ORDER PO-4194

Appeal PA17-423

London Health Sciences Centre

October 5, 2021

Summary: At issue in this appeal is whether a record responsive to a multi-part request made to London Health Services Centre (LHSC) under the Freedom of Information and Protection of Privacy Act  (FIPPA ) is subject to solicitor-client privilege and exempt from disclosure. In this order, the adjudicator first considers whether access to the record should be determined under either FIPPA or whether the Personal Health Information Protection Act (PHIPA) applies. She finds that FIPPA applies and the record is exempt from disclosure under section 49 (a) (discretion to refuse a requester’s information), with section 19(a) of that act.

Also at issue in this appeal is the reasonableness of LHSC’s search for records responsive to two parts of the appellant’s request. In this order, the adjudicator finds that LHSC’s search for responsive records was reasonable. She dismisses the appeal.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3 Sched. A , as amended, sections 2 (definitions), 3(1), 4(1), 4(3), 8(1), 8(4), 52, 53, and 54; Freedom of Information and Protection of Privacy Act,  RSO 1990, c F31 , as amended, sections 2(1) (definition of “personal information”), 17, 19, 47(1), and 49(a).

OVERVIEW:

[1] This appeal arises from a conflict between the requester and the London Health Sciences Centre (LHSC). The requester, who was an in-patient at LHSC for almost two years, disputes decisions made by LHSC regarding his care and care planning, including the level of involvement in the care planning process that was afforded to him by LHSC. Another basis for the conflict between the parties arises from the requester’s belief that LHSC interfered with an application he made to an organization that provides funding for self-directed care.

[2] Against this backdrop, the requester submitted a multi-part request to LHSC under both the Freedom of Information and Protection of Privacy Act  (FIPPA ) and the Personal Health Information Protection Act (PHIPA). The portion of the request that is at issue in this appeal is for access to copies of email correspondence to and from three named LHSC employees and emails sent to members of two distribution lists. The portions of the request that are relevant to this appeal are the following:

3. Copies of ‘MH Adult Inpatient B7-100’ LHSC emails pertaining to exchanges [about] patient [the requester]. Specifically, this request relates to all ‘MH Adult Inpatient B7-100’ involvement and exchanges with any individuals regarding [the requester]. Request scope includes: 1. Emails received from all individuals, including [the requester], in which [the requester] was discussed; 2. Emails received from all individuals in which [the requester] was discussed. (February 2, 2016 to July 10, 2017).

4. Copies of ‘MH Adult Inpatient B7-200’ LHSC emails pertaining to exchanges [about] patient [the requester]. Specifically, this request relates to all ‘MH Adult Inpatient B7-200’ involvement and exchanges with any individuals regarding [the requester]. Request scope includes: 1. Emails received from all individuals, including [the requester], in which [the requester] was discussed; 2. Emails received from all individuals in which [the requester] was discussed. (February 2, 2016 to July 10, 2017).

[3] LHSC issued an access decision under FIPPA. The portion of the decision that specifically addressed parts 3 and 4 of the request, which addressed emails to and from the two distribution lists, stated:

LHSC has made a final decision with respect to the requested records. There are 36 pages of records responsive to [parts 3 and 4 of the request].

• We are releasing 34 pages in full

• We have fully redacted page 22 under [solicitor-client privilege]

• We have redacted ½ of pages 28 and 29 due to the inclusion of personal health information of another patient.

[4] In its decision, LHSC also provided an explanation of its response to parts 3 and 4 of the request:

Emails from both the [MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 distribution] lists were combined in one folder by Information Technology Services and provided to the Freedom of Information Office at the time of the request.

A thorough search of the relevant email account was performed by Information Technology Services and further reviewed by the Freedom of Information Office. I have removed as many duplicate copies of records that you have already received/that are in your possession (e.g. any emails which were sent directly to you, or on which you were cc’d) as time allows.

[5] The appellant filed an appeal of LHSC’s decision with respect to parts 3 and 4 of his request, to the Office of the Information and Privacy Commissioner of Ontario (the IPC). A mediator was appointed to explore the possibility of a mediated resolution.

[6] During mediation, the appellant advised that he believes that additional records responsive to parts 3 and 4 of his request exist. He also advised that he continues to seek access to the record which LHSC claims is exempt from disclosure pursuant to the solicitor-client privilege exemption at section 19 of FIPPA. However, the appellant confirmed that the withheld portions which were described by LHSC as the personal health information of another patient, are not at issue and he is not seeking access to that information. Accordingly, the issues on appeal are the reasonableness of LHSC’s search for records responsive to parts 3 and 4 of the request and whether the page that LHSC redacted is exempt from disclosure as a result of solicitor-client privilege.

[7] In discussions with the mediator, the appellant advised that he is of the view that LHSC did not conduct a reasonable search with respect to parts 3 and 4 of his request. He explained that B7-100 and B7-200 relate to floor numbers within LHSC and that these parts of his request are for emails sent or received from these dedicated email accounts used to inform staff on the unit. He explained that he believes emails from accounts for the specific floor numbers should exist as he has received copies of such emails as a result of access requests that he has made to other organizations. He also explained that he has some knowledge of email practices and protocols from formerly working in the information technology field.

