The complainant, a patient of a regional cancer centre within a public hospital, filed a complaint against the hospital about a cancer symptoms survey he completed at the cancer centre. He complained that the hospital collected his personal health information through the survey and then disclosed it to Cancer Care Ontario, without a valid consent. He also complained about the hospital’s privacy practices and privacy training in respect of how hospital staff registered him for his appointment and how a hospital volunteer assisted him with the survey, and regarding the placement of the survey kiosks. Finally, the complainant asked that his survey responses be removed from his health records with the hospital.
The hospital responded that it had the complainant’s implied consent to collect and use his personal health information in the survey, in accordance with the requirements of the Personal Health Information Protection Act, 2004. The hospital also responded that the Act permitted the hospital to use the services of Cancer Care Ontario (in its capacity as a health information network provider) to collect the complainant’s personal health information through the survey and use it, and to disclose personal health information to Cancer Care Ontario (in its capacity as a prescribed entity). In addition, the hospital confirmed that it provided additional training to its staff and volunteers, added language to the survey to highlight that it was voluntary, and determined that the privacy screen software it used for the kiosks was adequate. Finally, the hospital acknowledged the complainant’s concerns about the validity of his consent and advised him that while it could not remove his survey responses from his health records, it could take steps to preclude the use of his survey responses going forward.
The adjudicator determines that the hospital has responded adequately to the complaint and there are no reasonable grounds to conduct a review. As a result, she declines to conduct a review and she dismisses the complaint.
PHIPA DECISION 167
Collection
Health Information and Privacy
Date
File Numbers
HC18-62
Adjudicators
Stella Ball
Decision Type
Decision - PHIPA
Applicable Legislation
PHIPA - 2
PHIPA - 3(1)4i
PHIPA - 10(1)
PHIPA - 10(3)
PHIPA - 10(4)
PHIPA - 12(1)
PHIPA - 20(2)
PHIPA - 29(a)
PHIPA - 37(1)(a)
PHIPA - 45(1)
PHIPA - 45(3)
PHIPA - 45(5)
PHIPA - 57(2)(c)
PHIPA - 57(3)
PHIPA - 57(4)
PHIPA - Regulation 329/04 s. 6(2)
PHIPA - Regulation 329/04 s. 6(4)
PHIPA - Regulation 329/04 s. 18(1)