Why is the CPTA circulating these Standards now?
The College of Physiotherapists of Alberta (CPTA) has worked with representatives of the Government of Alberta for some time to develop Standards and resources necessary to support a transition to physiotherapists being designated custodians under the Health Information Act (HIA). As we have communicated previously, such a change requires an act of Government; this is not within the power of the CPTA to enact. In 2025, the Government of Alberta provided feedback to the College regarding draft Standards that were previously submitted for review by the Health Information Policy Branch.
The College has reviewed and incorporated this feedback into draft Standards which are now being circulated to registrants, partner organizations, and members of the public.
Section 133(2) of the Health Professions Act requires that the College must provide, for review and comment, a copy of proposed Standards of Practice to registrants, the relevant minister(s), and any other person Council considers necessary.
Being designated as custodians under the HIA would be a significant change to the privacy landscape for physiotherapists and will require considerable effort by the College and registrants alike. We are taking the steps that we can, to be ready when the time comes. This circulation of Standards is part of our efforts to strategically position Registrants and the College should legislative amendments to the Health Information Act and Health Information Regulation proceed.
The College has previously indicated that the principles underlying privacy legislation are essentially the same, regardless of the legislation in question. If that’s the case, what’s the big deal?
It is true that in many ways the rights of patients and responsibilities of those who collect and use patient health information are more similar than they are different. For example, privacy legislation consistently grants patients access to the information an organization has in its custody and control about the patient. And all Alberta privacy legislation includes requirements to secure the information that an organization has in its custody and control, to prevent unauthorized access or changes to that information.
However, the HIA is also different from other pieces of privacy legislation in important ways.
At its foundation, the HIA is authority-based legislation. Unlike PIPA, which is consent-based legislation, under the HIA, custodians are granted the authority to collect, access, use and disclose health information for purposes specified in the act. Custodians are required to identify the authorized purposes for which health information is collected at the time of collection and must only collect information that relates to and is necessary to enable the custodian to carry out an authorized use.
Under the HIA, a custodian or their affiliate seeks consent when accessing or using health information for purposes that were not identified at the time of collection or if they are disclosing health information when there is no legislative authority to do so, for example, disclosure to someone outside of the “circle of care.”
What do you mean by the ‘circle of care’?
35(1) A custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information
- to another custodian for any or all of the purposes listed in section 27(1) or (2), as the case may be,
In other words, if designated as custodians, physiotherapists and their affiliates will be able to disclose health information to other designated custodians and their affiliates, provided those custodians are providing the client with health services or engaged in another legislatively authorized purpose. This makes those custodians part of the client’s “circle of care.”
However, custodians are required to disclose the least amount of information, in the most anonymous manner possible, to achieve the authorized purposes.
What does it mean to be a custodian vs being an affiliate to a custodian under the Act?
“Custodian” - is a health services provider who is designated in the Health Information Regulation (HIR) as a Custodian, or who is within a class of health services providers that is designated in the regulations. Custodians include health organizations, and regulated members of health professions as identified in the HIR. Custodians are accountable to ensure that policies, procedures and practices are in place to protect individually identifying health information and comply with the requirements of the HIA. Custodians are responsible for their affiliates’ compliance with the HIA.
“Affiliate” - in relation to a Custodian, means an individual employed by the Custodian; a person who performs a service for the Custodian as an appointee, volunteer or student or under a contract or agency relationship with the Custodian; an information manager; or a person who is designated under the regulations to be an Affiliate, who has been designated as an affiliate by the custodian.
How do I know if I am a custodian or an affiliate under the Act?
If registrants of the College of Physiotherapists of Alberta become designated as custodians under the HIA, the default will be that all registrants of the College will be considered custodians and have the roles and responsibilities associated with being a custodian.
However, there are times when a physiotherapist may work as an affiliate to a custodian. For example, physiotherapists employed in a hospital setting are currently considered affiliates to the hospital which is designated as a custodian under the Act.
In such situations, the relationship between affiliate and custodian and their respective responsibilities and accountabilities must be clearly identified within the employment agreement or contract, or other formal document (e.g., job description or organizational policies).
Again, unless you have an employment contract identifying you as an employee of a custodian or other formal document designating you as an affiliate of a custodian, you would be considered a custodian under the HIA, responsible to fulfill the duties and responsibilities that are specified in the Act.
I work for a large hospital in an urban center. How would this change affect my practice?
As an individual working in the public sector, a transition to being designated custodians under the Act will likely have limited impact on your day-to-day practice. However, privacy-related questions and concerns are consistently among the most common topics of questions received by the College. These questions are not limited to the private sector. Physiotherapists in the public sector are encouraged to take this opportunity to review their responsibilities under the Act, the terms of their contracts (to confirm their status as affiliates), and their organization’s privacy policies.
I work for a public body, as defined in the Protection of Privacy Act. How would this change affect my practice?
According to the HIA, that legislation applies to all health information and applies unless another Act (such as POPA) expressly states that the other Act (POPA) prevails. The College’s understanding is that the HIA would apply to the health information in the custody and control of physiotherapists working for public bodies.
Physiotherapists working for public bodies are encouraged to contact their organization’s privacy officer to discuss the nuances of privacy legislation and mechanisms in place within the practice setting to address the physiotherapists’ duties if designated as custodians under the HIA.
If physiotherapists were designated custodians tomorrow, how long would it take to get access to Netcare?
It is important to know that if registrants of the College of Physiotherapists of Alberta are designated as custodians under the HIA, that does not mean that they will automatically be granted access to Netcare. There is considerable work that will need to occur after physiotherapists are designated as custodians before they will have access.
See the Climbing HIA Mountain infographic below for more information.
The process to get access to Alberta Netcare Portal requires several steps. How long it takes you to get access to Netcare will depend on your starting point and the proactive steps you have taken to prepare for physiotherapists being designated as custodians under the HIA.
What are the ‘to do’ items that physiotherapists in the private sector can complete now?
- Check to see if your employment agreement states that you are an affiliate of an existing custodian.
- Talk to your employer and colleagues about the most appropriate arrangement for custodians and affiliates for your practice setting.
- Should each physiotherapist be a custodian and individually fulfill the responsibilities of custodian under the Act?
- Should one individual serve as custodian under the Act, fulfilling the requirements of the Act, with other eligible custodians being designated as affiliates instead?
Depending on the answers to the above questions, work independently, or with your colleagues to:
- Create a list of the information systems and processes you employ to collect or use health information (treatment information and booking/billing information), including EMRs, online booking systems, AI scribe tools, etc.
- Review the requirements for Information Manager Agreements established in Section 7.2 of the HIR and the terms of contracts currently in place with any third-party providers (e.g., your EMR provider). Identify any changes that would be required if physiotherapists were designated as custodians.
- Begin the process of completing Privacy Impact Assessments for the systems you use.
- The completion of a PIA takes significant time. However, even if physiotherapists are not designated custodians under the HIA, the PIA will remain a valuable resource to ensure you are protecting patient information with appropriate safeguards.
- Review the chart copy fees established in the HIA and HIR.
- Make a plan for how you will update your organization’s fee schedules in relation to chart copies to ensure compliance with the HIA and HIR should the legislative amendments occur.