[8] The mediator communicated the appellant’s position to LHSC which responded that it had advised the appellant that separate emails accounts for floors B7-100 and B7- 200 do not exist. Later in the mediation stage, LHSC provided a letter to this office, detailing its search for responsive records. In that letter, LHSC also confirmed that there are no email accounts called “B7-100” or “B7-200” and that the email addresses “MHAdultInpatientB7-100@lhsc.on.ca” and MHAdultInpatientB7-200@lhsc.on.ca” are not email accounts. It explained that MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 are distribution lists that enable a user to send message to everyone on that distribution list at once.

[9] Also during mediation, LHSC advised the IPC, in writing, that it had considered processing the request under PHIPA but had decided to process it under FIPPA instead. It cited two reasons for doing so. First, it stated that it did not consider the responsive records to be part of the appellant’s “legal health record”. Second, it stated that the responsive records primarily set out complaints made by the appellant and attempted resolutions of those complaints, which it views as issues that are only tangentially related to the appellant’s care.

[10] As a mediated resolution was not reached, the appeal was moved to the adjudication stage where an adjudicator may conduct an inquiry. As the adjudicator assigned to the appeal, I decided to conduct an inquiry.

[11] As an institution subject to FIPPA, LHSC processed this request under that act. However, LHSC is also a health information custodian subject to PHIPA. Both PHIPA and FIPPA contain provisions relevant to the reasonableness of a custodian or institution’s search for responsive records, and the IPC has considered the issue of reasonable search similarly under both acts. Also at issue is the page that LHSC redacted (the email chain) pursuant to solicitor-client privilege. Accordingly, I have considered whether PHIPA or FIPPA is the appropriate act under which to make that determination. [1]

[12] I initially sought and received representations from LHSC on whether the request should be considered under PHIPA or FIPPA, or both; whether the appellant has a right of access to the record that has been withheld; and, whether LHSC’s search for responsive records was reasonable under either or both of those acts. LHSC provided representations, which I shared with the appellant in accordance with the IPC’s Code of Procedure and Practice Direction 7.

[13] I then sought representations from the appellant. The date that was set for the receipt of the appellant’s representations was May 10, 2019. Subsequently, the appellant’s representative requested a number of consecutive extensions for the submission of representations, providing reasons for this accommodation. I granted those extensions, setting new dates for the submission of representations each time. On October 11, 2019, I agreed to place the appeal on hold for several months. Following that hold, repeated attempts by the IPC to reach the appellant to re-activate the appeal were unsuccessful. On March 5, 2020, I wrote to the appellant’s representative to advise that if I did not receive a response, I would consider the appeal to be “abandoned” and it may be closed. On March 20, 2020, the appellant’s representative requested that I adjourn the appeal sine die. [2] In the circumstances, I declined to do so. However, after considering the circumstances explained by the appellant’s representative, I agreed to grant several additional extensions over the next few months. On November 11, 2020, I received representations from the appellant in response to LHSC’s initial representations.

[14] I shared the appellant’s representations with LHSC and received its reply on December 21, 2020. I then sought sur-reply representations from the appellant, which I received on March 19, 2021. Following consideration of the representations, I concluded my inquiry.

[15] In this order, I find that the request should be considered under both PHIPA and FIPPA. However, I find that the record should be considered only under FIPPA. I uphold LHSC’s decision to deny access to the record on the basis of solicitor-client privilege because I find it is exempt under section 49(a), read with section 19(a) of FIPPA. I also find that LHSC’s search for records responsive to parts 3 and 4 of the appellant’s request was reasonable and in accordance with its obligations under both PHIPA and FIPPA. I dismiss the appeal.

RECORDS:

[16] LHSC identified 35 pages of emails and emails chains as responsive to the request. The majority of them have been disclosed to the appellant. The content of a one page email chain at page 22 (the email chain) remains at issue. LHSC claims it is subject to solicitor-client privilege and exempt from disclosure on that basis.

PRELIMINARY ISSUE:

Does PHIPA or FIPPA, or both, apply in the circumstances of this appeal?

[17] There is no dispute that LHSC is a body that is both a health information custodian within the meaning of section 3(1) of, and subject to PHIPA, and an institution within the meaning of the definition in section 2(1) of, and subject to FIPPA.

[18] PHIPA (Part V) grants an individual a right of access to records of their own personal health information that are in the custody or under the control of a health information custodian, subject to limited exceptions. FIPPA grants an individual a right of access to records of general information (Part II) and to an individual’s own personal information (Part III) in the custody or under the control of an institution, subject to certain exceptions.

[19] In circumstances such as this, where an institution or custodian is subject to both PHIPA and FIPPA, when it receives a request for access to information, it may be required to decide whether PHIPA or FIPPA, or both, apply to the request.

[20] In making this decision, LHSC must consider the nature of the request (i.e., whether the request is for personal health information, for information that is not personal health information, or both); the contents of the records responsive to the request (i.e., whether the responsive records(s) contain personal health information, or information that is not personal health information); and, in the case of a request for personal health information, whether the requester is a person authorized under PHIPA to exercise a right of access to that information. [3]

[21] LHSC submits that the access request before me is covered by both PHIPA and FIPPA. It submits that the request is expansive and captures both records of personal health information belonging to the appellant and general records that do not contain the appellant’s personal health information. Specifically, it explains that because many, if not all of the responsive records involve the care of a patient in hospital (the appellant), they would constitute personal health information under section 4 of PHIPA. However, it submits that the responsive records also include general records which, in some instances, contain other individuals’ personal information, as that term is defined in section 2 of FIPPA.

