ORDER PO-3644

Appeal PA13-311

Ministry of Health and Long-Term Care

August 31, 2016

Summary: The appellant sought access to two records prepared by the Canadian Institute of Health Information (CIHI) and submitted to the Ministry of Health and Long-Term Care (the ministry). The ministry denied access to the responsive records relying on the discretionary exemption in section 22(a) (information published or available to the public) of the Freedom of Information and Protection of Privacy Act  and referred the appellant to CIHI to obtain them. The appellant appealed the ministry’s decision, arguing that CIHI’s disclosure of data to only approved requesters resulted in the records not being publicly available, thereby making the section 22(a) exemption inapplicable. Section 22(a) is found not to apply to the records and the ministry is ordered to issue a revised decision to the appellant.

Statutes Considered: Freedom of Information and Protection of Privacy Act , RSO 1990, c F.31 , as amended, section 22(a).

OVERVIEW:

[1]  The Ministry of Health and Long Term Care (the ministry) received a request from the appellant under the Freedom of Information and Protection of Privacy Act  (the Act ) for access to all records pertaining to the Discharge Abstract Database (DAD) and the National Ambulatory Care Reporting System (NACRS) for acute care hospitals in Ontario submitted to it by the Canadian Institute for Health Information (CIHI). The appellant, a media outlet, confirmed in its request that it was not interested in personal information about patients and accordingly, any personal identifiers in the records should be removed. The appellant subsequently clarified its request to include only the de-identified data sets received by the ministry from CIHI pertaining to the DAD and the NACRS for acute care hospitals in Ontario for the most recent reporting year (the records).

[2]  In response to the request, the ministry issued a decision advising the appellant that the requested information was available to the public through CIHI and directing it to CIHI’s web site. The appellant appealed the ministry’s decision to this office (the IPC).

[3]  During mediation, the appellant advised that it had attempted to obtain the records through CIHI but was unable to. In response, the ministry issued a second decision letter to the appellant advising that its position remained the same: that the requested information is publicly available through CIHI’s data request process, which is a public mechanism for accessing the information. Mediation did not resolve the appeal and it was transferred to the adjudication stage of the appeal process for an inquiry under the Act .

[4]  Upon being assigned this appeal for adjudication and noting the conflicting positions of the parties, I sought clarification from them on whether the records sought by the appellant are, in fact, publicly available through CIHI. At the insistence of the ministry that they are, the IPC contacted the appellant to determine if it had attempted to obtain the records from CIHI through CIHI’s data request process. The appellant confirmed that it had not availed itself of CIHI’s process to obtain the records and it agreed to attempt to do so. The appeal was then placed on hold pending the appellant’s attempt to obtain the records through CIHI in the manner suggested by the ministry. A few months later, the appellant advised the IPC that it wished to pursue the appeal. It explained that it did not believe CIHI’s data request process was designed for access by the public because it required the signing of a Third-Party Record Level Data Non-Disclosure/Confidentiality Agreement (the Data Agreement) that prohibited the public dissemination of the records it sought. At the appellant’s request, I reactivated the appeal and commenced my inquiry.

[5]  I invited the ministry to provide representations addressing the Data Agreement and how the provisions of the Data Agreement impact on its position that the records are currently publicly available. The ministry and the appellant both provided representations, including reply and sur-reply representations, which I shared in accordance with section 7 of the IPC’s Code of Procedure and Practice Direction Number 7. I also invited representations from CIHI on specific questions arising from this appeal. I shared CIHI’s response with the ministry and the appellant and received comments from both parties in response.

[6]  For the reasons that follow, I find that the discretionary exemption in section 22(a) does not apply to the records and I order the ministry to issue a revised decision to the appellant.

RECORDS:

[7]  The records at issue are the reports sent by CIHI to the ministry relating to the DAD and the NACRS for acute care in hospitals in Ontario for 2012/2013, which the appellant has agreed to receive in de-identified form.

DISCUSSION:

[8]  The sole determination I must make in this appeal is whether the records qualify for exemption under section 22 (a) of the Act , which states:

A head may refuse to disclose a record where,

the record or the information contained in the record has been published or is currently available to the public[.]

