PHIPA DECISION 23

Complaint HI15-66

Viterna Health Centre Inc., Vicpark Health Clinic Inc., 2081467 Ontario Inc. and a group of respondents

January 14, 2016

Summary: The IPC issues an interim order directing the landlord of premises holding abandoned health records to ensure the security of the records for two months, pending the IPC’s review.

Statutes considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sch A, sections 2 , 12(1) , 13(1) , 49 , 61(1) (h) and O. Reg. 329/04, section 3(7), Courts of Justice Act , RSO 1990, c C.43, section 109 , Bankruptcy and Insolvency Act , RSC 1985, c B-3, sections 37  and 215 .

Cases Considered:   RJR-MacDonald Inc. v. Canada (A.G.), [1994] 1 SCR 311, 1994 CanLII 117 (SCC).

INTRODUCTION

[1]  On November 24, 2015, I issued a Notice of Review notifying a group of respondents, including Viterna Health Centre Inc. (“Viterna”), Vicpark Health Clinic Inc. (“Vicpark”), and 2081467 Ontario Inc. (“Vitality”) that a review has been commenced by the Office of the Information and Privacy Commissioner/Ontario (the “IPC”) under the Personal Health Information Protection Act (the “Act”). This Notice of Review requested representations on whether an interim order should be issued in this review against any respondent(s) requiring that records of personal health information be secured pending the completion of the review.

[2]  Based on the representations received, and for the reasons set out below, I have decided to issue an order requiring one of the respondents, Pelican (Vic.Park) Commercial Inc. (“Pelican”) to take the steps described below to secure records pending the completion of this review.

BACKGROUND

[3]  As set out in the Notice of Review, the IPC was advised of the following facts:

• Vicpark operated a clinic providing health services located at 301-2901 Sheppard Ave. E., Toronto, ON M1T 3J3 (the “Sheppard Premises”) in office spaced leased from Pelican;
• Viterna operated a clinic providing health services located at 7828 Kennedy Road, Unit ID, Markham, ON L3P 5P1 (the “Markham Premises”) in office space leased from TSL Investments Ltd. (“TSL”) and at 1571 Sandhurst Circle, Unit 414, Scarborough, ON MIV IV2 (the “Scarborough Premises”) in office space leased from Cominar 1 Inc. (“Cominar”) with Triovest Realty Advisors Inc. (“Triovest”) acting as property manager;
• Vitality operated a clinic providing health services located at 103-111 Times Ave., Thornhill, ON L3T OA2 (the “Thornhill Premises”) in office space leased from Arya Investments Corp. (“Arya”);
• [four named individuals] are each directors and/or officers of one or more of Vicpark, Viterna, and Vitality;
• On September 4, 2015, Vicpark, Viterna, and Vitality made assignments in bankruptcy to A. Farber & Partners Inc. (“Farber”) of all of their property for the uses, intents, and purposes provided by the Bankruptcy and Insolvency Act  (the "Assignment "). Farber was appointed as trustee of the estate of these corporations; and,
• Subsequent to the Assignment , records of personal health information on the above noted premises were abandoned. ^[1]

[4]  The IPC initiated this review because there are reasonable grounds to believe that:

• Viterna, Vitality, and Vicpark each may be, or may have been, health information custodians within the meaning of the Act with respect to the clinic providing health services operated on each respective premises;
• Farber, TSL, Triovest, Cominar, Arya and/or Pelican each may be, or may have been, health information custodians pursuant to section 3(7) of O. Reg. 329/04 under the Act;
• Viterna, Vitality, Vicpark, Farber, TSL, Triovest, Cominar, Arya and/or Pelican as health information custodians, may have failed, or may be about to fail, to:
• ensure that the records of personal health information in each of their custody or under each of their control are, or were, retained, transferred or disposed of in a secure manner in contravention of section 13(1) of the Act, and,
• to take steps that are reasonable in the circumstances to ensure that personal health information in each of their custody or under each of their control are, or were, protected against theft, loss and unauthorized use or disclosure and to ensure that the Records containing the information are protected against unauthorized copying, modification or disposal in contravention of section 12(1) of the Act;
• Farber, TSL, Triovest, Cominar, Arya and/or Pelican may be persons who have duties under section 49 of the Act and may have used or disclosed, or may be about to use or disclose, personal health information in contravention of those duties; and,
• [four named individuals] may be, or may have been, agents of Viterna, Vitality and/or Vicpark as health information custodians as defined in section 2 of the Act and, as such, may be the subject of an Order of the IPC pursuant to section 61(1)(h) of the Act.