[22] The appellant does not make any specific submissions on whether PHIPA or FIPPA, or both, might apply to his request.

[23] Given the nature of the appellant’s request, it is my view that some of the responsive records would be subject to PHIPA, some would be subject to FIPPA and some would be subject to both acts. Accordingly, when considering the issue of the reasonableness of LHSC’s search for responsive records, I will consider the issue under both PHIPA and FIPPA. As I will explain, the approach to deciding whether a search is reasonable is the same under either act.

[24] With respect to the appellant’s right of access to the sole record that is before me, a one-page email chain, LHSC claims it is subject to solicitor-client privilege. Both PHIPA and FIPPA contain exemptions from the right of access for solicitor-client privileged information.

[25] In order to determine which statute applies to the record, it is necessary to first determine whether the record contains the appellant’s “personal health information,” as that term is defined in PHIPA. If it does, the appellant’s right of access will initially be determined under PHIPA. If the record does not contain the appellant’s personal health information, then the appellant’s right of access will only be determined under FIPPA.

[26] In situations such as this, where both PHIPA and FIPPA could apply, LHSC must consider the interaction between the two statutes. [4] Sections 8(1) and 8(4) of PHIPA provide guidance in this task. These sections state:

(1) Subject to subsection (2) [containing certain exceptions that are not relevant in this complaint], the Freedom of Information and Protection of Privacy Act  and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information in the custody or under the control of a health information custodian unless this Act specifies otherwise.

(4) This Act does not limit a person’s right of access under section 10  of the Freedom of Information and Protection of Privacy Act  or section 4 of the Municipal Freedom of Information and Protection of Privacy Act to a record of personal health information if all the types of information referred to in subsection 4 (1) are reasonably severed from the record.

[27] Read together, sections 8(1) and 8(4) of PHIPA preserve an individual’s right of access under FIPPA to certain information in records of personal health information, the right of access to which is otherwise governed by PHIPA. [5]

[28] Where a requester seeks access to a record of personal health information under both statutes, this office first considers the extent of any right of access under PHIPA, and then considers the extent of any right of access under FIPPA to the residual portions of the record for which a determination under PHIPA has not been made. [6]

[29] Having regard to the above, I will first briefly consider the appellant’s right of access to the record at issue, under PHIPA.

ISSUES:

1. Access under PHIPA

Does the record contain “personal health information as defined in section 4 of PHIPA?

2. Access under FIPPA

Does the record contain “personal information” as defined in section 2(1) of FIPPA and, if so, to whom does it relate?

Does the solicitor-client privilege exemption in FIPPA at section 49(a), read with section 19(a), apply to the information to which the appellant otherwise has a right of access under section 47(1) of FIPPA?

3. Did LHSC exercise its discretion under section 49(a) of FIPPA?
4. Did LHSC conduct a reasonable search for records under PHIPA and/or FIPPA?

DISCUSSION:

Issue A: Access under PHIPA

Does the record contain “personal health information as defined in section 4 of PHIPA?

[30] Section 52 of PHIPA grants an individual a right of access to a record of their own personal health information that is in the custody or under the control of a health information custodian, subject to limited exceptions and exclusions.

[31] In order to determine whether the appellant has a right of access to the record (or any portion of the record) under PHIPA, it is first necessary to determine whether the patient’s information in the record constitutes their “personal health information” within the meaning of PHIPA.

[32] “Personal health information” is defined in section 4 of PHIPA as follows, in part:

(1) “personal health information” subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual.

[33] Subsection 4(2) defines “identifying information” as “information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.”

[34] Section 4(3) of PHIPA states that personal health information includes “identifying information that is not personal health information … but that is contained in a record that contains personal health information…”

Representations

[35] LHSC submits that the record is a two-email discussion between LHSC staff regarding a complaint made by the appellant to a professional college. LHSC acknowledges that the complaint that is the subject of the email discussion relates to care provided to the appellant and therefore could be viewed as his personal health information under section 4 of PHIPA. LHSC explains that the request was initially processed under FIPPA because it considered the information to be more closely related to the employment of a staff member and personal information as defined in section 2(1) of that act; however, it submits that it recognizes that the record may contain both personal health information and personal information.

[36] In his representations, the appellant does not specifically address whether the record might contain his own personal health information but his representations suggest that he believes that it does. He also questions why an email exchange involving his former Social Worker, assigned by LHSC to be “responsible for” his care and treatment, would be discussing matters that are subject to solicitor-client privilege.

Analysis and findings

[37] In PHIPA Decision 17, this office adopted a broad interpretation of the phrase “personal health information.” This office has applied this broad interpretation in subsequent decisions and orders. [7]

[38] The presence of any personal health information in the record makes it a record of personal health information. With this method, the unit of analysis is the whole record, rather than individual paragraphs, sentences or words contained in the record. Additionally, the phrase “relates to”, found in sections 4(1)(a) and (b) of PHIPA, is to be read in its grammatical and ordinary sense, including information that is connected in some way to the health of the individual to whom the information relates, or to the provision of health care to them. [8] This interpretation best gives effect to one of the purposes of PHIPA, which is to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions.