[9]  Section 22(a) is intended to provide institutions, such as the ministry, with the option of referring a requester to a publicly available source of information where the balance of convenience favours this method of alternative access. It is not intended to be used in order to avoid an institution’s obligations under the Act . [1] In order to rely on the section 22(a) exemption, the ministry must take adequate steps to ensure that the records that are alleged to be publicly available are the records that are responsive to the request. [2] The ministry must also establish that the records are available to the public generally, through a regularized system of access, such as a public library or a government publications centre. [3] To show that a “regularized system of access” exists, the ministry must demonstrate that:

• a system exists
• the records are available to everyone, and
• there is a pricing structure that is applied to all who wish to obtain the information. [4]

[10]  Examples of the types of records and circumstances that have been found to qualify as a “regularized system of access” include: unreported court decisions, [5] statutes and regulations, [6] property assessment rolls, [7] septic records, [8] property sale data, [9] police accident reconstruction records [10] and orders to comply with property standards. [11]

The ministry’s representations

[11]  The ministry asserts that CIHI has a data request process in place for the public to use to obtain the records at issue and that CIHI prepares de-identified reports precisely for disclosure to the public. It cites CIHI’s Privacy Policy on the Collection, Use, Disclosure and Retention of Personal Health Information and De-Identified Data, 2010 (Privacy Policy) to explain that since 1994, CIHI has been leading the development and maintenance of comprehensive and integrated health information “to help the public and those running Canada’s health system get a clearer picture of what’s being spent on health care, what kind of care is being delivered, who’s delivering it and the factors influencing the health of Canadians. Governments, hospitals, health authorities, health professional colleges and associations, the media, the public and others have come to depend on CIHI as the essential source of relevant, timely and dependable health information...”.

[12]  The ministry states that CIHI ensures its data holdings are accessible to third parties, including the public, through its data request process, and it lists its data sets on its web site so that third parties can request specific data from one or more databases as necessary. The ministry states that CIHI’s web site clearly notes the availability of the DAD and the NACRS for access and use. It adds that CIHI retrieves data at an aggregate or de-identified record level and applies a pricing structure for those seeking it; by contrast, the ministry does not routinely prepare de-identified versions of the data it receives from CIHI for disclosure to the public. The ministry explains that given this background, it relied on section 22(a) in responding to the appellant’s request precisely because CIHI’s data request process constitutes “a regularized system of access” that CIHI put in place for the public.

[13]  The ministry explains that the Ontario subset of the DAD to which the appellant seeks access consists of demographic, administrative and clinical data for hospital patients’ discharges (inpatient acute, chronic and rehabilitation) and day procedures across Ontario, and the Ontario subset of NACRS contains administrative, clinical, financial and demographic data for patients’ ambulatory care visits across Ontario. The ministry notes that CIHI produced the records based on raw data CIHI receives from hospitals and both data sets contain extensive personal health information about Ontario patients’ use of healthcare services, including diagnoses and treatment outcomes. The ministry states that as a result, when the records are in its custody and control they are subject to the Personal Health Information Protection Act (PHIPA).

[14]  It continues that while the data to be provided to the appellant would be de-identified, the scope of the data in relation to each de-identified individual would nonetheless be highly extensive and the inclusion of so many data fields in the data raises the risk that identifying information may be disclosed inadvertently. The ministry notes that “identifying information” is defined in section 4(2) of PHIPA in part as information “for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.” The ministry submits that CIHI’s data request process is designed specifically to mitigate this risk.

[15]  The ministry states that CIHI requires requesters to complete the Data Agreement prior to disclosing requested information in order to balance the public interest in CIHI’s data holdings against the imperative to protect the privacy of the individuals whose personal health information is described in that data. It adds that the sole purpose of the Data Agreement is to reduce and manage the risk of privacy violations in respect of an individual’s personal health information. The ministry notes that it is not possible to render record level data completely de-identifiable and that some residual risk for re-identification will always exist even after de-identification. The ministry asserts that consequently, there is a risk that the DAD and NACRS data CIHI makes available to the public could be manipulated or combined with data from other sources to indirectly identify an individual, and it is for this reason that CIHI requires requesters to sign the Data Agreement.

[16]  The ministry states that CIHI advised it that the appellant did not submit a written request for the records; instead, the appellant discussed the request with CIHI staff by telephone and declined to follow up once it was advised that it would have to sign the Data Agreement. The ministry understands that the appellant is most concerned about the publishing prohibition contained in the Data Agreement. The ministry notes that CIHI amended its Data Agreement on May 1, 2014, removing the provision that does not permit a data recipient to “publish, report or otherwise disclose health facility identifiable information by name” without first “obtain[ing] express prior written authorization from the health facilities or relevant ministry of health.” The ministry takes the position that the removal of this prohibition would address the appellant’s concerns about signing the Data Agreement, and it provides a copy of the new Data Agreement along with its representations.

