This guide is a general summary and is not intended as legal advice. For guidance specific to your practice, consult a legal professional or your regulatory body.
Is Jane HIA compliant?
Yes, Jane is compliant with Alberta's Health Information Act (HIA).
Does HIA apply to my clinic?
Which privacy legislation applies to your Alberta clinic depends on the type of practice you run. There's the Health Information Act (HIA) and the Personal Information and Protection Act (PIPA).
The Health Information Act (HIA) is the more prescriptive of the two, but it only applies to practitioners designated as "custodians" under the Act. You can review the full list of designated practitioners in Health Information (Ministerial) Regulation. Custodians have a duty to protect health information as well as obligations around safeguarding, retention, and destruction.
PIPA applies to all other practitioners in Alberta not governed by the HIA. For more information on PIPA, see our guide on Is Jane Alberta PIPA Compliant?
If you're unsure whether HIA applies to your organization, contact your regulatory body for guidance.
How does HIA apply to my clinic?
Below are a few common principles in HIA that apply to small businesses and clinics.
Accountability and Management
Custodians are responsible for health information in their custody, and are required to implement a privacy management program and prepare and submit a Privacy Impact Assessment (PIA) to the Privacy Commissioner of Alberta under specific circumstances. PIAs are covered in additional detail below.
Notice
Individuals must be informed about why you are collecting their information and the legal authority behind it.
When using automated systems to collect health information, you must inform individuals ahead of collection.
If collecting information with a device that may not be visible to individuals, you must obtain written consent to do so before collection.
Use and Disclosure
Information you collect must be used only for the specified purpose the information was originally collected for, except under specific (and limited) legal exceptions.
Custodians may also disclose health information to other custodians and regulated health services providers under certain circumstances.
Consent
If you are not collecting, using, or disclosing information for an authorized purpose under the HIA, you must obtain consent from individuals. Consent must be received from the individual, unless an exemption is specific. This consent can be explicit or implied.
If collecting information with a device that may not be visible to individuals, you must obtain written consent to do so before collection.
With an individual's consent, custodians may disclose health information to another person as long as the individual has been appropriately informed and acknowledges they've been informed of the risks and benefits.
Access
Individuals whose information you hold have the right to request access to this information and to correct their health data if needed.
Limited Manner and Need-to-Know
Health data must be handled with the utmost anonymity, and only those who need to access the information should be able to do so.
Privacy Impact Assessments (PIAs)
A PIA is a process that helps custodians review the impact a new project or system may have on individual privacy. It ensures technical compliance with the HIA and assesses broader privacy implications for the individuals whose information is involved.
If your practice is governed by the HIA, you're required to complete a Privacy Impact Assessment (PIA) before:
- Introducing or changing an administrative practice or information system that relates to the collection, use, or disclosure of health information
- Becoming a "sharing custodian"
Privacy Impact Assessments for information systems must identify risks to health information, identify measures to protect the privacy of individuals, and address the security and confidentiality of individuals' health information.
Information about a custodian's duty to prepare privacy impact assessments can be found in Section 64 of the HIA. For practitioners not governed by the HIA, submitting a PIA to the Office of the Information and Privacy Commissioner (OIPC) is voluntary.
Submitting your PIA
If you're completing a PIA before implementing Jane, here are a few things to keep in mind:
- Submit your PIA questionnaire before implementing Jane.
- Include Jane's Privacy Notice and Terms of Use with your submission. You'll also want to reach out to the Jane team to request an Information Management Agreement (IMA). These are the agreements you enter into when setting up with Jane. Each custodian needs to sign their own IMA.
- Submit your PIA questionnaire with a cover letter from the head of your practice or clinic.
How does Jane enable my compliance with HIA?
Jane includes several technical features to help Alberta clinics meet both HIA and PIPA requirements.
- Signed, locked, and timestamped charts: to support the integrity of clinical records.
- Access controls: the Account Owner determines which staff members can access which information in Jane.
- Individual user accounts: all Jane users can log in individually, and all activity in Jane is tied to their account. Passwords can be easily reset at any time.
- Behaviour tracking: actions taken by a logged-in user are recorded, and clinic owners can audit this through the Activity Log.
- Secure data storage: health information is stored in secure and compliant data centres, with regular backups performed on secondary servers.
- Flexible charting: to help meet regulatory documentation requirements
- Intentional deletion: Jane restricts the ability to delete patient records for which health information has been added.
- Controlled disclosure: sharing of health information is managed at the patient level.
- Intake Forms: customizable electronic forms to alert patients to their privacy rights and collect consent.
- Keyboard shortcut to blur patient names: for added privacy in busy clinic settings.
- Real-time data saving: information is saved as it's entered in Jane.
- Privacy commitments from Jane: see Jane's Privacy Policy and Terms & Conditions.
For a full overview of Jane's security features, check out our Privacy, Security, and Compliance Hub. You can also read more about the HIA directly from Alberta's Health Information Act Guidelines and Practices Manual and HIA Fact Sheets on various topics.
Still have questions?
Have questions about this guide or anything else related to privacy? Email Privacy and Security Support at [email protected].