[39] I have reviewed the record and find that it contains the personal health information of the appellant as that term is defined in PHIPA. In particular, the record contains the appellant’s name along with information that reveals that he was a patient who received treatment at LHSC. Accordingly, I conclude that the record contains personal health information of the appellant as that term is defined in paragraph (b) of the definition in section 4(1) of PHIPA. In addition, I find that the record contains other identifying information about the appellant, which qualifies as his personal health information under section 4(3) of PHIPA.

[40] As a result of this finding, the appellant’s right of access to the record must be considered under PHIPA, initially.

[41] Normally, the next step would be to determine the extent of the appellant’s access rights under PHIPA. This determination involves a consideration of whether the record is dedicated primarily to the appellant’s personal health information within the meaning of section 52(3) of PHIPA, and if not, whether his personal health information is reasonably severable from the record under section 52(3).

[42] A determination of the extent of the appellant’s access rights under PHIPA also involves consideration of whether any of the exemptions from the right of access apply. Once the access rights under PHIPA have been determined, the next step is to determine any residual rights of access under FIPPA to the portions of the record for which a determination under PHIPA has not been made.

[43] Like FIPPA, PHIPA contains exemptions from the right of access for information that is subject to solicitor-client privilege. Specifically, the relevant portions of sections 52(1)(a) and (f) state:

Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(a) the record or the information in the record is subject to a legal privilege that restricts disclosure of the record or the information as the case may be, to the individual;

…

(f) the following condition are met:

(i) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act  or the Municipal Freedom of Information and Protection of Privacy Act or is acting as part of such an institution, and

(ii) the custodian would refuse to grant access to part of the record,

(A) under clause 49 (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act , if the request were made under that Act and that Act applied to the record [.]

[44] Section 52(1)(f) of PHIPA refers to section 49(a) of FIPPA, which exempts personal information of the requester that is subject to section 19 of the FIPPA. As I explain below, the entire record is exempt from disclosure on the basis of solicitor-client privilege. As a result, it is not necessary for me to decide the extent of the appellant access rights under PHIPA in this instance.

Issue B: Access under FIPPA

[45] LHSC relies on the solicitor-client privilege exemption at section 19 of FIPPA to deny access to the record. Section 19 is an exemption under Part II of FIPPA. It applies when a requester seeks access to records of general information. [9] However, if the record contains the requester’s own personal information, access to the record must be considered under Part III of FIPPA. [10] Therefore, if the record at issue contains the requester’s personal information, the appropriate exemption to consider is section 49(a), read with the solicitor-client privilege exemption at section 19, which is the exemption under Part III.

[46] Accordingly, I must first determine whether the record contains personal information and, if so, to whom that personal information relates.

Does the record contain “personal information” as defined in section 2(1) of FIPPA and, if so, to whom does it relate?

[47] In order to determine whether section 19 or section 49(a) is the appropriate exemption under which to consider access to the record at issue, I must first determine whether the record contains the appellant’s “personal information”.

[48] “Personal information” is defined in section 2(1) of FIPPA as follows, in part:

“personal information” means recorded information about an identifiable individual, including:

(a) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(e) the personal opinion or views of the individual except where they relate to another individual,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[49] The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [11]

[50] Section 2(2) also relates to the definition of personal information. It states:

Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

[51] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [12]

[52] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [13]

[53] Above, I found that the record contains the personal health information of the appellant. Such information is also his “personal information” under paragraph (b) of the definition of that term in section 2(1) of FIPPA.

[54] As the record contains the appellant’s personal information, his right of access under FIPPA must be determined under section 47(1) in Part III of FIPPA, which gives requesters a general right of access to their own personal information, subject to limited exemptions. [14] As LHSC relies on the solicitor-client privilege exemption to withhold the record, I must consider whether section 49(a), read with the solicitor-client privilege exemption at section 19, applies.

Does the solicitor-client privilege exemption in FIPPA at section 49(a), read with section 19, apply to the information to which the appellant otherwise has a right of access under section 47(1) of FIPPA?

[55] LHSC withheld the record as solicitor-client privileged information. As explained above, I will consider whether it is subject to solicitor-client privilege and exempt from disclosure under section 49(a), read with section 19.

[56] Section 47(1) gives individuals a general right of access to their own personal information held by an institution. Section 49 provides a number of exemptions from this right. That section states:

A head may refuse to disclose to the individual to whom the information relates personal information,

if section 12, 13, 14, 14.1, 14.2, 15, 16, 17, 18, 19, 20 or 22 would apply to the disclosure of that personal information. [emphasis added]

[57] Section 49(a) of FIPPA recognizes the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information. [15]

[58] Where access is denied under section 49(a), the institution must demonstrate that, in exercising its discretion, it considered whether a record should be released to the requester because the record contains his or her personal information.

[59] In this case, LHSC relies on section 49(a), read with section 19. Section 19 of FIPPA states:

A head may refuse to disclose a record,

(a) that is subject to solicitor-client privilege;

(b) that was prepared by or for Crown counsel for use in giving legal advice or in contemplation of or for use in litigation; or

(c) that was prepared by or for counsel employed or retained by an educational institution or a hospital for use in giving legal advice or in contemplation of or for use in litigation.

[60] Section 19 contains two branches. Branch 1 (“subject to solicitor-client privilege”) is based on the common law. Branch 2 (“prepared by or for counsel employed or retained by …a hospital…”) is a statutory privilege. The institution must establish that one or the other (or both) branches apply.