[17]  The ministry submits that the information at issue is publicly available even though public access is conditional on the signing of CIHI’s Data Agreement. The ministry further submits that the section 22(a) exemption applies where the information requested is “currently available to the public” and it does not require the information to be available without any restrictions whatsoever. The ministry contends that CIHI’s system is a regularized system of access available to members of the public generally, as required for the exemption to apply. It concludes by asserting that the fact that the appellant, like any other member of the public requesting the data from CIHI, has to sign CIHI’s Data Agreement in order to receive the records does not result in the information not being available to the public; the information is publicly available through a process designed to protect the privacy of individuals.

The appellant’s representations

[18]  The appellant refutes the ministry’s position that the records are publicly available from CIHI. It states that while some information from the records is available on CIHI’s web site, it is only a small fraction of the records that comprises only aggregate data in a few categories. The appellant argues that section 22(a) does not allow the ministry to refuse access where only part of the requested records is publicly available.

[19]  The appellant denies that CIHI’s data request process results in the records being available to the public because of CIHI’s internal approval process for data requests. It notes that under CIHI’s data request process, requesters are required to submit their research request to CIHI which then reviews the request and decides whether the request should be approved. The appellant argues that this approval process prior to disclosure means that the records are not available to the public since access is limited to approved requesters.

[20]  The appellant adds that if the records available through CIHI are identical to what should be produced by the ministry, it concedes that the ministry may rely on section 22(a). Nonetheless, the appellant argues that the ministry should not exercise its discretion to rely on section 22(a) in this appeal. Finally, the appellant expresses concern about the cost of obtaining the records through CIHI since CIHI charges an hourly rate to fulfill data requests.

The ministry’s reply representations

[21]  The ministry states that the issue in this appeal is whether the appellant’s request for information is best met by CIHI directly or by the ministry processing the information provided to it by CIHI. The ministry reiterates that the appellant’s request seeks the “reports sent by CIHI to the ministry.” It notes that CIHI has the technology needed to de-identify the information in accordance with the appellant’s request and could prepare the records for disclosure more quickly than the ministry could. It states it has no routine process in place for facilitating the disclosure of voluminous, extremely detailed data in de-identified form to the public, and that it would have to develop a novel, manual de-identification process to properly de-identify the records in accordance with its legal obligations under PHIPA so that no identifying personal health information is disclosed inadvertently. Accordingly, it submits that any cost estimate that CIHI may provide is likely to be less than the fee the ministry would charge based on the fee schedule under the Act .

The appellant’s sur-reply representations

[22]  The appellant asserts that the issue in this appeal is whether the restrictions placed on the records by CIHI’s Data Agreement make the application of the publicly available exemption improper. The appellant acknowledges that the Data Agreement may be an appropriate best practice for CIHI but contends this is not material to the ministry’s reliance on the section 22(a) exemption because the Act  does not allow for any restrictions to be imposed on the use of responsive records. The appellant argues that by requiring it to obtain the records through CIHI, the ministry is trying to “do through the back-door what it is not permitted to do on its own, namely control the use of the records after disclosure” even though the ministry is precluded from imposing any such restrictions under the Act .

[23]  The appellant characterizes the strict limits imposed by CIHI’s Data Agreement on the use and disclosure of the information as a “gag order” that prevents it from communicating what it discovers from the records. It argues that this “gag order” imposed as a pre-condition of release of the records by CIHI results in the records not being truly available to the public, and on this basis, the appellant urges me to reject the ministry’s argument that the balance of convenience relieves the ministry from its obligation to provide access under the Act . The appellant further argues that the only way to allow for proper airing of the issues is to obtain the records from the ministry. The appellant asserts that the ministry should not be relieved from dealing with the records because of the difficulties inherent in redacting them. In this regard, it refers to provisions in the Act  that address situations involving a large volume of records, including the ability to seek an extension of time to process the request.

Information from CIHI

[24]  CIHI states that it is an independent, not-for-profit, pan-Canadian organization with a mandate to deliver comparable and actionable information to accelerate improvements in health care, health systems performance and population health across the continuum. It explains that it has entered into agreements with the ministry that govern its collection, use and disclosure of the personal health information it receives as a prescribed entity under PHIPA from Ontario hospitals as permitted under section 45(5) of PHIPA. It continues that its collection, use and disclosure of personal health information and de-identified data is governed by its Privacy Policy and particularly section 37 which states:

37. CIHI discloses health information and analyses on Canada’s health system and the health of Canadians in a manner consistent with its mandate and core functions.

