PHIPA DECISION 299

Complaint HR24-00035

Grand River Hospital

September 2, 2025

Summary: Grand River Hospital reported an incident to the Information and Privacy Commissioner of Ontario (IPC) under the Personal Health Information Protection Act (PHIPA). After fetal remains were found in a hospital bathroom, a charge nurse showed these remains to some staff present at the hospital. The nurse gave a staff member permission to take a photo of the fetus, and the staff member later sent the photo to other hospital employees. The photo contained no information identifying the patient who passed the fetus and none of the staff members who were shown the fetus or a photo of it knew the patient’s identity.

The hospital conducted an investigation into the incident, during which it found that one additional staff member had also taken a photo of the fetus, and another had received a photo of it. The hospital subsequently ensured that all photos of the fetus were deleted. The investigation addressed the appropriate discipline for staff members and the additional training required.

The hospital eventually identified the affected patient but did not notify them of the incident. The hospital’s position was that notice was not required as the photos of the fetus did not contain the patient’s personal health information. The hospital also stated that notifying the patient of the incident would result in a risk of harm to the patient.

In this decision, the adjudicator finds that photos of the fetus and any discussions that may have occurred when the charge nurse showed the fetus to other staff do not contain the patient’s personal health information because they did not include any identifying information about the patient. As no personal health information was involved in the incident, the adjudicator finds that the PHIPA obligation to notify a patient of unauthorized disclosure of their personal health information does not apply. Additionally, based on confidential information the hospital provided regarding the patient’s particular situation, the adjudicator upholds the hospital’s decision not to notify the affected patient in the circumstances.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 20024, c. 3, Sched. A, sections 4(1), 4(2), 12(1), and 12(2).

Decisions Considered: PHIPA Decisions 82 and 263.

INTRODUCTION:

[1] This decision arises from an incident in which a staff member at Grand River Hospital (the hospital) took a photo of fetal remains and sent this photo to two other staff members. This incident was reported to the hospital’s privacy office. A subsequent investigation found that one other staff member also took a photo of the fetus, and another staff member received a photo of the fetus.

[2] The fetal remains were discovered in the stall of a bathroom at the hospital. A nurse saw that the fetus was contained in an intact amniotic sac and showed it to other staff members being of the view that it was a unique opportunity to view a fetus in this condition.

[3] The hospital identified the incident as a privacy breach and reported it to the Information and Privacy Commissioner of Ontario (the IPC) pursuant to the Personal Health Information Protection Act (PHIPA).

[4] During the IPC’s investigation into this matter, the hospital advised that it was unsure whether the fetus itself was considered personal health information under PHIPA. Because of this, the hospital was uncertain whether it was required to notify the patient who passed the fetus of the incident under section 12(2) of PHIPA.[1] The hospital stated that it had made a decision not to notify the affected patient and informed the IPC investigator that it would not reconsider that decision at that time.

[5] The file was transferred to the adjudication stage, where I decided to conduct a review under section 58(1) of PHIPA.[2]

[6] During the review, I sought and received representations from the hospital, including on whether the fetus or photos of the fetus contained “personal health information” of the affected patient and whether the hospital was required to notify her based on the notice requirement in section 12(2) of PHIPA.

[7] In the discussion that follows, I explain why I find that any discussions that took place between staff members regarding the fetal remains and the photos themselves are not “personal health information” of the affected patient within the meaning of section 4(1) of PHIPA. I explain why this finding precludes the hospital from being subject to the section 12(2) notice requirements.

BACKGROUND:

The Incident

[8] A pregnant patient (the affected patient) attended at the hospital’s emergency department with obstetrical concerns. The affected patient went to the bathroom and passed a fetus, which was left in the bathroom. Initially, the hospital did not know who the patient that had passed the fetus was. The hospital was later able to determine who the affected patient was, but this occurred several days after the fetus was found.

[9] Members of the hospital’s environmental services staff, who are responsible for the cleaning, disinfection, and housekeeping of patient and non-patient areas, found the fetal remains and alerted the charge nurse.

