A call centre set up by Medicentres Canada Inc., which operates 25 family health clinics in Edmonton and Calgary, received hundreds of calls Thursday, with many more expected.
Dr. Arif Bhimji, a spokesman for the private company, said people are being told to come to a clinic to check whether their private details were on the laptop.
They are also being urged to check their financial records for unusual activity.
"We are telling them to monitor their credit card statements, bank statements and similar types of documents, and to consider getting a credit report from Transunion or Equifax, which are the main credit reporting agencies in Canada," Bhimji said.
The information on the stolen laptop included unencrypted names, birthdates, health card numbers, billing codes, billing amounts and diagnostic codes for patients who were seen at the clinics from May 2, 2011, to Sept. 19, 2013.
Bhimji said there has been no indication of any fraudulent activity involving the health information.
People phoning the call centre are also asking what happened and why it took almost four months for the theft to be made public, he said.
Health Minister Fred Horne said the laptop was stolen Sept. 26. The theft was reported by Medicentres on Oct. 1 to Alberta privacy commissioner Jill Clayton and Edmonton police.
Horne said he was not told until Tuesday, when he received a letter from the company.
Clayton said she will investigate, but noted there is nothing in provincial law that requires a health provider to report such a theft or notify people affected.
She also said she has no authority under Alberta law to report a theft to the provincial government. Clayton suggested Alberta's law needs to be changed to make reporting mandatory.
"This case is an important reminder of the need for these types of provisions in the Health Information Act," she said Thursday in a release. "I will be formally asking the government to consider such an amendment."
Clayton said investigators believe people who steal such laptops are interested in the information inside them, not just the laptop hardware.
Her office hopes to complete its review within a few months.
Horne said the health information shouldn't have been stored on a laptop and in unencrypted form.
The minister said he believes the government would be open to improving the law.
"The concern is about how so much time went by before patients were notified. We will look at that and, if there are things we can do to strengthen the Health Information Act, I am completely there —and I am pretty sure my colleagues will support me."
New Democrat health critic David Eggen wants the government to draft new legislation to ensure private medical information is better protected.
Eggen said the NDP has been calling for better safeguards since 2009, including the need to notify patients quickly when there is a security breach.
"A breach of this magnitude is shocking," he said.
The College of Physicians and Surgeons of Alberta said it has spoken to Medicentres about the breach and plans to speak with Clayton about what happened.
Kelly Eby, a spokeswoman for the college, noted there are specific rules about how private health information is to be safeguarded.
"We are absolutely concerned about a privacy breach like this," she said. "I think the rules are pretty clear. Adherence to the rules? Maybe that is something different."
Dr. Allan Garbutt, president of the Alberta Medical Association, said he welcomes the investigation. It is important that patients feel confident that the information they share when being treated is protected, he said.
Bhimji said the laptop was in the possession of an IT consultant when it was stolen and the consultant no longer works with Medicentres Canada.
Also on HuffPost