ORDER PO-4523

Appeals PA22-00262 and PA22-00267

Ministry of Health

June 12, 2024

Summary: The appellant submitted two requests under the Act  to the ministry for a record identifying the number of COVID-19 tests run each day, organized by vaccination status, for August 23 to December 11, 2021. The ministry advised the appellant the requested information is not a “record” under section 2(1) (b) of the Act  due to section 2 of Regulation 460 under the Act  because the process of producing the record would unreasonably interfere with the ministry’s operations. In this order, the adjudicator upholds the ministry’s decision and dismisses the appeals.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, section 2(1) (definition of “record”); R.R.O. 1990, Regulation 460, section 2.

Orders and Investigation Reports Considered: Orders MO-1488 and PO-4283.

OVERVIEW:

[1] The appellant submitted two access requests under the Freedom of Information and Protection of Privacy Act  (the Act ) to the Ministry of Health (the ministry) for the number of COVID-19 tests administered on each day organized by those identified as “the ‘fully’ COVID-19 vaccinated…, the partially COVID-19 vaccinated, the COVID-19 unvaccinated…, and those with an unknown COVID-19 vaccination status” for the period August 23, 2021 to December 11, 2021.[1] The appellant requested to view this information in the original format and for a copy to be provided to him in a spreadsheet.

[2] The ministry advised the appellant that “no responsive records were located as the ministry does not report data in the format that you are seeking.” The ministry further explained:

The Capacity Planning and Analytics Division (CPAD) has information on testing using Ontario Laboratory Information System (OLIS) data, however vaccination status of individuals at the time of test is not captured. Creating the data in the requested format would require a dedicated research project which is out of the scope of the FOI [Freedom of Information] request process.

[3] The appellant appealed the ministry’s decisions to the Information and Privacy Commissioner of Ontario (the IPC).

[4] Mediation did not resolve the appeals and they were transferred to the adjudication stage of the appeals process. The adjudicator originally assigned to these appeals decided to conduct a joint inquiry due to the nature of the information requested and the issues raised. Representations were sought and received from the ministry.

[5] The appeal was then transferred to me to continue the inquiry. I sought and received representations from the appellant and then supplementary representations from the ministry regarding Order PO-4283, which considered the meaning of the term “record” under the Act .

[6] In the discussion that follows, I uphold the ministry’s decision and dismiss the appeal.

DISCUSSION:

[7] The only issue before me is whether the requested information is a “record” under the Act .[2] The ministry does not dispute the responsive information is contained in two databases: the Ontario Laboratory Information System (OLIS) which includes a subset of data including COVID-19 test results submitted by hospitals and community laboratories, and CoVAX which includes the individual-level records of Ontarian’s COVID-19 vaccinations. However, even though the responsive information exists, the ministry claims the information is not a “record” within the meaning of the Act , because it cannot be compiled into a record without significant manual work. Therefore, I must consider whether a responsive “record” as defined by the Act  can be generated from OLIS and CoVAX.

[8] Section 2(1)  of the Act  defines “record” as “any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

(a) correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material, regardless of physical form or characteristics, and any copy thereof, and

(b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution.

[9] Section 2 of Regulation 460 under the Act  states,

A record capable of being produced from machine readable records is not included in the definition of “record” for the purposes of the Act  if the process of producing it would unreasonably interfere with the operations of an institution.

[10] Based on my review of the parties’ representations and the circumstances of these appeals, I find the requested information does not qualify as a “record” as defined in section 2(1) (b) the Act  two reasons. First, I find the ministry is not able to produce the record using technical equipment or expertise normally used by the institution. Second, I find the ministry has demonstrated that creating the record would unreasonably interfere with its operations and, therefore, the information requested is not a “record” under section 2 of Regulation 460 of the Act .

Parties’ Representations

[11] The ministry states the appellant seeks access to a record that shows COVID-19 test results organized by the vaccination status of the individual receiving the test. The ministry submits no such record exists or is capable of being produced by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the ministry. The ministry further submits that creating a record would require a largely manual research project which would unreasonably interfere with its operations.

[12] The ministry states there is no single, consolidated database that includes the number of COVID-19 tests, the test results, and the vaccination status of the individuals tested. The ministry states that OLIS includes a subset of data containing records of COVID-19 test results submitted by hospitals and community laboratories. The ministry states OLIS is the electronic system that allows hospitals and community laboratories to submit lab test results to health care practitioners, Ontario Health and the ministry. The ministry states CoVAX includes the individual-level records of Ontario’s COVID-19 vaccinations.

