Alberta benefits plan ordered to review referrals after unauthorized medical-information disclosure

The Alberta School Employee Benefit Plan was ordered to review its health-provider referral practices after disclosing a claimant’s personal information to LifeMark without consent. In Order PIPA2026-02, dated February 19, 2026, Alberta privacy adjudicator Amanda Swanek found that a general willingness to participate in treatment did not authorize disclosure to a provider the claimant had not yet agreed to see.

The Office of the Information and Privacy Commissioner’s ruling, case file 010993, was not a blanket rejection of the plan’s consent forms. Swanek upheld its collection and internal use of information for the ongoing disability claim, as well as a separate disclosure expressly authorized for the claimant’s union.

A proposed referral was not an existing care relationship

The plan argued that the claimant had agreed to recommended treatment and knew an assessment with LifeMark was being arranged. It sent a referral form and background medical information to LifeMark in June 2018. The claimant disputed having authorized that disclosure.

Swanek accepted that the claims facilitator might initially have misunderstood whether treatment arrangements were already in place. But telling the claimant that providers were being researched did not alert them that medical information would be sent to whichever provider was selected. Nor was notice of an intended LifeMark referral enough: the claimant had not had an opportunity to agree to it.

The release on which the plan relied covered disclosure to the claimant’s health-care providers and to independent consultants for specified purposes. LifeMark was not yet the claimant’s provider, because the claimant had not agreed to receive treatment there. The plan did not argue that LifeMark was acting as an independent medical consultant, a distinct role contemplated by the release.

The Personal Information Protection Act permits several forms of consent, but Swanek rejected reliance on deemed consent or an opportunity to opt out in these circumstances. She emphasized the sensitivity of the information and noted that some of it may have come from providers rather than the claimant. The plan had not identified an applicable statutory exception permitting disclosure without consent, and she found none.

The ongoing-claim consent remained effective

The claimant had signed a release in 2014, when the disability claim began, and argued that it was too broad to authorize later collection from a physician who had not been treating them at that time. The form did not name each provider or specify every item of information and collection date.

Swanek found that the form sufficiently identified collection for managing the disability claim and limited information handling to what was relevant to that claim. It remained valid for the claim’s duration. The collection in 2018 concerned the same claim, not a new one, and the physician was treating the claimant when the information was collected. A change of treating provider did not, by itself, require fresh consent under the form.

She also characterized information-sharing among the plan’s employees administering the claim as internal use, rather than disclosure to an outside party. That use was covered by the consent. The privacy inquiry did not determine whether the plan’s employees had made good medical or benefits decisions.

Union disclosure rested on a separate authorization

The claimant said agreeing to union representation did not amount to permission to share confidential medical reports. The plan, however, produced a separate consent signed in 2017 directing disclosure of the claimant’s complete benefits-claim file, including medical information, to the union. Swanek found that this expressly authorized the disclosure.

An earlier request for advance notice of disclosures did not change that result. Swanek did not need to decide whether the earlier exchange had modified the 2014 release, because the later union-specific authorization was clear. She nevertheless emphasized that individuals can vary or withdraw consent under PIPA and noted that the plan had subsequently accepted a request to vary the claimant’s consent.

Consent was not the only requirement. PIPA also limits information handling to reasonable purposes and a reasonable extent. Swanek found those requirements met for the authorized collection, internal use and union disclosure. Having already found the LifeMark disclosure unauthorized, she did not decide whether it separately met the reasonableness requirements.

Practice review and written compliance notice

The reasons record that the facilitator later asked LifeMark to delete the information and supplied the claimant with LifeMark’s email confirming deletion. Swanek nevertheless ordered the plan to review its referral practices, explaining that referrals involving sensitive medical and similar information required express written consent in accordance with the Act.

The plan was also ordered to notify both the adjudicator and the complainant in writing, within 50 days after receiving the order, that it had complied. The order addressed privacy practices; it did not award damages or decide the claimant’s entitlement to benefits or choice of treatment provider.