Dernières décisions

This decision addresses both an individual complaint and an IPC-initiated investigation into a hospital’s practices around its agents’ use of personal health information for education purposes. In the individual complaint, a hospital patient alleged that a doctor had improperly accessed her health records while claiming an education purpose for the accesses. The patient’s allegations raised broader questions about whether the hospital had in place adequate information practices to govern this use of personal health information by its agents. The IPC opened the self-initiated investigation to address those systemic issues.

In this decision, the adjudicator finds there were a number of unauthorized accesses to the patient’s health records. These accesses were made in violation of the hospital’s policy on education use, which permits patients to refuse consent to this use, and the patient’s withdrawal of consent under the policy. The adjudicator finds these accesses were violations of the Personal Health Information Protection Act, 2004 (PHIPA). After considering the circumstances surrounding the accesses, she concludes they were largely the result of systemic deficiencies in the information practices around education use that the hospital had in place at the time. These were failures by the hospital to comply with its obligations under PHIPA, including its duty to take reasonable steps to protect personal health information in its custody or control.

The adjudicator then considers a number of changes the hospital has already made or has committed to making to its information practices in response to the breaches, as well as the hospital’s cooperation throughout the IPC process. In view of all the circumstances, she finds it unnecessary to issue orders against the hospital. However, she provides guidance to the hospital in the form of three key recommendations, as well as some additional recommendations, for further improvements to its information practices in relation to the use of personal health information for education purposes.

The complainant, a patient of a regional cancer centre within a public hospital, filed a complaint against the hospital about a cancer symptoms survey he completed at the cancer centre. He complained that the hospital collected his personal health information through the survey and then disclosed it to Cancer Care Ontario, without a valid consent. He also complained about the hospital’s privacy practices and privacy training in respect of how hospital staff registered him for his appointment and how a hospital volunteer assisted him with the survey, and regarding the placement of the survey kiosks. Finally, the complainant asked that his survey responses be removed from his health records with the hospital.
The hospital responded that it had the complainant’s implied consent to collect and use his personal health information in the survey, in accordance with the requirements of the Personal Health Information Protection Act, 2004. The hospital also responded that the Act permitted the hospital to use the services of Cancer Care Ontario (in its capacity as a health information network provider) to collect the complainant’s personal health information through the survey and use it, and to disclose personal health information to Cancer Care Ontario (in its capacity as a prescribed entity). In addition, the hospital confirmed that it provided additional training to its staff and volunteers, added language to the survey to highlight that it was voluntary, and determined that the privacy screen software it used for the kiosks was adequate. Finally, the hospital acknowledged the complainant’s concerns about the validity of his consent and advised him that while it could not remove his survey responses from his health records, it could take steps to preclude the use of his survey responses going forward.
The adjudicator determines that the hospital has responded adequately to the complaint and there are no reasonable grounds to conduct a review. As a result, she declines to conduct a review and she dismisses the complaint.

The complainant, a patient of a regional cancer centre within a public hospital, alleged that Cancer Care Ontario collected and used his personal health information, obtained through a cancer symptoms survey, without his valid consent and without legal authority. He also expressed concerns about the survey, including that it should have clearly stated that its completion was voluntary. Cancer Care Ontario responded that various sections of the Personal Health Information Protection Act, 2004 and its regulations authorize it to provide the survey to the hospital, collect personal health information from the hospital and store personal health information from the survey in a database. In some of these transactions, Cancer Care Ontario acts in its capacity as a health information network provider, while in others, it acts in its capacity as a prescribed entity. Cancer Care Ontario also took steps to address the complainant’s concerns, including updating the survey to make it clearer that completion of the survey was voluntary.
The adjudicator determines that Cancer Care Ontario has responded adequately to the complaint and there are no reasonable grounds to conduct a review. As a result, she declines to conduct a review and she dismisses the complaint.

The complainant, a teacher named in two reports made by a third party to the Children’s Aid Society of Toronto about a child in need of protection, sought access to “records of service” relating to himself. CAST refused the complainant’s access request on the basis that it did not provide a “service” to him within the meaning of section 312(1) of the Child, Youth and Family Services Act and, therefore, he has no right of access under the Act. The complainant sought a review of CAST’s decision by the IPC.

The adjudicator upholds CAST’s decision that the complainant has no right of access to the records under section 312(1) of the Act because the records do not relate “to the provision of a service” to him. The adjudicator dismisses the complaint.