[5]  In the context of this early stage of this review under the Act, I sought representations from the respondents as I was concerned that the Records were at imminent risk of being lost, destroyed, disclosed, or disposed of in contravention of the Act prior to the completion of this review.

[6]  A number of the respondents sent representations in response to the Notice, or contacted this office. Discussions between some of the respondents and this office led to a resolution of issues about the interim security of the Records at some locations in a manner satisfactory to this office. No order is thus required with respect to Records abandoned at the Markham, Scarborough and Thornhill premises. However, I am satisfied that an order requiring that the Records at the Sheppard Premises be secured on an interim basis is required.

THE SHEPPARD PREMISES

[7]  Pelican, as landlord to the Sheppard Premises, confirmed that its tenant (which it states was Viterna) vacated these premises on or about September 1, 2015 without notice, placing Viterna in default of its lease obligations. Pelican has confirmed that Records were left in the Sheppard Premises.

[8]  The history of the IPC’s communications with Pelican with respect to this matter is as follows:

• The Notice of Review was sent to Pelican on November 24, 2015 and delivered to Pelican on November 26, 2015. This Notice of Review requested submissions by December 7, 2015.
• On December 4, 2015, the IPC left a voicemail for Pelican with respect to this matter.
• On December 8, 2015, the IPC sent an email to Pelican, noting that the Notice of Review had been sent on November 24, 2015, noting that no submissions had been received as of the December 7, 2015 deadline, and requesting that Pelican contact the IPC as soon as possible.
• On December 11, 2015, the IPC spoke with Pelican staff by telephone and requested confirmation that records were still located on the Sheppard Premises. Also on December 11, 2015, the IPC sent an email to Pelican again providing the Notice of Review, requesting confirmation that records were still located on the Sheppard Premises by December 14, 2015, and advising it of an access request from a patient.
• On December 15, 2015, the IPC sent an email to Pelican requesting a signed statement addressing the current location of the Records, the steps taken to secure the records, and confirming that the records would be kept secure and would not be used, disclosed, accessed, viewed, copied, modified, destroyed, transferred or moved to another location pending the completion of the IPC’s review unless two weeks prior written notice is provided to the IPC.
• On December 16, 2015, the IPC received a signed statement from Pelican confirming that Viterna vacated the premises on or about September 1, 2015 without notice and confirming that Records were located on the Sheppard Premises (which were vacant), and that keys to the Sheppard Premises are held by the landlord (Pelican), the leasing agent and the property manager. Pelican advised the IPC that it wanted to lease the Sheppard Premises as soon as possible.
• Also on December 16, 2015, the IPC sent an email to Pelican noting that Pelican had not provided a statement confirming that the records would be kept secure and would not be used, disclosed, accessed, viewed, copied, modified, destroyed, transferred or moved to another location pending the completion of the IPC’s Review unless 2 weeks prior written notice is provided to the IPC. The IPC again requested this statement.
• On January 6, 2016, the IPC contacted Pelican by telephone. Pelican stated that it would not promise to keep the records secure pending the completion of the IPC’s review and noted that it wished to re-lease the Sheppard Premises. Pelican denied that records left on the Sheppard Premises had been destroyed and estimated that approximately 15 bankers’ boxes of records remained on the Sheppard Premises. ^[2] Pelican stated that it was concerned about liability if it promised to keep the Records secure and was further concerned about storage costs.

DECISION

[9]  As indicated above, I initiated this review because this office had received information providing reasonable grounds to believe that records containing personal health information had been abandoned. The review raises issues about whether the respondents are health information custodians or other parties with obligations under the Act, and whether they had complied or would comply with their statutory duties. At the outset of the review, I sought submissions from the respondents with a view to ensuring the security of the records pending completion of my review.

[10]  In the context of this decision, I am guided by the principles set out in RJR-MacDonald Inc. v. Canada (A.G.) ^[3] which, although not directly applicable to this type of order under the Act, help in analyzing the considerations to be taken into account in deciding whether to issue an interim order preserving the status quo. In setting out the test for interlocutory injuctive relief, the court stated as follows:

First, a preliminary assessment must be made of the merits of the case to ensure that there is a serious question to be tried. Secondly, it must be determined whether the applicant would suffer irreparable harm if the application were refused. Finally, an assessment must be made as to which of the parties would suffer greater harm from the granting or refusal of the remedy pending a decision on the merits.

