Information and Privacy Commissioner, Ontario, Canada

Commissaire à l’information et à la protection de la vie privée, Ontario, Canada

ORDER HO-12

Complaint HA13-58-2

Dynamic Foot Care and Therapy Inc.

July 3, 2014

Summary: Through their agent and substitute decision-maker the complainants sought access to their records of personal health information from Dynamic Foot Care and Therapy Inc. This order determines that Dynamic Foot Care and Therapy Inc. is deemed to have refused the complainants’ request for access. Dynamic Foot Care and Therapy Inc. is ordered to provide a response to the complainants’ agent and substitute decision-maker regarding the complainants’ request for access to records of personal health information in accordance with the Personal Health Information Protection Act, 2004 and without recourse to a time extension.

Statutes considered: Personal Health Information Protection Act, 2004, ss. 2, 3, 4, 5, 23, 25, 53 and 54.

BACKGROUND:

[1] This is a complaint under the Personal Health Information Protection Act, 2004 (the Act).

[2] The complainants are a mother and her 16 year old daughter. They purchased custom made foot orthotics from Dynamic Foot Care and Therapy Inc. in July 2011.

[3] The complainants are represented by an agent, the husband of one complainant and the father of the other complainant. The office of the Information and Privacy Commissioner of Ontario (IPC) confirmed with the complainants that the agent is authorized to act for and on their behalf for purposes of this complaint.

[4] On October 24, 2013, the agent mailed a written request to Dynamic Foot Care and Therapy Inc. for access to the complainants’ records of personal health information. The written request stated:

I’m requesting copies of invoices for custom made foot orthotics for [my wife and daughter] between June – August 2011.

[5] Section 53(1) of the Act states that an individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the personal health information.

[6] Section 25 of the Act states that if the Act permits or requires an individual to make a request, give an instruction or take a step, and a substitute decision-maker is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual, the substitute decision-maker may make the request, give the instruction or take the step on behalf of the individual. It further states that where the substitute decision-maker makes a request, gives an instruction or takes a step in these circumstances, all references in the Act to the individual in respect of the request, instruction or step shall be read as references to the substitute decision-maker. The term substitute decision-maker is defined in section 5(1) of the Act.

[7] Section 54 of the Act requires a health information custodian that receives a request for access to a record of personal health information from an individual or his or her substitute decision-maker, to provide a response as soon as possible in the circumstances, but no later than 30 days after receiving the request. In certain circumstances, within 30 days after receiving the request for access, a health information custodian may give the individual written notice extending the time for a response for a further period of time not to exceed 30 days.

[8] If a response or notice of extension is not given within 30 days after receiving a request for access, the health information custodian is deemed to have refused the request for access pursuant to section 54(7) of the Act, which states:

If the health information custodian does not respond to the request within the time limit or before the extension, if any, expires, the custodian shall be deemed to have refused the individual’s request for access.

[9] On January 8, 2014, the IPC received a deemed refusal complaint from the agent for the complainants indicating it had been more than 30 days since he made the request for access to Dynamic Foot Care and Therapy Inc. for the records of personal health information of the complainants, and that he had not received a response. As a result, this complaint file was opened.

DISCUSSION:

Issue A. Are the records at issue records of personal health information as defined in sections 2 and 4 of the Act?

[10] Section 2 of the Act defines a record as:

…a record of information in any form or in any medium, whether in written, printed, photographic or electronic form or otherwise, but does not include a computer program or other mechanism that can produce a record.

[11] Section 4(1) of the Act states, in part:

In this Act,

personal health information, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,

(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,

(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,

(f) is the individual’s health number, or

(g) identifies an individual’s substitute decision-maker.

[12] Identifying information is defined in section 4(2) of the Act as information that identifies an individual or for which it is reasonable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

[13] The requested records relate to the provision of health care to the complainants by a chiropodist at the former Lisa Street Medical Clinic located at 14 Lisa Street, Brampton, Ontario, L6T 4W2, a clinic operated by Dynamic Foot Care and Therapy Inc., and to payments in respect of the health care provided to the complainants, in particular, invoices for custom made foot orthotics. I am therefore satisfied that the requested records contain identifying information that relates to the provision of health care to the complainants and to payments for the provision of health care to the complainants.

[14] As a result, I find that the records at issue are records of personal health information as defined in sections 2 and 4 of the Act.

Issue B. Is Dynamic Foot Care and Therapy Inc. a health information custodian as defined in section 3(1) of the Act?