These disclosures typically fall into one of four categories:

(a) Disclosures to parties with responsibility for the planning and management of the health care system to enable them to fulfill those functions;

(b) Disclosures to parties with a decision-making role regarding health care system policy to facilitate their work;

(c) Disclosures to parties with responsibility for population health research and/or analysis; and

(d) Disclosures to third-party data requesters to facilitate health or health services research and/or analysis.

[25]  CIHI states that any party interested in obtaining the de-identified records requested by the appellant would be required to sign its Data Agreement. It advises that it has a rigorous multi-step review and authorization process for all requests for record level data to ensure the use and purpose for which the data are requested are consistent with CIHI’s mandate and to ensure that the requester falls into one of the four categories listed in section 37 of its Privacy Policy. CIHI states that if the request is authorized, the second part of the process is to obtain a signed copy of the Data Agreement which binds the recipient to the terms and conditions of use, disclosure, retention and destruction, and permits CIHI, upon reasonable notice, to visit the recipient’s premises to conduct an audit to verify the recipient’s compliance with the terms of the Data Agreement. [12]

[26]  CIHI confirms that the requirements set out in the Data Agreement cannot be modified to remove the restrictions found therein. It notes that aggregate data that it makes available for public use is generally available on its external web site, but also may be requested under its data request process in the form of customized data tables and outputs.

[27]  In respect of the de-identified data requested by the appellant, CIHI states that the range of de-identification measures it applies to any file is dependent on: the purpose of the request and the application of the data minimization principle; whether the recipient is known and trusted and has neither the motive nor the intention to attempt to re-identify individuals; any mitigating controls that may be placed on the use and subsequent disclosure of the file through a data sharing agreement; and, finally, follow-up to ensure the data is destroyed at the end of the approved retention period and the right to audit to ensure that the mitigating controls have been properly applied.

[28]  CIHI concludes by advising that it does not have a publicly available record level DAD file and that creating one would be extremely difficult and would require significant expertise, time and expense to produce.

The ministry’s response to the CIHI information

[29]  The ministry submits that the information provided by CIHI supports its position in this appeal. It states that it makes the same distinction between aggregate data and de-identified record or patient level data, and therefore, the only DAD and NACRS data it could disclose to the appellant without breaching PHIPA is the aggregate data that CIHI has described and that is publicly available on CIHI’s web site. The ministry continues that the de-identified record level data requested by the appellant falls within the definition of “identifying information” in PHIPA and constitutes personal health information. It notes that while CIHI can disclose this type of information in accordance with privacy policies that have been approved by the IPC, the ministry would only disclose this type of information under a privacy agreement that restricts the recipient’s ability to use or disclose, manipulate or process, and match, merge or link, and requires the recipient to appropriately destroy or return the information after use to ensure the protection of individual privacy. It reiterates its submission that section 22 (a) of the Act  applies and it asserts that the exemption does not require that the information be available without any controls.

[30]  The ministry concludes by submitting that if I determine that section 22(a) does not apply in this appeal, the responsive record it would have to prepare to satisfy the request would fall outside the definition of “record” on the basis of section 2 of Ontario Regulation 460 of the Act , which states:

A record . . . is not included in the definition of “record” for the purposes of the Act  if the process of producing it would unreasonably interfere with the operations of the institution.

The appellant’s response to the CIHI information

[31]  The appellant submits that the information provided by CIHI supports its position and confirms that: records are only released if a requester falls into one of the four categories listed in CIHI’s Privacy Policy; CIHI may refuse a request for the records altogether; and if CIHI approves release of the records, a requester must enter into a legally binding agreement governing their use once released.

[32]  The appellant argues that the restrictions on the classes of the public to whom the records are available, the approval of the request for specified purposes only, and the constraints on the use of any information CIHI discloses are restrictions that the Act  prohibits the ministry from imposing. For this reason, the appellant repeats its submission that the records are not “available to the public” as the phrase is understood in the Act . The appellant asks me to order the records disclosed on this basis and because the ministry did not rely on any other exemption to withhold the records.

Analysis and finding

[33]  Both parties in this appeal have submitted detailed representations which I have reviewed and considered in their entirety. I have also reviewed the Data Agreement in its entirety and have considered it along with the information provided to me by CIHI. For the reasons that follow, I agree with the appellant that the records are not currently publicly available as required for the application of the section 22(a) exemption.