[10] The hospital states that the normal procedure would have been to discard the fetal remains in a safe manner. Instead of doing so, the charge nurse placed the fetus in a sterile, unmarked container. She did so because the fetus was intact in its amniotic sac, and the charge nurse believed that this provided a unique teaching opportunity for nursing staff to view a fully intact product of conception.

[11] The charge nurse offered staff members, both clinical and non-clinical, an opportunity to view the intact fetus. The hospital notes that discussions regarding the fetus may have occurred while the fetus was being shown to staff members. An environmental services aide (the aide)[3] asked the charge nurse if she could take a photo, and the charge nurse allowed her to do so.

[12] When the environmental services staff who had found the fetal remains learned that the aide had taken a photo of the fetal remains, they asked the aide to send them the photo, which she did. The aide also showed her supervisor the photo, and the supervisor informed the aide that it was not appropriate to have taken the photo despite the charge nurse’s permission.

[13] Three days after this shift, the hospital’s human resources department notified its privacy specialist that the aide had taken a photo of a fetus and sent this photo to other staff members. The privacy specialist began an investigation into the matter. During this investigation, the hospital determined the identity of the patient who had passed the fetus. The hospital also determined that one additional staff member also took a photo of the fetal remains, with the permission of the charge nurse, and sent the photo to another staff member. Nine months after the incident, the hospital reported the privacy breach to the IPC.

The Hospital’s Investigation

Containment

[14] The hospital began containment efforts shortly after the incident. After her supervisor spoke with her, the aide who photographed the fetus reported that she had deleted the photo of the fetus and asked those with whom she shared it to delete it as well. The staff who were sent the photo also confirmed that they deleted it, did not share it with anyone else, and did not share it on social media.

[15] Staff from three departments were working on the night of the incident. Supervisors of all three departments sent emails to staff working that night, asking them to delete any photos of the fetus they may have taken or received, and to confirm that deletion. All staff members who took or received a photo of the fetus confirmed that they had deleted the photos and not shared them further.

[16] After the hospital determined who the affected patient was, it conducted an audit on the patient’s health records, as a precaution. The hospital did not identify any inappropriate accesses to the patient’s records.

Discipline and Training

[17] The hospital conducted interviews with the charge nurse and the aide. During these interviews, the charge nurse acknowledged that her role did not involve training or providing learning opportunities to non-clinical staff, and that the aide was not in the patient’s circle of care.[4] The charge nurse stated that she was not fully aware of the hospital’s “Photography, Audio Recording and Video Policy” (the Photography Policy) but said she generally understood that patient permission was needed to record patients. The nurse agreed that she did not have this permission before showing the fetus to staff members. The nurse also confirmed that she gave the aide permission to take a photo of the fetus.

[18] The aide stated that she asked for permission before taking the photo of the fetus and that, at the time, she did not think taking the photo was wrong. While the aide was aware of the Photography Policy, she did not think it applied to her taking a photo of the fetal remains. The aide stated that she sent the photo to other staff only after they requested it.

[19] Following the interview, the aide resigned from her position at the hospital.

[20] The hospital used a Breach Management Risk Scale to help determine the appropriate discipline for the charge nurse. The Breach Management Risk Scale is a tool that helps to determine the level of risk associated with an event and provides recommended disciplinary actions associated with each level of risk.

[21] Using this tool, the hospital determined that the charge nurse’s role in the incident had a high level of risk associated with it, but that there was no evidence of any malicious intent on the charge nurse’s part. The hospital also took into account that the charge nurse was forthcoming and transparent in her interview, that this appeared to be an isolated incident, and that the charge nurse had no history of concerns with her manager, human resources, or the privacy office. The privacy office recommended that the charge nurse be given a week’s suspension without pay and be required to complete a learning plan within 30 days. The hospital’s human resources department accepted this recommendation. The hospital also reported the charge nurse to the College of Nurses of Ontario and placed a letter of counsel in her employment file.

[22] As part of her learning plan, the charge nurse signed both a privacy pledge and confidentiality agreement, retook the annual privacy training, and reviewed relevant privacy policies, including the Photography Policy.

