PHIPA DECISION 232

Complaint HA21-00093

The Hospital for Sick Children

December 8, 2023

Summary: The complainant is the parent of a child whose sudden death was investigated by the Ontario Provincial Police (OPP). Under the Personal Health Information Protection Act, 2004  (PHIPA ), the complainant made a request to a named physician (Dr. X) with privileges at the respondent hospital for access to a report and related records arising from the OPP’s request for an expert opinion to assist in the OPP’s death investigation. The hospital responded to the request on behalf of Dr. X, based on its initial position that responsive records would be hospital records. Later, during the IPC’s review, it became clear that the records sought by the complainant arose from the OPP’s retainer of Dr. A (a different physician with privileges at the hospital), and not Dr. X, for an expert opinion to assist the OPP in their investigation.

Through its various searches, the hospital located responsive records in its email system. These include Dr. A’s expert opinion report for the OPP, records the OPP provided to Dr. A for the purpose of the expert opinion, and other communications between Dr. A and the OPP relating to the retainer agreement executed between them for the expert opinion. The records also include an email between Dr. A and Dr. X, with whom Dr. A consulted about the expert opinion. Ultimately, the hospital denied access to all responsive records on various grounds in PHIPA and in the Freedom of Information and Protection of Privacy Act  (FIPPA ). The complainant took issue with the hospital’s decisions, and complained to the IPC.

In this decision, the adjudicator finds that the complainant has no right of access to the records under PHIPA  or under FIPPA. She finds that the responsive records are OPP records relating to the investigation into the death of the complainant’s child, and are not subject to the access provisions in PHIPA  because they are not records of personal health information in the custody or under the control of the hospital, or of Drs. A or X, acting in the capacity of a health information custodian for the purposes of PHIPA . The adjudicator also finds that the records are not in the custody or under the control of the hospital for the purpose of the access provisions in FIPPA. In the result, the adjudicator upholds the hospital’s denial of access to the records under PHIPA and FIPPA, and dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004,  SO 2004, c 3, Sch A  (as amended), sections 2 (definitions), 3, 4, and 52(1); Freedom of Information and Protection of Privacy Act , RSO 1990, c F.31, sections 2  (definitions), 10(1), 47(1), and 25(2).

Decisions and Orders Considered: PHIPA Decisions 17, 35, 62, and 110; CYFSA Decision 4; Orders PO-4287, MO-4283, and PO-4368.

OVERVIEW:

[1] The complainant and her spouse are the parents of a child whose sudden death was the subject of investigation by a municipal police service and, later, by the Ontario Provincial Police (OPP). Since their child’s death, the complainant and her spouse have made a number of access requests to various institutions under the Freedom of Information and Protection of Privacy Act  (FIPPA ) and its municipal counterpart[1] in an attempt to obtain information about the circumstances of their child’s death, and the corresponding investigation by the municipal police and the OPP.[2] These include requests made to the Ministry of the Solicitor General (the ministry), of which the OPP is a part, for information relating to the OPP’s investigation into the death of their child.

[2] The complainant says that in accordance with a suggestion she received after requesting records from the ministry, she wrote directly to a doctor (Dr. X), a physician with privileges at the Hospital for Sick Children (the hospital), to request certain information relating to the OPP’s investigation. Specifically, the complainant requested from Dr. X a copy of the report completed by the pediatrician who was consulted on the death investigation. The complainant later made clear that she seeks all records held by Dr. X relating to the death investigation, including any relevant records supporting the findings made by the consulting pediatrician in the expert opinion report.

[3] The hospital responded to the request made to Dr. X, based on its initial position that responsive records of Dr. X would be in the hospital’s custody or control. The hospital denied access to the records based on various grounds in FIPPA and in the Personal Health Information Protection Act ,  2004  (PHIPA ).

[4] The complainant was dissatisfied with the hospital’s denial of her request, and filed a complaint with the Office of the Information and Privacy Commissioner of Ontario (IPC). During the IPC’s review of the matter, it became clear that the records the complainant seeks arose from the OPP’s retainer of Dr. A, a different physician with privileges at the hospital, for an expert opinion to assist the OPP in the death investigation. The complainant submitted evidence in support of an assertion that the records arose in the context of a hospital program to address cases of suspected child maltreatment (and that the records are thus in the hospital’s custody or control). As I describe in more detail below, during the course of the review the hospital modified, then modified again, its positions under PHIPA and FIPPA in respect of the records.

[5] In this decision, I find that the complainant does not have a right of access to the records under PHIPA  or FIPPA. I find that the responsive records, being OPP records relating to a death investigation, are not records of personal health information in the custody or under the control of the hospital, or of Drs. A or X, acting in the capacity of a health information custodian for the purposes of PHIPA . As a result, the records cannot be the subject of an access request made under PHIPA  to the hospital, or to Drs. A or X in their own right. I also find that the records are not in the custody or under the control of the hospital for the purposes of FIPPA, and are therefore not subject to the right of access in that statute. In the result, I uphold the hospital’s denial of the complainant’s requests under PHIPA and FIPPA.

