PHIPA DECISION 177

This decision and related PHIPA Decision 176 address a complainant’s allegations that a number of individuals at two hospitals made unauthorized accesses to records of his son’s personal health information after his son’s death. The records at issue in both decisions are contained in a shared electronic medical records system (EMR) accessible to both hospitals.
This decision addresses the allegations concerning accesses to EMR records in the custody or control of Hôtel-Dieu Grace Healthcare (HDGH), as well as accesses by an HDGH agent to a record in the custody or control of the other hospital, Windsor Regional Hospital – Ouellete Campus. In this decision, the adjudicator finds that the accesses at issue were made in accordance with the Personal Health Information Protection Act, 2004 (PHIPA), generally in relation to quality of care purposes permitted under PHIPA. She also finds that HDGH complied with its obligations under PHIPA to take reasonable steps to protect personal health information in its custody or control, and to respond adequately to the complaint. As a result, she concludes the review without issuing an order. However, the adjudicator makes some comments to help improve HDGH’s privacy practices in future.