This complaint concerns allegations that the respondent Sinai Health System (the hospital) and an affected person (a doctor who had privileges at the hospital at the relevant times) used and disclosed the complainant’s personal health information in violation of her withdrawal of consent following her allegations of sexual assault by the doctor, and her request that the doctor no longer be involved in her health care. The incidents at issue involve the hospital’s and doctor’s disclosures of the complainant’s personal health information to the doctor’s lawyer and to the College of Physicians and Surgeons of Ontario, for purposes related to proceedings involving the doctor arising from allegations about his conduct. They also include the doctor’s uses and a disclosure of her personal health information for health care purposes.
In this decision, the adjudicator finds that the hospital’s and doctor’s disclosures to the doctor’s lawyer and to the College, made for the purposes of existing or reasonably contemplated proceedings involving the doctor, were authorized by PHIPA to be made without consent.
However, the adjudicator finds that other uses and one disclosure of the complainant’s personal health information, made for health care purposes, were made in violation of PHIPA. In the circumstances, the complainant’s report of sexual assault and her request that the doctor no longer be involved in her health care was an express withdrawal of her consent to the doctor’s use and disclosure of her personal health information for health care purposes. Her statements also amounted to an express instruction against these uses and disclosure of her personal health information for health care purposes without her consent. By failing to recognize and implement the complainant’s express withdrawal of consent to, and her express instruction against, these uses and disclosure, the hospital allowed the doctor to continue to use and disclose the complainant’s personal health information for health care purposes contrary to her wishes, and in violation of PHIPA.
During the course of the complaint, the hospital acknowledged and implemented the complainant’s withdrawal of consent with respect to her personal health information. To address the broader issues raised by the complaint, the adjudicator orders the hospital to amend its information practices to clarify an individual’s right to withhold or withdraw consent to the collection, use, and disclosure of her personal health information, and to make express instructions with respect to the uses and disclosures of that information for certain purposes without consent. These amendments should make clear that an individual will not always employ specific terminology in PHIPA to communicate a withholding or withdrawal of consent or an express instruction with respect to her personal health information.