If something outside your clinic handles patient calls, Alberta's Health Information Act probably calls it an information manager.
And section 66 says an information manager needs a written agreement before it touches anything.
Alberta's Health Information Act governs how custodians handle health information, and a clinic's phone handles a great deal of it. The provision that matters most for anyone putting a service on that line is section 66: where a custodian engages a third party to process, store, retrieve or dispose of health information, or to provide information management or information technology services, that third party is an information manager and the relationship requires a written information management agreement. Not a preference. A precondition.
Who is a custodian under the HIA?
The Act defines custodians in section 1(1)(f), with more designated in the Health Information Regulation. The list covers the organizations most people picture (physicians, chiropractors, nurses, Alberta Health Services and Alberta Health among them) and it is a defined list rather than a general description of anyone holding health data.
The definition matters because it determines which statute you are actually under. A physiotherapy clinic and a med-spa can look similar from the street and sit under different regimes, and the answer changes what the AI receptionist has to do. A business that is not a custodian is not exempt from privacy law; it is under PIPEDA or Alberta's Personal Information Protection Act instead.
Getting this wrong in either direction is expensive. Assuming you are a custodian when you are not means over-engineering. Assuming you are not when you are means a written agreement you needed and do not have.
When does an answering service become an information manager?
When it processes, stores, retrieves or disposes of health information for the custodian, or provides information management or information technology services. A service that takes patient calls, records them, transcribes them and stores the result is doing several of those at once.
There is a useful clarification in the Act's structure: a custodian acting as an information manager for another custodian does not thereby become the custodian of that information. The information stays the original custodian's responsibility. Applied to an AI receptionist, that is the point: engaging someone to handle patient calls does not move the duty off the clinic.
Which means the agreement is not paperwork protecting the vendor. It is the instrument by which the clinic keeps control of information it remains answerable for: what may be collected, what may be retained, for how long, what happens on termination, and what the vendor may never do.
- Processing: anything done to the information, including transcription and structuring.
- Storage: where recordings and transcripts live, and for how long.
- Retrieval: who can pull a patient's call back up, and on what authority.
- Disposal: how it is destroyed, and whether the clinic can prove it was.
What does this mean for a clinic putting AI on its phone?
Three things, in order: establish whether you are a custodian, get the information management agreement in place before the receptionist goes live, and make the retention and disposal terms specific enough to be enforceable. A generic vendor contract is not an IMA.
The sequencing matters more than it looks. An agreement signed after a line has been running for two months does not retroactively cover the two months, and the calls from that period are the ones a review would ask about first.
The other practical implication is on what the receptionist is allowed to collect. The cheapest way to reduce exposure under any health privacy regime is to collect less, and an AI receptionist is unusually easy to constrain: it can be built to capture the fact of a request and route it, without ever collecting the clinical detail a caller might volunteer.
Under Alberta's Health Information Act a service that handles patient calls for a clinic is an information manager, and section 66 requires a written information management agreement, which means the paperwork is a precondition of switching the receptionist on, not a formality after it.
For an Alberta clinic we scope what the receptionist may collect before we build it, because the cheapest health information to protect is the kind you never captured.
Start free pilotWhat this page does not cover
This is a reading of the legislation as it applies to an AI receptionist answering a business phone, not legal advice. Statutes are amended and regulators publish new guidance; check the source links, which are dated, and take advice on anything that matters.
- The full contents of an IMA. Section 66 and the Health Information Regulation set out what these agreements must address. This page identifies the requirement rather than drafting the document.
- Whether your clinic is a custodian. That turns on the definition in s. 1(1)(f) and the Regulation, and on facts about your practice. It is a question for your own advisors.
- Other provinces. Every province has its own health privacy statute. Ontario's PHIPA is covered separately; the rest are not covered here.
Questions this raises
- Does an AI receptionist count as an information manager under the HIA?
- Where it processes, stores, retrieves or disposes of health information for a custodian, or provides information management services, it fits the description. A line that records, transcribes and stores patient calls is doing exactly that.
- Is a written agreement really required, or just recommended?
- Section 66 frames it as a requirement for the arrangement, not a best practice. The safe assumption is that the agreement precedes the engagement.
- Does engaging an information manager transfer responsibility for the information?
- No. The Act is structured so that an information manager does not become the custodian of information provided to it in that capacity. Responsibility stays with the custodian.
- Is a med-spa a custodian?
- It depends entirely on who is providing what service. Some services delivered by regulated health professionals bring the HIA into play; purely cosmetic services delivered by non-custodians may not. This is a question to settle before the AI receptionist is designed, not after.
- Can the receptionist be built to collect less health information?
- Yes, and it is the most effective single control available. A line can be scoped to capture that a caller wants an appointment and route anything clinical to staff, without recording the clinical detail at all.
Sources
- Health Information Act, RSA 2000, c H-5: s. 66, information managersAlberta King's Printer / CanLIIconsulted 2026-08-09
- Health Information Act: overview for custodiansGovernment of Albertaconsulted 2026-08-09
Want an AI receptionist built around these rules rather than despite them?
We build a working receptionist on your calls, your booking rules and your escalation rules, and you call it yourself before committing to anything. About 14 days, no call limit during the pilot.
Start free pilot