The framework that governs how health information moves through Alberta's healthcare system is not a single statute but an interlocking set of legislative instruments, regulatory bodies, and professional standards, each with distinct purposes, overlapping responsibilities, and different enforcement mechanisms. When a registered nurse in early thirties working at a private clinic in Lethbridge, Alberta develops an opioid dependency and begins forging prescriptions, the situation does not remain contained within a single institutional silo. Information about the nurse's conduct, health status, professional fitness, and potential criminal activity becomes relevant to multiple actors at once: the College of Registered Nurses of Alberta, the College of Physicians and Surgeons of Alberta if a physician's prescribing authority was implicated, the private clinic as employer, any hospital where the nurse also holds privileges, law enforcement conducting a criminal investigation, and potentially child welfare authorities given the nurse has 2 young children at home. Understanding which statutes authorize what disclosures, which bodies have jurisdiction over which aspects of the situation, and how information lawfully flows between these entities is essential for anyone who must navigate this landscape—whether as the subject of an investigation, a colleague with reporting obligations, a privacy officer managing disclosure requests, or a regulator receiving information from multiple sources.
Alberta's health information privacy regime is anchored by the Health Information Act, a provincial statute that governs the collection, use, and disclosure of individually identifying health information by custodians within the health system. The Health Information Act defines "health information" broadly to include diagnostic, treatment, and care information about an identifiable individual, as well as registration information that connects a person to a health services provider. A custodian under this legislation includes hospitals, nursing homes, pharmacies, physicians, and other health services providers who collect or maintain health information in connection with providing a health service. The private clinic in Lethbridge where the nurse worked is a custodian under this framework if it collects health information in the course of providing care, as is any hospital where the nurse might have held privileges. The Health Information Act creates a general rule that health information may only be collected, used, or disclosed in accordance with the statute, and unauthorized disclosure can result in administrative penalties, regulatory consequences, and in some circumstances, prosecution. This is the foundational statute that determines whether a given piece of information about the nurse—her patient records, her own health records if she sought treatment for dependency through the health system, or notes from occupational health assessments—may lawfully be shared with another entity.
The Health Information Act contains specific provisions authorizing disclosure without consent where disclosure is necessary to protect the health or safety of others, where disclosure is required by law, or where disclosure is to a regulatory body for the purpose of carrying out its statutory responsibilities. When the College of Registered Nurses of Alberta opens an investigation into a nurse's fitness to practice, the College is a body exercising statutory powers under the Health Professions Act, and custodians are authorized to disclose information to the College that is necessary for the investigation. Similarly, when law enforcement investigates potential criminal conduct—such as the forgery of prescriptions—the Health Information Act permits disclosure to law enforcement where the disclosure is authorized by a warrant or subpoena, or where there are reasonable grounds to believe that disclosure is necessary to investigate or prevent an offence. The interplay between these provisions means that the same piece of information—a prescription record, a clinical note documenting drug diversion, or a report from a pharmacy—may be disclosed to the College, to law enforcement, and potentially to the College of Physicians and Surgeons of Alberta, each through a distinct legal pathway. Custodians navigating this terrain must be able to identify the specific statutory basis for each disclosure, because disclosure without lawful authority constitutes a breach of the Health Information Act regardless of how compelling the institutional interest in sharing information might seem.
Alberta's Personal Information Protection Act operates alongside the Health Information Act but governs a different domain. The Personal Information Protection Act applies to organizations in the private sector that collect, use, or disclose personal information in the course of commercial activities, but it explicitly does not apply to personal information that is health information as defined in the Health Information Act and that is in the custody or control of a custodian under that statute. This means that a private clinic that is a custodian under the Health Information Act will have its handling of patient health information governed by that statute, not the Personal Information Protection Act. However, the Personal Information Protection Act may still apply to the clinic's handling of employee personal information that does not fall within the Health Information Act's scope—for instance, human resources records about the nurse's employment history, performance evaluations, or disciplinary actions that do not involve health information. Where a private clinic is managing parallel streams of information—health information about patients, employment information about staff, and potentially health information about staff who have accessed workplace health services—the organization must apply the correct statutory framework to each category. A privacy officer at the clinic cannot simply treat all information identically; the rules governing disclosure of a patient chart differ from the rules governing disclosure of an HR file, even when both involve the same nurse.