BACKGROUND:

[6] The complaint arises from the complainant’s request to Dr. X for “the report completed by you, a pediatrician,” based on the complainant’s understanding that the OPP’s investigation into the death of her child had included consultation with a pediatrician who ultimately produced an expert opinion report to assist in the OPP’s investigation.

[7] The hospital responded to the request sent to Dr. X, based on its initial position that the records sought by the complainant would be in the custody or under the control of the hospital. The hospital conducted a search in response to the complainant’s request, but reported locating no patient records for the complainant’s child (because the child was never a hospital patient). As a result, the hospital took the position that PHIPA  does not apply in the circumstances. As I explain further below, the access provisions in PHIPA  apply to records of personal health information in the custody or under the control of the hospital as a health information custodian, within the meaning of those terms in PHIPA .

[8] The hospital advised the complainant that her request is instead governed by FIPPA, which applies to the hospital in its capacity as an institution under that statute. FIPPA grants a requester a right of access to certain records (that are not records of personal health information) in the hospital’s custody or control. The hospital stated, however, that the report the complainant seeks is not a hospital report, but rather an OPP report. The hospital recommended that the complainant make an access request directly to the OPP for a copy of the report.

[9] The complainant was not satisfied with the hospital’s response. She noted that she had made her request to Dr. X, and not to the hospital that had responded on Dr. X’s behalf, because “[Dr. X has] care and control of the above information we are seeking.” In making this claim, the complainant is asserting that Dr. X (and not the hospital) is the health information custodian in respect of the records she seeks.

[10] The complainant also reiterated that her request is for access to all records relating to Dr. X’s investigation concerning the complainant’s child, and she set out a non-exhaustive list of information that she considers to be responsive to her request. In addition to the report itself, this includes any clinical notes, summaries, case studies and other references supporting the findings in the report, and records relating to consultations with other medical professionals with regard to the investigation.

[11] The hospital responded with a second decision. It reiterated its position that records responsive to the complainant’s request are not patient records, and thus not subject to PHIPA . The hospital suggested that the complainant file a FIPPA request directly to the ministry for the records she seeks. However, the hospital said the complainant could also file a FIPPA request to the hospital, and it provided her with instructions on how to do that.

The access requests and hospital decisions at issue in the present complaint

[12] Further to the hospital’s instruction, the complainant filed a FIPPA request to the hospital. This request (later described by the hospital as FIPPA request #1) was accompanied by a $5 FIPPA request fee, and read, in part, as follows:

[Dr. X] has in her possession [the complainant’s child’s] medical information and has completed a medical report. We are seeking the Expert Opinion Report (Report), which was requested by [a neuropathologist], as well as other records originating from or provided relating to the Report created by [Dr. X]. This Report and the related records were created and prepared as a part of [the complainant’s child’s] ongoing medical death investigation ... As [the child’s] parents, we are exercising our right of access under Ontario laws to receive all medical information related to the report as well as a copy of the report [...] Your organization has already confirmed the above records exist and are in the Hospital’s possession [...]

[13] In response, the hospital issued a decision stating that it had conducted a search and located responsive records. The hospital described the records as an expert opinion report that was requested by, and prepared for, the OPP; and other related records that originated from, or were provided to, the OPP.

[14] The hospital stated that the report and the related records were “created and prepared to allow the OPP to discharge their investigative and law enforcement functions.” Based on its view that the OPP had a greater interest than the hospital in the records, the hospital transferred the request to the OPP under section 25(2) of FIPPA.[3]

[15] In response to the hospital’s decision, the complainant submitted another request to the hospital (later described by the hospital as FIPPA request #2). In this request, the complainant clarified the following:

• While the hospital says it has transferred certain records to the OPP, the complainant seeks “all additional information in [Dr. X’s] possession, which was gathered to create the above report(s).” The complainant described this additional information as including Dr. X’s clinical notes, summaries, and the other types of records set out above.
• The complainant’s son was not a patient of the hospital. As a result, Dr. X “may have these records in her own care and control.”

[16] In response, the hospital reiterated its position that the OPP has a greater interest than the hospital in records responsive to FIPPA request #1.

[17] In addition, the hospital stated that it interprets the complainant’s FIPPA request #2 as a “new request” for “all records of [Dr. X], including emails, notes, peer reviews and summaries, relating to the expert report prepared on [the complainant’s child’s] case.”

[18] The hospital asked the complainant to confirm its understanding of the complainant’s “new request,” and to submit a new $5 FIPPA application fee in order to proceed with a search further to that request.

Opening of the present complaint with the IPC

[19] The complainant was dissatisfied with the hospital’s responses, and submitted a PHIPA  complaint to the IPC.

[20] During the mediation stage of the IPC process, the hospital provided information in support of its decisions on the complainant’s FIPPA requests #1 and #2.