[13] While the ministry has custody and control over the testing results and the vaccination information for individuals, the ministry submits the requested record organizing the number of tests by vaccination status cannot be created because CoVAX and OLIS were not designed to connect with one another. The ministry submits the primary goal of testing and vaccination in Ontario during the COVID-19 pandemic was to ensure as many people as possible would have access to these services without barriers. As such, the ministry states individuals were not required to present their health card or proof of Ontario residence to receive a COVID-19 test or vaccination[3] which means the health number, which is the standard identifier for the ministry, is not recorded consistently in either OLIS or CoVAX. As such, the ministry submits there is no way to run an electronic data query that would produce an accurate record of test results by vaccination status.

[14] Further, the ministry did not prescribe a form for Ontarians to complete when they received COVID-19 tests so the information collected at the point of testing varied among test administrators. The ministry acknowledges some testing locations may have collected information on individuals’ vaccination status, however vaccination status was not consistently collected at the time of COVID-19 test administration, was not entered as a data field in OLIS, and was not received by the ministry. Finally, the ministry submits that individuals could opt-out of their personal information being shared with the ministry.[4] In these cases, the ministry states no personal identifier is available to correlate the data in OLIS with that in CoVAX.

[15] Given these circumstances, the ministry submits the requested information cannot be produced by computers or other electronic means and would require an extensive, largely manual, research project, which would amount to the creation of a new record.

[16] The ministry refers to the claim the appellant made during mediation that the requested record exists because the ministry reported “positive case counts by vaccination status” day-by-day during the pandemic. The ministry submits the appellant mischaracterized the data it reported to the public. The ministry states it reported information by COVID-19 case counts by vaccination status. The appellant’s request is for the number of COVID-19 tests performed each day organized by vaccination status. The ministry submits the tests numbers requested are not the same as the case numbers publicly reported by the ministry during the pandemic. The ministry explains a COVID-19 case is a person who is recorded as testing positive for COVID-19 and this data is managed by the Case and Contact Management System (CCM). However, a COVID-19 test is a laboratory test performed for COVID-19 and does not reflect the number of specimens collected or persons tested. In other words, more than one test may be performed per specimen or person. The ministry confirms it never reported testing numbers by vaccination status.

[17] The ministry reiterates CoVAX is the source of vaccination data and does not include information on whether an individual who received a COVID-19 vaccine had ever been tested for COVID-19. The ministry states OLIS contains records of tests conducted but not vaccination status. The ministry confirms there is no single database that contains information regarding COVID-19 tests and COVID-19 vaccinations. Moreover, the ministry submits it did not develop a method to link these two types of information and never publicly reported breakdowns of COVID-19 tests by vaccination status.

[18] The ministry further submits producing the requested record would unreasonably interfere with its operations. The ministry considered two approaches to create the requested record and concluded that both approaches would unreasonably interfere with its operations within the meaning of section 2 of Regulation 460. The ministry describes the two approaches as follows:

Research Project Approach 1

[19] The ministry submits it would be required to resource a research project with an estimated six-week timeframe and a dedicated team of four full-time ministry analysts. Using the rules for calculating costs under Regulation 460, the ministry submits the overall cost for a project of this scope would be approximately $54,000. The ministry submits this approach would include the following tasks:

• Developing a methodology for linking OLIS and CoVAX including probabilistic matching based on the incomplete personal identifiers in the databases. The ministry explains that probabilistic matching or linking is a process through which a series of variables such as names, dates of birth, or postal codes are used to make a “a best guess” that the records from different datasets represent the same individual. The ministry submits a code for probabilistic matching must be developed to suit the characteristics of the project and the databases used. The ministry submits there is no “off the shelf” code or algorithm that can accomplish probabilistic linkage. However, because the personal identifiers are not complete in OLIS and CoVAX, it is not possible to link test numbers with vaccination records without probabilistic matching.
• Linking the two datasets using the methods developed in step one and calculating the number of tests performed each day by the vaccination status of the person being tested at the time of their test. The ministry states all analysis will then be verified by another analyst.
• Documenting the above steps with ministry policy to assist the appellant in interpreting the results.