[11]  I am satisfied that this review, and the issue of security of the Records pending the completion of this review, raises a serious question to be tried. There are reasonable grounds to believe that the Records are records of personal health information that were abandoned. Pelican has advised that the Records were left in the Sheppard Premises. Based on the information before me, it appears that the Records are records of personal health information that were in the custody or under the control of a health information custodian within the meaning of the Act. The requirement that there be a serious issue to be tried has been described as a low one, requiring satisfaction that the issue to be tried is neither frivolous or vexatious. This requirement has been met.

[12]  The second criterion requires an examination of the harms at issue, and whether the harms cannot be quantified in monetary terms or cannot be cured. With respect to Pelican, I conclude that the irreparable harms requirement is satisfied. Pelican has stated its intention to re-lease the Sheppard Premises (where the Records are currently located) and has not confirmed that it will keep the Records on these premises (that are the subject of this review) secure pending the completion of this review. Some of the potential harms at issue in this decision involve the theft, loss, destruction, and disposal of the Records left in the Sheppard Premises. Should these harms occur, the individuals about whom the Records relate would, among other things, lose the ability to request access to the missing Records or to have these Records used in their health care. Such a theft, loss, destruction, or disposal would practically restrict the orders available in this review, as a respondent who is found to be responsible for these Records would be unable to exercise its statutory functions with respect to Records that have been stolen, lost, disposed of, or destroyed. I conclude that the irreparable harms criterion is met.

[13]  Pelican has not provided written representations describing any harms that would occur if an order were issued to it requiring that the Records be secured pending the completion of this review. In a telephone conversation with the IPC, Pelican has raised concerns about assuming legal liability for the Records and the costs associated with this storage. Balanced against these concerns, I note that the Records are already in the possession of Pelican and further that in order for the IPC to meaningfully exercise its statutory function these Records must be maintained pending the completion of this statutory review. Lastly, I note that requiring any other respondent to secure the records would have the effect of altering the status quo. In this context, I am satisfied that the balance of convenience favours issuing an order against Pelican to secure the records on an interim basis. The terms of my order, set out below, are not unduly onerous and are time limited, subject to further extension.

[14]  Before concluding, I wish to address submissions made by Farber in response to the Notice of Review. Farber submitted that the Notice issued in this matter is in effect an “action” within the meaning of section 215  of the Bankruptcy and Insolvency Act  ^[4] and, as such, the IPC requires leave of the Bankruptcy Court (the “Court”) in order to proceed against it outside the Court. In the alternative, Farber submitted that since the issues to be determined relate to or arise from the administration of the Estate, the IPC must bring an application in the Court pursuant to section 37  of the Bankruptcy and Insolvency Act . Farber further submitted that the Bankruptcy and Insolvency Act  affords specific protection to the Trustee arising from the administration of the Estate. As the Bankruptcy and Insolvency Act  is federally enacted, and the powers of the Commissioner are prescribed under the Act, a provincially enacted statute, Farber submitted that the Commissioner and the IPC are bound by the Bankruptcy and Insolvency Act .

[15]  With regard to Farber’s submission that the Bankruptcy and Insolvency Act  prescribes my jurisdiction under the Act, I am unable to decide this issue as a result of section 109  of the Courts of Justice Act , and specifically the fact that Farber has not provided a notice of constitutional question. Farber relies on federal paramountcy to prescribe the applicability of the Act, triggering section 109  of the Courts of Justice Act . In any event, I decided not to issue an interim order against Farber to secure the records at this time and Farber may raise this issue again in the future with proper notice.

ORDER

For the reasons set out above, I order as follows:

 

1. Pelican shall take steps that are reasonable in the circumstances to ensure that personal health information in the Records located on the Sheppard Premises is protected against theft, loss and unauthorized use or disclosure.
2. Pelican, including its employees and agents, shall not dispose of, destroy or transfer to another person the Records located on the Sheppard Premise and/or the personal health information in such Records, without the prior written approval of the IPC.
3. This Order shall remain in effect for a period of two months following which, if the Review has not been completed, I may seek submissions on whether its terms should be extended.
4. For greater clarity, nothing in this Order shall be interpreted to interfere with the regulatory activities of a College under the Regulated Heath Professions Act, 1991.

 

Original Signed by:		January 14, 2016
Sherry Liang
Assistant Commissioner