The complainant submitted a correction request under section 55(1) of the Personal Health Information Protection Act (the Act) to the Appletree Medical Group (Appletree) with respect to information contained in a record relating to a walk-in visit at a clinic run by Appletree. Appletree denied the correction request under section 55(8) of the Act, on the basis that the complainant had not established that the record is incomplete or inaccurate for the purposes for which the Appletree uses the information. In this decision, the adjudicator finds that the complainant has not established that the record is incomplete or inaccurate for the purposes for which Appletree uses the information and she upholds Appletree’s refusal to correct the record. No order is issued.

The complainant alleged that a staff member of the Ontario Provincial Police (the OPP) had inappropriately accessed and disclosed an OPP incident report that contained her personal information. The ministry responsible for the OPP admitted that the complainant’s personal information had been accessed in violation of the Freedom of Information and Protection of Privacy Act (the Act).

In this report, I find that the complainant’s incident report was accessed by an OPP sergeant without authorization on at least two occasions. In the absence of sufficient evidence, I do not find that the incident report was subsequently disclosed to the complainant’s spouse, but I do conclude that the incident report number was disclosed by an unknown OPP employee contrary to the Act. I conclude that the ministry does not have reasonable measures in place to protect personal information in its database, as required by section 4(1) of Regulation 460. I recommend improvements to the privacy policies and procedures, privacy training, and auditing of accesses to personal information. I also recommend that the ministry disclose the disciplinary measures imposed on the sergeant as a result of the inappropriate accesses.

The complainant submitted a request to the hospital for access to video surveillance clips of herself during an involuntary hospitalization ordered under the Mental Health Act. The hospital denied the complainant access to the responsive records. The hospital claims that granting the complainant access to the records could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the complainant or a risk of serious bodily harm to the complainant or another person under section 52(1)(e)(i) of PHIPA.

The adjudicator finds that the records are not “dedicated primarily to” the complainant’s personal health information (PHI). Accordingly, the complainant’s right of access under PHIPA is limited to her PHI that can reasonably be severed from the records. The adjudicator finds that the exemption under section 52(1)(e)(i) of PHIPA does not apply to the records and that the records are comprised wholly of the complainant’s PHI. Accordingly, the adjudicator orders the hospital to grant the complainant access to the records in full.

A public hospital (the hospital) contacted the Office of the Information and Privacy Commissioner of Ontario (IPC) to report a privacy breach under the Personal Health Information Protection Act, 2004 (PHIPA or the Act). Specifically, a hospital employee inappropriately accessed highly sensitive personal health information (phi) of a family member. In light of the steps taken by the hospital to address the breach, no formal review of this matter will be conducted under Part VI of PHIPA.

The complainant submitted a correction request under the Personal Health Information Protection Act to a neurologist to correct two consultation reports the neurologist had prepared. The neurologist refused to make the requested corrections, relying on section 55(8) and/or 55(9) and the complainant filed a complaint with the IPC. The adjudicator finds that the complainant has failed to demonstrate that the information in the records is incomplete or inaccurate for the purposes for which the neurologist uses the information. As a result, the neurologist’s decision not to make the requested corrections is upheld.

The complainant sought access to video footage of events leading up to, and including his restraint and placement in a seclusion room by hospital staff.

In PHIPA Decision 123, the adjudicator ordered the hospital to grant the complainant access to the portions of the video footage containing his personal health information that she determined can reasonably be severed from the exempt portions.

The hospital sought a reconsideration of PHIPA Decision 123. In this reconsideration decision, the adjudicator finds that the claimed grounds for reconsideration in sections 27.01(d) of the Code of Procedure for Matters under the Personal Health Information Protection Act, 2004 and/or section 64(1) of the Personal Health Information Protection Act is established. Accordingly, the hospital’s reconsideration request is granted in part, and as a result the adjudicator varies the order provisions in PHIPA Decision 123.

A joint custodial parent complained about several aspects of the hospital’s decisions in response to his request for access to the health records of his two children, both of whom are under the age of eight. During the adjudication stage of the complaint, the other joint custodial parent for the children (the children’s mother) confirmed to the adjudicator that she does not consent to the father’s access request. As a result, it is not necessary to decide the various issues raised by the father about the hospital’s decisions. As one of two equally ranked substitute decision-makers for the children under the Personal Health Information Protection Act, 2004 (PHIPA), the father does not have an independent right under PHIPA to request access to the children’s health records over the objection of the children’s mother. The adjudicator dismisses the complaint on this basis.

