Alberta Physiotherapists Are Now HIA Custodians: What Changes for Clinics

On 22 June 2026, physiotherapists in Alberta became designated custodians under the province's Health Information Act, known as the HIA. For many clinic owners this changes the privacy rulebook they work under, and it affects the software they use to store patient records. Physiotherapists who practised under a different privacy law before that date now have duties around policies, privacy impact assessments, written agreements with technology providers and breach reporting. This guide explains in plain language what the change means, who counts as a custodian or an affiliate and what to ask software vendors. It is general information, not legal advice, and it is based on guidance from the College of Physiotherapists of Alberta as read on 5 November 2026.

Key takeaways

• Effective 22 June 2026, registrants of the College of Physiotherapists of Alberta are designated custodians under the HIA, in every practice setting.
• Physiotherapists should assume they are the custodian unless they have documentation showing they are an affiliate of another custodian.
• Custodians are expected to run a privacy management program, designate a privacy officer, train staff and prepare policies.
• New or changed electronic systems may need a privacy impact assessment submitted to the Office of the Information and Privacy Commissioner of Alberta.
• Software and IT providers who handle health information are treated as information managers and need a written agreement meeting the regulation's requirements.

What changed on 22 June 2026

According to the College, the designation came through the proclamation of the Health Statutes Amendment Act, 2025 (No. 2) together with Ministerial Order M.O. 19/2026. Before 22 June 2026, physiotherapists followed the privacy rules that applied to their particular practice. From that date, the College says, registrants are designated custodians under the HIA wherever they work. The College has published a Privacy Guide and a Policies and Procedures manual for physiotherapist custodians, and the Government of Alberta provides HIA resources on its website.

Custodian or affiliate?

The distinction decides who carries the main responsibilities.

• Custodian: the person or organisation designated under the Act and its regulation, who holds responsibility for the health information it collects, uses and discloses.
• Affiliate: a person who works for or with a custodian, such as an employee, an appointee, a volunteer or student, someone under a contract or agency relationship, or an information manager.

The College guidance says physiotherapists should default to the understanding that they are a custodian. To be an affiliate of another custodian, the other party must be a designated custodian and must have identified the physiotherapist as its affiliate in writing, for example in an employment contract or job description. A physiotherapist working in a hospital may be an affiliate of the health provider, while a physiotherapist in sole practice is the custodian and acts as privacy officer. Support staff employed by a physiotherapist custodian are designated as affiliates.

The main duties of a custodian

The College's guidance lists these core responsibilities:

• Privacy officer: designate an individual responsible for the overall security and protection of health information.
• Privacy management program: establish policies and procedures covering collection, use, disclosure, access and correction, storage and disposal, training and breach response.
• Staff training and confidentiality: train affiliates at hire, regularly afterwards and when practices or systems change.
• Collection notice: tell patients why information is collected, how it is used, who to contact and what safeguards exist.
• Safeguards: physical, technical and administrative controls such as unique user logins, strong passwords and encryption of information in storage and transit.
• Privacy impact assessments: prepare and submit them to the Office of the Information and Privacy Commissioner before implementing or significantly changing an administrative practice or information system, for example a new electronic medical record or a new information manager.
• Breach reporting: affiliates report to the privacy officer as soon as practicable, and where there is a risk of harm the custodian notifies the Commissioner, the responsible minister and the affected individuals.
• Access and correction: patients have a right of access and can request corrections, with responses generally due within 30 days.
• Retention and disposal: keep records for the period set by the College's standards, and destroy them securely, logging what is destroyed.

The College's sample manual suggests a retention period of at least ten years from the last date of service, or ten years from a minor's 18th birthday, but custodians should check the College's current standards of practice for the binding rule.

What this means for software and IT providers

This is where clinic owners most often need help. The College's guidance describes electronic medical record providers, IT specialists, online booking portals and AI scribe tools as potential information managers. A custodian who uses an information manager must designate it as an affiliate and have a written agreement that meets the requirements of the Health Information Regulation. The College's sample describes an agreement under which the custodian retains control of the health information, can monitor compliance, sets out each party's responsibilities and has remedies if the provider does not comply. Hiring an information manager does not remove the custodian's own responsibility.

Storage outside Alberta needs particular attention. The College guidance says agreements must protect the information and allow the custodian to monitor it, and its manual includes a form for disclosure before information is stored outside Alberta, noting that Alberta rules still apply.

Questions to ask any clinic software vendor

• Will the vendor sign an information manager agreement that meets the HIA and its regulation?
• Where is patient data stored, and where are backups kept?
• Does each staff member get a unique login, and are access and changes logged?
• Is information encrypted in storage and in transit?
• Can the clinic export all of its data at any time?
• What happens to data when the contract ends?
• How does the vendor handle suspected breaches and notify the clinic?
• Does the vendor support the clinic's privacy impact assessment with documentation?

A starter checklist for Alberta physiotherapy clinics

• Confirm whether each physiotherapist is a custodian or an affiliate, and put it in writing.
• Name a privacy officer.
• Adopt written policies, using the College's manual as a starting point.
• Train every staff member and keep signed confidentiality agreements.
• List every system that holds patient information and who provides it.
• Check whether a privacy impact assessment is needed for each system and submit it before changes go live.
• Put information manager agreements in place with software and IT providers.
• Prepare a breach response plan and a process for access and correction requests.
• Set retention and secure disposal rules.

For clinics elsewhere in Canada, privacy laws differ by province, so this checklist should not be applied outside Alberta without checking local rules.

An honest note about CareTrack

CareTrack by CreativeIn Tek is clinic management software with patient records, visit records, attachments, treatment plans with sessions, billing, role-based access and WhatsApp reminders. CreativeIn Tek does not currently offer Canadian data hosting or an Alberta information manager agreement, and it does not claim that CareTrack makes any clinic compliant with the HIA. Alberta custodians should not treat any software as HIA-ready without reviewing the agreement, hosting and safeguards for themselves. For general privacy practices that apply to clinics anywhere, see this guide to patient data privacy for clinics, which is written for Pakistan but covers habits such as role-based access and unique logins.

Where to find official information

The College of Physiotherapists of Alberta publishes its Privacy Guide, its HIA policies and procedures manual and the announcement of the designation. The Government of Alberta provides further HIA material at alberta.ca/health-information-act, and the Office of the Information and Privacy Commissioner of Alberta explains privacy impact assessments on its website.

Frequently asked questions

Are all Alberta physiotherapists custodians now?

The College says registrants are designated custodians from 22 June 2026, and they should assume custodian status unless documentation shows they are an affiliate of another custodian.

Do physiotherapy clinics need a privacy impact assessment?

The College's guidance says custodians prepare and submit them before implementing or changing an administrative practice or information system, for example a new electronic medical record. Confirm the requirement for your case with the Commissioner's office.

Does the clinic software vendor need an agreement?

Software and IT providers that handle health information are treated as information managers and need a written agreement meeting the regulation's requirements.

Does this apply to med spas or clinics in other provinces?

No. This article is about Alberta physiotherapists. Other professions and provinces have different rules.

Last reviewed: 5 November 2026, against College of Physiotherapists of Alberta guidance. This article is general information and not legal advice. To discuss how CareTrack stores and protects clinic records, contact the team.