[21] The hospital explained that it had responded to the complainant’s requests concerning Dr. X’s records because Dr. X is a staff physician of the hospital, and it is the hospital, not Dr. X, who has custody of hospital records in the hands of a hospital agent.[4]

[22] The hospital clarified that it had located 14 records responsive to FIPPA request #1. The hospital’s decision to transfer the complainant’s FIPPA request #1 to the ministry (on the OPP’s behalf), pursuant to section 25(2) of FIPPA, was made after extensive consultation with the OPP and the ministry.[5]

[23] With regard to FIPPA request #2, the hospital stated that it was “willing to have a search conducted of the records of [Dr. X] as they relate to [the complainant’s child] and the Expert Opinion Report,” if the complainant wished to continue with the request and pay the FIPPA fee.

[24] The complainant remained dissatisfied with the hospital’s explanations. As these issues could not be resolved through mediation, the file was transferred to the adjudication stage of the PHIPA  process, and assigned to me as the adjudicator.

Adjudication stage of the complaint process

[25] At the adjudication stage of the IPC process, I formed the preliminary view that the complainant’s FIPPA request #2 is within the scope of the complainant’s earlier requests (including FIPPA request #1) for records, including any records of Dr. X, relating to the expert opinion report concerning the death of her child. Because the hospital had not conducted a search for records responsive to FIPPA request #2, I asked the hospital to do so, without requiring payment of any additional fee under FIPPA.

[26] The hospital conducted this search, and identified one record responsive to FIPPA request #2. This record is an email between Dr. X and another physician with privileges at the hospital, Dr. A. The hospital later explained that this email is one of the 14 records the hospital had already identified as being responsive to FIPPA request #1.

[27] Through the review, it became clear that the OPP had retained Dr. A as an independent expert in relation to the OPP’s investigation into the death of the complainant’s child. Neither the hospital nor Dr. X is a party to the retainer agreement between the OPP and Dr. A.

[28] During the review, I gave both parties an opportunity to consider and to respond to relevant arguments and evidence put before me in the complaint. I also shared with the parties some preliminary views based on the information before me. Among other things, I explained to the parties the bases for my preliminary views that the records are not subject to the right of access in PHIPA .[6] I also noted that if the records are not in the hospital’s custody or control for the purposes of FIPPA, or if they are subject to an exclusion in FIPPA, there is no right of access to them under that statute. I invited the parties to comment on my preliminary views.

[29] During the review, the hospital provided representations in which it amended its initial position in some respects, then resiled from its amended position. The hospital issued revised decisions reflecting its changing positions. The complainant provided representations in which she asserts that the records at issue are in fact in the hospital’s custody or control because they relate to a hospital program to address cases of suspected child abuse and maltreatment. I asked the hospital to address the complainant’s evidence, including by providing information about the role and function of this program, and the duties of hospital physicians (such as Dr. A) within the program. The hospital provided representations addressing these matters. Throughout the review, I shared the parties’ representations with one another in accordance with the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004.

[30] In this decision, I find that the records at issue are not records of personal health information in the custody or under the control of a health information custodian for the purposes of PHIPA . As a result, the right of access in PHIPA  does not apply. I also find that the records are not in the custody or under the control of the hospital for the purposes of FIPPA, and thus not subject to the right of access in FIPPA. I therefore uphold the hospital’s denial of access to the records, and dismiss the complaint.

RECORDS:

[31] At issue are 14 records located by the hospital in response to the complainant’s requests for an expert opinion report relating to the OPP’s investigation into the death of the complainant’s child, and other records (including any records of Dr. X) relating to that report. The records identified by the hospital include the expert opinion report; documents originating from, or provided to, the OPP in connection with the expert opinion report; and an email between Drs. A and X relating to the expert opinion.

[32] While the complainant initially described the report as the “expert report prepared by Dr. X,” it is now clear that the report was prepared by another individual, Dr. A, pursuant to a retainer agreement between Dr. A and the OPP. Neither the hospital nor Dr. X is a party to the agreement. As will be seen below, however, my findings would be the same had the report been authored by Dr. X.

ISSUES:

1. Does PHIPA apply in the circumstances?

Are the records at issue records of “personal health information” “in the custody or under the control” of a “health information custodian” within the meaning of PHIPA ?

2. Does FIPPA apply in the circumstances?

Are the records at issue “in the custody” or “under the control” of the hospital within the meaning of FIPPA?

DISCUSSION:

[33] A key issue to be decided is whether PHIPA , or FIPPA, or both, apply in the circumstances of the complaint. In situations where both PHIPA and FIPPA could apply, the IPC’s approach is to first consider the extent of any right of access under PHIPA , and then consider the extent of any right of access under FIPPA to any records or portions of records for which a determination under PHIPA  has not been made.[7] Deciding which statute (if any) applies will depend on considerations including, among others, the nature of the request, the context in which the records at issue arise, and the contents of those records.[8]

A. Does PHIPA apply in the circumstances?

Are the records at issue records of “personal health information” “in the custody or under the control” of a “health information custodian” within the meaning of PHIPA ?

