ORDER PO-4401

Appeal PA21-00361

Ontario Health

May 31, 2023

Summary: Ontario Health (OH) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA ) for certain data related to patients who died while on waiting lists, during fiscal year 2020-2021. The responsive record has not yet been produced, but OH provided a sample record to the IPC, and took the position that whether the request is considered under the Personal Health Information Protection Act, 2004  (PHIPA ) or FIPPA, the information cannot be released because it is identifying information about other individuals. In this order, the adjudicator finds that PHIPA  does not apply, including because the information is not “personal health information” within the meaning of PHIPA . For similar reasons, she finds that the information is not “personal information” under FIPPA, so it cannot be withheld under the mandatory exemption at section 21(1) (personal privacy). As a result, she orders OH to produce the record and disclose it to the appellant.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 2(1) (definition of “personal information”); Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3 , as amended, sections 4(1) (definition of “personal health information”) and 45, and 52(1).

Orders Considered: Orders PO-2551, PO-2892, PO-3189, PO-3643, PO-4272, MO-2337, MO-4166-I, and PHIPA Decision 82.

OVERVIEW:

[1] Ontario Health (OH) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA ) for certain data related to patients who died while on waiting lists, during fiscal year 2020-2021. OH states that the responsive record will be a table containing thousands of lines of data. The table will not contain names or addresses, as none were requested. This appeal turns on the question of whether it is reasonable to expect that any individual can be identified from the information in the table, whether alone or in combination with other information. In this order, I find that it is not. Therefore, the information in the table does not qualify as “personal information” under FIPPA and cannot be withheld under the mandatory personal privacy exemption at section 21(1) of FIPPA which OH claimed over it.

[2] OH also claimed that the information is personal health information. In this order, I find that the Personal Health Information Protection Act, 2004 (PHIPA) is not relevant in this appeal, including because the information at issue is not “personal health information” under PHIPA.

[3] The relevant part of the request is:

Please provide data on the number of patients that died while on a waiting list for surgery or a procedure in fiscal year 2020-21. Please break the data out by procedure and case info - date the patient was referred to a specialist, decision date, date for the procedure and date of cancellation. . . .

Please provide data on the number of patients that died while on a waiting list for either a diagnostic scan or a consultation with a specialist in fiscal year 2020-21. Please break the data out by procedure and case info - date the patient went on the waiting list, date for the meeting with the specialist or date for diagnostic scan (if scheduled), and date of cancellation[.]

[4] In response, OH denied access to the information under FIPPA due to its view that individuals could be re-identified, and also noted that it cannot use or disclose “personal health information” except in specified circumstances as a “prescribed entity” under PHIPA . As a result, OH stated that it could only provide data at an aggregate level and not at the level requested.

[5] The requester, now the appellant, appealed OH’s decision to the Information and Privacy Commissioner of Ontario (IPC).

[6] The IPC appointed a mediator to explore resolution. During mediation, the scope of the appeal was narrowed, excluding the data breakdown related to specialists. OH maintained its position that it cannot disclose the information. It also introduced the threshold issue that, in any event, the information sought does not qualify as a “record” within the meaning of FIPPA and Regulation 460 under FIPPA, stating that the process of producing a record would unreasonably interfere with OH’s operations.^[1] The appellant raised the public interest in the data he seeks.

[7] Since no further mediation was possible, the appeal moved to the adjudication stage of the appeal process, where an adjudicator may conduct an inquiry.

[8] I began a written inquiry under FIPPA, by sending a Notice of Inquiry to OH, setting out the facts and seeking representations on the issue of whether the information sought is a “record.” I also asked OH for a sample record, if it wished to rely on section 21(1) of FIPPA to withhold information. OH responded with representations about the issues of whether information is a “record,” and access rights under PHIPA and FIPPA. OH also provided a sample record based on “dummy data.” The appellant provided representations in response.^[2]

[9] In light of my consideration of the parties’ representations and a recently issued IPC order (Interim Order MO-4166-I) which also addressed whether health data sought was a “record,” I asked OH for additional representations. In response, OH indicated that the question of whether the information sought was a “record” was no longer at issue, but it maintained its resistance to the release of the requested information under PHIPA and FIPPA. The appellant provided sur-reply representations, and OH provided supplementary representations.

[10] For the reasons that follow, I allow the appeal. OH will be ordered to produce the responsive record from its data, and to release it to the appellant, given my findings that PHIPA  does not apply to the information at issue, and that the information is not “personal information” under FIPPA and the personal privacy exemption in section 21(1) of FIPPA cannot apply.