The Freedom of Information and Protection of Privacy Act provides another layer of the regulatory architecture, governing access to information and protection of privacy in relation to public bodies. If the nurse worked at a hospital operated by Alberta Health Services rather than a private clinic, the Freedom of Information and Protection of Privacy Act would govern certain administrative records, while the Health Information Act would continue to govern health records. The distinction matters when information requests arrive: a request from a regulator for investigation files may engage the Freedom of Information and Protection of Privacy Act if the files are administrative records of a public body, while the same regulator's request for health records engages the Health Information Act. For a private clinic, the Freedom of Information and Protection of Privacy Act is generally not applicable, but the clinic must still understand that information disclosed to public bodies—including law enforcement agencies and regulatory colleges exercising statutory powers—may subsequently be subject to access requests under that legislation, creating downstream implications for information the clinic provides.
The Health Professions Act is the statute that establishes the regulatory colleges for health professions in Alberta, including the College of Registered Nurses of Alberta and the College of Physicians and Surgeons of Alberta. Each college operates under its own regulation and bylaws made pursuant to the Health Professions Act, but the overarching framework is consistent: colleges have the statutory mandate to protect the public, they register and license practitioners, they set standards of practice and codes of ethics, and they have the power to investigate complaints and conduct fitness-to-practice proceedings. The Health Professions Act grants colleges broad investigative powers, including the authority to require production of documents and records relevant to an investigation, and it imposes duties on regulated members to cooperate with investigations. When the College of Registered Nurses of Alberta investigates a nurse for conduct related to opioid dependency and prescription forgery, it exercises powers under the Health Professions Act, and that statute authorizes the College to collect information that would otherwise be protected under the Health Information Act or Personal Information Protection Act. The nurse who is the subject of the investigation cannot rely on privacy legislation to refuse disclosure of information that the College is statutorily entitled to obtain; the Health Professions Act carves out explicit authority that overrides the general privacy protections.
The relationship between the College of Registered Nurses of Alberta and the College of Physicians and Surgeons of Alberta illustrates how information-sharing obligations arise in a situation involving multiple regulated professionals. If the prescription forgery involved a physician's name or prescribing authority—whether the nurse forged the physician's signature, used prescription pads without authorization, or otherwise implicated the physician's practice—the College of Physicians and Surgeons of Alberta may have legitimate regulatory interest in the matter. The Health Professions Act contemplates cooperation between colleges, and section 130.1 authorizes sharing of information between colleges where it is relevant to the regulatory functions of each body. This means that information collected by the College of Registered Nurses of Alberta in the course of investigating the nurse may be disclosed to the College of Physicians and Surgeons of Alberta without consent if the information is necessary for the physician college to carry out its regulatory mandate. The same mechanism operates in reverse: if the College of Physicians and Surgeons of Alberta initiates its own investigation into whether a physician failed to maintain adequate controls over prescription materials, information gathered in that investigation may be shared back with the nursing college. Both colleges operate under the same statutory framework, and the legislation contemplates that regulatory bodies will not operate in isolation when professional misconduct crosses disciplinary boundaries.
The mandatory reporting provisions in the Health Professions Act create obligations that intersect with privacy legislation in ways that practitioners and administrators must understand. Section 127 of the Health Professions Act requires regulated members to report to a college if they have reasonable grounds to believe that another regulated member has engaged in conduct that constitutes a danger to the public or is otherwise deserving of investigation. This reporting obligation operates notwithstanding privacy protections that might otherwise apply: a nurse who witnesses a colleague diverting medications is obligated to report that conduct even though doing so involves disclosing information about the colleague. The mandatory reporting provision creates an exception to the general privacy rules, and failure to report can itself constitute unprofessional conduct. Similarly, employers have reporting obligations under section 56 of the Health Professions Act: a health services employer must report to the relevant college if a regulated member's employment is terminated, suspended, or restricted for reasons related to professional competence or conduct. When the private clinic in Lethbridge terminates or suspends the nurse due to the prescription forgery, the clinic is obligated to report that action to the College of Registered Nurses of Alberta, and this mandatory report includes information about the circumstances that led to the employment action. The clinic cannot refuse to report on privacy grounds; the Health Professions Act imposes the obligation and authorizes the necessary disclosure.
