Decisions

Under the Personal Health Information Protection Act, 2004 (PHIPA), the complainant requested that corrections be made to a consultation note documenting her visit to the London Health Sciences Centre (the hospital). Among other reasons, the complainant asserts that statements in the note about certain behaviours and health issues are inaccurate, and are inconsistent with information she later provided to the hospital about her health and her capacity to live a successful life. The complainant filed a complaint with the IPC about the hospital’s refusal to make her requested corrections. In this decision, the adjudicator upholds the hospital’s refusal to correct based on an exception to the duty in section 55(8) of PHIPA that otherwise requires the hospital to correct personal health information in certain circumstances. In this case, the adjudicator finds that the exception at section 55(9)(b) of PHIPA for professional opinions or observations (accurate or otherwise) made in good faith applies to the personal health information at issue in the consultation note. She dismisses the complaint.

The Office of the Information and Privacy Commissioner received a privacy complaint about the disclosure of a certified copy of a death registration for a deceased individual (the deceased) by the Ministry of Public and Business Service Delivery (the ministry) to an applicant who is not the deceased’s next of kin or extended next of kin. The complainant, who is the deceased’s mother and next of kin, believed that the disclosure was unauthorized and, therefore, a privacy breach under the Freedom of Information and Protection of Privacy Act (the Act).

In this report, I find that the information at issue is “personal information” within the meaning of section 2(1) of the Act and that the ministry’s disclosure of this information was not in accordance with section 42(1) of the Act. I also find that the ministry did not have reasonable measures in place to prevent unauthorized access to the personal information in accordance with section 4(1) of Regulation 460 made under the Act. As a result, I recommend that the ministry take reasonable steps to be satisfied as to the identity of an applicant before granting them access to a certified copy of a death registration. Further, as I found that the ministry did not respond adequately to the breach with respect to containment, I recommend that the ministry consider pursuing other means to retrieve the deceased’s certified copy of a death registration.

An affected person in an IPC complaint file made a procedural request that the IPC disclose to him a number of documents, including records of the complainant’s personal health information, in order to participate in the IPC’s review of the complaint under the Personal Health Information Protection Act, 2004 (PHIPA). The complaint concerns allegations that the respondent Sinai Health System (the hospital) contravened PHIPA by, among other things, failing to implement and enforce the complainant’s withdrawal of consent in respect of her personal health information after the complainant reported to the hospital that the affected person had sexually assaulted her during a medical examination. At the relevant time, the affected person was a doctor with privileges at the hospital. Although the complainant initially objected to the doctor’s disclosure request, she ultimately did not take issue with the request.

This interim decision sets out the adjudicator’s decision on the doctor’s disclosure request. After considering the requirements of procedural fairness in this case, based on relevant factors including the nature of the decision to be made, the role of the doctor as an affected person in the complaint, and the statutory context governing the IPC, among other factors, the adjudicator grants the doctor’s disclosure request in part. She decides to disclose most, but not all, of the documents the doctor requested.

With respect to the doctor’s request for the complaint documentation (i.e., the documents originating the complaint to the IPC) and the mediator’s report (which an IPC mediator issued to the complainant and the respondent hospital at an earlier stage of the complaint), the adjudicator decides to disclose these documents in part. She discloses to the doctor only those portions of the documents that relate to the issues to be decided in the review. She severs from the documents information that relates to other issues that were fully and finally resolved at earlier stages of the complaint. The severed information does not relate to the doctor, or to the issues remaining to be decided in the review, and its disclosure is not required for the purposes of procedural fairness to the doctor.

The adjudicator also denies the doctor’s request for disclosure of the complainant’s complete patient chart “up to the end of the time period at issue.” Instead, she decides to disclose to the doctor only those discrete records of personal health information from the complainant’s patient chart that are relevant, and proportionate, in the circumstances, in view of the specific allegations of unauthorized use and disclosure by the doctor that are at issue in the review. In addition, to protect the privacy of the complainant and the integrity of the IPC’s processes, the adjudicator orders that certain express conditions and restrictions attach to the handling of these records from the complainant’s patient chart. The conditions and restrictions, which are consistent with obligations imposed in comparable proceedings, are set out in undertakings enclosed with the parties’ copies of this interim decision.

These undertakings restrict the use and disclosure of these records of the complainant’s personal health information by the doctor and his legal counsel except for the purposes of the review (and any court proceedings arising from the review), and ensure the security of the records. If they wish to receive these records, the doctor and his legal counsel must first agree to these conditions and restrictions, by signing and returning the undertakings to the adjudicator.