Branch 1: common law privilege

[61] At common law, solicitor-client privilege encompasses two types of privilege: (i) solicitor-client communication privilege; and (ii) litigation privilege. Here, the LHSC claims that solicitor-client privilege applies. Its representations refer to litigation privilege.

Solicitor-client communication privilege

[62] Solicitor-client communication privilege protects direct communications of a confidential nature between a solicitor and client, or their agents or employees, made for the purpose of obtaining or giving professional legal advice. [16] The rationale for this privilege is to ensure that a client may freely confide in his or her lawyer on a legal matter. [17] The privilege covers not only the document containing the legal advice, or the request for advice, but information passed between the solicitor and client aimed at keeping both informed so that advice can be sought and given. [18]

[63] Confidentiality is an essential component of the privilege. Therefore, the institution must demonstrate that the communication was made in confidence, either expressly or by implication. [19] The privilege does not cover communications between a solicitor and a party on the other side of a transaction. [20]

Litigation privilege

[64] Litigation privilege protects records created for the dominant purpose of litigation. It is based on the need to protect the adversarial process by ensuring that counsel for a party has a “zone of privacy” in which to investigate and prepare a case for trial. [21] Litigation privilege protects a lawyer’s work product and covers material going beyond solicitor-client communications. [22] It does not apply to records created outside of the “zone of privacy” intended to be protected by the litigation privilege, such as communications between opposing counsel. [23] The litigation must be ongoing or reasonably contemplated. [24]

Representations

[65] LHSC claims that the common law solicitor-client privilege set out in section 19(a) applies to the record. Its representations on the application of this exemption, however, focus on the common law principle of litigation privilege. LHSC submits that the record is a two-email discussion regarding a complaint made by the appellant to a professional college that was “prepared for the dominant purpose of litigation” and was “so closely linked to a litigation process” that disclosure would reveal information prepared for litigation.

[66] The appellant’s representations on the application of the solicitor-client privilege exemption are brief but he states that he is not satisfied that the information is exempt. He submits that LHSC has not provided sufficient proof that the emails were prepared for use in litigation. He questions why an exchange between LHSC and his former social worker who was responsible for his care and treatment while he was in the hospital would discuss a privileged topic or be created for the purposes of litigation. He wonders whether the record discusses either of the parties to the email suing a patient.

Analysis and finding

[67] Having considered the content of the record, I find that it is qualifies for exemption as a solicitor-client communication privileged record under section 19(a) of FIPPA.

[68] As noted by LHSC, the emails that make up the record at issue were both copied to its counsel. Although from my review of the record it is clear that legal advice is not being directly sought or provided in the emails, I accept that the information they contain is being passed by LHSC, the client, to its solicitor to ensure that LHSC is being provided with the necessary legal advice with respect to the matter. Specifically, I accept, based on my review of the record, that LHSC copied legal counsel in order to ensure that counsel was kept informed about issues related to the complaint and to ensure that counsel provide LHSC with relevant legal advice where required. In my view, the record forms part of the continuum of communications between a lawyer and their client for the purpose of seeking or obtaining legal advice with respect to a patient complaint regarding one of their staff.

[69] Additionally, I note that the emails are expressly marked as being “confidential” in several locations. From these notations as well as from the content of the record, I accept that the communications were made in confidence.

[70] I also find that there is no evidence that LHSC has waived its privilege with respect to communications with its lawyer in relation to the relevant matter.

[71] I accept therefore, that the record falls under the solicitor-client communication privilege component of the common law solicitor-client privilege set out in section 19(a) of FIPPA.

[72] Because of my finding that the record falls under the solicitor-client communication privilege component of the common law solicitor-client privilege set out in section 19(a) of FIPPA, I find that the exemption at section 49(a), read with section 19(a), applies to the record. As section 49(a) is a discretionary exemption, this finding is subject to my review of LHSC’s exercise of discretion, which I consider below.

Issue C: Did LHSC exercise its discretion under section 49(a) of FIPPA?

[73] Section 49(a) of FIPPA is a discretionary exemption. Where an exemption is discretionary, LHSC has the discretion to grant access to information despite the fact that it could withhold it. LHSC must exercise its discretion. I must determine whether LHSC exercised its discretion under section 49(a) and whether its exercise of discretion was appropriate.

[74] Through orders issued under FIPPA and its municipal equivalent, the IPC has developed a list of considerations that may be relevant to an institution’s exercise of discretion under FIPPA. These include:

• the purposes of the Acts, including the principles that:
• information should be available to the public;
• individuals should have a right of access to their own personal information;
• exemptions from the right of access should be limited and specific;
• the privacy of individuals should be protected.
• the wording of the exemption and the interests it seeks to protect;
• whether the requester is seeking his or her own personal information;
• whether the requester has a sympathetic or compelling need to receive the information;
• whether the requester is an individual or an organization;
• the relationship between the requester and any affected persons;
• whether disclosure will increase public confidence in the operation of the institution;
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person;
• the age of the information;
• the historic practice of the institution with respect to similar information.

[75] Not all these considerations will necessarily be relevant, and additional unlisted considerations may be relevant. [25]

[76] If I determine that LHSC failed to exercise its discretion, or that it erred in exercising its discretion, I may send the matter back to LHSC for a re-exercise of discretion. I may not, however, substitute my own discretion for that of LHSC. [26]

Representations

[77] LHSC acknowledges that it could have disclosed the record because section 49(a) is a discretionary exemption. It submits, however, that it chose to exercise its discretion not to disclose the record on the basis that it is subject to solicitor-client privilege. It also submits that it took into consideration the confidential nature of the information that the record contains and decided to exercise its discretion not to disclose it.