[15] The Act provides individuals with right of access to their records of personal health information that are in the custody or under the control of a health information custodian. The term health information custodian is defined in section 3 of the Act, which reads, in part:

In this Act,

health information custodian, subject to subsections (3) and (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties of the work described in the paragraph, if any:

1. A health care practitioner or a person who operates a group practice of health care practitioners.

…

[16] A health care practitioner is a term defined in section 2 of the Act, which reads in part as follows:

health care practitioner means,

(a) A person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care,

…

[17] Health care is also defined in section 2 of the Act, in part, to mean:

…any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

…

[18] Section 1(1) of the Regulated Health Professions Act, 1991 includes the following definitions of member and college:

In this Act,

College means the College of a health profession or group of health professions established or continued under a health professions Act;

…

member means a member of a College:

[19] Dynamic Foot Care and Therapy Inc., operated the former Lisa Street Medical Clinic located at 14 Lisa Street, Brampton, Ontario L6T 4W2 (the Clinic). Dynamic Foot Care and Therapy Inc. retained the services of health care practitioners to provide health care to individuals seeking services from the Clinic, including the chiropody services sought by the complainants. A chiropodist, a member of the College of Chiropodists of Ontario, provided health care to the complainants at the Clinic. The chiropodist conducted observations, examinations and assessments and provided care and services to diagnose or treat the complainants’ physical conditions. Dynamic Foot Care and Therapy Inc. has custody or control of the records of personal health information as a result of or in connection with the provision of health care to the complainants at the Clinic.

[20] Applying the definitions, I find that Dynamic Foot Care and Therapy Inc. was at the material time a person who operates a group practice of health care practitioners and therefore is a health information custodian within the meaning of the Act.

Issue C. Was the request for access made in accordance with the Act and was the agent authorized to make the request for access under the Act?

[21] Section 53(1) of the Act allows an individual to exercise right of access to a record of personal health information by making a written request to the health information custodian that has custody or control of the personal health information. Section 53(1) of the Act states:

An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information.

[22] Section 25 of the Act permits a substitute decision-maker authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual to make a request, give an instruction or take a step that the Act permits or requires the individual to make, give or take. Section 25 of the Act states:

(1) If this Act permits or requires an individual to make a request, give an instruction or take a step and a substitute decision-maker is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual, the substitute decision-maker may make the request, give the instruction or take the step on behalf of the individual.

(2) If a substitute decision-maker makes a request, gives an instruction or takes a step under subsection (1) on behalf of an individual, references in this Act to the individual with respect to the request made, the instruction given or the step taken by the substitute decision-maker shall be read as references to the substitute decision-maker, and not to the individual.

[23] A substitute decision-maker is defined in section 5(1) of the Act as follows:

substitute decision-maker, in relation to an individual, means, unless the context requires otherwise, a person who is authorized under this Act to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual.

[24] Section 23(1) of the Act states that where the individual is at least sixteen years of age, a person authorized in writing by the individual is permitted to act for or on behalf of the individual. Section 23(1) of the Act provides, in part, as follows:

If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent:

1. If the individual is capable of consenting to the collection, use or disclosure of the information.

i. The individual, or

ii. If the individual is at least 16 years of age, any person who is capable of consenting, whom the individual has authorized in writing to act on his or her behalf and who, if a natural person, is at least 16 years of age.

…

[25] The agent made a written request for access under the Act for the records of personal health information of the complainants, in particular, invoices for custom made foot orthotics for the complainants between June – August 2011. The complainants authorized the agent, the husband of one complainant and the father of the other complainant, in writing, to act on their behalf in making the written request for access. The IPC is in receipt of this written authorization. Based on the foregoing, I find that the agent is acting as a substitute decision-maker for the complainants in respect of the request for access and that the request for access was made in accordance with the Act.

Issue D. Did Dynamic Foot Care and Therapy Inc. respond to the request for access in accordance with section 54 of the Act? Is Dynamic Foot Care and Therapy Inc. in a deemed refusal situation pursuant to section 54(7) of the Act?

[26] Under section 54(2) of the Act, a health information custodian must respond to a request for access to a record of personal health information as soon as possible in the circumstances but not later than 30 days after receiving the request. This is subject to an extension of time for a further period not to exceed 30 days if, within 30 days after receiving the request for access, the health information custodian gives the individual written notice of the extension setting out the length of the extension and the reasons for the extension.

[27] Sections 54(3) and 54(4) of the Act provide as follows:

(3) Within 30 days after receiving the request for access, the health information custodian may extend the time limit set in subsection (2) for a further period of time of not more than 30 days if,

(a) meeting the time limit would unreasonably interfere with the operations of the custodian because the information consists of numerous pieces of information or locating the information would necessitate a lengthy search; or

(b) the time required to undertake the consultations necessary to reply to the request within 30 days after receiving it would make it not reasonably practical to reply within that time.

(4) Upon extending the time limit under subsection (3), the health information custodian shall give the individual written notice of the extension setting out the length of the extension and the reason for the extension.

[28] On October 24, 2013, the complainants’ agent and substitute decision-maker made a written request for access to Dynamic Foot Care and Therapy Inc. for the complainants’ records of personal health information, in particular, invoices for custom made foot orthotics for the complainants between June – August 2011. The complainant’s agent and substitute decision-maker indicated, and I have concluded, that Dynamic Foot Care and Therapy Inc. did not respond to the request for access within 30 days of receiving the request.

[29] There is also no evidence to suggest that, within 30 days after receiving the request for access, Dynamic Foot Care and Therapy Inc. provided the complainants or their agent and substitute decision-maker with written notice extending the time for a response for a further period of time not exceeding 30 days. In any event, this additional 30 day period would have also expired.