[23] Following the incident, the hospital conducted training with the departments whose staff were present at the hospital at the time of the incident. This training included reviews of relevant hospital policies, including the Photography Policy, the Personal Use of Technology policy, and the Code of Conduct Expectations policy. The hospital also provided these departments with refresher training on the principle of a patient’s circle of care.

[24] The hospital sent out a reminder to its staff members that they do not have hospital-owned devices and should not take photos with their personal phones.

Notification of the Affected Patient

[25] As part of its investigation into the incident, the hospital consulted a third-party ethicist regarding whether it should notify the affected patient of the incident. This ethicist recommended notification. However, just prior to submitting the privacy breach report to the IPC, the privacy department followed up with the hospital department assigned to contact the affected patient and found out that this department had not notified the patient. From the information provided, there appeared to have been some confusion or miscommunication about which hospital department was responsible for notifying the patient, so the notification never occurred.

[26] At that point, the privacy department decided that the hospital would not notify the patient of the incident. Among the reasons they cited for not doing so was that the photo did not contain any patient identifiers. Moreover, nine months had passed since the incident, and the hospital determined that notifying the patient of the incident, given the time that had passed and the personal circumstances of the patient, could potentially cause far greater harm to her. The hospital’s stated reasons for not notifying the affected patient, as set out in its initial breach report to the IPC, did not include an assertion that the incident did not involve “personal health information,” as defined in section 4(1) of PHIPA.

DISCUSSION:

[27] As a preliminary matter, there is no dispute that the hospital is a health information custodian within the meaning of that term as set out in section 3(1) of PHIPA, and that the various involved staff are employees and agents within the meaning of section 2 of PHIPA.

[28] PHIPA sets out in what circumstances the collection, use, and disclosure of personal health information by health information custodians is authorized. Health information custodians are also subject to security obligations set out in section 12 of PHIPA. Section 12(1) mandates that health information custodians “take steps that are reasonable in the circumstances” to ensure that the personal health information in its custody or control is protected against, among other things, unauthorized use or disclosure.

[29] If unauthorized use or disclosure of that personal health information occurs, section 12(2) requires that the health information custodian notify the affected individual of this unauthorized use or disclosure “at the first reasonable opportunity.”

[30] Section 12(3) of PHIPA requires that a health information custodian notify the Commissioner of unauthorized use or disclosure of personal health information if the circumstances of this unauthorized use or disclosure meet the prescribed requirements.[5]

[31] Sections 12(1), (2) and (3) read as follows:

Security

12 (1) A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.

Notice of theft, loss, etc. to individual

(2) Subject to subsection (4) and to the exceptions and additional requirements, if any, that are prescribed, if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall,

(a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure; and

(b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI.

Notice to Commissioner

(3) If the circumstances surrounding a theft, loss or unauthorized use or disclosure referred to in subsection (2) meet the prescribed requirements, the health information custodian shall notify the Commissioner of the theft or loss or of the unauthorized use or disclosure.

[32] The notification requirement applies to unauthorized disclosures of personal health information. In this case, the hospital now takes the position that none of the discussion about the fetus, or the photos of the fetal remains contain personal health information, as that term is defined under section 4(1) of PHIPA.

Are discussions about the fetus or photos taken of the fetal remains “personal health information” within the meaning of section 4(1) of PHIPA?

Definition of Personal Health Information

[33] Section 4(1) of PHIPA defines “personal health information” as “identifying information about an individual in oral or recorded form” if that information falls into one of the categories set out in paragraphs 4(1)(a) through (g).

[34] Most relevant to this matter is the category of information in section 4(1)(a) that “relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family.”

[35] Section 4(1) limits personal health information to identifying information about an individual, and section 4(2) defines “identifying information” as “information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.”

The Hospital’s Position

[36] In its representations, the hospital breaks down the definition of “personal health information” into three constituent parts:

• identifying information about an individual
• in oral or recorded form
• that relates to their physical or mental health (or another type of information listed in 4(1)).

