Dernières décisions

During the course of working with this office on a privacy breach file, a Health Centre notified the Information and Privacy Commissioner of Ontario that additional possible unauthorized accesses by a number of employees had been discovered. This file was opened to address the additional unauthorized accesses and the systemic issues related to the breaches.

The Health Centre ultimately determined 28 of those accesses to be breaches of the Act. This decision concludes that at the time of the breaches the Health Centre had inconsistencies regarding staff requirements to sign confidentiality and EMR authorized user agreements, there was an inadequate privacy notice on the Health Centre’s EMR system, and a formal privacy breach policy was not in place. As such, this Decision finds that at the time of the breaches, the Health Centre had not taken reasonable steps to protect the personal health information within the meaning of section 12(1) of the Act. However, this decision also finds that the Health Centre has since remedied these issues.

This decision also finds that the Health Centre did not provide the patients affected by this breach the notification required by section 12(2) of the Act. Specifically, the Health Centre did not provide notice of the breach “at the first reasonable opportunity.”

Lastly, I decide that no review of this matter is warranted.

The complainant requested from St. Joseph’s Healthcare Hamilton (the hospital) access to a complete copy of his file for a specified time period. The hospital initially denied the request in full, relying on sections 52(1)(e)(i) (harm to the requester or others) and 52(1)(e)(iii) (confidential source) of PHIPA. During the IPC review of the complaint, the hospital agreed to provide the complainant with most of the information at issue. However, it continued to withhold portions under section 52(1)(e)(iii) (confidential source). In this decision, the adjudicator upholds the hospital’s claim that the section 52(1)(e)(iii) exemption applies to the remaining information and dismisses the complaint.

This reconsideration decision addresses the complainant’s request to reconsider PHIPA Decision 141, in which the adjudicator found that the hospital conducted a reasonable search for responsive records.
The complainant sought a reconsideration of PHIPA Decision 141 and made an allegation of bias against the adjudicator. In this reconsideration decision, the adjudicator finds that the allegation of bias is not established and that the reconsideration request fails to establish any ground for reconsideration under section 27.01 of the Code of Procedure for Matters under the Personal Health Information Protection Act, 2004. The reconsideration request is denied.

This decision addresses a request under the Personal Health Information and Protection of Privacy Act (PHIPA) made to the Queensway Carleton Hospital (the hospital) for the personal health information of a patient, the complainant’s son. The request was for the complainant’s son’s entire file while on a particular ward and correspondence about him exchanged between any and all employees at the hospital. The hospital granted partial access to the information, denying access to portions of the records under both PHIPA and the Freedom of Information and Protection of Privacy Act (FIPPA). The hospital claimed the exemptions at section 52(1)(a) of PHIPA (legal privilege) and sections 13(1) (advice and recommendations) and 21(1) (personal privacy) of FIPPA. In addition to objecting to the denial of access to portions of the records, the complainant took issue with the reasonableness of the hospital’s search for responsive records.

In this decision, the adjudicator partially upholds the hospital’s decision. She finds that section 52(1)(a) of PHIPA applies to the information for which it was claimed. She also finds that some of the information is exempt from disclosure under section 52(1)(f) of PHIPA (flow-through to FIPPA), because section 49(a) of FIPPA (discretion to refuse a requester’s own personal information), read with section 13(1) of FIPPA, applies to some of the information at issue. The adjudicator orders the hospital to provide the non-exempt information to the complainant. She also finds the hospital’s search for records deficient and orders it to conduct an additional search for records.

Under the Personal Health Information Protection of Privacy Act, 2004 (PHIPA) the complainant submitted a correction request to the William Osler Health System – Peel Memorial Centre (the custodian) requesting that notes made in her medical record indicating that she had a specified medical condition be struck from her record. The custodian denied the complainant’s request on the basis of section 55(9)(b) of PHIPA which sets out an exception to a custodian’s duty to correct at section 55(8) of PHIPA provided that the information consists of professional opinions or observations made in good faith. In this decision, the adjudicator upholds the custodian’s refusal to correct the personal health information in the record under section 55(8) of PHIPA because the exception at section 55(9)(b) applies. She dismisses the complaint.