Law enforcement's involvement adds another regulatory body to the information-sharing matrix. When the nurse's conduct involves forging prescriptions, the conduct potentially constitutes criminal offences under the Criminal Code—forgery, uttering forged documents, and potentially fraud. The Controlled Drugs and Substances Act also creates offences related to obtaining controlled substances through fraudulent means. Law enforcement investigating these potential offences has authority to seek judicial authorization for search warrants, production orders, and other investigative tools that compel disclosure of information that would otherwise be protected. A warrant issued under the Criminal Code authorizes the custodian to disclose information to law enforcement even though such disclosure would otherwise violate the Health Information Act; the warrant creates the lawful authority. However, law enforcement does not always proceed by warrant. Police may request voluntary disclosure of information from a custodian, and the custodian must determine whether the Health Information Act permits such disclosure. The Health Information Act allows disclosure to police without warrant where the custodian has reasonable grounds to believe the disclosure is necessary to investigate or prevent an offence, but the custodian retains discretion and must apply this standard conscientiously. A clinic that discloses information to police without proper authorization faces potential liability under the Health Information Act, while a clinic that refuses a lawful demand faces potential obstruction charges or contempt proceedings. Navigating these requests requires understanding both the limits of police authority and the conditions under which custodians may voluntarily comply.
The Office of the Information and Privacy Commissioner of Alberta provides oversight of compliance with the Health Information Act, the Personal Information Protection Act, and the Freedom of Information and Protection of Privacy Act. Individuals who believe their health information has been disclosed without authorization may complain to the Commissioner, who has the power to investigate and issue orders requiring organizations to comply with the legislation. The Commissioner's role is distinct from the regulatory colleges: the colleges regulate the professional conduct of their members, while the Commissioner regulates organizational compliance with privacy legislation. If the private clinic disclosed the nurse's health information without lawful authority, the nurse could complain both to the College (if the unauthorized disclosure was made by another regulated professional) and to the Information and Privacy Commissioner (regarding the organizational failure to comply with the Health Information Act). The Commissioner has issued guidance documents and decisions interpreting the Health Information Act in the context of regulatory investigations, and these resources inform how custodians should understand their obligations. The Commissioner has consistently held that the statutory exceptions permitting disclosure to regulatory bodies must be interpreted according to their terms and that custodians should not volunteer information beyond what the exception authorizes. At the same time, the Commissioner has affirmed that regulatory colleges exercising powers under the Health Professions Act are entitled to receive information necessary for their investigations, and custodians who refuse to comply with lawful demands may face separate consequences under the Health Professions Act.
The interplay between consent-based disclosure and disclosure without consent is central to understanding how information moves through this system. In ordinary circumstances, the Health Information Act requires that health information be disclosed only with the informed consent of the individual to whom it relates. The consent must be express or implied, depending on the context, and the scope of the consent determines the scope of permissible disclosure. However, the statute contains numerous exceptions where disclosure is permitted or required without consent, and these exceptions are the pathways through which information flows in regulatory and law enforcement investigations. When a nurse is being investigated for fitness to practice, she cannot withhold consent and thereby prevent the College from obtaining relevant information; the College's statutory authority operates independently of her consent. Similarly, when law enforcement obtains a warrant, the nurse's consent is irrelevant—the warrant compels disclosure. Understanding that the consent requirement is the default but not the absolute rule allows practitioners and administrators to correctly apply the legislation: they must first ask whether consent has been given or can be obtained, and if not, whether a statutory exception permits disclosure. If no exception applies, disclosure without consent is a breach regardless of how important the disclosure might seem from an institutional or public safety perspective.
