Latest IPC Decisions

The Office of the Information and Privacy Commissioner received a privacy complaint about the Toronto Police Service (the police)’s disclosure of information relating to an individual’s arrest and drug-related charges to their employer, the Correctional Service of Canada. The complainant believed that the disclosure breached their privacy under the Municipal Freedom of Information and Protection of Privacy Act (the Act).

This report finds that the information at issue is “personal information” within the meaning of section 2(1) of the Act. It also finds that the police’s disclosure of this information was not in accordance with section 32 of the Act.

The Office of the Information and Privacy Commissioner of Ontario received a complaint alleging that the City of Toronto contravened the Municipal Freedom of Information and Protection of Privacy Act (the Act) when it posted the complainant’s Committee of Adjustment application, which included her personal information, on the internet. In this report, I find that the City’s Committee of Adjustment applications are a public record, pursuant to section 27 of the Act, and are therefore not subject to the privacy rules under Part II of the Act.

Although I find that the City’s Committee of Adjustment applications are outside the scope of the Act, I recommend that the City pursue its intended review of its Committee of Adjustment application forms with the view of implementing data minimization principles. The City should also proceed with developing criteria to determine when it is appropriate to remove personal information from its forms.

The office of the Information and Privacy Commissioner of Ontario received a complaint under the Personal Health Information Protection Act (the Act) against a medical clinic. The complaint alleged that the clinic had inadequate privacy practices with respect to the security and safeguarding of the personal health information of its patients. The decision finds that the clinic did not have reasonable measures in place to ensure the protection of the personal health information of its patients as required by section 12(1) of the Act. However, in light of the steps taken by the clinic to address the issues identified, no review of this matter will be conducted under Part VI of the Act.

A father, a non-custodial parent with only access rights to his child, requested his child’s personal health information (PHI) from Dr. Paola Leon (the custodian). In support of his request, the father provided a court order and a consent to disclosure from the child’s mother, who has sole custody of the child.

The custodian denied the request on the basis that the father, as a non-custodial parent, does not have a right of access to the child’s PHI because he is not a lawfully authorized substitute decision-maker for the child under the Personal Health Information Protection Act, 2004 (PHIPA). The custodian subsequently gave the father a summary of the child’s PHI and treatment, but she decided not to disclose entire records containing the child’s PHI under PHIPA’s discretionary disclosure provisions at sections 29(a) (consent), 41(1)(d)(i) (compliance with summons or order) and 43(1)(h) (permitted or required by law). The custodian’s exercise of discretion was informed by her concerns about the child’s best interests and about the potential harm that disclosure could cause the child.

In this decision, the adjudicator finds that the father does not have a right of access to the child’s PHI under Part V of PHIPA. She also upholds the custodian’s exercise of discretion not to disclose the child’s PHI to the father under Part IV of PHIPA. She upholds the custodian’s decision and issues no order.

The complainant made an access request to a psychiatrist (the custodian) under the Personal Health Information Protection Act (the Act), for records of personal health information relating to himself. After reviewing the records the custodian provided him, he made a complaint to the IPC on the basis that further records exist that are responsive to his access request, raising the issue of reasonable search. In this decision, the adjudicator finds that the complainant has established that further records may exist, and also that the custodian did not provide sufficient evidence that the search for records was reasonable. The custodian is ordered to conduct a further search for records responsive to the complainant’s request and to provide a written explanation to the complainant regarding the results of the search.

The complainant made an access and correction request to Alexandra Marine and General Hospital (the hospital) under the Personal Health Information Protection Act (the Act). Upon receipt of his records of personal health information, the complainant requested corrections of the information in them. He also believed that further records exist that are responsive to his access request, raising the issue of reasonable search. In this decision, the adjudicator finds that the exception to the duty to correct at section 55(9)(b) (good faith professional opinion or observation) applies. The hospital’s decision to not make the requested corrections is upheld. With respect to the hospital’s search for responsive records, the adjudicator upholds the hospital’s search with one exception and orders the hospital to conduct a further search for a particular mental health assessment and issue a new decision letter to the complainant with respect to the results of the search.