[37] The hospital addresses the latter two elements of this definition first, noting that the photos of the fetal remains were information in recorded form. The hospital also acknowledges that there may have been discussions regarding the fetus when it was displayed. The hospital states that these would qualify as information in oral form.

[38] Further, the hospital states that information about a spontaneous abortion and products of conception, such as photos of or discussion of the fetal remains, are the type of information addressed in section 4(1)(a) of the definition of “personal health information”, as they clearly relate to the pregnant woman’s physical health.

[39] However, it is the hospital’s position that the discussions and photos of the fetal remains are not personal health information because they did not contain identifying information, as is required to meet the definition of personal health information set out in section 4(1). The hospital argues that the patient could not be identified either through the discussions about the fetus or the photos taken of it. The hospital also notes that it confirmed that none of the staff who were shown the fetal remains knew the identity of the pregnant patient.

[40] The hospital states that the fetus and the container it was placed in were not marked or labelled with any information identifying the patient. According to the charge nurse, she did not communicate any patient information when displaying the fetus. Based on this, the hospital submits that neither the discussions nor the photos contained information that would directly identify the patient.

[41] The hospital contends that it would also not be reasonably foreseeable that the photos themselves or any information discussed during the display of the fetal remains could be used to identify the patient. The hospital states that none of the staff who viewed the fetus had access to other information that could identify the patient. Moreover, the hospital states that there were multiple other patients attending in the emergency department with obstetrical concerns at that time. Based on this, the hospital submits that the employees who viewed the fetus would not be able to deduce who had passed the fetus.

[42] The hospital notes that only someone with special knowledge of the patient’s circumstances – such as the patient herself, health care providers directly involved in her care, or perhaps her friends or family – could have identified the patient from the fetus. The hospital argues that based on previous IPC decisions, the test regarding whether it is reasonably foreseeable that an individual could be identified is not whether those with such special knowledge could identify a patient from the information at issue. Rather, as set out in PHIPA Decision 82 (and recently applied in PHIPA Decision 263), “the test is whether it is reasonably foreseeable, in the circumstances, that others without that special knowledge could identify the patient by combining the information provided by the hospital with other available information.”[6] Applying this test, the hospital argues that it is not reasonably foreseeable that those without special knowledge could identify the patient from either the discussions or photos of the fetus, and therefore, neither contains the patient’s personal health information.

Analysis and Finding

[43] As the hospital notes, to be considered the patient’s personal health information, the photos of the fetus or any discussions that occurred when the charge nurse displayed the fetus must contain the patient’s identifying information. Under section 4(2), this includes information that directly identifies an individual (such as an individual’s name) and any information “for which it is reasonably foreseeable in the circumstances […] could be utilized, either alone or with other information, to identify an individual.”

[44] The hospital cites PHIPA Decision 263 as a recent PHIPA case that addressed identifiability of information when a patient is not named or otherwise directly identified. In that case, a magazine article described an unnamed child’s experiences in the child welfare system, including general details about that child’s physical and developmental health. The community health centre believed that one of its employees had provided their client’s information to the article’s author, and in doing so, had breached the child’s privacy in contravention of PHIPA. One of the questions that the adjudicator addressed in PHIPA Decision 263 was whether the magazine article included the child’s identifying information.

[45] In making her determination, the adjudicator in PHIPA Decision 263 referred to PHIPA Decision 82, a decision that considered whether statements made to the media about a patient were unauthorized disclosures of personal health information, given the information relating to the patient that was already publicly available. In PHIPA Decision 82, the adjudicator stated:

... the test is not whether someone with special knowledge could identify the patient. Clearly, the family members of the patient could readily identify the patient discussed in the news reports, because of their knowledge of the circumstances. Rather, the test is whether it is reasonably foreseeable, in the circumstances, that others without that special knowledge could identify the patient by combining the information provided by the hospital with other available information.[7]

[46] The adjudicator in PHIPA Decision 263 applied the reasoning in PHIPA Decision 82 and found that it was not reasonably foreseeable that members of the public without special knowledge could identify the child from the information in the magazine article, either alone or by combining that information with other information. Accordingly, she found that the magazine article did not contain personal health information within the meaning of PHIPA.

