp;<\/li><li>Immigration status&nbsp;<\/li><li>Billing data&nbsp;<\/li><li>Health service eligibility information&nbsp;<\/li><li>Telecommunications data&nbsp;<\/li><\/ul>\n\n\n\n<p><strong>3)<\/strong> <strong><u>Recorded Information<\/u><\/strong><\/p>\n\n\n\n<ul><li>X-rays<\/li><li>Notes<\/li><li>Letters<\/li><li>Audio-video recordings<\/li><li>Lab reports&nbsp;<\/li><\/ul>\n\n\n\n<p><strong>You should know this:&nbsp;<\/strong><\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">Any information which is non-identifying information can be collected, used and disclosed freely.\u00a0<\/span><\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">Because non-identifying information does not disclose the identity of the person.\u00a0<\/span><\/p>\n\n\n\n<h2><strong>Alberta Health Information Act Requirements<\/strong><\/h2>\n\n\n\n<p><strong>1)<\/strong> <strong><u>General Requirements:<\/u><\/strong><\/p>\n\n\n\n<ul><li>Ensure administrative, physical and technical safeguards of personal health information&nbsp;<\/li><li>Regularly validate or assess your implemented safeguards&nbsp;<\/li><li>Hire or designate an affiliate who is responsible for the overall privacy and security&nbsp;<\/li><li>If storing data outside of Alberta, sign agreements with service providers\/business partners to maintain the confidentiality of the data&nbsp;<\/li><li>Make sure your affiliates have enough awareness of safeguards and HIA&nbsp;<\/li><li>Define the penalty structure for affiliates who breach or attempt to breach the data<\/li><\/ul>\n\n\n\n<p><strong>2)<\/strong> <strong><u>Physical Safeguards:<\/u><\/strong><\/p>\n\n\n\n<ul><li>Whiteboards having patient information should not be placed in public areas&nbsp;<\/li><li>Lock building or rooms where you physically store data&nbsp;<\/li><li>Only authorized persons should have access to server rooms&nbsp;<\/li><li>There should be an alarm system&nbsp;<\/li><li>Consider the use of access cards&nbsp;<\/li><li>Secure the laptops&nbsp;<\/li><li>Implement a clean desk policy&nbsp;<\/li><li>Use lock shredding bins for disposal of sensitive records<br><\/li><\/ul>\n\n\n\n<p><strong>3)<\/strong> <strong><u>Technical Safeguards:<\/u><\/strong><\/p>\n\n\n\n<ul><li>Implement access control to all your digital systems&nbsp;<\/li><li>Make sure each digital system user has a unique username&nbsp;<\/li><li>Implement a strong password policy&nbsp;<\/li><li>Maintain system logs and regularly check who has viewed or edited health information&nbsp;<\/li><li>Detect unauthorized activities&nbsp;<\/li><li>Use password-protected screensavers and security screens<\/li><li>Install anti-virus system, firewalls and intrusion detection system&nbsp;&nbsp;<\/li><li>Implement encryption on mobile devices<\/li><li>Implement document-tracking system&nbsp;<\/li><li>Implement data-integrity controls&nbsp;<\/li><li>Encrypt sensitive emails<\/li><li>Implement security mechanisms to protect wireless networks from eavesdropping<\/li><li>Implement and periodically validate data backup and business recovery plans&nbsp;<\/li><\/ul>\n\n\n\n<p><strong>4)<\/strong> <strong><u>Administrative Safeguards<\/u><\/strong><\/p>\n\n\n\n<ul><li>You must implement privacy policies and procedures&nbsp;<\/li><li>You must train your staff based on policies and procedures so that they can avoid any data breach&nbsp;<\/li><li>Carry out a <a href=\"https:\/\/www.syscreations.ca\/blog\/pia-alberta\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span style=\"color:#7b68ee\" class=\"has-inline-color\"><u>Privacy Impact Assessment<\/u><\/span><\/a> to discover the risks and later mitigate them&nbsp;<\/li><li>Use the most secure method for sharing health information&nbsp;<\/li><li>Periodically evaluate the policies and procedures&nbsp;<\/li><\/ul>\n\n\n\n<p><strong>5)<\/strong> <strong><u>Staff or Affiliates Access<\/u><\/strong><\/p>\n\n\n\n<ul><li>Affiliates working for or with healthcare providers must have access to necessary data only.&nbsp;<\/li><li>Staff taking online\/offline appointments should not have access to see all medical treatment details.&nbsp;<\/li><li>Staff handling billing should not have access to see the treatment information.&nbsp;<\/li><li>Doctors and nurses should have access to see data of patients they are directly involved with.