[78] The appellant does not directly address the LHSC’s decision to exercise its discretion not to disclose the record. He submits that the legislation is supposed to provide for access and permit transparency. He submits that every single record “needs to be disclosed” and there is “absolutely no basis whatsoever” for LHSC to refuse to do so. He submits that the legislation does not permit LHSC to hide select records that it does not wish to disclose. He submits that LHSC has a duty to be fully transparent and disclose all requested records to him.

Analysis and finding

[79] I find that in denying access to the record, LHSC properly exercised its discretion under section 49(a) of FIPPA. I am satisfied that LHSC considered the nature of the information in the record and the interests the solicitor-client privilege exemption seeks to protect, which are significant. I note that LHSC also considered the fact that the record contains the personal information of another individual and contemplated the potential impact that providing access would have on that individual.

[80] There is no evidence before me to suggest that LHSC took into account any irrelevant factors, acted in bad faith, or erred in its exercise of discretion. Therefore, I uphold LHSC’s exercise of discretion and its decision to deny access to the record under section 49(a) of FIPPA, read with section 19.

Issue D: Did the LHSC conduct a reasonable search under PHIPA and/or FIPPA?

[81] Where a requester claims that additional records exist beyond those identified by the institution or custodian, the issue to be decided is whether the institution or custodian has conducted a reasonable search for records as required by sections 53 and 54 of PHIPA and section 24 of FIPPA. If I am satisfied that the search carried out by LHSC was reasonable in the circumstances, I will uphold the decision. If I am not satisfied, I may order further searches.

[82] The IPC has extensively canvassed the issue of reasonable search for responsive records in orders issued under the FIPPA and its municipal counterpart, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). It has also addressed the issue of reasonable search under PHIPA. [27] In addition to what is set out in PHIPA Decision 18, the principles outlined in orders of this office addressing reasonable search under FIPPA and its municipal counterpart are instructive to the review of this issue under PHIPA.

[83] The acts do not require the institution or custodian to prove with absolute certainty that further records do not exist. However, it must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [28] To be responsive, a record must be "reasonably related" to the request. [29]

[84] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [30]

[85] The IPC will order a further search if the institution or custodian does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [31]

[86] Although a requester will rarely be in a position to indicate precisely which records the institution or custodian has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [32] A requester’s lack of diligence in pursuing a request by not responding to requests from the institution or custodian for clarification may result in a finding that all steps taken by the institution or custodian to respond to the request were reasonable. [33]

The parties’ representations

LHSC’s representations

[87] LHSC submits that it conducted a “diligent and reasonable search of the emails contained within the MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 email lists” as identified in parts 3 and 4 of the appellant’s request. In support of its position, LHSC provided affidavits from an Information Technology Analyst and a Privacy Consultant, both whom are employed by LHSC.

[88] The Information Technology Analyst submits that she had “direct involvement in the email system search” for records responsive to parts 3 and 4 of the appellant’s request. She submits that she was asked to locate any emails related to the appellant from the MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 email lists. As a result of information provided to her from the request, she submits that she conducted an electronic search query in the hospital email system using Microsoft eDiscovery Tools and the following parameters:

(a) Request Scope: February 2, 2016 to July 10, 2017

(b) Mailbox Search: “MH Adult Inpatient B7-100” and “MH Adult Inpatient B7-200”

(c) Filter Keywords: [appellant’s name]

[89] She submits that she provided LHSC’s Privacy Consultant with the results of her search in an Outlook data file (which she submits is also known as a “PST file” [Personal Storage Table]), containing 1,676 email messages.

[90] The Information Technology Analyst submits that during her search query, she confirmed that the MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 email messages are distribution lists or “Contact Groups.” She submits that a contact group is a grouping of users’ email addresses collected under one name. She further submits that a message sent to a contact group is sent to all recipients that are listed as a member in the group and as a result, the search query using the criteria listed at (a) to (c) specified above, returned results for all email addresses that were members of those contact groups. She submits that the MH Adult Inpatient B7-100 contact group contained 129 members and the MH Adult Inpatient B7-200 contact group contained 99 members.

[91] The Information Technology Analyst submits that in addition to the PST file, she provided the Privacy Consultant with a text document file which, she submits, is automatically generated by the eDiscovery tool and contains details of the Microsoft eDiscovery email search query and the individual email addresses that were searched.

[92] The Privacy Consultant submits that she had direct involvement in the searches in response to the appellant’s request. She advises that she contacted the Information Technology Analyst for assistance conducting a search of the LHSC email system.

[93] The Privacy Consultant submits that at the time of the request, part of which is at issue in this appeal, the appellant had already submitted 22 requests under FIPPA, many of which included email correspondence between staff at LHSC and, in particular, staff with email addresses within the MH Adult Inpatient B7-100 or MH Adult Inpatient B7-200 email lists. As a result, a large volume of emails had already been provided to him.

[94] The Privacy Consultant submits that, upon receipt of the PST file from the Information Technology Analyst, she cross-referenced the 1,676 emails with the emails previously disclosed to the appellant as a result of other requests. She submits that she also removed duplicated emails. She submits that despite the large number of emails, she discovered that “almost all emails had already been produced under other requests or were duplicative emails.” She submits that with previously released and duplicated emails removed, there were 36 pages of responsive records remaining. She submits that she disclosed 34 pages in full, withheld one page, in full, on the basis of litigation privilege and one page, in part, as it contained the personal health information of another patient.