[34] PHIPA  grants an individual a right of access only in respect of records of personal health information about the individual that are in the custody or under the control of a health information custodian (section 52).[9] In this complaint, it is thus necessary to consider whether Dr. X and/or Dr. A and/or the hospital is a “health information custodian” with “custody” or “control” of records of “personal health information,” within the meaning of those terms in PHIPA .

[35] The complainant has taken the position throughout this complaint that Dr. X is the health information custodian with respect to the records she seeks. I have assumed that the complainant also takes the position that Dr. A (the physician who actually prepared the expert opinion report) is a health information custodian with respect to the records.

[36] The hospital maintains that it has appropriately responded to the complainant’s requests under FIPPA. This position is premised on its view that the hospital is not governed by PHIPA  (i.e., is not a health information custodian) in respect of the records at issue in this complaint. The hospital’s representations at the review stage also indicate that it views neither Dr. X nor Dr. A as a health information custodian governed by PHIPA  with respect to the records.

[37] In the discussion that follows, I conclude that PHIPA  does not apply in the circumstances of this complaint. This is because I find that the records the complainant seeks are not records of personal health information in the custody or under the control of a health information custodian for the purposes of PHIPA .

Neither Dr. A nor Dr. X is a health information custodian in respect of the records at issue

[38] I will first consider the complainant’s main claim that Dr. A and/or Dr. X is a health information custodian with respect to the records at issue in the complaint. This is the basis for the complainant’s assertion that she is entitled under PHIPA  to all records in the “care and control” of Dr. X (which I read to include Dr. A).[10]

[39] “Health information custodian” is defined in section 3(1)  of PHIPA . Paragraph 1 of section 3(1) states:

In [PHIPA ], “health information custodian”, subject to subsections (3) to (11),[11] means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any […]

A health care practitioner or a person who operates a group practice of health care practitioners.

[40] Section 2  of PHIPA  defines “health care practitioner” to include “a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care,” and “any other person whose primary function is to provide health care for payment.”[12]

[41] Based on the information before me, I find it reasonable to assume that Dr. A and Dr. X are members of the relevant regulatory college, and/or that their primary function is “to provide health care for payment.”

[42] However, under either definition, to qualify as a health information custodian with respect to the particular records at issue in this complaint, I must be satisfied that Dr. A or Dr. X was providing “health care” within the meaning of PHIPA . That term is defined in section 2  of PHIPA  as follows:

“health care” means any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

(c) is carried out or provided as part of palliative care, and includes,

(d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and

(e) Repealed: 2020, c. 13, Sched. 3, s. 8 (1).

(f) a home and community care service that is funded under section 21 of the Connecting Care Act, 2019[.]

[43] As is clear from the definition, to qualify as “health care” for the purposes of PHIPA , the activity in question (i.e., the observation, examination, assessment, care, service or procedure) must be done for a “health-related purpose.”

[44] Both the hospital and the complainant have confirmed that the complainant’s child was never a patient of Dr. A and/or Dr. X (or of the hospital). It is clear that Dr. A (and, incidentally, Dr. X) became involved with the child’s case only at the stage of the OPP’s investigation into the child’s death, and specifically for the purpose of Dr. A’s preparation of an expert opinion report to assist the OPP in their investigation, pursuant to a private expert retainer agreement between Dr. A and the OPP. In an affidavit submitted for this review, Dr. A explains that all the records at issue were either created by her (i.e., the expert opinion report), or were given to her by the OPP for the purposes of preparing her expert opinion report.

[45] Further below, I observe that I am not persuaded that all the records at issue in this complaint would qualify as records of “personal health information” within the meaning of PHIPA . Even if they were, I find that neither Dr. A nor Dr. X is a “health information custodian” in respect of those records. This is because I am not satisfied that Dr. A or Dr. X has, or had, custody or control of the records as a result of or in connection with the performance of activities for a “health-related” purpose within the meaning of PHIPA . Instead, their activities were undertaken for other purposes—namely, the law enforcement purpose of assisting in the OPP’s death investigation. In these circumstances, neither Dr. A nor Dr. X can be characterized as providing “health care” within the meaning of PHIPA .

[46] This conclusion is consistent with the IPC’s interpretation of the term “health care” in PHIPA , in the context of analogous activities that are not undertaken to maintain or to ameliorate the health of an individual. For example, the IPC has found that the following activities do not qualify as “health care” within the meaning of PHIPA , because they are not done for a “health-related purpose”:

• the preparation of a custody and access assessment report for family law proceedings (PHIPA Decision 15);
• counselling to manage parenting issues (PHIPA Decision 126, upheld on reconsideration in PHIPA Decision 146);
• services to coordinate individuals’ access to third-party programs (PHIPA Decision 134); and
• an independent medical assessment of an employee conducted for the purpose of accommodating return-to-work needs (PHIPA Decision 154).

