A Note About Privacy. (Research, registries, clinical or quality improvement?)

This page primarily relates to the collection and management of medical data for research purposes or for non-research projects like registries and quality improvement studies. It is for guidance only and is not intended to be a definitive authority on the subject of privacy. If in doubt please contact the Information, Privacy and Records Management Office (IPRMO).

Legal Responsibilities

All users of REDCap must comply with appropriate local and federal privacy legislation. This includes Alberta's Health Information Act (HIA) and the Protection of Privacy Act (POPA). Summaries of these acts can be found on the website of the University of Alberta Information, Privacy and Records Management Office (IPRMO).

University of Alberta staff must also comply with University policy as detailed on the University's policies and procedures site. 

• Research Policies

• Information Management and Privacy Policies

What does this mean for us? Projects conducted within the College of Health Sciences generally fall into one of two categories.

REB Approved Research Projects

Both the HIA and POPA contain exemptions for projects that are REB approved.  However,  the REB is responsible for ensuring that the research team is taking adequate steps to protect the privacy of the research data. Patient identifiers (see TCPS2 chapter 5) may be included in the project database provided that these identifiers have been documented in the REB submission. Researchers must also comply with any specific requirements mandated by the REB.

Projects Without REB Approval

Some projects, such as certain registries, quality improvement projects, and those with a purely administrative focus, will not have REB approval and therefore are not considered to be research under the terms of the acts. As a result, if a project is collecting identifiable information, the study team may be required to complete a Privacy Impact Assessment PIA and submit it to the Office of the Information and Privacy Commissioner of Alberta (OIPC). The precise details depend on which act applies to the project.

Health Information Act

If the project collects identifiable healthcare information then the HIA applies and the project lead must work with the Custodian of the data (as defined in the act). The Custodian may need to submit a Privacy Impact Assessment (PIA) to the Office of the Information and Privacy Commissioner of Alberta (OIPC). For inpatient health information the Custodian will be Alberta Health Services or Covenant Health, but for patients seen in ambulatory settings the Custodian may be an individual physician, surgeon or dentist. Contact the University's Privacy Office for advice on who is the Custodian and for information on PIAs.

Since REDCap is operated by the University of Alberta the Custodian will also require that an information management agreement (IMA) is in place between the Custodian (or Principal Investigator) and the University.

Protection of Privacy Act

Public bodies may only collect personal information in specific circumstances and in the manner prescribed by the Protection of Privacy Act. The act gives individuals certain privileges regarding collection, use and disclosure of personal information. Please see the IPRMO page for more information.

If you are collecting Personal Information about an identifiable individual (email addresses used to conduct REDCap surveys are generally considered to be identifiers) then you may be required to submit a Privacy Impact Assessment to the OIPC.  More information is available on the IPRMO PIA page. Please contact the IPRMO for advice or for support developing a PIA.

REDCap and Privacy

REDCap provides a number of features that are designed to protect the privacy of research participants and is considered to be compliant with Canadian legislation such as the HIA, POPA and TCPS2 as well as U.S privacy requirements such as HIPAA. Details of these security features are available on request.

REDCap has the potential to be GDPR compliant. These features are enabled on a project by project basis. Please email the helpdesk if your project needs the GDPR privacy features enabled.

Privacy Notifications

Privacy legislation in some jurisdictions requires that a privacy notification is posted on participant facing web pages, which may include REDCap surveys. Please see this page for additional information.

Additional Help

For additional help with regards to privacy issues please contact the University's Privacy Office.