[95] Both the Information Technology Analyst and the Privacy Consultant submit that they have no reason to believe that any records from the MH Adult Inpatient B7-100 or MH Adult Inpatient B7-200 email list which would be responsive to parts 3 and 4 of the appellant’s request have been destroyed or otherwise are no longer in the possession of LHSC. She further submits that she believes that all records within the scope of her search of MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 email list were located and provided to the privacy office.

Appellant’s representations

[96] The appellant submits that he does “not feel that LHSC is forthcoming with clear answers.” He also submits that he believes that LHSC’s representations are “erroneous in many ways.” He submits that the emails requested for distribution lists MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 do exist and were not provided to him. He submits that “LHSC did not conduct a proper search for the records and did not return any correct nor appropriate results.”

[97] In response to LHSC’s representations, the appellant makes a number of submissions which I have summarized under the following three points:

1. Characterization of MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 as distribution lists:
• The appellant submits that it does not matter if these are contact groups, distribution lists or actual email accounts which redirect to other recipients as, no matter the characterization, a record of all email messages sent through these means should exist.
• The appellant submits that the ability to trace and collect all emails sent through these lists can be done by a manager or IT administrator by searching the “command accounts.”
• The appellant submits that LHSC mentioned that the “e- Discovery/Litigation Hold feature” was enabled, which means a “journal rule” has been applied by LHSC within Outlook Exchange to “journal” internal messages and external messages pertaining to the distribution lists.
• The appellant submits that LHSC has the ability to collect and trace histories of all @lhsc.on.ca emails sent via distribution lists or via an account to account transaction directly from their webserver. He submits a tracking script can be run on the server and will trace the who, what and when of emails sent to and received from the distribution lists. He submits that such a tracking script will generate a list of all senders and recipients of all emails that flowed through the distribution lists. He provides an example of a tracking script that LHSC could use to search for the records he seeks.
• The appellant submits that by using the approaches suggested above, specifically, the journal rule, searching the command accounts and use of tracking scripts, the LHSC should be able to retrieve all email messages pertaining to his request and will have MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 within the “To”, “cc” and “bcc” fields confirming they are the appropriate results. He submits that he has received no emails addressed directly to the distribution lists.
2. Search methods and integrity of the results:
• The appellant submits that he has “serious concerns regarding the competency and integrity of LHSC’s searching techniques and collection of results.” He submits that he has confirmation from various sources that the LHSC’s Freedom of Information (FOI) and IT departments are not doing proper or secure searches.
• The appellant submits that the FOI and IT departments are contacting the individuals directly and informing them of the requests, asking them to locate and forward their emails to those departments themselves.
• The appellant submits that some of these individuals are deleting emails relevant to the FOI request so that the full results of the searches are incomplete. He submits that this has been highlighted in past LHSC communications which makes it clear that some emails were deleted by individuals targeted by the request. He provides the following examples:

• o Footnotes stating: “This request only contains emails that were still in [named individual’s] email account at the time of your request” and,

• o An email from the Privacy Consultant admitting that some emails pertaining to the individual’s accounts were deleted by that individual beforehand: “…if the email wasn’t in the package I provided to you, the email no longer exists.”

• The appellant reiterates that none of the emails in the results were addressed to the distribution lists themselves (MH Adult Inpatient B7-100 and “MH Adult Inpatient B7-200) and submits that this “proves that the wrong results were provided entirely and whatever emails were provided that their integrity vastly compromised and tampered.”
• The appellant reiterates that in order to provide “the correct and uncompromised results [LHSC] needs to collect email document messages from journal rules and command accounts and not the individuals in question themselves.” He also again questions whether a tracking script was ever run on the server pertaining to his request and also whether there is a command email account containing the full untampered archiving pertaining to Distribution lists MH Adult Inpatient B7- 100 and MH Adult Inpatient B7-200.

LHSC’s reply representations

[98] In reply, LHSC responds to the appellant’s comments and questions. First, addressing the appellant’s assertion that none of the emails in the results being addressed to the distribution lists proves that the wrong results were provided, LHSC submits that this is the result of the manner in which it conducted its search. It reiterates that it used the Microsoft eDiscovery tool and sets out the electronic search query it applied. It reiterates that MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200 are not mailboxes or email accounts that collect an archive of emails but are distribution lists or contact groups which were explained in the affidavit of the Information Technology Analyst. It reiterates that the search query retuned 1,676 emails but submits:

[T]hese emails did not contain the contact group name because each “contact group” is strictly a method or instructions for routing an email and not an email address per se. Whenever an email is addressed to a contact group, Microsoft Outlook sends the same email to each member of the contact group. Therefore, each email returned from the search query mentioned above, shows the recipient’s email address and not the contact group/distribution list name. For example, an email addressed to MH Adult Inpatient B7-100 results in that email being sent to each of the 129 members of that contact group, and each email displays only the email address belonging to each individual recipient.

[99] Addressing the appellant’s question as to whether “a script” was even run on the server pertaining to distribution lists MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200, LHSC responds that “a script was run on the server/email program using the Microsoft eDiscovery tool.” It submits that the details of that search query or script are outlined above. It reiterates that “[t]his script or search query generated a PST file” which was previously explained in the Information Technology’s Analyst’s affidavit.

