Informationmanagers.ca Logo

Physiotherapists Are Now Custodians Under Alberta’s Health Information Act

by

male physiotherapist in blue scrubs discussing treatment plan with female sitting on exam table in a clinic

Physiotherapists Are Now Custodians Under Alberta’s Health Information Act

Guest Author – Samia Arshad – 2nd Year Practicum HIM Student (SAIT) 

Effective June 22, 2026, all registered physiotherapists in Alberta are designated custodians under the Health Information Act (HIA). The change comes through the proclamation of the Health Statutes Amendment Act, 2025 (No.2) together with Ministerial Order M.O. 19/2026.

What is New?

Until now, physiotherapists were subject to several different privacy laws, depending on the setting of their practice.  Now, all health information that a physiotherapist collects, uses, and discloses when providing health services will be subject to the HIA, regardless of where they practice.

What is a Custodian?

A custodian is a healthcare provider who is accountable for the health information in their custody or control.

Unlike the Personal Information and Protection Act (PIPA), which is consent based, the HIA is authority based. The HIA authorizes custodians to collect, use, and disclose health information for purposes set out in the Act, and requires them to identify those purposes at the point of collection.

By default, every physiotherapist is a custodian. However, when a physiotherapist works with another custodian–for example, in a multi-disciplinary community practice, or as an employee of a hospital or other custodian—they may act as an affiliate if the named custodian accepts the responsibility to ensure that the personal health information (PHI) will be managed in compliance of the HIA.

When a custodian declares themselves as an affiliate:

  • The relationship between the affiliate and custodian must be clearly established in writing.
  • Roles and responsibilities for managing health information must be clearly defined.

Custodians may delegate their responsibility to another custodian.
You can not abdicate your responsibilities as a custodian.

What Are a Custodian’s Responsibilities?

The HIA sets out several legal duties that every custodian must meet. As a custodian, you are responsible to:

  • Safeguard health information with reasonable administrative, technical, and physical measures (duty to protect, s. 60).
  • Collect only what is necessary for an authorized purpose and disclose the least amount of information needed.
  • Complete and submit Privacy Impact Assessments (PIAs) to the Office of the Information and Privacy Commissioner (OIPC) before implementing new or changed administrative practices or information systems (s. 64).
  • Put Information Manager Agreements in place with third-party providers such as EMR vendors (HIR s. 7.2). See the Top 3 Agreements Your Healthcare Practice MUST Have (and Why).
  • Report privacy breaches where there is a risk of harm. Penalties for failing to comply with mandatory privacy breach notification requirements range from $2,000 to $500,000.
  • Provide patients access to their records, respond to correction requests, and apply the chart-copy fees set in the HIA and HIR.
  • Create or review and update collection statements, privacy policies and procedures to ensure compliance with the HIA.

How Will This Impact Physiotherapists?

The impact depends on where you practise.

Public sector (AHS, hospitals, other agencies subject to POPA and HIA) Many physiotherapist will operate as affiliates under an existing custodian under the HIA.  Ask your organization’s privacy officer if you’re not sure.

Private practice (previously subject to PIPA, now HIA) Physiotherapists must create or review, and update your privacy collection statement, policies and procedures, PIAs, and EMR/third-party agreements to meet HIA requirements.

Physiotherapists are required to submit a PIA to the OIPC before implementing a new practice or system, or a change to an existing one (HIA s. 64).

How Will this Affect Other Healthcare Providers?

This change allows physiotherapists to share health information with other custodians–including physicians, pharmacists, chiropractors, dentists, nurses, and others–for the patients’ continuing care and treatment without additional consent from the patient, where authorized by the HIA.

Where to Get Help?

The College of Physiotherapists’ recommends that members prepare your PIAs now, as they take significant time to complete.

Resources are available from the College, the Office of the Information and Privacy Commissioner (OIPC) and Information Managers to help physiotherapists understand and meet their new responsibilities under the HIA.

References and Resources

College of Physiotherapists of Alberta.

Government of Alberta.

Information Managers Ltd.

Office of the Information and Privacy Commissioner of Alberta. Health Information Act resources. https://oipc.ab.ca/