PHIPA DECISION 21

Complaint HA14-90

Halton Healthcare Services

January 8, 2016

Summary: The complainant sought disclosure of the personal health information of his deceased sister, without the consent of the estate trustee, for health care purposes as permitted under section 38(4)(c) of PHIPA. In this decision the IPC finds that in refusing disclosure, the hospital did not properly exercise its discretion under that provision and orders it to re-exercise its discretion. The IPC also directs the hospital to consider whether disclosure may be appropriate under section 38(4)(b)(ii) (circumstances of death).

Statutes considered: Personal Health Information Protection Act, 2004, sections 38(4)(b)(ii) and 38(4)(c).

Cases Considered:   PHIPA Decision 19.

INTRODUCTION

[1]  This case concerns a request by an individual for the personal health information of a deceased family member, the obligations of a health information custodian under the Personal Health Information Protection Act, 2004 (PHIPA or the Act) in considering a request for disclosure of such information, and the role of the Information and Privacy Commissioner of Ontario (the IPC or this office) in inquiring into the custodian’s response to such a request.

BACKGROUND

[2]  Section 38(4)(c) of the Act permits a health information custodian to disclose the personal health information of a deceased individual to specified family members, if they reasonably require the information to make decisions about their own health care or that of their children:

A health information custodian may disclose personal health information about an individual who is deceased, or is reasonably suspected to be deceased,

….

(c) to the spouse, partner, sibling or child of the individual if the recipients of the information reasonably require the information to make decisions about their own health care or their children’s health care. 

[3]  The complainant in this case, on his own behalf and on behalf of his mother and sister, made a request to Halton Healthcare Services (the hospital) to review and make desired copies of health care records of his deceased sister. The information the complainant wishes to review consists of all the hospital’s records relating to his late sister, from June 2012 to September 2013, when she received treatment for mental illness at the hospital. The complainant indicated in his letter that he was relying on section 38(4)(c) of PHIPA.

[4]  The hospital responded by indicating that it did not believe section 38 of PHIPA negated the requirement to obtain consent to release of the records. Since the individual whose records were sought by the complainant is deceased, the hospital stated that the complainant should seek consent of the estate trustees, who are the daughters of the deceased. The complainant made a complaint to this office on his own behalf and on behalf of his mother and sister, seeking this office’s assistance in obtaining the records. [1]

[5]  The IPC assigned a mediator to explore a resolution of the complaint. As no resolution was possible, it was forwarded to the adjudication stage of the IPC’s processes. I decided to initiate a review of the complaint, during which I sought and received written submissions from the complainant and the hospital.

[6]  On this date, I am issuing this and three other decisions relating to disclosure under section 38(4)(c).

DISCUSSION

[7]  Unlike the Freedom of Information and Protection of Privacy Act (FIPPA) and its municipal equivalent, PHIPA does not provide a general right of access to information held by the organizations to which it applies. The only right of access established under PHIPA is the right, under section 52(1), of individuals to obtain access to records of their own personal health information.

[8]  PHIPA draws a distinction between the provision of “access” to personal health information, and the “disclosure” of personal health information by a health information custodian. Individuals have a right of access to records of personal health information about themselves in the custody or control of health information custodians, subject to limited and specific exceptions. An individual’s right of access under section 52(1) of PHIPA must be exercised by the individual about whom the records relate or (if applicable) that person’s lawfully authorized substitute decision-maker on his or behalf. [2] The health information custodian is obliged to respond to the request for access and, if no exceptions apply, provide access.

[9]  On death, the right of access may only be exercised by the estate trustee or, in the absence of an estate trustee, the person who has assumed responsibility for the administration of the deceased’s estate. [3] In this case, the complainant is not the estate trustee for his deceased sister’s estate, and he is therefore not entitled to exercise a right of access under section 52(1) of PHIPA.

[10]  In addition to the provisions of PHIPA governing “access” to records of personal health information, PHIPA contains provisions governing when health information custodians may “disclose” personal health information. Under PHIPA, disclosure is permitted with the individual’s consent or the consent of the individual’s substitute decision-maker (where applicable). In the case of a deceased individual, only the estate trustee (or, if there is no estate trustee, the person who has assumed responsibility for the administration of the deceased’s estate) may give consent. Disclosure without consent is also permitted, and in some cases required, under specific provisions in the Act. [4]

[11]  In this case, both the hospital and the complainant have requested that the estate trustees, the daughters of the deceased individual, consent to release of her personal health information to the complainant. The estate trustees have refused consent. Accordingly, the issue before me is whether PHIPA permits disclosure to the complainant without consent. In the circumstances of this case, the complainant believes he qualifies for disclosure without consent under section 38(4)(c).