&nbsp;<\/li><\/ul>\n\n\n\n<p><strong>6)<\/strong> <strong><u>Retention and Disposal of Records<\/u><\/strong><\/p>\n\n\n\n<ul><li>Continue to hold data for 10 years&nbsp;<\/li><li>Shred paper-based data&nbsp;<\/li><li>In the case of digitally-stored data, use professional data wiping software or destroy the media drive itself&nbsp;<\/li><\/ul>\n\n\n\n<h2><strong>How to be Compliant with HIA and Carry out PIA at the Same Time? &#8211; The Most Easiest Method&nbsp;<\/strong><\/h2>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\"><strong>(Under section 64 of HIA, PIA is mandatory.)<\/strong>\u00a0<\/span><\/p>\n\n\n\n<p>Suppose you\u2019re developing a healthcare mobile app in Alberta.&nbsp;<\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">Here is how your app and organization can be HIA compliant and you can carry out PIA at the same time.\u00a0<\/span><\/p>\n\n\n\n<p><strong>Step #1:<\/strong> You need to draft a compliance strategy before even starting to develop your app as there are many technical requirements your app should work accordingly.&nbsp;<\/p>\n\n\n\n<p><strong>Step #2:<\/strong> You need to make sure that APIs you\u2019re using in your app are also HIA compliant APIs.&nbsp;<\/p>\n\n\n\n<p><strong>Step #3:<\/strong> Sign a business associate agreement with your 3rd party business partners or service providers.&nbsp;<\/p>\n\n\n\n<p><strong>Step #4:<\/strong> You should carry out <strong>TRA (Threat and Risk Assessment)<\/strong> on the app &#8211; with respect to applicable laws.&nbsp;<\/p>\n\n\n\n<p><strong>Step #5:<\/strong> TRA reveals the app\u2019s security vulnerabilities which you have to fix. Once you fix it, your app would become compliant with the law you\u2019ve considered while carrying out TRA.&nbsp;<\/p>\n\n\n\n<p><strong>Step #6: <\/strong>You need to carry out a separate compliance audit in case there are regulations you missed out to meet during TRA.&nbsp;<\/p>\n\n\n\n<p><strong>Step #7<\/strong> Lastly, you should carry out PIA (Privacy Impact Assessment)&nbsp; which validates the compliance-readiness of your entire organization including the mobile app.<\/p>\n\n\n\n<p>This way, your app and organization would become compliant with HIA and you can carry out PIA at the same time.<\/p>\n\n\n\n<h1><strong>Finding This Difficult? Let Our Compliance Consultants Help You to Be HIA Compliant and Carry Out PIA <\/strong><\/h1>\n\n\n\n<p>We are an Ontario-based team of technical and compliance experts &#8211; has been helping Canadian healthcare entities for 7 years.&nbsp;<\/p>\n\n\n\n<p>We not only provide <a href=\"https:\/\/www.syscreations.ca\/healthcare-compliance-consulting\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span style=\"color:#7b68ee\" class=\"has-inline-color\"><u>compliance consulting services<\/u><\/span><\/a> but also help entities to address the technical and operational requirements of several compliance laws.<\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">Being a Canadian company, we understand the gravity of compliance. Thus we only provide you with quality and proactive service.<\/span><\/p>\n\n\n\n<p><span style=\"color:#7b68ee\" class=\"has-inline-color\">In addition to compliance, our team has ultimate expertise in carrying out PIA and TRA.\u00a0<\/span><\/p>\n\n\n\n<p>We are also clever enough to let you get access to <a href=\"https:\/\/www.syscreations.ca\/blog\/alberta-netcare-ehr\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span style=\"color:#7b68ee\" class=\"has-inline-color\"><u>Alberta Netcare<\/u><\/span><\/a><span style=\"color:#7b68ee\" class=\"has-inline-color\">.<\/span>&nbsp;On a concluding note, we would like to share a <a href=\"https:\/\/www.syscreations.ca\/healthcare-app-regulations-canada\" target=\"_blank\" rel=\"noreferrer noopener\"><span style=\"color:#7b68ee\" class=\"has-inline-color\"><u>case study<\/u><\/span><\/a> that talks about how we helped an app agency to fill 47 security gaps and develop a HIPAA compliant app.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you\u2019re a healthcare provider practicing in Alberta or you are working with or for a healthcare provider, this blog is for you!\u00a0 Our most experienced compliance consultants offering HIA compliance consulting for 7 years are here sharing everything about Alberta Health Information Act (HIA).&nbsp; What is HIA?&nbsp; HIA is the healthcare-specific data privacy law [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":26563,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[12],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v16.1.