The office of the Information and Privacy Commissioner/Ontario (IPC or this office) received a complaint under the Personal Health Information and Protection Act (the Act) against a pharmacy. The complaint related to the unauthorized collection of personal health information. Specifically, pharmacy staff attempted to collect the complainant’s health card number in order to fill her prescription. This was the second incident of this nature reported to this office.
This Decision finds that the pharmacy did not collect the complainant’s health card number, and therefore, did not contravene the Act. However, the Decision also finds that the pharmacy staff lacked education and training around the collection of health cards under the Act and failed to properly communicate the pharmacy’s policy to this complainant that the production of her health card was voluntary.
In response to this complaint, the pharmacy has taken a number of steps including training its staff and revising its information practices around health cards and health card numbers. In light of the actions taken by the pharmacy, I have decided no formal review of this matter will be conducted under Part VI of PHIPA.

The complainant’s information was contained in records of a children’s aid society (the CAS) relating to reports that a child suffered harm while in his care as a babysitter. The complainant sought access to all of his personal information in the CAS’s files. The CAS provided the complainant with a severed copy of records containing his personal information. The complainant then filed a complaint with the Information and Privacy Commissioner of Ontario (IPC), asking the IPC to review the CAS’s decision to withhold information in the records from him.
Exercising her discretion under sections 317(3) and 317(4) of the Child, Youth and Family Services Act, 2017 (the Act), the adjudicator determines that there are no reasonable grounds to conduct a review of the subject-matter of the complaint and that a review is not warranted. She bases her determination on her finding that the complainant has no right of access to the records under section 312(1) of the Act because the records do not relate to “the provision of a service” to him as required for the application of that section. As a result, the adjudicator declines to conduct a review and she dismisses the complaint.

The Office of the Information and Privacy Commissioner of Ontario received a complaint under the Personal Health Information Protection Act, 2004 (the Act) about an alleged unauthorized use of patients’ personal health information by three doctors of a public hospital. This decision finds that the use of the personal health information by two of the three doctors to be in accordance with the Act. According to the audit information provided by the hospital, the third doctor did not access the patients’ personal health information.

This decision concerns a complainant’s request under Part X of the Child, Youth and Family Services Act, 2017 (the Act) for records about a family member. It considers the right of access in Part X to records of an individual’s personal information that relate to the provision of a service to the individual. It also considers the potential relevance of sections of Part X that permit or require the disclosure of personal information in some circumstances.

In this decision, the adjudicator finds that the complainant does not have a right of access to personal information of his family member under the Act, because he is neither the individual to whom the personal information relates, nor an authorized substitute decision-maker for that individual. She also finds that the service provider properly exercised its discretion under a potentially applicable section of the Act that permits disclosure in some circumstances. In the result, she upholds the service provider’s refusal of the complainant’s request for his family member’s personal information. She also upholds the service provider’s search for other records within its custody or control about the complainant and other family members. She dismisses the complaint.

The complainant’s representative submitted a correction request under the Personal Health Information Protection Act to the Central LHIN operating as the Home and Community Care Support Services – Central (the custodian). The complainant submits that a home care assessment form contains a number of errors. The custodian agreed to make some corrections, but not others. In this decision, the adjudicator finds that the exception to the duty to correct at section 55(9)(b) (good faith professional opinion or observation) applies. The custodian’s decision to not make the requested corrections is upheld.