RECORD:

[11] The record OH would have to create would be a table consisting of 7787 lines of record-level information. OH provided this as a sample table based on “dummy data”:

Sample Table based on “Dummy Data”

Sample Table based on “Dummy Data”

Service Detail 1 (diagnostic scan or procedure)	Decision to Treat Date	Scheduled Procedure Date	Order/Referral Received Date	Procedure No Longer Required Date (Death Date)	Procedure No Longer Required Reason
CT-Head	N/A	2020-04-01	2020-20-01	2020-03-31	Patient death
Knee Replacement	2020-01-01	2021-01-01	2019-09-30	2020-04-01	Patient death

ISSUES:

1. Why doesn’t PHIPA  apply in the circumstances?
2. Does the responsive record contain personal information as that term is defined in section 2(1) of FIPPA, and, if so, to whom does it relate?

DISCUSSION:

Background information and scope of the appeal

[12] Through FIPPA, the appellant seeks certain data from OH related to deaths while on Ontario waiting lists in fiscal year 2020-2021.

[13] OH is both an “institution” that is subject to FIPPA,^[3] and a “prescribed entity” to which health information custodians under PHIPA  may disclose personal health information under section 45 of PHIPA .^[4] It is subject to the respective rules relating to disclosure of “personal information” under FIPPA, and use and disclosure of “personal health information” under PHIPA . OH is not, however, a “health information custodian” under PHIPA .

[14] OH’s access decision in response to the request made under FIPPA cited both FIPPA and PHIPA . OH characterized the request as one for “general records,” stated that “specific dates associated with cancellations are exempted under FIPPA [section] 21(3)(a),” and indicated that there was a small cell count issue in relation to identification.^[5] I understand this to mean that OH was seeking to rely on the exemption at section 21(1) of FIPPA, taking into consideration the presumption at section 21(3)(a).^[6] It also stated that it is a prescribed entity under PHIPA , and summarized some points about its capacity as such.

[15] The parties disagree about the nature of the information in the table that OH would create to respond to the request. The appellant states that he is not seeking any information that would identify a patient, emphasizing that that he seeks accountability and transparency “[w]hile of course respecting the need to safeguard patient confidentiality.” OH’s position is the information is identifying information under both PHIPA and FIPPA, and therefore, cannot be disclosed.

[16] The parties also disagree about what the information itself reveals and what value it has in relation to the appellant’s reason for wanting it.^[7] This order makes no findings to resolve the parties’ dispute about that because the reason for seeking the information at issue, and its potential use, does not need to be considered when determining whether the information at issue is “personal information,” as that term is defined under FIPPA.^[8]

[17] Although OH has obligations to protect “personal health information” under PHIPA , I find that the information in the responsive record is not “personal health information,” so these provisions are not relevant.

Issue A: Why doesn’t PHIPA apply in the circumstances?

[18] For the reasons that follow, I find that PHIPA  does not apply in this appeal.

There is no right of access to the information requested under PHIPA

[19] PHIPA  grants an individual a right of access to records of their own personal health information that are in the custody or under the control of a health information custodian, subject to certain limited exceptions.^[9]

[20] In this appeal, the appellant seeks information from OH about deaths that have occurred, so he is clearly not seeking information about himself.^[10] For its part, OH emphasizes that it is a “prescribed entity,” and not a “health information custodian,” under PHIPA . In addition, for the reasons I set out below, the information sought by the appellant is not personal health information.

[21] In these circumstances, there is no right of access under section 52 of PHIPA .

[22] OH’s position is that the record will contain personal health information, which OH cannot use or disclose as a prescribed entity (apart from certain purposes stipulated under PHIPA  or its regulation). I will consider whether the information in the record to be created is “personal health information,” next.

Is the information requested “personal health information” within the meaning of PHIPA?

The definition of “personal health information” in PHIPA

[23] “Personal health information” is defined in section 4 of PHIPA . Section 4(1) of PHIPA  says, in part:

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual[.]

[24] Section 4(2) of PHIPA  defines “identifying information” as follows:

(2) In this section,

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual. [Emphasis added.]

[25] The key issue here is identifiability.

[26] The appellant does not seek the names of any of the patients who died while on a waiting list. He also does not seek their sex, ethnic background, postal code or address, or information that would identify the doctor or medical facility involved (or would have been involved) in their care before passing away. Rather, he sees his request as one for “anonymous data,” and emphasizes the importance of maintaining patient confidentiality. He also notes that Ontario hospitals (and other provinces) that serve much smaller populations provided similar data breakdowns without any issues.