[12]  This case raises issues about the obligations of a health information custodian when deciding whether or not to disclose information under section 38(4)(c), the rights of individuals to complain to the IPC about a custodian’s decision to not disclose information to them under this section, and the extent of the IPC’s authority to inquire into such a complaint.

Representations

[13]  The hospital’s states that the only records it holds of the complainant’s late sister relate to her mental health. It submits the intent of section 38(4)(c) is to permit access to personal health information for the purposes of analysis of biological, pathological or DNA samples, that can be genetically mapped and analysed for familial traits and possible epidemiological tracking. The hospital states that it contacted an analyst with this office on an informal basis, who agreed with this interpretation of this provision.

[14]  The hospital submits that as psychiatric records do not provide any such specimens, it believes that access to the records of this deceased patient must follow the regular rules of release (i.e., with consent of the estate trustee).

[15]  In his original letter to the hospital, the complainant refers to the fact that his father and sister both committed suicide, and the traumatic effect of both. He describes the family as enduring isolation, the stigma of suicide, and silence, and states that the lack of information about his sister’s situation is particularly hurtful. The complainant states that it is his (and his sister and mother’s) duty to themselves, to their children and grandchildren to be fully apprised of what occurred in the time leading up to his sister’s death so that they can be best informed and ensure these events are never repeated.

[16]  The complainant states that it would be useful to know if his sister was thought to be genetically at risk, bi-polar, suffering from Post-Traumatic Stress Disorder or severely affected with Generalized Anxiety Disorder. He states that his hope is that this knowledge would provide the opportunity for the family to make positive future personal and family health care decisions, continue the healing process and hopefully find closure.

[17]  The complainant also states that, in the past, his sister openly shared information about health conditions with family members to alert them with the hope that they would not suffer the same fate.

[18]  The complainant and his sister provided additional representations to this office which they ask to be kept confidential. They are consistent with the letter the complainant submitted to the hospital. Without revealing the details of the representations, it is fair to describe the reasons for seeking the information as based primarily in their desire to know more about their late sister’s circumstances in the time preceding her suicide, and the wish not to perpetuate a “wall of silence” around the death of a loved one.

Analysis

[19]  There is no dispute that the information the complainant seeks is the “personal health information” of the complainant’s deceased sister, within the meaning of the Act.

[20]  Section 38(4)(c) is an exception to the general rule requiring consent for the disclosure of personal health information. If the conditions of this section are met, section 38(4)(c) permits a health information custodian to disclose personal health information about a deceased person, even without consent. The custodian may disclose information under section 38(4) verbally, or in a record. Where an individual claims to qualify for disclosure under section 38(4)(c), the health information custodian must consider whether the individual meets the conditions for disclosure, and decide whether and how much information to disclose. Although, depending on the circumstances, it may be reasonable for a health information custodian to advise an individual seeking disclosure to try to obtain consent, it would be wrong to take the position, as this hospital initially did, that disclosure under section 38(4) requires consent.

[21]  Since disclosure under this provision is discretionary, a health information custodian is also permitted not to disclose that personal health information. In PHIPA Decision 19, also released on this date, I discuss in greater detail the nature of a health information custodian’s duties in considering a request for disclosure under this section, and the role of the IPC in inquiring into a complaint about a refusal to disclose. I stated that there is an “implied public statutory duty” that discretion under this section be based on relevant considerations, and not be exercised in bad faith or for an improper purpose. It goes without saying that the duty also requires that the custodian turn its mind to the request for disclosure, and whether the person seeking the information meets the conditions permitting disclosure.

[22]  I turn now to the facts of the complaint before me. As stated above, section 38(4)(c) permits the hospital to disclose the information if the complainant (and his family members) “reasonably require the information to make decisions about their own health care” or that of their children. As disclosure under this provision is for the purpose of health-care decision-making, it does not provide a broader discretion to disclose information for sympathetic or compassionate reasons. To support disclosure under section 38(4)(c), the complainant must be able to show a link between disclosure of the information to him, and the ability to make informed decisions about his own health care or that of his children.

[23]  Having said that, I find that the hospital did not adequately consider the complainant’s request, for the following reasons. The complainant referred to the possibility that information about the nature of his sister’s mental illness may provide insight into a potential link to his own health or the health of other family members. As stated above, the hospital did not consider information about mental illness to be the type of information which could give rise to permitted disclosure under section 38(4)(c), referring to the fact that its records do not include “specimens” that could be analyzed.

