Privacy commissioner says sweeping health care bill fails to adequately protect Albertans’ privacy

By ZOE MASON on December 3, 2025.

In a letter to Ministers Adriana LaGrange and Matt Jones, Alberta Information and Privacy Commissioner Diane McLeod raised concerns about amendments to the Health Information Act under Bill 11.

McLeod identifies gaps in the legislation regarding information sharing, records maintenance and the proposed changes to the health card that she says do not adequately safeguard sensitive health information.

Bill 11, the Health Statutes Amendment Act, was tabled Nov. 24 and is currently being debated in the legislative assembly. The bill contains a number of significant changes to health care delivery in the province, including enabling dual-practice for certain Alberta physicians and updates to the province’s health card.

The HIA is responsible for outlining and safeguarding the privacy rights of Albertans regarding their personal health information.

“Any amendments must ensure these rights are upheld and strengthened as HIA expands the sharing and use of health information,” she wrote.

One aspect of the bill that McLeod finds troubling is the use of personal health numbers on driver’s licenses, which she argues would increase the risk of fraud. She says in her letter that she previously recommended against the measure, and reports that her office has received over 50 messages expressing concern about the change.

The Registrar of Motor Vehicles, the branch that would be responsible for collecting PHNs to put them on driver’s licenses, is not subject to privacy laws in Alberta. McLeod says that means there are presently no obligations to protect sensitive information and no consequences for breaches.

“There is also no oversight by my office,” she wrote.

The Ministry of Primary and Preventative Health Services previously cited health card misuse as the justification for rolling out this policy.

McLeod submitted 31 recommendations regarding the proposed amendments to the HIA on Oct. 20. In her letter, the commissioner acknowledges that several of her recommendations were followed. She says she was informed by representatives of the Ministry of Primary and Preventative Health Services that most of her suggestions would be addressed through regulation in collaboration with her office.

But McLeod urges the government to establish the requirements she suggested in the act itself, a move she says will provide needed clarity to both the custodians of health care information and the public.

“It is my view that these requirements should be codified in the Act, not in the regulations, as it is up to the legislature to establish the most important high level principles that will guide the overall governance and accountability under HIA.”

Another proposed amendment would allow for health information to be shared by multiple custodians, a model that is not in use anywhere else in the country. McLeod says it opens the door to confusion across the health system which could put Albertans’ health information at risk.

McLeod also raised concerns about the bill’s plans to address abandoned health records. She says the bill does not clearly establish what will happen when another control over a person’s records is transferred, leaving uncertainty as to how individuals can exercise their right to access records.

The bill also expands data-sharing between custodians and public bodies, as well as the inputting of health information in automated systems, including ones that use artificial intelligence, and fails to outline privacy rights relating to these systems. McLeod writes that privacy rights are clearly protected in other privacy laws that permit the use of AI.

McLeod urges the government to align the policy with the Protection of Privacy Act, which contains a stronger definition of the kinds of information that can be shared and requires public bodies to follow a uniform process to ensure that information shared is non-identifiable.

“I am pleased that the amendments address modern issues, including the use of technology to enhance delivery of public health services,” wrote McLeod. “However, advancing these policies must be balanced with adequate rights, so that individual scan continue to effectively control their own health information, which is the primary purpose of privacy laws.”

“In my view, Bill 11 as it is currently before the legislative assembly does not effectively achieve this balance.”