[47] I further note that in PHIPA Decision 35, the IPC found that the definition of “health care” in PHIPA  does not include actions taken after an individual’s death, because it would not be reasonable to treat such actions as being done for the “health-related purpose” of providing a deceased individual with “health care.” Similar logic applies here. It would not be reasonable to characterize Dr. A’s or Dr. X’s involvement in the OPP’s death investigation as having a health-related purpose in relation to the deceased child (or to any other person).

[48] In these circumstances, I conclude that neither Dr. A nor Dr. X is a health information custodian in respect of the records at issue. As a result, neither Dr. A nor Dr. X is a person to whom the complainant may make an access request under PHIPA  for the records she seeks.

The hospital is not a health information custodian with custody or control of the records at issue

[49] I also find, for the reasons below, that the hospital itself is not a health information custodian in respect of the records at issue in this complaint. As I also discuss below, it follows that neither Dr. A nor Dr. X can be an “agent” of the hospital within the meaning of PHIPA .[13]

[50] Hospitals are generally subject to PHIPA  in respect of “personal health information” in their “custody or control.” Paragraph 4.i of section 3(1) of PHIPA  states:

In [PHIPA ], “health information custodian”, subject to subsections (3) to (11),[14] means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any […]

A person who operates one of the following facilities, programs or services:

A hospital within the meaning of the Public Hospitals Act, a private hospital within the meaning of the Private Hospitals Act, a psychiatric facility within the meaning of the Mental Health Act or an integrated community health services centre within the meaning of the Integrated Community Health Services Centres Act, 2023.

[51] As noted above, the right of access in PHIPA  is set out in section 52  of PHIPA . Section 52(1) states, in part:

Subject to this Part [Part V of PHIPA , which governs rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless […]

[52] If the hospital is a health information custodian in respect of the child’s personal health information, there is no dispute that the complainant would be authorized to seek access to this information under PHIPA , on her child’s behalf.[15]

[53] The records at issue in this complaint include Dr. A’s expert opinion report about the circumstances of the child’s death, and an email exchanged between Drs. A and X about Dr. A’s expert opinion. In an affidavit submitted for this review, Dr. A notes that the responsive records also include coroner’s records and records of interviews conducted by the police during the death investigation, which records the OPP provided to Dr. A for the purpose of informing her expert opinion.

[54] The term “personal health information” is defined in section 4  of PHIPA  to include identifying information about an individual relating to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual [paragraph (b) of the definition at section 4(1)]. It also includes information relating to the individual’s physical or mental health, or to the health history of the individual’s family (paragraph (a) of the definition); information relating to the donation, or testing or examination, of any body part or bodily substance of the individual [paragraph (e)]; and the individual’s health number [paragraph (f)]. In addition, if a record contains any of the types of information about an individual listed in section 4(1), then any other identifying information of the individual contained in the record also qualifies as the individual’s personal health information [section 4(3)].

[55] In this case, for the same reasons given above, information in the records about the activities of Dr. A or of the coroner (or of Dr. X, or the hospital) in relation to the deceased child does not qualify as information about the “providing of health care” to the child, or to the identification of any one of them as a “provider of health care” to the child, within the meaning of paragraph (b) of section 4(1) of PHIPA . None of Dr. A’s or the coroner’s (or Dr. X’s, or the hospital’s) activities in relation to the child after the child’s death qualifies as “health care” within the meaning of PHIPA .

[56] Neither party claims that information concerning activities conducted after the child’s death qualifies as the child’s personal health information. They do not address whether the records contain other information that would qualify as personal health information of the child.

[57] In the circumstances, I am not persuaded that all the records at issue in the complaint are, in fact, records of “personal health information” of the complainant’s child within the meaning of PHIPA . However, I conclude in any event that the records the complainant seeks (including any that would qualify as records of personal health information) are not in the custody or under the control of the hospital for the purposes of PHIPA . My reasons follow.

The records at issue are not in the “custody” or “under the control” of the hospital for the purposes of PHIPA

[58] “Custody” and “control” are not defined terms in PHIPA . However, the IPC has frequently interpreted and applied sections of PHIPA  that contain these terms. These include the definition of “health information custodian” [section 3(1)]; the duty of health information custodians to take reasonable steps to protect personal health information (section 12); the right of access to an individual’s personal health information (section 52); and the obligation of health information custodians to conduct a reasonable search for records in response to an access request (sections 53 and 54). In addition, in PHIPA Decisions 62 and 110, the IPC made specific findings about custody or control of personal health information, based on indicators such as a party’s ownership of and responsibility for the information, to identify the health information custodian in those matters.