The Office of the Information and Privacy Commissioner of Ontario received a privacy complaint alleging that the Township of Tay (the township) contravened the Municipal Freedom of Information and Protection of Privacy Act (the Act) when it published council meeting minutes with the complainants' personal information online and made a hard copy of those minutes available to the public. The IPC opened a privacy complaint to review the township’s disclosure of the information at issue. During the early stages of the complaint, the township removed the complainants’ names and address from the version of the meeting minutes available online.

This report finds that the some of the information contained in the meeting minutes is personal information. This report also finds that the township’s disclosure of the personal information in the meeting minutes was not in accordance with section 32 of the Act.

The complainant made three access requests to Public Health Ontario (PHO) for information relating to her and her two minor children in respect of laboratory testing for Lyme disease, including the names of staff members who accessed her and her children’s electronic health record. After clarifying the request, PHO issued a decision granting partial access to responsive records, withholding the staff names citing privacy concerns, but not claiming any exemptions under the Personal Health Information Protection Act (PHIPA). During the mediation of the complaint, PHO claimed the application of the discretionary exemption in section 20 (threat to health and safety) of the Freedom of Information and Protection of Privacy Act (FIPPA) through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA. Also during mediation, the complainant raised the issue of search, believing that other records relating to her and her children exist.

During the review of the complaint, PHO further raised the application of sections 18(1)(c) and (d) (economic and other interests) of FIPPA, through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA.

In this decision, the adjudicator finds that PHO is a health information custodian, and the records at issue qualify as the personal health information of the complainant and her children. She further finds that each record is dedicated primarily to the personal health information of the patient that the audit report relates to.

She goes on to find that the information at issue is not exempt from the right of access in section 52(1) under sections 18(1)(c), 18(1)(d) or 20 of FIPPA through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA. Lastly, she upholds PHO’s search for records responsive to the request.

This investigation file was opened after the Ministry of the Solicitor General (the ministry) contacted the Office of the Information and Privacy Commissioner of Ontario (the IPC) to report a privacy breach under the Freedom of Information and Protection of Privacy Act. The breach related to the ministry’s look-up tool web portal for COVID-19 status information (the Portal). Specifically, the ministry advised that an audit of the Portal had determined that a number of police services had conducted broad ranging community searches rather than performing a more specific search of individuals tested for COVID-19.

This report concludes that the ministry did not have adequate measures in place to protect the personal information contained in the Portal. It also finds that the ministry did not respond adequately to the breaches.

Open Doors for Lanark Children and Youth (Open Doors) received a request under the Personal Health Information Protection Act (PHIPA or the Act) for access to the entirety of the requester’s file from family therapy sessions that occurred in the late 1980s and early 1990s. Open Doors conducted two searches for records, and provided the requester with partial records. In particular, Open Doors granted the requester access to her own personal health information in the records, and disclosed to the requester her mother’s personal health information pursuant to the discretionary disclosure provision in section 38(4)(c) of the Act. The requester filed a complaint with the Office of the Information and Privacy Commissioner of Ontario (the IPC) in order to seek the remaining portions of the records. As part of her complaint, the requester maintained that Open Doors had not conducted a reasonable search for records responsive to her request.
In this decision, the adjudicator finds that Open Doors has conducted a reasonable search for records, as required by sections 53 and 54 of the Act. She finds that the records contain the personal health information of the requester, as well as her mother, father, and brother, but that none of the records at issue are “dedicated primarily” to the requester’s own personal health information for the purposes of section 52(3). As a result, the requester’s right of access under the Act is limited to her personal health information that is reasonably severable from the records. Upon review of the records, the adjudicator determines that Open Doors has provided the requester with access to her own reasonably severable personal health information. The adjudicator also finds that Open Doors has disclosed as much of the mother’s personal health information as can be reasonably severed from the personal health information of the requester’s father and brother. Finally, the adjudicator orders Open Doors to consider the consent obtained from the requester’s brother during her review of the complaint, and to exercise its discretion and consider whether to disclose the brother’s personal health information to the requester under section 29(a) of the Act.