The complainant alleged that the physician disclosed more of his personal health information than necessary to the Workplace Safety and Insurance Board, in contravention of the Personal Health Information Protection Act (PHIPA). In this decision, the adjudicator finds that the discretionary disclosure provision at section 43(1)(h) (disclosure permitted or required by law) authorized the physician to disclose the complainant’s personal health information to the WSIB pursuant to the requirement at section 37(1) of the Workplace Safety and Insurance Act, 1997. She also finds that the data minimization principle at section 30 of PHIPA does not apply, by virtue of section 30(3) of PHIPA, and she dismisses the complaint.

The complainant submitted a correction request under the Personal Health Information Protection Act to the hospital to correct his medical history information found in his electronic medical record. The hospital denied the complainant’s request citing sections 55(8) and 55(9). In PHIPA Decision 186 the adjudicator found that the complainant did not demonstrate that the information in the record was incomplete or incorrect for the purpose the hospital uses the information as required under section 55(8). As a result, the hospital’s decision to not make the requested corrections was upheld and the complaint was dismissed.

The complainant submitted a correction request under the Personal Health Information Protection of Privacy Act to a physician requesting the removal of notations related to the status of her mental health. The physician denied the complainant’s request citing sections 55(8) and 55(9)(b). The adjudicator finds that the complainant did not demonstrate that the information in the record was incomplete or incorrect for the purpose the physician uses the information under section 55(8). As a result, the custodian’s decision to not make the requested correction is upheld.

An individual submitted a request under the Personal Health Information Protection Act (PHIPA or the Act) to the Region of Peel (the custodian) for access to an investigation report (the report) resulting from his complaint to the Professional Standards Department of Peel Regional Paramedic Services, a division of the Region of Peel. The custodian denied access to the report on the basis that it is exempt from disclosure under sections 52(1)(c) (for use in a proceeding) and 52(1)(d) (for an investigation authorized by law) of PHIPA. The custodian also claimed that the report was excluded from the scope of MFIPPA as a result of the application of the exclusion at section 52(3) (records related to labour relations and employment-related matters) of that act. In this decision, the adjudicator finds that access to the report is governed by PHIPA, not MFIPPA and that neither of the exemptions at sections 52(1)(c) and (d) of PHIPA apply. She orders the custodian to provide the report to the complainant.

Under the Personal Health Information Protection Act, 2004 (PHIPA), the complainant requested that corrections be made to a consultation note documenting her visit to the London Health Sciences Centre (the hospital). Among other reasons, the complainant asserts that statements in the note about certain behaviours and health issues are inaccurate, and are inconsistent with information she later provided to the hospital about her health and her capacity to live a successful life. The complainant filed a complaint with the IPC about the hospital’s refusal to make her requested corrections. In this decision, the adjudicator upholds the hospital’s refusal to correct based on an exception to the duty in section 55(8) of PHIPA that otherwise requires the hospital to correct personal health information in certain circumstances. In this case, the adjudicator finds that the exception at section 55(9)(b) of PHIPA for professional opinions or observations (accurate or otherwise) made in good faith applies to the personal health information at issue in the consultation note. She dismisses the complaint.

The Office of the Information and Privacy Commissioner received a privacy complaint about the disclosure of a certified copy of a death registration for a deceased individual (the deceased) by the Ministry of Public and Business Service Delivery (the ministry) to an applicant who is not the deceased’s next of kin or extended next of kin. The complainant, who is the deceased’s mother and next of kin, believed that the disclosure was unauthorized and, therefore, a privacy breach under the Freedom of Information and Protection of Privacy Act (the Act).

In this report, I find that the information at issue is “personal information” within the meaning of section 2(1) of the Act and that the ministry’s disclosure of this information was not in accordance with section 42(1) of the Act. I also find that the ministry did not have reasonable measures in place to prevent unauthorized access to the personal information in accordance with section 4(1) of Regulation 460 made under the Act. As a result, I recommend that the ministry take reasonable steps to be satisfied as to the identity of an applicant before granting them access to a certified copy of a death registration. Further, as I found that the ministry did not respond adequately to the breach with respect to containment, I recommend that the ministry consider pursuing other means to retrieve the deceased’s certified copy of a death registration.

An affected person in an IPC complaint file made a procedural request that the IPC disclose to him a number of documents, including records of the complainant’s personal health information, in order to participate in the IPC’s review of the complaint under the Personal Health Information Protection Act, 2004 (PHIPA). The complaint concerns allegations that the respondent Sinai Health System (the hospital) contravened PHIPA by, among other things, failing to implement and enforce the complainant’s withdrawal of consent in respect of her personal health information after the complainant reported to the hospital that the affected person had sexually assaulted her during a medical examination. At the relevant time, the affected person was a doctor with privileges at the hospital. Although the complainant initially objected to the doctor’s disclosure request, she ultimately did not take issue with the request.