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Compliance Consulting Alberta | Health Information Act Regulations<\/title>\n<meta name=\"description\" content=\"Know Alberta health information act regulations and how compliance consulting helps you be compliant with HIA Alberta.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Easiest Guide to HIA Alberta\" \/>\n<meta property=\"og:description\" content=\"HIA regulations + How to be compliant with it!\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/\" \/>\n<meta property=\"og:site_name\" content=\"SyS Creations - IT Management, Compliance &amp; Consulting Company in Canada\" \/>\n<meta property=\"article:published_time\" content=\"2021-02-23T12:40:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-02-23T12:40:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.syscreations.ca\/blog\/wp-content\/uploads\/2021\/02\/Blog-24-23-2-21.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Easiest Guide to HIA Alberta\" \/>\n<meta name=\"twitter:description\" content=\"HIA regulations + How to be compliant with it!\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\">\n\t<meta name=\"twitter:data1\" content=\"6 minutes\">\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/#website\",\"url\":\"https:\/\/www.syscreations.ca\/blog\/\",\"name\":\"SyS Creations - IT Management, Compliance &amp; Consulting Company in Canada\",\"description\":\"SyS Creations - IT Management, Compliance &amp; Consulting Company in Canada\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":\"https:\/\/www.syscreations.ca\/blog\/?s={search_term_string}\",\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.syscreations.ca\/blog\/wp-content\/uploads\/2021\/02\/Blog-24-23-2-21.jpg\",\"contentUrl\":\"https:\/\/www.syscreations.ca\/blog\/wp-content\/uploads\/2021\/02\/Blog-24-23-2-21.jpg\",\"width\":1280,\"height\":720,\"caption\":\"What are Alberta Health Information Act Regulations? [+ How Compliance Consulting Helps to be HIA Compliant?]\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/#webpage\",\"url\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/\",\"name\":\"Compliance Consulting Alberta | Health Information Act Regulations\",\"isPartOf\":{\"@id\":\"https:\/\/www.syscreations.ca\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/#primaryimage\"},\"datePublished\":\"2021-02-23T12:40:20+00:00\",\"dateModified\":\"2021-02-23T12:40:21+00:00\",\"author\":{\"@id\":\"https:\/\/www.syscreations.ca\/blog\/#\/schema\/person\/c09c2823449c6b5e7b11fd98b3897f9a\"},\"description\":\"Know Alberta health information act regulations and how compliance consulting helps you be compliant with HIA Alberta.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"item\":{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/\",\"url\":\"https:\/\/www.syscreations.ca\/blog\/\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"position\":2,\"item\":{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/\",\"url\":\"https:\/\/www.syscreations.ca\/blog\/hia-compliance-consulting-alberta\/\",\"name\":\"What are Alberta Health Information Act Regulations? [+ How Compliance Consulting Helps to be HIA Compliant?]\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/#\/schema\/person\/c09c2823449c6b5e7b11fd98b3897f9a\",\"name\":\"Parth Patel\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.syscreations.ca\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e69b7008ca1aaee24496ae0be968f8af?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e69b7008ca1aaee24496ae0be968f8af?s=96&d=mm&r=g\",\"caption\":\"Parth Patel\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/posts\/26559"}],"collection":[{"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/comments?post=26559"}],"version-history":[{"count":3,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/posts\/26559\/revisions"}],"predecessor-version":[{"id":26562,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/posts\/26559\/revisions\/26562"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/media\/26563"}],"wp:attachment":[{"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/media?parent=26559"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/categories?post=26559"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.syscreations.ca\/blog\/wp-json\/wp\/v2\/tags?post=26559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}