[59] In making these determinations, the IPC implicitly followed the approach established in its extensive jurisprudence under FIPPA and its municipal counterpart MFIPPA addressing the question of custody or control within the meaning of those other statutes. Furthermore, in CYFSA Decision 4, the IPC explicitly applied the principles derived under FIPPA and MFIPPA to address the issue of custody or control under the Child and Family Services Act, 2017 (CYFSA). In that decision, the IPC noted that all these statutes overseen by the IPC (FIPPA, MFIPPA, CYFSA, and PHIPA ) contain similar language limiting the right of access under the relevant statute to records and information in the “custody” or under the “control” of the body to which the request is made.

[60] I find the relevant provisions governing access to records and information in those other statutes (FIPPA, MFIPPA, and CYFSA) and in PHIPA  to be broadly analogous,[16] and the principles outlined in IPC orders and decisions issued under those other statutes to be instructive in making determinations about custody or control for the purposes of PHIPA . I apply those principles here in deciding whether the hospital in this complaint has custody or control of the records for the purposes of PHIPA .

[61] The courts and the IPC have applied a broad and liberal approach to the question of custody or control in the context of FIPPA and MFIPPA.[17] Based on this approach, the IPC has developed a non-exhaustive list of factors to consider in determining whether or not a record is in the custody or control of an institution under FIPPA or MFIPPA, or a service provider under CYFSA.[18] Drawing from this list, I find the following factors to be relevant in this complaint:

• Was the record created by the hospital (or an agent of the hospital)?
• What use did the creator intend to make of the record?
• Does the hospital have a statutory power or duty to carry out the activity that resulted in the creation of the record?
• Is the activity in question a “core,” “central,” or “basic” function of the hospital?
• Does the content of the record relate to the hospital’s mandate and functions?
• Does the hospital have physical possession of the record, because its creator provided it voluntarily or pursuant to a statutory or employment requirement?
• If the hospital does have possession of the record, is it more than “bare possession”? In other words, does the hospital have the right to deal with the record in some way and does it have some responsibility for its care and protection?
• Does the hospital have a right to possession of the record?
• Does the hospital have the authority to regulate the record’s content, use and disposal?
• To what extent has the hospital relied on the record?
• How closely is the record integrated with other records held by the hospital?
• What is the usual practice of the hospital in relation to possession or control of records of this nature?

[62] In determining whether records are in the “custody” or under the “control” of the hospital, I must consider relevant factors contextually in light of the purpose of the legislation.[19]

[63] As noted above, although the hospital initially addressed the request made to Dr. X based on its position that records held by Dr. X are in its custody or control, the hospital later took the position that it does not have, and never had, custody or control of the records.

[64] The hospital’s amended position was based on its clarification that the records at issue arose solely in the context of a private agreement between Dr. A and the OPP, in which the hospital has no interest, for the purpose of the OPP’s retainer of Dr. A as an independent expert in relation to a legal proceeding. Neither the hospital nor Drs. A or X claimed to be a health information custodian in respect of the records. However, the hospital acknowledged that it had located the records in its record-holdings during its searches in response to the complainant’s access requests. During the review, both the hospital and Dr. A provided evidence about their relationship to the records, and the context in which the records arose.

[65] Both the hospital and Dr. A take the position that Dr. A’s duties under the agreement were performed independently of her duties as a physician with privileges at the hospital. The hospital explained that it located the records at issue during its searches only because Dr. A had used the hospital’s email system to communicate with the OPP in connection with their agreement. With respect to the one responsive email record between Dr. A and Dr. X, the hospital explained that the record documents a discussion between the physicians about Dr. A’s expert opinion arising from her private agreement with the OPP. I understand the hospital to be saying that the record does not relate to either Dr. A’s or Dr. X’s duties as physicians with privileges at the hospital.

[66] When I invited the complainant to address the hospital’s new position, she informed me of Dr. A’s role in a hospital program called the Suspected Child Abuse and Neglect (SCAN) Program, which provides certain services in cases of suspected child maltreatment. The hospital’s website describes the SCAN Program as providing a link between the hospital and community doctors and hospitals, Children's Aid Societies, law enforcement, and other community agencies. The program’s services include the assessment and management of cases involving hospital patients or children referred to the program by the community. The program is located within the hospital, and program members include hospital staff, such as clinicians.[20]

[67] In addition to this publicly available information, I considered the complainant’s detailed representations about the role and function of the SCAN Program, and the work performed by hospital staff (including hospital physicians) who are part of the program. Among other evidence, the complainant provided extracts from independent reports about the program in support of her assertion that the program is a central part of the hospital’s operations. The complainant also provided evidence that SCAN Program members routinely share and peer-review preliminary opinion reports created by its members, and that the hospital’s legal department comments on these reports before they are released. Based on all this, it is the complainant’s assertion that the hospital has legal and other interests in the opinion reports prepared by hospital staff in the context of its SCAN Program, and that the hospital thus has custody or control of these opinion reports (and related records) for the purposes of access-to-information requests made to the hospital.