After the adjudicator makes the disclosure described in this decision, she will continue the review to address the substantive issues raised by the complaint, including the issue of whether the hospital implemented the complainant’s withdrawal of consent (including by notifying its agents of the withdrawal of consent), in accordance with PHIPA.

An adopted person made a request to the Children’s Aid Society of Ottawa (CASO) under the Child, Youth and Family Services Act, 2017 (the CYFSA or the Act), for access to her complete file, including information about her birth parents, particularly about her birth father. The CASO granted partial access to the requested records, disclosing all information but for identifying information about the requester’s birth parents, which it redacted. The requester filed a complaint with the Information and Privacy Commissioner of Ontario (the IPC) because she seeks access to her complete and unredacted file, including the identifying information about her birth parents.

In this decision, the adjudicator finds that the redacted information, the identifying information about the requester’s birth parents, is excluded from the scope of Part X of the CYFSA under the exception at section 285(4)(a), as it is information that relates to an adoption. As a result of the application of the exception, Part X does not apply to the requested information and the requester does not have a right of access to her birth parents’ identifying information under that part. The complaint is dismissed.

The complainant submitted a request for access to all records relating to the death of her husband, who was admitted to the hospital during the COVID-19 pandemic. The hospital conducted two searches and granted the complainant access to the roughly 800 pages of records that it located. The complainant challenged the reasonableness of the hospital’s search for records. In this decision, the adjudicator finds that the hospital conducted a reasonable search for responsive records in accordance with its obligations under the Personal Health Information Protection Act, 2004. She dismisses the complaint.

The complainant sought a review of the hospital’s decision to refuse her request, under the Personal Health Information Protection Act, to correct her records of personal health information related to her hospital admission. The complainant sought removal of a form, signed by a physician, requiring her to undergo a psychiatric assessment, and removal of references to her having schizophrenia and suicidal thoughts. The hospital relied on the exception at section 55(9)(b) (professional opinions or observations made in good faith) of PHIPA to the duty to correct in section 55(8).

In this decision, the adjudicator finds that the hospital does not have a duty to make the requested corrections under section 55(8) of PHIPA because the complainant has not demonstrated that the information is incomplete or inaccurate for the purposes for which the hospital uses the information. As a result, she does not need to consider the exception at section 55(9)(b).

The complainant requested access to an electronic file containing his personal health information. The custodian granted the complainant partial access to responsive records claiming that disclosure of the names of certain individuals withheld would give rise to the harm contemplated in the exemption at section 52(1)(e)(i) (harm to patient or others) of the Personal Health Information Protection Act. The complainant filed a complaint with the Information Privacy Commissioner of Ontario seeking access to the withheld names. The complainant also argued that further responsive records should exist.
In this interim decision, the adjudicator upholds the custodian’s search for records. However, she defers consideration of the possible application of the exemption at section 52(1)(e)(i) pending the complainant’s written confirmation that he continues to seek access to the withheld names and the subsequent notification of these individuals.

The complainant submitted a correction request under the Personal Health Information Protection of Privacy Act to a physician seeking the removal of a letter from her medical file. The physician denied the complainant’s request citing sections 55(8) and 55(9)(b). The adjudicator finds that the complainant did not demonstrate that the information in the record was incomplete or incorrect for the purpose the physician uses the information. As a result, the custodian’s decision to not make the requested correction is upheld.

The Toronto Police Services Board (the police or the TPS) was notified that a TPS employee may have inappropriately accessed the complainants’ personal information from a police database. The TPS investigated and found that the TPS employee accessed and disclosed the complainants’ personal information to another TPS employee in violation of the Municipal Freedom of Information and Protection of Privacy Act (the Act).

In this report, I find that the TPS employee conducted database searches of the complainants’ personal information without authorization, and verbally disclosed their personal information to another TPS employee contrary to the Act. I conclude that the TPS does not have reasonable measures in place to protect personal information in its database, as required by section 3(1) of Regulation 823 to the Act. I recommend improvements to the TPS verification and auditing protocols. I also recommend improvements to its privacy guidance documents, and privacy training program. In addition, I recommend notifying additional parties whose privacy was breached and who the TPS identified during this investigation.