Research Project Approach 2

[20] In the alternative, the ministry submits it considered the implications of providing the appellant two de-identified, individual-level data sets – one derived from CoVAX and one derived from OLIS – to enable him to perform the manual linking himself. However, the ministry concluded this approach would also unreasonably interfere with the operations of the ministry. As with Approach 1, the ministry submits it would be required to resource a dedicated research project with an estimated timeframe of a minimum of two weeks staffed by a team of four ministry analysis in addition to pulling in other staff from the ministry’s data and privacy areas and a cost of approximately $2,550 for the four analysts plus additional costs for staff from the privacy and data areas. The ministry submits this approach would include the following tasks:

• Consulting with Information Management Strategy and Policy Branch (IMSPB) to review the list of variables in both OLIS and CoVAX to identify what can be shared with the appellant to avoid the disclosure of personal health information (PHI). The ministry notes that IMSPB may advise that none of the responsive information maybe shared due to a risk of unauthorized disclosure of PHI[5] and/or concerns regarding the secure storage of the disclosed data.
• Creating new CoVAX and OLIS files containing only the variables identified in step 1 as appropriate to share by IMSPB and create a new, anonymous personal identifier assigned to each individual to allow the appellant to link the two files.
• Manually reviewing the files to ensure they do not contain PHI and to ensure PHI will not be inadvertently disclosed once the two files are combined by the appellant.
• Manually reviewing the quality and completeness of the anonymous personal identifiers.
• Identifying a mechanism to transmit the datasets to the appellant. Due to the volume of information requested, the ministry submits the information must be transmitted electronically and the Excel spreadsheet requested by the appellant would be inadequate. The ministry submits the appellant would need to have access to specialized data management and statistical software.

[21] To proceed with either approach, the ministry submits it would be required to redirect its resources from actual ministry priorities to complete these research projects. The ministry submits the staff with the expertise required to complete these research projects were “retained for general operational purposes, not to assist the ministry to meet its obligations under the Act .” Specifically, the ministry submits the analysts with the knowledge skills to conduct the research projects are specialized staff within the Health Analytics and Insights Branch who are in short supply and high demand within the ministry.

[22] The ministry also notes the research projects, particularly Approach 2 as described above, would introduce privacy risks because the data in CoVAX and OLIS is PHI within the meaning of section 4 of the Personal Health Information Protection Act. The ministry notes the research projects would require using PHI without the consent of the individuals whose PHI is captured by the databases. While ministry analysts typically work with encrypted data as a best practice to protect PHI, the nature of the request and the necessity of using probabilistic linkage would require analysts to access unencrypted PHI containing the personal information and PHI of the residents who consented to sharing their information with the ministry.

[23] Finally, the ministry notes the resulting records would not be comparable to the aggregate data reported publicly because of “the significant data quality challenges anticipated with the project and the different sources for the lab testing data.” The ministry submits this discrepancy could cause significant confusion.

[24] Given these circumstances,, the ministry submits the appellant is asking it to create a record that does not exist, and it should not be required to do so.

[25] In response to the ministry’s representations, the appellant confirmed he seeks the test numbers by vaccination status. The appellant provided a history of the COVID- 19 pandemic in Ontario and the various concerns he and his family raised regarding the government’s reporting of statistics, the COVID-19 mandates regarding testing and vaccination, and other policy decisions. Relevant to this appeal, the appellant submits Ontario began releasing COVID-19 statistics regarding the overall positivity rate and positive cases by vaccination status on a near daily basis in August 2021. However, the appellant submits the testing numbers by vaccination status were not made available and this led to the appellant’s requests under the Act .

[26] The appellant submits even if a “record” does not exist, the ministry is under a “solemn obligation” to create a new record from the raw data. The appellant submits it is in the public interest for the ministry to create this record.[6] The appellant also takes issue with the ministry’s interpretation of the phrase normally used in paragraph (b) of the definition of “record” in section 2(1)  of the Act . The appellant claims the ministry created and used both a software application, the Verify Ontario app, and the CoVAX[7] database to respond to the pandemic. It appears the appellant believes the ministry could create the record requested in a similar manner through which the ministry developed other applications and databases during the COVID-19 pandemic.

[27] With regard to the ministry’s representations regarding staff resources that would be required to complete the searches, the appellant submits the ministry did not prove that its allocation of resources to FOI is “consistent with the creation and maintenance of a culture of transparency and integrity.” Further, the appellant submits the ministry did not demonstrate “its allocation of resources to freedom of information requests is commensurate with its own expenditures.” The appellant, referring to Order MO-1488, submits the ministry could “look to its own resources and consider whether they are sufficient to meet the needs of an institution of its size.”