This interim decision sets out the adjudicator’s decision on the doctor’s disclosure request. After considering the requirements of procedural fairness in this case, based on relevant factors including the nature of the decision to be made, the role of the doctor as an affected person in the complaint, and the statutory context governing the IPC, among other factors, the adjudicator grants the doctor’s disclosure request in part. She decides to disclose most, but not all, of the documents the doctor requested.

With respect to the doctor’s request for the complaint documentation (i.e., the documents originating the complaint to the IPC) and the mediator’s report (which an IPC mediator issued to the complainant and the respondent hospital at an earlier stage of the complaint), the adjudicator decides to disclose these documents in part. She discloses to the doctor only those portions of the documents that relate to the issues to be decided in the review. She severs from the documents information that relates to other issues that were fully and finally resolved at earlier stages of the complaint. The severed information does not relate to the doctor, or to the issues remaining to be decided in the review, and its disclosure is not required for the purposes of procedural fairness to the doctor.

The adjudicator also denies the doctor’s request for disclosure of the complainant’s complete patient chart “up to the end of the time period at issue.” Instead, she decides to disclose to the doctor only those discrete records of personal health information from the complainant’s patient chart that are relevant, and proportionate, in the circumstances, in view of the specific allegations of unauthorized use and disclosure by the doctor that are at issue in the review. In addition, to protect the privacy of the complainant and the integrity of the IPC’s processes, the adjudicator orders that certain express conditions and restrictions attach to the handling of these records from the complainant’s patient chart. The conditions and restrictions, which are consistent with obligations imposed in comparable proceedings, are set out in undertakings enclosed with the parties’ copies of this interim decision.

These undertakings restrict the use and disclosure of these records of the complainant’s personal health information by the doctor and his legal counsel except for the purposes of the review (and any court proceedings arising from the review), and ensure the security of the records. If they wish to receive these records, the doctor and his legal counsel must first agree to these conditions and restrictions, by signing and returning the undertakings to the adjudicator.

After the adjudicator makes the disclosure described in this decision, she will continue the review to address the substantive issues raised by the complaint, including the issue of whether the hospital implemented the complainant’s withdrawal of consent (including by notifying its agents of the withdrawal of consent), in accordance with PHIPA.

An adopted person made a request to the Children’s Aid Society of Ottawa (CASO) under the Child, Youth and Family Services Act, 2017 (the CYFSA or the Act), for access to her complete file, including information about her birth parents, particularly about her birth father. The CASO granted partial access to the requested records, disclosing all information but for identifying information about the requester’s birth parents, which it redacted. The requester filed a complaint with the Information and Privacy Commissioner of Ontario (the IPC) because she seeks access to her complete and unredacted file, including the identifying information about her birth parents.

In this decision, the adjudicator finds that the redacted information, the identifying information about the requester’s birth parents, is excluded from the scope of Part X of the CYFSA under the exception at section 285(4)(a), as it is information that relates to an adoption. As a result of the application of the exception, Part X does not apply to the requested information and the requester does not have a right of access to her birth parents’ identifying information under that part. The complaint is dismissed.

The complainant submitted a request for access to all records relating to the death of her husband, who was admitted to the hospital during the COVID-19 pandemic. The hospital conducted two searches and granted the complainant access to the roughly 800 pages of records that it located. The complainant challenged the reasonableness of the hospital’s search for records. In this decision, the adjudicator finds that the hospital conducted a reasonable search for responsive records in accordance with its obligations under the Personal Health Information Protection Act, 2004. She dismisses the complaint.

The complainant sought a review of the hospital’s decision to refuse her request, under the Personal Health Information Protection Act, to correct her records of personal health information related to her hospital admission. The complainant sought removal of a form, signed by a physician, requiring her to undergo a psychiatric assessment, and removal of references to her having schizophrenia and suicidal thoughts. The hospital relied on the exception at section 55(9)(b) (professional opinions or observations made in good faith) of PHIPA to the duty to correct in section 55(8).

In this decision, the adjudicator finds that the hospital does not have a duty to make the requested corrections under section 55(8) of PHIPA because the complainant has not demonstrated that the information is incomplete or inaccurate for the purposes for which the hospital uses the information. As a result, she does not need to consider the exception at section 55(9)(b).