PHIPA DECISION 180

The office of the Information and Privacy Commissioner/Ontario (IPC or this office) received a complaint under the Personal Health Information and Protection Act (the Act) against a pharmacy. The complaint related to the unauthorized collection of personal health information. Specifically, pharmacy staff attempted to collect the complainant’s health card number in order to fill her prescription. This was the second incident of this nature reported to this office.
This Decision finds that the pharmacy did not collect the complainant’s health card number, and therefore, did not contravene the Act. However, the Decision also finds that the pharmacy staff lacked education and training around the collection of health cards under the Act and failed to properly communicate the pharmacy’s policy to this complainant that the production of her health card was voluntary.
In response to this complaint, the pharmacy has taken a number of steps including training its staff and revising its information practices around health cards and health card numbers. In light of the actions taken by the pharmacy, I have decided no formal review of this matter will be conducted under Part VI of PHIPA.