Under the Personal Health Information Protection Act, 2004 (PHIPA), the complainant made several requests to his former psychotherapist for records of his personal health information in unredacted and electronic format. In PHIPA Decision 100, the IPC upheld the psychotherapist’s decision to deny access to the records, in full, under section 52(1)(e)(i) of PHIPA, a discretionary exemption from the right of access in PHIPA that applies where granting access “could reasonably be expected to result in a risk of” certain serious harms. The complainant’s request for reconsideration of PHIPA Decision 100 was denied in PHIPA Decision 113.
Four days after the release of PHIPA Decision 113, and again a few weeks later, the complainant requested the same records from the psychotherapist. In response to the new requests, the psychotherapist again denied access, on the same ground in PHIPA. The complainant complained to the IPC about the psychotherapist’s refusal of access.
In this decision, the adjudicator finds that the common law doctrine of issue estoppel applies in the circumstances. The complainant’s new access requests to the psychotherapist, made only days after the IPC’s decisions dismissing his previous complaint in respect of the same records and on the same issue, were not accompanied by any new information to support a different decision by the psychotherapist. On the facts before her, the adjudicator concludes that the complainant’s current and previous complaints to the IPC concern the same question and the same parties, and that the IPC decisions disposing of this question are final decisions. She also finds there would be no unfairness in exercising her discretion to apply issue estoppel in the circumstances. She declines to conduct a review under PHIPA, and she dismisses the complaint.

The complainant submitted a correction request under the Personal Health Information Protection of Privacy Act to the hospital to correct his medical history information found in his electronic medical record. The hospital denied the complainant’s request citing sections 55(8) and 55(9). The adjudicator finds that the complainant did not demonstrate that the information in the record was incomplete or incorrect for the purpose the hospital uses the information. As a result, the hospital’s decision to not make the requested corrections is upheld.

The complainant submitted a request under the Personal Health Information Protection Act (PHIPA or the Act) to the Ottawa Physiotherapy & Sport Clinic (the custodian) for access to his records of personal health information. The custodian issued a decision granting access to paper copies of the records upon payment of a fee of $150 for the processing of the request. The complainant filed a complaint with the Information and Privacy Commissioner of Ontario (the IPC) regarding the custodian’s fee and its refusal to provide the records in electronic format.

In this decision, the adjudicator finds that, by virtue of section 52(1.1), the complainant’s right of access to his records of personal health information includes the right to access them in electronic format. She orders the custodian to provide the complainant with the records in electronic format.

The adjudicator also considers the amount of fee which would be in keeping with the principle of “reasonable cost recovery” under section 54(11) to provide the records in electronic format. She finds that, if the records are provided on a physical storage device such as CD or USB, reasonable cost recovery is $153.75. She finds that if the records are instead transmitted electronically (for example, via secure email or as a password protected PDF sent by regular email), reasonable cost recovery is $143.75.

Finally, the adjudicator finds that the fees for providing the records in electronic format are instead of and not in addition to the fee for paper copies that has been already paid by the complainant. She also finds that the difference between the $150 fee already paid by the complainant and the fees that she has found to be in keeping with reasonable cost recovery for providing the records in electronic format is sufficiently negligible that the custodian is not permitted to charge the complainant for the difference if it is providing the records on a physical storage device nor is it required to provide a refund if the records are to be transmitted electronically.

The Office of the Information and Privacy Commissioner received a privacy complaint about the Toronto Police Service (the police)’s disclosure of information relating to an individual’s arrest and drug-related charges to their employer, the Correctional Service of Canada. The complainant believed that the disclosure breached their privacy under the Municipal Freedom of Information and Protection of Privacy Act (the Act).

This report finds that the information at issue is “personal information” within the meaning of section 2(1) of the Act. It also finds that the police’s disclosure of this information was not in accordance with section 32 of the Act.

The Office of the Information and Privacy Commissioner of Ontario received a complaint alleging that the City of Toronto contravened the Municipal Freedom of Information and Protection of Privacy Act (the Act) when it posted the complainant’s Committee of Adjustment application, which included her personal information, on the internet. In this report, I find that the City’s Committee of Adjustment applications are a public record, pursuant to section 27 of the Act, and are therefore not subject to the privacy rules under Part II of the Act.

Although I find that the City’s Committee of Adjustment applications are outside the scope of the Act, I recommend that the City pursue its intended review of its Committee of Adjustment application forms with the view of implementing data minimization principles. The City should also proceed with developing criteria to determine when it is appropriate to remove personal information from its forms.

The office of the Information and Privacy Commissioner of Ontario received a complaint under the Personal Health Information Protection Act (the Act) against a medical clinic. The complaint alleged that the clinic had inadequate privacy practices with respect to the security and safeguarding of the personal health information of its patients. The decision finds that the clinic did not have reasonable measures in place to ensure the protection of the personal health information of its patients as required by section 12(1) of the Act. However, in light of the steps taken by the clinic to address the issues identified, no review of this matter will be conducted under Part VI of the Act.