[30] On January 15, 2014, the IPC sent a Notice of Review to both the complainants’ agent and substitute decision-maker and to Dymanic Foot Care and Therapy Inc. at the same address where the request was made on October 24, 2013. The Notice of Review stated that the complainants filed a complaint alleging Dynamic Foot Care and Therapy Inc. is deemed to have refused the request for access by not giving a response within the time period set out in section 54 of the Act. The Notice of Review requested Dynamic Foot Care and Therapy Inc. to immediately respond to the request for access and to forward a copy of the response to the Analyst at the IPC assigned to this complaint. The Notice of Review indicated that if Dynamic Foot Care and Therapy Inc. failed to do so by January 29, 2014, the IPC may issue an order requiring Dynamic Foot Care and Therapy Inc. to provide a response to the complaint.

[31] On January 22, 2014, in response to the Notice of Review, Omar Mansoury, the Director and Administrator of Dynamic Foot Care and Therapy Inc., advised the Analyst at the IPC that Dynamic Foot Care and Therapy Inc. had not received the original written request for access made by the complainants’ agent and substitute decision-maker on October 24, 2013. On January 22, 2014, the Analyst sent a copy of the written request for access made on October 24, 2013, to Dynamic Foot Care and Therapy Inc. by courier at the same address referred to above. The IPC received confirmation that the copy of the written request for access couriered by the IPC on January 22, 2014, was delivered and received on January 23, 2014.

[32] The complainants’ agent and substitute decision-maker stated, and I have concluded once again, that Dynamic Foot Care and Therapy Inc. did not respond to the request for access re-sent by the Analyst at the IPC on January 22, 2014, within 30 days of receiving the request and that it has not provided a response to date. There is also no evidence to suggest that, within 30 days after receiving the request for access couriered by the IPC on January 22, 2014 and received on January 23, 2014, that Dynamic Foot Care and Therapy Inc. provided the complainants or their agent and substitute decision-maker with written notice extending the time for a response for a further period of time not exceeding 30 days. In any event, this additional 30 day period would have also expired.

[33] The Analyst at the IPC assigned to the complaint had a number of telephone conversations with Omar Mansoury, the Director and Administrator of Dynamic Foot Care and Therapy Inc., in an effort to resolve this complaint. The Analyst also left numerous messages for Mr. Mansoury. During the Analyst’s conversations with Mr. Mansoury, he assured the Analyst that Dynamic Foot Care and Therapy Inc. would respond to the request for access. However, to date, Dynamic Foot Care and Therapy Inc. has not provided a response to the request for access.

[34] It has been more than eight months since the complainants’ agent and substitute decision-maker made the written request for access for the complainants’ records of personal health information on October 24, 2013. It has been more than five months since the request for access was again couriered by the Analyst at the IPC on January 22, 2014 and since the request was received on January 23, 2014.

[35] Throughout this time, the IPC has encouraged Dynamic Foot Care and Therapy Inc. to meet its statutory obligations under the Act by providing a response to the request for access for the complainants’ records of personal health information. The lack of response from Dynamic Foot Care and Therapy Inc. is unacceptable.

[36] As I stated in Order HO-009, the right of individuals to access their records of personal health information is essential to the exercise of other statutory and common law rights, including the right of individuals to determine for themselves what shall or shall not be done with their own bodies, the right of individuals to informational self-determination and the right of individuals to require the correction of amendment of personal health information about themselves. It is also vital in ensuring continuity of care, for example, where individuals have decided to seek health care from another health care provider. The vital interest that individuals have in the information contained in their records of personal health information has also been acknowledged by the Supreme Court of Canada in McInerney v. MacDonald, [1992] 2 S.C.R. 138, where the Court stated:

[I]nformation about oneself revealed to a doctor acting in a professional capacity remains, in a fundamental sense, one’s own. The doctor’s position is one of trust and confidence. The information conveyed is held in a fashion somewhat akin to a trust. While the doctor is the owner of the actual record, the information is to be used by the physician for the benefit of the patient. The confiding of the information to the physician for medical purposes gives rise to an expectation that the patient’s interest in and control of the information will continue.

[37] As a result, I find that Dynamic Foot Care and Therapy Inc. is in a deemed refusal situation pursuant to section 54(7) of the Act.

ORDER:

1. I order Dynamic Foot Care and Therapy Inc. to provide a response to the complainants regarding their request for access to their records of personal health information, in particular, copies of invoices for custom made foot orthotics for the complainants between June – August 2011, in accordance with the Act and without recourse to a time extension, no later than July 11, 2014.

2. In order to verify compliance with Provision 1 of this Order, I order Dynamic Foot Care and Therapy Inc. to provide me with a copy of the response referred to in Provision 1 by July 11, 2014. This should be forwarded to my attention c/o Information and Privacy Commissioner/Ontario, 2 Bloor Street East, Suite 1400, Toronto, Ontario, M4W 1A8.

Original signed by: Nathalie Rioux Analyst

July 3, 2014

---