Dernières décisions

The complainant requested access to an electronic file containing his personal health information. The custodian granted the complainant partial access to responsive records claiming that disclosure of the names of certain individuals withheld would give rise to the harm contemplated in the exemption at section 52(1)(e)(i) (harm to patient or others) of the Personal Health Information Protection Act. The complainant filed a complaint with the Information Privacy Commissioner of Ontario seeking access to the withheld names. The complainant also argued that further responsive records should exist.
In this interim decision, the adjudicator upholds the custodian’s search for records. However, she defers consideration of the possible application of the exemption at section 52(1)(e)(i) pending the complainant’s written confirmation that he continues to seek access to the withheld names and the subsequent notification of these individuals.

The complainant submitted a correction request under the Personal Health Information Protection of Privacy Act to a physician seeking the removal of a letter from her medical file. The physician denied the complainant’s request citing sections 55(8) and 55(9)(b). The adjudicator finds that the complainant did not demonstrate that the information in the record was incomplete or incorrect for the purpose the physician uses the information. As a result, the custodian’s decision to not make the requested correction is upheld.

The Toronto Police Services Board (the police or the TPS) was notified that a TPS employee may have inappropriately accessed the complainants’ personal information from a police database. The TPS investigated and found that the TPS employee accessed and disclosed the complainants’ personal information to another TPS employee in violation of the Municipal Freedom of Information and Protection of Privacy Act (the Act).

In this report, I find that the TPS employee conducted database searches of the complainants’ personal information without authorization, and verbally disclosed their personal information to another TPS employee contrary to the Act. I conclude that the TPS does not have reasonable measures in place to protect personal information in its database, as required by section 3(1) of Regulation 823 to the Act. I recommend improvements to the TPS verification and auditing protocols. I also recommend improvements to its privacy guidance documents, and privacy training program. In addition, I recommend notifying additional parties whose privacy was breached and who the TPS identified during this investigation.

Under the Personal Health Information Protection Act, 2004 (PHIPA), the complainant made several requests to his former psychotherapist for records of his personal health information in unredacted and electronic format. In PHIPA Decision 100, the IPC upheld the psychotherapist’s decision to deny access to the records, in full, under section 52(1)(e)(i) of PHIPA, a discretionary exemption from the right of access in PHIPA that applies where granting access “could reasonably be expected to result in a risk of” certain serious harms. The complainant’s request for reconsideration of PHIPA Decision 100 was denied in PHIPA Decision 113.
Four days after the release of PHIPA Decision 113, and again a few weeks later, the complainant requested the same records from the psychotherapist. In response to the new requests, the psychotherapist again denied access, on the same ground in PHIPA. The complainant complained to the IPC about the psychotherapist’s refusal of access.
In this decision, the adjudicator finds that the common law doctrine of issue estoppel applies in the circumstances. The complainant’s new access requests to the psychotherapist, made only days after the IPC’s decisions dismissing his previous complaint in respect of the same records and on the same issue, were not accompanied by any new information to support a different decision by the psychotherapist. On the facts before her, the adjudicator concludes that the complainant’s current and previous complaints to the IPC concern the same question and the same parties, and that the IPC decisions disposing of this question are final decisions. She also finds there would be no unfairness in exercising her discretion to apply issue estoppel in the circumstances. She declines to conduct a review under PHIPA, and she dismisses the complaint.

The complainant submitted a correction request under the Personal Health Information Protection of Privacy Act to the hospital to correct his medical history information found in his electronic medical record. The hospital denied the complainant’s request citing sections 55(8) and 55(9). The adjudicator finds that the complainant did not demonstrate that the information in the record was incomplete or incorrect for the purpose the hospital uses the information. As a result, the hospital’s decision to not make the requested corrections is upheld.

The complainant submitted a request under the Personal Health Information Protection Act (PHIPA or the Act) to the Ottawa Physiotherapy & Sport Clinic (the custodian) for access to his records of personal health information. The custodian issued a decision granting access to paper copies of the records upon payment of a fee of $150 for the processing of the request. The complainant filed a complaint with the Information and Privacy Commissioner of Ontario (the IPC) regarding the custodian’s fee and its refusal to provide the records in electronic format.

In this decision, the adjudicator finds that, by virtue of section 52(1.1), the complainant’s right of access to his records of personal health information includes the right to access them in electronic format. She orders the custodian to provide the complainant with the records in electronic format.

The adjudicator also considers the amount of fee which would be in keeping with the principle of “reasonable cost recovery” under section 54(11) to provide the records in electronic format. She finds that, if the records are provided on a physical storage device such as CD or USB, reasonable cost recovery is $153.75. She finds that if the records are instead transmitted electronically (for example, via secure email or as a password protected PDF sent by regular email), reasonable cost recovery is $143.75.

Finally, the adjudicator finds that the fees for providing the records in electronic format are instead of and not in addition to the fee for paper copies that has been already paid by the complainant. She also finds that the difference between the $150 fee already paid by the complainant and the fees that she has found to be in keeping with reasonable cost recovery for providing the records in electronic format is sufficiently negligible that the custodian is not permitted to charge the complainant for the difference if it is providing the records on a physical storage device nor is it required to provide a refund if the records are to be transmitted electronically.

The Office of the Information and Privacy Commissioner received a privacy complaint about the Toronto Police Service (the police)’s disclosure of information relating to an individual’s arrest and drug-related charges to their employer, the Correctional Service of Canada. The complainant believed that the disclosure breached their privacy under the Municipal Freedom of Information and Protection of Privacy Act (the Act).

This report finds that the information at issue is “personal information” within the meaning of section 2(1) of the Act. It also finds that the police’s disclosure of this information was not in accordance with section 32 of the Act.