[47] In this case, the hospital’s representations suggest that the staff members who viewed the fetal remains should be treated as equivalent to members of the public, in that they lacked special knowledge of the patient’s circumstances. The hospital submits that these staff members were not the patient’s friends or family and were not involved in her care, so had no ability to access additional information about the patient.

[48] I accept that, in this case, there is no evidence that there was any information in the public realm that would have made it reasonably foreseeable that the patient could be identified by utilizing that information combined with viewing or discussing the fetus. However, I note that PHIPA Decisions 263 and 82 dealt with information available to general members of the public. The case at hand involves hospital staff, who may have access to additional information about patients who were in the hospital’s care.

[49] In this case, none of the staff members who viewed the fetal remains, or took or received photos of the fetal remains, were involved in the affected patient’s care. Therefore, no additional information that could have identified the patient was available to them as a function of their professional roles or responsibilities. Furthermore, as part of its investigation into this incident, the hospital conducted an electronic audit of the patient’s chart and found no inappropriate accesses, ruling out the possibility of staff gaining access to additional information that could have identified her. Finally, the hospital confirmed that there were multiple other patients in the emergency department with obstetrical concerns at that time, and therefore, employees who discussed and viewed the fetal remains directly or via photos afterwards would not have been able to deduce who had passed the fetus.

[50] Accordingly, and for all these reasons, I find that the photos and discussions of the fetus do not contain information identifying the patient, and therefore, do not contain the patient’s personal health information. Based on this, I conclude that the viewing, photographing, and discussion of the fetal remains during the incident at issue did not involve the patient’s personal health information.

[51] To be clear, this finding in no way minimizes the seriousness of either the conduct of the nurse and other staff in this case or any ethical issues relating to the incident, including those affecting the dignity of the patient. These are matters separate from PHIPA compliance. The hospital has chosen to deal with these through appropriate disciplinary action and additional staff training.

Is the hospital required to notify the affected patient under section 12(2) of PHIPA?

[52] Section 12(2) requires a health information custodian to notify an individual at the first reasonable opportunity if personal health information belonging to that individual that is in the custody or control of the health information custodian “is stolen or lost or if it is used or disclosed without authority.”

[53] This notice obligation in section 12(2) applies to unauthorized uses or disclosures of personal health information. In this case, while there may have been discussions of the fetal remains, and photos of it were taken and sent to others, I have already found that these did not contain personal health information. Accordingly, section 12(2), which pertains to unauthorized uses or disclosures[8] of personal health information, does not apply in the circumstances. I find that the hospital is not required to provide notice to the patient of the incident pursuant to section 12(2) of PHIPA.

[54] While PHIPA does not preclude the hospital from notifying the patient of what occurred in relation to the fetus that she passed, there is no duty to provide this notice. The hospital considered notifying the patient of the incident even though it did not involve identifying information. The hospital consulted an ethicist who invited the hospital to consider notification as a means of building trust with patients and demonstrating transparency.

[55] However, due to a miscommunication regarding which department would get in touch with the patient, the hospital did not end up providing the notice. Although it considered doing so anyway upon discovering this lapse nine months later, the hospital ultimately determined that notifying the patient of the incident carried a significant risk of harm to the patient, based on the passage of time and her particular circumstances.

[56] Had this case involved unauthorized collection, use, or disclosure of personal health information, the lack of coordination between departments could have resulted in a breach of the hospital’s obligations to provide timely notification under section 12(2) of PHIPA. Therefore, I recommend that the hospital review its notification protocol to ensure that it is ready to be deployed in a coordinated, timely, and effective manner for future incidents whenever legally required.

NO ORDER:

For the foregoing reasons, I decline to make any orders under PHIPA.

RECOMMENDATION:

I recommend that the hospital review its notification protocol to ensure that it is ready to be deployed in a coordinated, timely, and effective manner for future incidents whenever legally required to notify under section 12(2) of PHIPA.

 

Original signed by:		September 2, 2025
Jennifer Olijnyk
Adjudicator