Under section 66 of the Health Information Act (“HIA”) an information management agreement (IMA) must be entered into when Alberta Health Services (“AHS”) is considering that a third party undertake to:
After AHS has entered into an IMA, it may disclose health information to the Information Manager without the consent of the individuals who are the subjects of the information for the purposes authorized by the agreement.
An Information Manager may use the information disclosed by AHS only for the purpose authorized by the agreement. The Information Manager must comply with HIA as well as the agreement entered into by AHS. It is an offence under section 107(4) of HIA for an Information Manager to knowingly breach the terms and conditions of an agreement.
The terms of an IMA may provide for the Information Manager to disclose health information to a custodian other than AHS provided the Information Manager has been appointed as an affiliate of that custodian and only as authorized by AHS, according to the disclosure rules and processes outlined in HIA and the IMA.
Although, an IMA will contain binding obligations upon the Information Manager it is important to note that AHS will continue to be responsible for compliance with HIA respecting the information that has been disclosed to the Information Manager. This includes responsibilities for collection, use and disclosure of the least amount of information for the intended purpose.
Due to the nature of the services that Information Managers provide and the necessity for specific security requirements and statutory compliance incumbent upon AHS, Information and Privacy should be contacted for the drafting and implementation of an IMA.