[27] OH submits that what the appellant seeks is “by definition, not anonymous patient information, given that the patient details that would be disclosed risk the re-identification of such individuals.”^[11]

[28] Under section 4 of PHIPA , cited above, information is “personal health information” only if it is “identifying information.” Information is “identifying” if the information in itself identifies the patient (for instance by using the name), or if it is reasonably foreseeable that the patient could be identified from release of the information. The privacy protections in PHIPA  do not apply to information that cannot be associated with an identifiable patient.^[12]

No identifiability from the information itself

[29] Based on the wording of the request (clearly setting out the categories of information that the appellant is seeking), the appellant’s representations, and OH’s sample record, I do not accept OH’s position that the information (such as the sample data below) will be “identifying information” in itself. It is not apparent to me how it could be.

Sample Data

Sample Data

Service Detail 1 (diagnostic scan or procedure)	Decision to Treat Date	Scheduled Procedure Date	Order/Referral Received Date	Procedure No Longer Required Date (Death Date)	Procedure No Longer Required Reason
Knee Replacement	2020-01-01	2021-01-01	2019-09-30	2020-04-01	Patient death

No identifiability from the information, linked with other available information

[30] I find that OH has not sufficiently established identifiability when the record is linked with other available information, for the reasons set out below.

[31] The crux of OH’s position in this appeal is that, “given the data attributes that would be disclosed as part of this release (including date of death, procedure dates, and details of the service),” there is a risk of re-identification of individuals who were on a waiting list by a third party (such as a family member, neighbour, or business colleague) who is aware of information such as the date of death and, for example, the fact that the individual was to have a procedure (or the date of that procedure). OH notes that its data de-identification guidelines as a prescribed entity under PHIPA  require it to consider “Acquaintance Quasi-Identifiers” (AQIs). AQIs refer to personal identifiers that relate to information that indirectly identifies an individual but is only knowable to those who may be acquainted with an individual contained in a data set. OH submits that the appellant, who publishes “record-level information” to his website, would have these quasi-identifiers available to anyone, such that an individual on the Wait Times Information System may be identified as a result.

[32] In my view, these arguments are speculative at best, and do not sufficiently consider the nature of the information that will be in the table that OH will create (and, just as importantly, what will not be in the table). Nor do these arguments sufficiently address the number of entries in the table, and the limitations of the information itself.

[33] In considering whether unnamed patients can be identified from the information in the record, I am mindful of PHIPA Decision 82, which found that a hospital had relied too heavily on the fact that it had not named a patient to argue that no personal health information was in its public statement about a matter. In those circumstances, there was other publicly available information that showed that a patient was identifiable (and indeed already identified by a journalist linking certain information in the public realm to the hospital’s statements about the unnamed patient).

[34] However, in the appeal before me, there is insufficient evidence about specific publicly available information that could be used, along with the information in the record, to identify any individual in the table that OH will create. OH submits that a third party that has already received information about a group of patients and is seeking further information about their identities or clinical outcomes could use key dates about an individual to cross-reference data sets. It is not clear whether OH is referring to the appellant (who has received aggregate data), but the evidence does not establish that he is seeking their identities (it indicates the opposite). In any event, OH does not specify what data sets he, or any other third party, may cross-reference the information in the responsive record with, so I do not accept this argument as reasonable or persuasive.

[35] I acknowledge that there will be sub-pools of information from the total of 7787 lines of data. For example, individuals who all died on the same day would form a sub-pool of entries. If the identities of the deceased and dates of their deaths are otherwise in the public domain, and if the sub-pool is very small, one might theoretically be able to guess what individual had what condition. However, what would not be publicly known is whether any particular deceased individual was awaiting a particular surgery. In these circumstances I find the risk of re-identification from public knowledge of dates of death to be remote.^[13]

[36] The IPC has also considered similar arguments about identifiability of unnamed individuals as those presented in this appeal.

[37] Former Commissioner Brian Beamish considered the issue of identifiability resulting from combining information in the public realm with the information at issue in Orders MO-2337 and PO-2892. In those orders, the former Commissioner acknowledged that there will be situations where a limited number of people may already be independently aware of individuals referred to in records where the names would be redacted. He determined that this does not affect a decision to disclose such records under the applicable public sector statutes in those orders, since disclosure of the records without the names would not itself result in the identification of the unnamed individuals to the vast number of people who are unaware of the individuals’ identities.

[38] In Order PO-3643, the IPC considered whether the disclosure of statistical information related to suicides in Ontario hospitals and psychiatric facilities could be linked to information known to others in a manner that would identify the individuals reflected in the statistics. In my view, the following statement by the IPC is relevant to considering the arguments before me:

Identifiability must result from the disclosure of the information at issue on its own or in combination with other available information. Identifiability does not result simply because someone who already knows the information, in this case a friend or family member of an individual who committed suicide and who already knows about the individual’s suicide, recognizes a statistic in the form of a year and a facility as representing the deceased individual’s suicide. Obviously, there are people who know about these suicides by virtue of their relationship with or knowledge of a deceased individual, including the staff at the facilities who assisted the deceased individual. However, the prior personal knowledge of a few does not establish identifiability in the general public when the withheld information does not disclose any personal information about the deceased.