The confidentiality provisions in the Mental Health Act add a specialized layer to Alberta's health information privacy framework when the nurse has sought treatment for her dependency. If the nurse attended an addiction treatment program designated under the Mental Health Act, or if she received psychiatric treatment in connection with her dependency, the information from that treatment is governed by both the Health Information Act and the confidentiality provisions in the Mental Health Act. The Mental Health Act imposes heightened protections on mental health information, and the intersection of these protections with regulatory investigation creates questions that custodians must navigate carefully. A treatment program that receives a request from the College for information about the nurse's participation must determine whether the College's statutory authority under the Health Professions Act overrides the confidentiality provisions in the Mental Health Act, or whether the Mental Health Act's protections impose additional restrictions. The general principle is that specific statutory authority to obtain information for regulatory purposes will prevail over general confidentiality provisions, but the treatment program must be able to identify the source of that authority and apply it correctly. In practice, regulatory colleges often seek information from treatment programs, and treatment programs often disclose it, but the legal basis for that disclosure should be explicit rather than assumed.
The flow of information between institutions in a situation like the one involving the registered nurse in Lethbridge can be mapped along the statutory pathways described above. When the private clinic discovers the prescription forgery, it has reporting obligations to the College of Registered Nurses of Alberta under the Health Professions Act if the nurse's employment is terminated or restricted. The clinic may also choose to report to law enforcement, and if law enforcement requests clinic records, the clinic must determine whether to disclose voluntarily or to require judicial authorization. The College of Registered Nurses of Alberta, upon receiving the employer report or a complaint, opens an investigation and exercises its statutory powers to gather information from the clinic, from pharmacies that filled the forged prescriptions, from any hospital where the nurse worked, and potentially from healthcare providers who treated the nurse for her dependency. The College may share information with the College of Physicians and Surgeons of Alberta if a physician is implicated. Law enforcement conducts its parallel investigation, potentially obtaining warrants for information that the College has also collected, creating the possibility that law enforcement will seek the College's investigation files. The nurse's own healthcare providers—her family physician, her addiction counsellor, her mental health provider—may receive requests for information from multiple sources and must apply the correct statutory framework to each request. Throughout this process, the nurse retains certain rights: she has the right to access her own health information under the Health Information Act, she has procedural rights in the regulatory investigation under the Health Professions Act, and she may have Charter rights engaged if the law enforcement investigation results in criminal charges. The information-sharing obligations and permissions are not unidirectional; information flows in multiple directions, between institutions with different mandates, and the legal framework authorizes these flows only within specified channels.
The implications for organizational privacy practices are significant. A private clinic in Alberta must maintain policies and procedures that address how it will respond to disclosure requests from regulatory colleges, law enforcement, and other authorized bodies. Staff must be trained to recognize the difference between a voluntary request and a mandatory demand, and to escalate requests to appropriate decision-makers. The clinic's privacy officer—or whoever performs that function—must be familiar with the disclosure exceptions in the Health Information Act, the mandatory reporting provisions in the Health Professions Act, and the procedures for responding to law enforcement requests. When a situation like the one involving the nurse arises, the clinic cannot improvise; it must apply its policies consistently and document its decisions. Failure to do so creates risk: unauthorized disclosure exposes the clinic to regulatory sanction under the Health Information Act, while failure to make mandatory reports exposes the clinic to regulatory sanction under the Health Professions Act. The dual nature of these obligations—prohibition and mandate existing side by side—means that compliance requires careful attention to which statutory framework governs each disclosure decision.
For regulated professionals navigating this landscape, understanding the statutory architecture is not merely an academic exercise. A nurse who is the subject of an investigation cannot refuse to cooperate with the College on the basis that cooperation would breach patient confidentiality or her own privacy; the College's statutory authority supplies the lawful basis for disclosure, and the nurse's professional obligations require cooperation. At the same time, the nurse retains rights within the regulatory process, including the right to receive disclosure of the evidence against her before a hearing and the right to procedural fairness in the conduct of the investigation. Understanding how information flows into the regulatory process and how it may flow out—to other colleges, to law enforcement, to the public through published decisions—allows the nurse to make informed decisions about how to respond. The regulatory framework is designed to protect the public, and it operates on the assumption that information necessary for that purpose will be available to regulators; the privacy protections in the Health Information Act and elsewhere are calibrated to accommodate this regulatory necessity while still imposing meaningful limits on unauthorized disclosure.