Adding Alberta health-care numbers to licences increases fraud risk: privacy watchdog

EDMONTON – Alberta’s privacy watchdog is raising concerns about the government’s plan to add health-care numbers to driver’s licences and other forms of identification.

Information and privacy commissioner Diane McLeod said it would increase the risk of fraud as the numbers could be obtained outside of health-care settings.

“Personal health numbers of Canadians are a sought-after commodity on the dark web due to our publicly funded health-care system,” McLeod wrote in a letter to government, published Monday.

“Use of someone’s (personal health number) to access medical care could result in the wrong health information appearing in their record, which could cause them harm.”

The government announced the move last month, saying it would make it more convenient for Albertans to access health care as they wouldn’t have to carry multiple cards to prove their identity. It also plans to add mandatory citizenship markers to licences and other forms of ID. 

McLeod said she had warned the government to abandon its plan because of the increased risk of fraud, and because the Alberta government body responsible for driver’s licences, the Registrar of Motor Vehicles, isn’t subject to privacy laws.

“As such, they will hold highly sensitive health information of all Albertans, with no corresponding duty to protect this information and no consequences for breaches,” McLeod wrote.

“There is also no oversight by my office.”

Primary Health Services Minister Adriana LaGrange told reporters Tuesday that protecting personal information and personal health numbers is a priority, but the government was going to move ahead with its plan.

LaGrange said part of the reason it was moving ahead was because the changes would tamp down on fraud, though she acknowledged it could also create fraud risk.

“I just really think that right now, there is a greater potential for the abuse because there’s not even a picture attached to your health-care card (or) number,” she said.

“That can easily be given around to different people and you go in and use that number, whereas a picture on a driver’s licence, along with all of the other protections that are in place, would make sense.”

LaGrange said the province currently has 500,000 more active health-care numbers than there are Alberta residents.

Earlier Tuesday, her office said the legislation in question prohibits unauthorized people from using personal health numbers.

It also said the government is developing further regulations regarding the motor vehicle registrar and is to discuss those changes with McLeod.

“Ministries such as Service Alberta, Red Tape Reduction, and Technology and Innovation will not be authorized to use this information for other purposes, and all departments are required to maintain Albertans’ personal and health information in accordance with provincial privacy legislation,” LaGrange’s office said. 

Sharif Haji, the Opposition NDP’s primary health services critic, told reporters that the government should cancel its plan to add health-care numbers to licences in the wake of the commissioner’s concerns.

Haji said that beyond expanding potential access points to personal health information, the government also needs to consider how prevalent cybersecurity breaches and attacks have become.

“It’s a time that we should be worried about how Albertans’ information is protected.”

McLeod, in her letter, said the legislation raises other privacy concerns as well, though she commended the government for accepting a number of recommendations she made before the bill was brought forward.

“That said, several of my recommendations have not been addressed in the amendments and some recommendations have been only partially addressed,” she wrote.

One outstanding area of concern she covers in the letter is how the safety of health information is to be protected from artificial intelligence. Another concern is about new provisions for abandoned health records, which she said have become a pressing issue of late as the number of abandoned records has significantly increased.

Health records are considered abandoned when physicians, for example, retire, die, leave Alberta or otherwise leave behind patient records. In one case McLeod reported on last year, a storage space was discovered with close to 60 boxes of health records that used to belong to a Calgary physician who had retired nearly a decade earlier.

The new rules, outlined in McLeod’s letter, say that when a person or entity that isn’t a health authority or affiliate of one discovers abandoned health records, they must inform the minister, who can then direct another person or regulatory college to assume custody of the records.

McLeod wrote that it’s unclear what happens next and points out that regulatory colleges aren’t currently considered eligible custodians of health records.

“Will individuals be notified about where their records are to obtain a copy or for purposes of ongoing care?” she wrote. 

“It is unclear what will happen if ‘another person’ is not a custodian or if they are not subject to privacy laws at all.”

LaGrange’s office said the government is reviewing McLeod’s outstanding recommendations and that further regulations will be developed after the bill is passed in the legislature.

This report by The Canadian Press was first published Dec. 2, 2025.