[39] Order PO-4272 followed this reasoning, that identifiability must flow from the information itself, not from prior personal knowledge being reflected in the records. In that appeal, the institution argued that it is reasonably foreseeable that people connected to a patient whose treatment is reflected in a report might have information in their knowledge that could be combined with the information in the report in a way that would result in the identification of that particular patient. The IPC held that any information that might be known to individuals as a result of their personal connection to the patient is not information that can be said to exist generally in the public realm, and that it is information that would be known to a very limited number of individuals. As a result, the IPC did not accept that information that is already known as a result of a personal connection to the patient establishes identifiability in the general public when the withheld information itself does not, on its own or in association with other publicly available information, disclose any personal information about the patient.

[40] Here, I am not satisfied that release of the information at issue would enable the identification of any patient, except to those who are already aware of it through a personal connection. I agree with Commissioner Beamish that this does not render the information “identifying information.”

Conclusion

[41] For all these reasons, PHIPA  is not relevant in this appeal. There is no right of access under PHIPA  because the appellant is not seeking “personal health information” (his own or any other individual’s) from a “health information custodian” within the meaning of those terms in PHIPA .

[42] Because the information is not “personal health information”, the provisions of PHIPA and its Regulation pertaining to a prescribed entity’s use and disclosure of personal health information also do not come into play.

Issue B: Does the responsive record contain personal information as that term is defined in section 2(1) of FIPPA, and, if so, to whom does it relate?

[43] OH denied access in reliance on the personal privacy exemption in section 21(1) of FIPPA. For that exemption to apply, the information must be personal information. For the information to be personal information, it must be reasonable to expect that an individual will be identified from its disclosure.^[14] Therefore, for similar reasons to those set out above, and as explained below, I find that the responsive record that OH will create will not contain information about an “identifiable individual,” and as a result, that information is not “personal information.”

What is “personal information”?

[44] Section 2(1) of the Act defines “personal information” as “recorded information about an identifiable individual.”^[15] Information is “about” the individual when it refers to them in their personal capacity, which means that it reveals something of a personal nature about the individual. Information is about an “identifiable individual” if it is reasonable to expect that an individual can be identified from the information either by itself or if combined with other information.^[16]

[45] Section 2(1) of the Act gives a list of examples of personal information, including information relating to medical history [paragraph (b)]. Because I find below that no individuals are identifiable from the information, however, the information is not personal information.

There is no personal information is in the record

Are individuals identifiable?

[46] OH and the appellant disagree about whether individuals are identifiable, and as I explain below, I am not satisfied that OH has provided sufficient evidence in support of its position that the information in the responsive record is information about an “identifiable individual.”

[47] OH’s arguments under FIPPA mirror its position under PHIPA  (and point to its representations about PHIPA  for further details) on why the information is about an “identifiable individual” under FIPPA. OH submits that is reasonably foreseeable in the circumstances that the information “could be utilized alone or with other information to identify the individual (i.e., a patient on the [WTIS]).”

[48] In my view, it is noteworthy that the appellant does not seek the name, date of birth, age, sex, health card number, and/or address of any deceased patient. Nor does the responsive record contain more general geographical information relating to the patient, such as the town or city that they lived in, or the place(s) of their medical care. Rather, as discussed, according to OH, the table will have 7787 lines of “record-level data” consisting of: service detail (that is, the surgery, diagnostic scan, or procedure), four dates relevant to that service detail, and the reason the service is no longer required (“patient death”). I note these points about what information was requested and not requested because they are relevant for similar reasons to those discussed under Issue A, above.

[49] Having assessed OH’s arguments and supporting evidence to consider the question of identifiability from the information itself, or from the information linked with other information, I find OH’s arguments under FIPPA unpersuasive for similar reasons to those explained under Issue A. I find that it is not reasonable to expect any individual to be identifiable from the information itself, or from the information linked with other available information.

[50] Given my finding that no individual is “identifiable” from the table that OH will create in response to the appellant’s request, the information in the table does not qualify as “personal information” under FIPPA. As a result of this finding, OH cannot rely on the mandatory personal privacy exemption at section 21(1) of FIPPA to withhold it, and I will order it released to the appellant.

ORDER:

1. I allow the appeal.
2. I order OH to produce the responsive record within 45 days of this order, and to disclose the record to the appellant within 14 days of doing so.
3. In order to verify compliance with order provision 2, I reserve the right to obtain a copy of the record.

Original Signed by:		May 31, 2023
Marian Sami
Adjudicator