PHIPA DECISION 176

This decision and related PHIPA Decision 177 address a complainant’s allegations that a number of individuals at two hospitals made unauthorized accesses to records of his son’s personal health information after his son’s death. The records at issue in both decisions are contained in a shared electronic medical records system (EMR) accessible to both hospitals.
This decision addresses the allegations concerning accesses to EMR records in the custody or control of Windsor Regional Hospital – Ouellete Campus (WRH), as well as accesses by WRH agents to records in the custody or control of the other hospital, Hôtel-Dieu Grace Healthcare. In this decision, the adjudicator declines to consider the complaint against a WRH doctor in respect of two accesses in the EMR, because that matter has been appropriately dealt with in previous proceedings before the College of Physicians and Surgeons of Ontario. She finds that the remaining accesses were made in accordance with the Personal Health Information Protection Act, 2004 (PHIPA), generally in relation to quality of care purposes permitted under PHIPA. She also finds that WRH generally complied with its obligations under PHIPA to take reasonable steps to protect personal health information in its custody or control, and to respond adequately to the complaint. As a result, she concludes the review without issuing an order. However, the adjudicator makes some comments and one recommendation to clarify WRH’s obligations under PHIPA and to help improve its privacy practices in future.