[28] The appellant submits the ministry’s $54,000 estimated cost to achieve Research Project Approach 1 would be “a pittance in light of the certain returns and therefore denies that the data collection would ‘unreasonably interfere’” with the ministry’s operations. The appellant submits the data could reveal the efficacy of the COVID-19 vaccines and encourage members of the public to use the vaccine. The appellant submits if members of the public decide to get the COVID-19 vaccine when they otherwise would not, “the investment will have [paid] for itself.”

[29] The appellant disputes the ministry’s claim that the data quality challenges with compiling the information requested would result in significant confusion on his part. The appellant also questioned the ministry’s claim that more than one test may have been administered to a single specimen or individual. The appellant raised a number of questions regarding this claim. The appellant also raised a number of policy reasons as to why there is a public interest in the disclosure of the information at issue. I confirm these issues are outside the scope of these appeals.

[30] I invited the ministry to comment on Order PO-4283, which considered the definition of record under section 2  of the Act . The ministry submits Order PO-4283 is distinguishable for four reasons: (1) Order PO-4283 related to one type of database, whereas two are relevant here; (2) the necessary data at issue in Order PO-4283 existed to create the record and an algorithm could be created to complete the record; (3) the nature and size of the databases in question are different; and (4) the university had produced similar records in the past. The ministry reiterates the information requested is not a “record” under the Act and creating the record would unreasonably interfere with its operations.

[31] The ministry submits there are at least 8 million OLIS records and 1.2 million CoVAX records without personal identifiers. While it is not clear how many of these are from the period defined in the appellant’s request, the ministry submits it would be required to use probabilistic linking to assign personal identifiers to these records. Further, even if they were to use probabilistic matching to create the requested record, the ministry submits there may be unusable records because it would not be able to assign a unique health card to the data. Given these circumstances, the ministry submits the requested information is not a “record” within the meaning of the Act .

Analysis and findings

[32] Having reviewed both parties’ representations, I find the information requested is not a “record” within the meaning of section 2(1)  of the Act . I make this finding for two reasons: first, creating the record cannot be produced using technical equipment or expertise normally used by the ministry, and second, the creation of the record would unreasonably interfere with the ministry’s operations.

[33] The appellant seeks access to a list of the number of COVID-19 tests run daily, for a particular period of time, organized by vaccination status. The ministry advised the appellant that, to respond to his request, it would be required to create a new record from the testing information located on OLIS and the vaccination status information found on CoVAX. The ministry claims the requested information does not qualify as a “record” under the Act . It submits a huge amount of information would have to be linked between two large and distinct databases to provide the appellant with the information he seeks.

[34] The issue of whether a requested record qualifies as a “record” under the Act  was recently considered in Order PO-4283. In that decision, the adjudicator considered the two requirements set out above, to determine whether the number of full-time permanent and contract faculty as well as part-time faculty broken down by department at Lakehead University (the university) falls under the definition of a “record” in section 2(1) (b) of the Act . Reviewing IPC jurisprudence, the adjudicator stated a requested record will qualify as a “record” if the following two conditions are met:

1. If the information can be produced using computer hardware and software or any other information storage equipment and technical expertise normally used by the ministry.
2. If the process of producing the requested record would not unreasonably interfere with the institution’s operations.

[35] In Order PO-4283, the adjudicator found the responsive information requested was a “record” within the meaning of the Act  because the evidence established that:

1. the university could produce the record using hardware, software and technical expertise normally used by the university, and
2. the process of producing the record would not unreasonably interfere with the university’s operations.

[36] The adjudicator based his decision on the following conditions:

• The university had produced similar records in the past to institutions such as Statistics Canada, even though not broken down in the same level of detail.
• The university acknowledged its human resources databases contain the relevant information, although a small amount is in piecemeal or fragmentary form.
• The university has the programming or other technical expertise to produce the record.

[37] In this appeal, I am satisfied the ministry demonstrated the requested information cannot be produced using computer hardware and software or any other information storage equipment and technical expertise normally used by the ministry. I find the circumstances of these appeals are distinguishable from those before the adjudicator in Order PO-4283. Specifically, the information requested in Order PO-4283 was stored in a single human resources database whereas the information requested in these appeals is stored in two separate and distinct databases, OLIS and CoVAX. I reviewed the ministry’s representations and accept there is no single ministry database containing and connecting COVID-19 testing data and data on the vaccination status of the individual taking the test.

