Health Information Technology (EHR)

eHealth and Privacy Impact Assessments (PIAs)

Under Alberta’s Health Information Act (HIA), community pharmacies are legally required to prepare and submit Privacy Impact Assessments (PIAs) whenever they collect, use, or disclose individually identifying health information. This guide outlines key PIA requirements related to Alberta Health’s eHealth initiatives, PrescribeIT, and general privacy compliance scenarios, ensuring that pharmacies understand their obligations and are equipped to fulfill them.

Alberta Health eHealth Initiatives

Alberta Netcare Portal

Alberta Netcare is the province’s Electronic Health Record (EHR) platform, accessible to all community pharmacies. It is operated under the stewardship of Alberta Health, which mandates a Privacy Impact Assessment as a prerequisite for access.

  • Expedited PIA Requirement: Pharmacies must prepare and submit an expedited type PIA, which includes a copy of the pharmacy’s privacy and security policies and procedures compliant with the HIA, along with a cover letter explaining the submission’s intent.
  • Support Available: The eHealth privacy team at Alberta Health provides specific assistance for Netcare-related PIAs only. This includes guiding pharmacies through the preparation and formatting of their expedited PIAs.
  • Submission vs. Review: Importantly, pharmacies do not need to wait for OIPC review. Once the PIA is submitted to the Office of the Information and Privacy Commissioner (OIPC), pharmacies may proceed with Netcare onboarding.
  • Review Timeline: While the review is not mandatory for initial participation, submissions are typically reviewed within 6 to 8 weeks, after which the pharmacy will receive an official letter confirming the PIA file has been reviewed and closed.
  • Record Keeping: Pharmacies must retain hard copies of all submitted PIAs, cover letters, and OIPC correspondence. These documents are tied to the pharmacy, not the individual pharmacist, and should be maintained under the responsibility of the current licensee, who acts as a Custodian under the HIA. Other pharmacists working in the pharmacy are considered affiliates.

Change of Licensee: If the pharmacy undergoes a licensee change, the new licensee should obtain and retain all relevant PIAs. This transfer should be documented with a letter acknowledging the continuity and validity of the existing PIA documentation.

Change of Ownership: PIA transfer is only required if the ownership change also involves a change in licensee.

Real-Time Integration (RTI) with Netcare PIN

Real-Time Integration (RTI) enables seamless, automated interaction between a pharmacy’s Pharmacy Management System (PMS) and Alberta Netcare’s Pharmaceutical Information Network (PIN).

  • Functionality: RTI allows for the real-time upload of dispenses to PIN and the download of clinical medication histories from PIN to the pharmacy’s system, significantly enhancing clinical decision-making and accuracy of patient records.
  • Mandate from ACP: The Alberta College of Pharmacy (ACP) has mandated that all community pharmacies implement RTI by July 2026. This ensures more consistent, accurate, and timely sharing of health information across the province.
  • PIA Process: Pharmacies must prepare and submit a PIA specific to RTI functionality before going live. Alberta Health allows pharmacies to proceed with implementation once the PIA has been submitted to the OIPC. OIPC PIA review is not required prior to going live.
  • Review Timeline: Due to the complexity of RTI integrations, OIPC reviews for these PIAs can take 10 to 12 months. Pharmacies are encouraged to begin preparation and submission as early as possible to meet the 2026 deadline.

Immunization Submissions to ImmARI

Submissions via IDSM

As of January 1, 2021, pharmacies are required to electronically submit immunization and assessment records within 7 days to the Alberta Health Immunization Repository (ImmARI).

  • Primary Submission Tool: Most pharmacies use the Immunization Direct Submission Mechanism (IDSM), a web-based tool provided by Alberta Health.
  • PIA Requirement: No PIA is required for the use of IDSM.

Submissions via Okaki Pharmacy Immunization Program (PIP)

Some pharmacies use the Okaki Pharmacy Immunization Program (PIP) for submitting immunization records.

  • Alberta Health requires an expedited type PIA for pharmacies wishing to use PIP.
  • The HIA also mandates preparation and submission of a separate PIA specific to the Okaki system.
  • Support: Okaki representatives typically assist pharmacies with Okaki specific PIA preparation and submission.

Submissions via Telus Health Kroll

Kroll’s immunization module has been adapted to meet ImmARI’s data requirements. Pharmacies using RTI-integrated Kroll systems may activate integration for automatic immunization event submissions.

  • Requirements: Pharmacies replacing IDSM with Kroll for immunization submissions must have:
    • An updated version of Kroll
    • A revised RTI PIA
  • Note: PIA support for Kroll integration with ImmARI is not provided by the eHealth privacy team.

Support Contacts

PrescribeIT

PrescribeIT is a national e-prescribing service that enables prescribers and pharmacies to electronically transmit prescriptions.

  • PIA Endorsement: Pharmacies must endorse a pre-existing PrescribeIT PIA, already filed with the OIPC, to participate in the program.
  • Additional Requirements: Pharmacies must also prepare and submit a separate PIA for their Pharmacy Management System (PMS).
  • Support Provided by PrescribeIT:
    • Template letter for PIA endorsement
    • Updated PIA document (November 2023
    • PIA overview and guidance
  • Note: PrescribeIT does not support PMS-specific PIAs, but will allow pharmacies to proceed if an RTI PIA has been submitted.
  • To Enroll: Visit prescribeit.ca

General PIA Considerations

When is a PIA Required?

Under the HIA, a Privacy Impact Assessment must be prepared and submitted to the OIPC any time a pharmacy begins or intends to collect, use, or disclose individually identifying health information in new ways.

Common scenarios include:

  • Opening a new pharmacy location
  • Changing pharmacy management systems
  • Implementing new health information technologies (e.g., eFax, websites that share patient health information, EMRs)
  • Participating in new programs involving data exchange (e.g., PrescribeIT or ImmARI)

Each change may require a new PIA or an amendment to existing ones.

Licensee Responsibilities

  • The current licensee is the legal Custodian responsible for:
    • Maintaining all PIAs
    • Ensuring privacy and security policies are implemented
    • Updating or amending PIAs as operations evolve
  • Regular reviews of PIAs are recommended to ensure they reflect current practices and technologies.

PIA Support for RxA Members

RxA members can access complimentary PIA consultations to evaluate the need for a new PIA or to clarify obligations. More extensive support is available for an additional fee.

Contact:

Bill Ford, Privacy Impact Assessment Consultant
403-805-2430
fordbi@shaw.ca