[68] I asked the hospital to address the complainant’s evidence. I asked, in particular, that the hospital clarify the relationship, if any, between the specific records at issue in this complaint and the hospital’s SCAN Program. In response, the hospital issued another revised decision and, later, additional representations. In these responses, the hospital amended, and then amended again, its position on custody or control of the records.

[69] Despite the hospital’s changing positions throughout the review, I understand the hospital to have consistently taken the position that it is not authorized to release the records at issue in the context of an access-to-information request. I also note that after clarifying the context in which the records arose, the hospital has consistently characterized the records as OPP records, created by Dr. A or provided to Dr. A by the OPP, without the involvement of the hospital, exclusively for the purposes of the OPP’s investigation into the death of the complainant’s child.

[70] With its final set of representations, the hospital provided an affidavit from Dr. A that contains information relevant to deciding the issue of custody or control. Based on this evidence, and despite the hospital’s changing positions on the matter, I conclude for the reasons that follow that the records at issue are not in the hospital’s custody or control for the purposes of PHIPA .

[71] I begin by acknowledging Dr. A’s evidence about the aspects of the SCAN Program that are within the mandate of the hospital, and that result in the creation of records that are integrated with other hospital records for the purposes of clinical care. Dr. A explains that through “direct” clinical work (meaning the direct assessment of a child through physical examination, medical tests, and other means) or “indirect” clinical work (through the assessment of available information without any direct assessment of a child), SCAN Program physicians provide care, support, and assessment to children who may have been maltreated.

[72] The products of this direct or indirect clinical work by SCAN Program physicians include consultation records and opinions about the possibility of child maltreatment. In either case, these clinical work products are considered clinical records for the assessed child, and are stored in the hospital’s electronic medical records system under a standard hospital medical record number for the assessed child.

[73] Dr. A contrasts the above types of clinical work with a different type of work that she performs in response to specific requests from the following referral sources: the police; the coroner’s office; and defence lawyers. She refers to this type of work generally as “police work.” In doing police work, Dr. A says, she does not see the child directly but instead considers relevant documents and materials provided by the source in order to form an opinion about the possible causes of a child’s injuries, including whether they could have been inflicted intentionally or accidentally.

[74] Dr. A states that she views police work of this nature to be distinct from her clinical work for the hospital, including her clinical work within the SCAN Program. While her police work requires an exercise of her specific expertise, it is done for the purposes of informing a police or coroner’s investigation, for example, and not for hospital purposes. The purpose of a consultation in the context of police work is not clinical, and she does not generate any clinical recommendations. In addition, in these specific cases, the assessed child is not considered a hospital patient, and no medical record number is generated for the child.

[75] Consistent with the different nature of this work, Dr. A explains that she treats records arising from her police work as wholly separate from the hospital’s clinical records (such as those arising from the clinical work she performs under the auspices of the SCAN Program). After she completes an opinion report in the context of her police work, Dr. A provides it to the third party who requested the opinion. Dr. A understands that in cases where criminal charges are ultimately laid, she may be called to testify as a witness in criminal proceedings, where she is asked to share and explain her opinion to the court.

[76] Dr. A confirms that the records at issue in this complaint arose in the context of the specific type of police (non-clinical) work described immediately above, and not in the course of her clinical work for the SCAN Program. The OPP asked Dr. A to prepare an expert opinion to assist them in their investigation into the death of the complainant’s child, which was considered suspicious and potentially criminal in nature. For this purpose, the OPP provided her with numerous records, including those noted above from the coroner and interviews conducted by the police as part of their investigation.

[77] With respect to the responsive email between Drs. A and X, Dr. A states that this record arose from her request to Dr. X for Dr. X’s peer review of Dr. A’s expert opinion report prepared for the OPP’s death investigation, to ensure the report’s quality and accuracy. Dr. A states that Dr. X’s peer review of the expert opinion report in this context is not akin to the types of peer reviews regularly conducted by SCAN Program physicians of their colleagues’ clinical assessments. Dr. A thus denies any claim that the involvement of Dr. X in this matter would convert the email record into a hospital record about hospital matters.

[78] With respect to all the records at issue in this review, Dr. A confirms that in accordance with her usual practice for records relating to her police work, she did not log any information about the complainant’s child’s case in the hospital’s medical records system, did not create a patient file for the complainant’s child, and did not otherwise use the hospital’s medical records system as she would in the case of her clinical work for the SCAN Program. Dr. A states that she stored the records at issue (i.e., those she received from and sent to the OPP in relation to her expert opinion on the child’s case) on her hospital computer, in folders specifically created for the purpose of her work on the child’s case. These records were not integrated into the hospital’s medical records system, and would not be accessible by other hospital staff. Finally, she confirms her understanding that the records at issue are under the care and control of the OPP who asked her to assist in their investigation, and not of the hospital.