[34]  To demonstrate that a “regularized system of access” exists for the purposes of section 22(a), the ministry must show that: a system exists; the records are available to everyone; and there is a pricing structure that is applied to all who wish to obtain the information. CIHI’s data request process qualifies as a system that exists, in satisfaction of the first requirement. However, the ministry has not demonstrated that the records are available to everyone under CIHI’s system, and thus, the second requirement is not satisfied in this appeal.

[35]  I interpret the second requirement to mean that any member of the public is able to use the regularized system in question to obtain access to the records. The representations of the parties, the Data Agreement and the information provided by CIHI all establish that not everyone is able to obtain access to the records through CIHI’s data request process. The evidence before me indicates that the records may be available to the appellant and to certain members of the public, provided they enter into a Data Agreement with CIHI and subject to CIHI’s ultimate approval.

[36]  CIHI reviews and considers all data requests on a case-by-case basis and is bound by its Privacy Policy, which sets out its privacy framework and dictates to whom CIHI can make disclosures. In accordance with section 37 of its Privacy Policy, CIHI only discloses data “in a manner consistent with its mandate and core functions” and its “disclosures typically fall into one of four categories” which are set out in paragraphs (a) through (d) of section 37. The four defined categories of disclosures include “third-party data requesters to facilitate health or health services research and/or analysis” at paragraph (d). While the appellant, like any member of the public, is able to submit a request for the records through CIHI’s data request process as a third-party requester under section 37(d), CIHI’s approval of the appellant’s request is not guaranteed. The appellant could be denied access to the records by CIHI if CIHI determines that the appellant does not fall into one of the four categories of typical disclosures, or if CIHI deems the disclosure inconsistent with its mandate and core functions.

[37]  The uncertainty of whether or not a request will be accepted and access will be granted by CIHI under its data request process is inconsistent with the ministry’s position that the records are publicly available. Rather, the appellant’s position is more accurate – that CIHI’s approval process results in the records not being publicly available because access is limited to approved requesters using the information for approved purposes as set out in section 37 of CIHI’s Privacy Policy. The possible, conditional access to the records that exists under CIHI’s data request process falls short of the requirement that the records be available to everyone and leads me to conclude that the records sought by the appellant are not currently available as contemplated by section 22 (a) of the Act . Accordingly, I find that section 22(a) does not apply.

[38]  While I have decided that section 22(a) does not operate to prevent the appellant from seeking access to the records under the Act , I acknowledge the validity of the concerns the ministry raises in its submissions. Specifically, the ministry suggests that in order to provide access to the information it receives from CIHI, it would have to remove a number of fields of data to ensure that the records are properly de-identified. It suggests that the end result will likely be data that is less detailed and extensive than what the appellant could obtain from CIHI under a Data Agreement.

[39]  The ministry’s position is consistent with the IPC’s recent guidance paper on de-identification, “De-identification Guidelines for Structured Data,” which states that the amount of de-identification required in order to minimize the risk of re-identification may vary depending on the circumstances of the release of the data. Public release of data requires the most stringent de-identification measures. Release in response to an access request amounts to a public data release because the Act  does not impose on a requester any conditions regarding the processing, privacy or security of the information. Applying the principles in this paper, the ministry would be required to apply greater de-identification measures in responding to an access request than CIHI would in releasing information governed by a Data Agreement. The fact that the ministry receives de-identified patient level data from CIHI for limited purposes does not mean that it can release the same information publicly without adequate additional de-identification steps.

[40]  Therefore, while I have found against the ministry on the issue before me, the question of what measures the ministry needs to take to sufficiently de-identify the information in the data sets remains to be determined. I note that nothing in this order precludes the ministry from availing itself of CIHI’s technology, processes and expertise in ensuring adequate de-identification in response to the appellant’s access request.

[41]  Finally, the appellant asks that I order the ministry to disclose the records on the basis that the ministry did not claim any other exemptions for them. I decline to do so. The ministry has from the beginning of the inquiry asked that it be given an opportunity to claim exemptions and to rely on the application of PHIPA to the records in the event that section 22 (a) of the Act  does not apply. I did not ask the ministry to provide arguments in the alternative, such as which exemptions or other statutory provisions [13] apply to the records, as I conducted my inquiry on the basis that the ministry would be given the opportunity to issue a further access decision if I found that section 22(a) did not apply.

ORDER:

1. I do not uphold the ministry’s decision under section 22 (a) of the Act .
2. I order the ministry to issue a revised decision to the appellant in respect of the de-identified DAD and NACRS for acute care in hospitals in Ontario for 2012/2013, treating the date of this order as the date of the request.

Original Signed by:		August 31, 2016
Stella Ball
Adjudicator