[38] In addition, the ministry demonstrated there is no hardware, software, expertise or algorithm available to connect the testing data on OLIS with the vaccination status data on CoVAX to create the total numbers sought by the appellant. Further, I accept the ministry’s claim that creating a method to accurately link the disparate information in the databases would require technical equipment and expertise not normally used by the ministry. I do not agree with the appellant’s claim that creating the requested record is akin to the creation of the software applications and databases used by the ministry during the COVID-19 pandemic. While the appellant is correct in that the ministry created new applications and databases during the pandemic, it did so in response to a global pandemic and not an FOI request, where there is the requirement that a record be produced through technical means that are normally used by an institution.

[39] In any case, the ministry has demonstrated there is not a complete and consistent collection of personal identifiers in the databases, which will reasonably result in challenges with connecting and reconciling the testing numbers with vaccination status numbers. As the ministry explained in its representations, because individuals were not required to provide their personal information at the point of testing or vaccination, it is not possible to link records that are missing unique personal identifiers.

[40] The ministry submits to create a record with the information sought by the appellant would require it to use probabilistic matching to assign health card numbers to those records missing the personal identifiers. The ministry provided evidence to demonstrate how probabilistic matching is a novel technique that would require a high level of expertise that is beyond what is normally used by the ministry. The ministry further notes that results obtained from the application of that technique may not be consistent or correct and would require manual review and matching. It is the ministry’s position that, as a result, the research projects described that would be required to create the requested record would not require more than the software or technical expertise normally used by the institution as described in section 2(1) (b) of the Act . Upon review, I agree with the ministry that the methodology it would have to use to prepare the record requested by the appellant does not meet the first requirement of the definition of a “record”.

[41] Furthermore, I find the OLIS and CoVAX databases contain vastly more information to review and filter than was before the university in Order PO-4283. I acknowledge the ministry’s claim that the information requested by the appellant would contain far more sensitive data, such as PHI, of a much larger population of individuals (i.e. those who received a COVID-19 test between August and December of 2021) than the limited data found in the human resources database of a university.

[42] Finally, the ministry has demonstrated it has not produced similar records to the one requested by the appellant, unlike the university in Order PO-4283. The ministry confirmed it has never disclosed the information sought by the appellant. The ministry advised it has never linked the information on OLIS with that on CoVAX and, as a corollary, has never provided these linked data to another organization.

[43] In light of the above, I agree with the ministry and find the information requested by the appellant does not fit within the definition of “record” in section 2  of the Act  because it cannot be produced using computer hardware and software or any other information storage equipment and technical expertise normally used by the ministry.

[44] Furthermore, I find the process of producing the requested record would unreasonably interfere with the ministry’s operations under section 2 of Regulation 460 of the Act . The ministry provided detailed explanations regarding the work it would be required to undertake to create the record requested by the appellant. It is clear from a review of the ministry’s representations, the processes it described to create the record are unreasonably costly and would require an inordinate amount of time and effort. The ministry would be required to use a novel technique (i.e. probabilistic linkage) in an attempt to link the information between OLIS and CoVAX and then would have to manually review all of the information generated. After this work, the ministry advises that due to the incomplete personal identifiers provided, it may not be able to provide accurate results of the testing by vaccination status to the appellant.

[45] I find the ministry provided detailed evidence to explain the amount of work and level of expertise that would be required to create a record responsive to the appellant’s request. The level of detail provided by the ministry in this case contrasts that provided to the adjudicator in Order PO-4283. Overall, I find the process of producing the requested record, which may not even fully capture the information the appellant seeks access to, would unreasonably interfere with the ministry’s operations.

[46] I acknowledge the appellant’s interest in obtaining access to the information he has requested. Nonetheless, his position about the public interest in the information he has requested is not relevant to my determination of whether the requested information can be considered a “record” under the Act .

[47] In conclusion, I am satisfied the ministry has established the requested information does not meet the definition of a “record” under section 2(1)  of the Act .

ORDER:

I uphold the ministry’s decision and dismiss the appeal.

Original Signed By:		June 12, 2024
Justine Wai
Adjudicator