The Office of the Information and Privacy Commissioner of Ontario received a complaint alleging that the City of Toronto contravened the Municipal Freedom of Information and Protection of Privacy Act (the Act) when it posted the complainant’s Committee of Adjustment application, which included her personal information, on the internet. In this report, I find that the City’s Committee of Adjustment applications are a public record, pursuant to section 27 of the Act, and are therefore not subject to the privacy rules under Part II of the Act.

Although I find that the City’s Committee of Adjustment applications are outside the scope of the Act, I recommend that the City pursue its intended review of its Committee of Adjustment application forms with the view of implementing data minimization principles. The City should also proceed with developing criteria to determine when it is appropriate to remove personal information from its forms.

The office of the Information and Privacy Commissioner of Ontario received a complaint under the Personal Health Information Protection Act (the Act) against a medical clinic. The complaint alleged that the clinic had inadequate privacy practices with respect to the security and safeguarding of the personal health information of its patients. The decision finds that the clinic did not have reasonable measures in place to ensure the protection of the personal health information of its patients as required by section 12(1) of the Act. However, in light of the steps taken by the clinic to address the issues identified, no review of this matter will be conducted under Part VI of the Act.

A father, a non-custodial parent with only access rights to his child, requested his child’s personal health information (PHI) from Dr. Paola Leon (the custodian). In support of his request, the father provided a court order and a consent to disclosure from the child’s mother, who has sole custody of the child.

The custodian denied the request on the basis that the father, as a non-custodial parent, does not have a right of access to the child’s PHI because he is not a lawfully authorized substitute decision-maker for the child under the Personal Health Information Protection Act, 2004 (PHIPA). The custodian subsequently gave the father a summary of the child’s PHI and treatment, but she decided not to disclose entire records containing the child’s PHI under PHIPA’s discretionary disclosure provisions at sections 29(a) (consent), 41(1)(d)(i) (compliance with summons or order) and 43(1)(h) (permitted or required by law). The custodian’s exercise of discretion was informed by her concerns about the child’s best interests and about the potential harm that disclosure could cause the child.

In this decision, the adjudicator finds that the father does not have a right of access to the child’s PHI under Part V of PHIPA. She also upholds the custodian’s exercise of discretion not to disclose the child’s PHI to the father under Part IV of PHIPA. She upholds the custodian’s decision and issues no order.

The complainant made an access request to a psychiatrist (the custodian) under the Personal Health Information Protection Act (the Act), for records of personal health information relating to himself. After reviewing the records the custodian provided him, he made a complaint to the IPC on the basis that further records exist that are responsive to his access request, raising the issue of reasonable search. In this decision, the adjudicator finds that the complainant has established that further records may exist, and also that the custodian did not provide sufficient evidence that the search for records was reasonable. The custodian is ordered to conduct a further search for records responsive to the complainant’s request and to provide a written explanation to the complainant regarding the results of the search.

The complainant made an access and correction request to Alexandra Marine and General Hospital (the hospital) under the Personal Health Information Protection Act (the Act). Upon receipt of his records of personal health information, the complainant requested corrections of the information in them. He also believed that further records exist that are responsive to his access request, raising the issue of reasonable search. In this decision, the adjudicator finds that the exception to the duty to correct at section 55(9)(b) (good faith professional opinion or observation) applies. The hospital’s decision to not make the requested corrections is upheld. With respect to the hospital’s search for responsive records, the adjudicator upholds the hospital’s search with one exception and orders the hospital to conduct a further search for a particular mental health assessment and issue a new decision letter to the complainant with respect to the results of the search.

The office of the Information and Privacy Commissioner/Ontario (IPC or this office) received a complaint under the Personal Health Information and Protection Act (the Act) against a pharmacy. The complaint related to the unauthorized collection of personal health information. Specifically, pharmacy staff attempted to collect the complainant’s health card number in order to fill her prescription. This was the second incident of this nature reported to this office.
This Decision finds that the pharmacy did not collect the complainant’s health card number, and therefore, did not contravene the Act. However, the Decision also finds that the pharmacy staff lacked education and training around the collection of health cards under the Act and failed to properly communicate the pharmacy’s policy to this complainant that the production of her health card was voluntary.
In response to this complaint, the pharmacy has taken a number of steps including training its staff and revising its information practices around health cards and health card numbers. In light of the actions taken by the pharmacy, I have decided no formal review of this matter will be conducted under Part VI of PHIPA.

The complainant’s information was contained in records of a children’s aid society (the CAS) relating to reports that a child suffered harm while in his care as a babysitter. The complainant sought access to all of his personal information in the CAS’s files. The CAS provided the complainant with a severed copy of records containing his personal information. The complainant then filed a complaint with the Information and Privacy Commissioner of Ontario (IPC), asking the IPC to review the CAS’s decision to withhold information in the records from him.
Exercising her discretion under sections 317(3) and 317(4) of the Child, Youth and Family Services Act, 2017 (the Act), the adjudicator determines that there are no reasonable grounds to conduct a review of the subject-matter of the complaint and that a review is not warranted. She bases her determination on her finding that the complainant has no right of access to the records under section 312(1) of the Act because the records do not relate to “the provision of a service” to him as required for the application of that section. As a result, the adjudicator declines to conduct a review and she dismisses the complaint.

The Office of the Information and Privacy Commissioner of Ontario received a complaint under the Personal Health Information Protection Act, 2004 (the Act) about an alleged unauthorized use of patients’ personal health information by three doctors of a public hospital. This decision finds that the use of the personal health information by two of the three doctors to be in accordance with the Act. According to the audit information provided by the hospital, the third doctor did not access the patients’ personal health information.