[24]  I find that the hospital took an unduly narrow approach to section 38(4)(c). The words of the section do not limit the type of information that might be “reasonably required” by a family member in order to make informed decisions about their own health care. I see no reason to limit the application of this section to “specimens”. I also see no reason to exclude information about mental illness, as a category, from the type of information that might be “reasonably required” for the purpose expressed in that section. Among other things, I observe that the definition of “health care” in section 2 of the Act includes actions taken to diagnose, treat or maintain an individual’s mental condition. Some mental illnesses seem to run in families. [5] Whether or not the risk is capable of scientific analysis in the manner described by the hospital, it is possible that information about the complainant's sister’s mental illness is relevant to health care decisions by other family members.

[25]  As discussed in PHIPA Decision 19, the Act contains an “implied public statutory duty” that discretion under section 38(4) be based on relevant considerations, and not be exercised in bad faith or for an improper purpose. In this case I find that, in exercising its discretion under this section, the hospital relied on irrelevant considerations, i.e., the absence of “specimens”, as well as the fact that the records are about mental illness.

[26]  Having reached the conclusion that the hospital did not exercise its discretion properly, I now turn to consider what remedy I can give.

[27]  As a general principle, tribunals can only exercise the powers that are granted to them by the Legislature, through their governing statutes. ^[6] In the case of the IPC, the powers that can be exercised following a review under the Act are set out in section 61(1). The only power given to the IPC to order a custodian to provide access to personal health information is found in section 61(1)(a), in response to an individual’s request for records of his or her own personal health information. This section does not provide the IPC with the authority to order disclosure of information in response to a complaint under section 38(4).

[28]  However, there are other parts of section 61(1) that are relevant to a review under section 38(4). Sections 61(1)(c) and (i) state:

After conducting a review under section 57 or 58, the Commissioner may,

(c) make an order directing any person whose activities the Commissioner reviewed to perform a duty imposed by this Act or its regulations;

(i) make comments and recommendations on the privacy implications of any matter that is the subject of the review.

[29]  Based on the above powers, in a case where a custodian has failed to put its mind to a request for disclosure under section 38(4), or has exercised a discretion improperly, I may order the custodian to review the matter again. I may, in addition, or alternatively, provide comments or recommendations on its exercise of discretion under this provision. This approach is consistent with the remedies this office provides under FIPPA and its municipal equivalent, when an institution covered by one of those statutes has not exercised its discretion properly.

[30]  I will therefore order the hospital to re-exercise its discretion. I will also direct that it provide me with its response to the request and its reasons for disclosing or not disclosing the personal health information sought by the complainant, his sister and his mother.

[31]  I recommend that the complainant, his sister and his mother support their request to the hospital for disclosure under section 38(4)(c) with statements from their health care practitioners describing what kind of information is sought, and why that information is required by them in order to make decisions about their health care or the health care of their children. Although a complainant is not required to make a request for disclosure under section 38(4)(c) through a health care practitioner, nor provide evidence from a health care practitioner supporting the need for the information, this supporting documentation will help them to show that the conditions permitting disclosure under section 38(4)(c) exist. As disclosure under section 38(4)(c) must be based on a health care need, a health care practitioner is in a position to provide the best evidence of that need.

[32]  In reviewing the request for disclosure once more, the hospital should also consider whether disclosure of some information to the complainant, his sister and mother is permitted under section 38(4)(b)(ii) of the Act, which states:

A health information custodian may disclose personal health information about an individual who is deceased, or is reasonably suspected to be deceased,

….

(b) for the purpose of informing any person whom it is reasonable to inform in the circumstances of,

(i) the fact that the individual is deceased or reasonably suspected to be deceased, and

(ii) the circumstances of death, where appropriate…

[33]  Under this provision, a health care custodian is permitted to consider disclosure for reasons going beyond health-care decision-making, and may take into account a compassionate need for the information. A custodian is given discretion to decide when it is “appropriate” to disclose personal health information, about the fact and circumstances of a death. Disclosures under this provision are not limited to family members, but it would be reasonable to expect family members to be included amongst those to whom disclosure may be appropriate. Given the reasons the complainant has given for seeking disclosure, I find that the custodian should have considered whether disclosure of some information is “appropriate” under this provision.

ORDER:

1. For the foregoing reasons, I order the hospital to re-exercise its discretion, and consider the request for disclosure under section 38(4)(c) in accordance with the principles expressed in this decision, and taking into account any additional information the complainant provides to the hospital. I also order the hospital to consider whether disclosure of information is appropriate under section 38(4)(b)(ii).
2. I direct the hospital to provide me with its response to the request and its reasons for disclosing or not disclosing personal health information of the deceased to the complainant, his sister and his mother, whether verbally or in a record. This response shall be forwarded to my attention, within two weeks of the submission of any additional information from the complainant or, if he chooses not to submit any additional information, the date he informs the hospital of this.

Original Signed by:		January 8, 2016
Sherry Liang
Assistant Commissioner