[100] LHSC also addressed the appellant’s question as to whether “there [is] a command email account containing the full untampered archiving pertaining to distribution lists MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200. LHSC explains that the Microsoft eDiscovery tool automatically generates a text document file called a Personal Storage Table [PST file] that lists every single email that matched the email search query. It submits that the PST file contain 1,676 email messages, which were viewable in Microsoft Outlook and these records could also be printed, saved or exported as required by staff in LHSC’s FOI office.

[101] Finally, LHSC addressed the appellant’s concern that “the collection was not done independently through proper methods such as the journal rules and command accounts to collect the email documents from a secure database….” LHSC submits that it conducted an exhaustive search of its email system using a certified Microsoft tool, which is the method by which the FOI office at LHSC responds to requests involving records in the corporate email system.

The appellant’s sur-reply representations

[102] In sur-reply, the appellant reiterates that “no competent search was conducted.” He makes a number of additional submissions, specifically:

• he questions the choice of key word search terms applied by the Information Technology Analyst and lists a number of other terms that he believes should have been applied,
• he questions why no “discovery messages” were sent to the administrators of the contact groups or to the contact group addresses themselves for all members to search for information,
• he requests that he be provided with the exact script run and the PST file that the script generated,
• he submits that LHSC did not respond to his question of whether there is a command email account containing the “full untampered archiving pertaining to distribution lists MH Adult Inpatient B7-100 and MH Adult Inpatient B7-200, and,
• he submits that the certified Microsoft tool used by the LHSC “does not return effective investigation results if there is no Journaling of online exchanges and no access to the command account that created the contact groups.”

Analysis and finding

[103] Having carefully reviewed the evidence that is before me, I am satisfied that the search conducted by LHSC for records responsive to parts 3 and 4 of the request, specifically records from MH Adult Patient B7-100 and MH Adult Patient B7-200, was reasonable and is in compliance with its obligations under both PHIPA and FIPPA.

[104] As stated above, under FIPPA and MFIPPA, as well as under PHIPA, a reasonable search is one in which an experienced employee, knowledgeable in the subject matter of the request, expends a reasonable effort to locate records reasonably related to the request. [34] I accept that the individuals involved in the search for records responsive to the appellant’s request were experienced employees who were knowledgeable in LHSC’s record holdings and email system. I also accept that they expended a reasonable effort to locate the records reasonably related to the request.

[105] As also stated above, LHSC is not required to prove with absolute certainty that additional records do not exist. However, it must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. In my view, LHSC has provided such evidence. Moreover, I do not accept that the appellant has provided a reasonable basis for concluding that further responsive records that have not been identified by LHSC’s searches exist.

[106] I acknowledge that the appellant rejects the manner in which LHSC conducted its search and suggests several alternative means that he believes would have been more effective and would have generated more responsive records than those generated by the search methodology applied by LHSC. Even if I were to accept that the other means of searching for responsive records suggested by the appellant were viable alternatives for conducting a search within the system LHSC uses, I do not accept that the existence of these alternative means establishes that the search conducted by LHSC in this case is not reasonable. LHSC submits that it used Microsoft’s own eDiscovery tool to search for responsive records in its email system which I accept to be a reasonable search tool. In sum, I am satisfied that LHSC’s search methodology, selected tool and search query were reasonable means by which to conduct a search in for responsive records in its email system.

[107] I also acknowledge that the appellant questions why none of the responsive records provided to him have the distribution lists MH Adult B7-100 and MH Adult B7-200 as addresses in the “to”, “cc” or bcc” lines of the email. However, for two reasons, I am satisfied that this is not an indication that not all records responsive to parts 3 and 4 of the appellant’s request have been located. First, I accept that MH Adult B7-100 and MH Adult B7-200 are distribution lists and not email addresses and that the fact that the specific list names do not appear is a function of the way in which LHSC structured its search. Specifically, as submitted by LHSC, its search generated a PST for each of the distribution lists identifying the individuals to whom the emails were sent by their individual email addresses rather than by distribution list. Second, I note that LHSC submits that it not only removed duplicate emails from the responsive records but that it also only disclosed emails that it had not previously disclosed to him in response to any of his previous requests for records.

[108] Having considered the appellant’s evidence, I find that it falls short of demonstrating a reasonable basis to conclude that additional records responsive to parts 3 and 4 of his request exist, but which LHSC has not located.

[109] In contrast, I am satisfied that the evidence provided by LHSC is sufficient to demonstrate that it made a reasonable effort to identify and locate the requested records. In reaching this conclusion, I reiterate that neither FIPPA nor PHIPA require that LHSC prove with absolute certainty that additional responsive records do not exist, only that it establish that a reasonable search has been conducted, as I find has been conducted here.

[110] For the reasons set out above, I find that LHSC has conducted a reasonable search for records responsive to part 3 and 4 of the appellant’s request and that it has fulfilled its obligations under both FIPPA and PHIPA.

ORDER:

1. I uphold LHSC’s decision to deny access to the record at issue (the email chain).
2. I uphold LHSC’s search for records responsive to parts 3 and 4 of the request as reasonable.
3. I dismiss the appeal.

Original signed by:		October 5, 2021
Catherine Corban
Adjudicator