PHIPA DECISION 144

This decision finds that The Ottawa Hospital failed to take reasonable steps to implement the complainant’s lock-box request from October 2016 to June 2019 and, as a result, certain hospital caregivers used the complainant’s personal health information without consent or other authority. Other allegations of unauthorized use are dismissed. With the introduction of a new electronic medical records system in June 2019, the hospital remedied the deficiencies in its procedures for implementation of consent directives. The adjudicator makes one recommendation, to improve the directions given to users of the hospital’s electronic medical records. The adjudicator dismisses allegations that unauthorized uses were deliberate and malicious violations of the complainant’s privacy, concluding that they resulted from systemic failures in the hospital’s practices.