Data disclosure guidelines

Custodian of administrative health data

Alberta Health is the custodian of extensive, but not exhaustive, administrative information about the health care system in Alberta. As custodian of this valuable asset, Alberta Health provides access to administrative data to support health research and planning by various users (e.g., provincial health authority, academic researchers and others).

Disclosure under the Health Information Act

Aggregate data

The Health Information Act (HIA) Section 32(1) – Disclosure of Non-identifying Health Information – allows the disclosure of non-identifying health information for any purpose.

Data for research

The HIA Division 3 – Disclosure for Research Purposes – requires the researcher to submit a research proposal and receive approval from a recognized research ethics board (as listed in the act’s regulations) prior to requesting data from one or more custodians (e.g., Alberta Health, Alberta Health Services). Other HIA topics include the application (by researcher to a custodian) for disclosure of health information or to perform data matching; conditions and consents; and the need for an agreement between the custodian and the researcher for each research proposal.

If a requester intends to use the disclosed health information for data matching, they must first notify the Information and Privacy Commissioner, as per Section 32(2). The HIA defines data matching to mean the creation of individually identifying health information by combining individually-identifying or non-identifying health information or other information from two or more electronic databases, without the consent of the individuals who are the subject of the information.

Data for internal management purposes to other custodians

The HIA Section 27 (1) – Use of Individually Identifying Health Information – allows for the disclosure of individually identifying health information for internal management purposes. It is used to disclose data to support planning, policy development and quality improvement projects. 
Guiding principles for data disclosure under the HIA

Alberta Health must comply with HIA principles (listed below). For research, conditions may be imposed on the researcher in addition to those listed by the Research Ethics Board.

  1. Highest degree of anonymity for the persons who are the subject of the information;
  2. Least amount of information disclosed that will meet the needs of the stated purpose;
  3. Need to know – the disclosure of only necessary information to carry out research or responsibilities.

1. Highest degree of anonymity

  • Aggregate information is the most anonymous type of information. Non-identifying health information about groups of individuals with some common characteristic(s) ensures that the identity of an individual cannot be readily determined from the information.
  • Individually non-identifying information has identifiers removed so that the identity of the individual cannot be easily determined. Typical identifiers removed are as follows: personal health number, hospital chart number, name, address, postal code and date of birth. Where removing identifiers does not meet the research need, and given ethics approval, Alberta Health may choose to apply other techniques to protect the identity of the information including scrambling of the identifier (personal health number); truncation (first three digits of postal code), and substitution (age instead of date of birth). Other attributes or combinations of attributes may also be considered identifying (e.g., rare disease, geographical isolation, facility ID plus provider specialty).
  • Individually-identifying information has a higher level of protection. The disclosure of individually-identifying data may require individual consents.

2. Least amount of information

When collecting, using or disclosing health information, a custodian must collect, use and disclose only the amount of health information that is essential to enable the requester to carry out the intended purpose. Requesters need to clearly explain their need for the particular data elements requested.

3. Need to know

Requesters need to explain how the data will be used and for what purposes.

Disclosure process

Research data disclosures require a contractual tripartite Research Agreement between the researcher, their affiliated organization (usually their university), and Alberta Health. The agreement outlines the restrictions on data retention and on the disclosure and use of information. Once the agreement has been fully executed, data are provided to the requester.

Information requests are disclosed with a letter indicating which section of the HIA the data is disclosed under, as well as any restrictions on use of the information.

More information