This decision and related PHIPA Decision 177 address a complainant’s allegations that a number of individuals at two hospitals made unauthorized accesses to records of his son’s personal health information after his son’s death. The records at issue in both decisions are contained in a shared electronic medical records system (EMR) accessible to both hospitals.
This decision addresses the allegations concerning accesses to EMR records in the custody or control of Windsor Regional Hospital – Ouellete Campus (WRH), as well as accesses by WRH agents to records in the custody or control of the other hospital, Hôtel-Dieu Grace Healthcare. In this decision, the adjudicator declines to consider the complaint against a WRH doctor in respect of two accesses in the EMR, because that matter has been appropriately dealt with in previous proceedings before the College of Physicians and Surgeons of Ontario. She finds that the remaining accesses were made in accordance with the Personal Health Information Protection Act, 2004 (PHIPA), generally in relation to quality of care purposes permitted under PHIPA. She also finds that WRH generally complied with its obligations under PHIPA to take reasonable steps to protect personal health information in its custody or control, and to respond adequately to the complaint. As a result, she concludes the review without issuing an order. However, the adjudicator makes some comments and one recommendation to clarify WRH’s obligations under PHIPA and to help improve its privacy practices in future.

This decision and related PHIPA Decision 176 address a complainant’s allegations that a number of individuals at two hospitals made unauthorized accesses to records of his son’s personal health information after his son’s death. The records at issue in both decisions are contained in a shared electronic medical records system (EMR) accessible to both hospitals.
This decision addresses the allegations concerning accesses to EMR records in the custody or control of Hôtel-Dieu Grace Healthcare (HDGH), as well as accesses by an HDGH agent to a record in the custody or control of the other hospital, Windsor Regional Hospital – Ouellete Campus. In this decision, the adjudicator finds that the accesses at issue were made in accordance with the Personal Health Information Protection Act, 2004 (PHIPA), generally in relation to quality of care purposes permitted under PHIPA. She also finds that HDGH complied with its obligations under PHIPA to take reasonable steps to protect personal health information in its custody or control, and to respond adequately to the complaint. As a result, she concludes the review without issuing an order. However, the adjudicator makes some comments to help improve HDGH’s privacy practices in future.

The Office of the Information and Privacy Commissioner of Ontario received three related privacy complaints about the University of Guelph (the university). The complaints concerned the university’s collection of information relating to the COVID-19 vaccination status of students who wished to live on residence for the 2021–2022 academic year. The complainants believed that the collection breached the students’ privacy under the Freedom of Information and Protection of Privacy Act (the Act).

This report finds that the information at issue is “personal information” as defined in section 2(1) of the Act. It also finds that the collection of the personal information and the notice of collection were in accordance with sections 38(2) and 39(2) of the Act, respectively.

This investigation file was opened following the publication of a Toronto Star article in 2019 (the Article). The Article reported that a company that sells and supports electronic medical record software in primary care practices in Ontario, was anonymizing health data and selling the data to a third party corporation. In response to the article, the Office of the Information and Privacy Commissioner of Ontario commenced a review under the Personal Health Information Protection Act (the Act) and sought to identify the individual or entity who allegedly de-identified and sold the data.

The corporation that was identified as having sold the information was named as a respondent in this investigation and a number of other respondents were also added, one of which was identified as the health information custodian.

This Decision concludes that the act or process of de-identifying personal health information is a “use” within the meaning of section 2 of the Act, and that the use of personal health information for the purpose of de-identification is permitted without the consent of the individual, where the conditions set out under subsection 37(1)(f) of the Act are met. At the time of this investigation, the health information custodian’s written public statement about its information practices did not comply with section 16(1)(a) of the Act. However, this issue has since been remedied and the custodian’s updated privacy policy now meets the requirements of the Act by explicitly describing its practice of de-identifying personal health information and selling the information to a third party for a number of purposes, including for health-related research. With regard to the de-identified personal health information, the custodian has complied with subsection 12(1) of the Act, in that reasonable steps have now been taken to ensure the protection of personal health information by amending the sale agreement to include additional privacy and security controls. Further, the IPC has no information to suggest that the personal health information was not properly de-identified within the meaning of the Act.

Accordingly, this review will be concluded without proceeding to the adjudication stage and without an order being issued by this office.