[79] In the hospital’s own affidavit, prepared by the then-associate general counsel and director of privacy and risk management, the hospital confirms Dr. A’s understanding and explanation of the distinction between SCAN Program physicians’ clinical work, and their independent non-clinical or police work, for law enforcement purposes, which is separate from their work as physicians with privileges at the hospital. The hospital also confirms its understanding of the different recordkeeping practices maintained by SCAN Program physicians in respect of clinical records and records related solely to their independent police work. The hospital confirms its understanding that these latter records are maintained by those physicians outside the hospital’s electronic medical records system, and in a manner that is not accessible to the hospital or to other hospital staff.

[80] I invited the complainant to address the hospital’s final set of representations, including its clarification about the different kinds of work performed by hospital physicians involved in the SCAN Program, and their different treatment of records resulting from the different kinds of work. The complainant does not directly address these distinctions in her representations. She focuses instead on the hospital’s statements in its representations that it has custody and control of the records. She also challenges a claim made by the hospital that the records at issue will ultimately be released to her through the criminal trial process. I understand and accept the complainant’s assertion that it is unlikely all the records she seeks will be submitted as evidence in the pending criminal trial, and that, in any event, the possibility of the records’ release through the criminal process should not preclude her from exercising a right of access to the records under PHIPA .

[81] In this case, however, I find there is no right of access to the records under PHIPA . This is because I conclude the records are not in the hospital’s custody or under its control for the purposes of PHIPA .

[82] I arrive at this conclusion based on my acceptance of the hospital’s and Dr. A’s characterization of the records as OPP records directly related to the OPP’s core law enforcement mandate of investigating potential crimes, and not hospital records related to the hospital’s mandate or core functions as a provider of health care. The records arose solely in the context of the private agreement between Dr. A and the OPP for the preparation by Dr. A of an expert opinion report to assist in the OPP’s investigation. The hospital is not a party to the agreement between Dr. A and the OPP, nor to the OPP’s broader law enforcement investigation. In these circumstances, I am satisfied that in fulfilling her duties under her agreement with the OPP, Dr. A was acting independently of her role as a physician with privileges at the hospital, and was not performing hospital duties.

[83] The hospital itself played no role in the creation of the records, or in their use by Dr. A and the OPP for the OPP’s law enforcement purposes. The records did not arise in the context of and were not used for any hospital purposes, and they were segregated from hospital records, such as clinical records stored in the hospital’s medical records system. Instead, the records were stored in Dr. A’s private computer files, in accordance with the general practice for records of this nature arising from the police work that Dr. A and other hospital physicians occasionally perform for third parties, outside the context of their hospital duties. While the hospital located the records in the course of its searches, it did so only because Dr. A had stored them in her private files on the hospital’s computer systems. In this context, I find the hospital’s possession of the records amounts only to “bare possession”: There is no evidence to suggest the hospital exercises any powers in respect of the records’ contents, their uses, or their care and protection.[21] In summary, the hospital has no rights or obligations in respect of the records indicative of custody or control within the meaning of PHIPA .

[84] For all these reasons, I conclude that the hospital is not a health information custodian with custody or control of the records at issue. For the same reasons, I also conclude that Dr. A was not acting as an agent of the hospital in respect of the records at issue. I make the same finding with regard to Dr. X: Dr. X was not acting as an agent of the hospital in relation to her limited involvement in Dr. A’s retainer with the OPP.[22]

[85] As a result of all my findings above, there is no right of access to the records under PHIPA .

B. Does FIPPA apply in the circumstances?

[86] The hospital is also an “institution” within the meaning of FIPPA (section 2(1) of FIPPA).

[87] As a result, whether or not PHIPA  applies to the complainant’s request, the complainant may have a right of access under FIPPA to responsive records that are within the hospital’s custody or under its control.[23] If the records are not in the hospital’s custody or control, however, there is no right of access to them under FIPPA.

The records at issue are not “in the custody” or “under the control” of the hospital within the meaning of FIPPA

[88] Applying the same principles outlined above, I find, for the same reasons, that the records at issue in this complaint are not in the custody or under the control of the hospital for the purposes of FIPPA.

[89] To reiterate, the records arose solely in the context of the OPP’s law enforcement investigation, entirely outside the purview of the hospital, and are unrelated to the hospital’s mandate or core functions. While the records exist on the hospital’s computer systems, this amounts to “bare possession” only. The hospital had no involvement in the creation or use of the records, which are segregated from other records used for hospital purposes, such as clinical records stored in the hospital’s medical records system. Dr. A’s involvement with the records occurred wholly independently of her hospital role; Dr. A did not and does not act on behalf of the hospital in respect of the records. In summary, the hospital has no rights or responsibilities with respect to the records that are indicative of custody or control within the meaning of FIPPA.

[90] As a result, the records are not subject to the right of access in FIPPA.

NO ORDER:

For the foregoing reasons, I find the records at issue are not subject to the right of access in PHIPA  or in FIPPA. I therefore uphold the hospital’s denial of access to the records, and dismiss the complaint without issuing an order under either statute.

Original signed by:		December 8, 2023
Jenny Ryu
Adjudicator