PHIPA DECISION 28

HI15-66

Viterna Health Centre Inc. and 12 other named respondents.

April 26, 2016

Summary: In this decision, the IPC concludes a Review under the Personal Health Information Protection Act, 2004 , into abandoned records of personal health information, on the basis that the security of patient files has been assured and individuals will have a right of access to their health information. No orders are necessary in the circumstances.

Statutes considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c.3, Sched.A .

BACKGROUND:

[1]  This review under the Personal Health Information Protection Act, (the “Act”) relates to abandoned records of personal health information. These records were reported to the Information and Privacy Commissioner/Ontario (the “IPC”) as having been abandoned in the wake of the bankruptcy of three corporations that operated four clinics providing health services in the Greater Toronto Area.

[2]  The primary purpose of this review was to determine which, if any, of the named respondents to this review is responsible for ensuring the security of the abandoned records, and ensuring that individuals will be able to exercise their right of access to their health records. The IPC has now been advised that all patient files abandoned by the three bankrupt corporations have been secured, and that steps have been taken to ensure that individuals will be able to access their records and will be notified of where they are now retained. In the circumstances, it is not necessary to continue with this review.

Commencement of Review

[3]  On November 24, 2015, I issued a Notice of Review to the three bankrupt corporations, their trustee in bankruptcy, the landlords ^[1] for the four clinics leased by the bankrupt corporations, and four directors and/or officers of the bankrupt corporations. This Notice of Review advised that a review had been commenced by the IPC under the Act, and summarized the below facts that had been brought to the attention of the IPC:

• Vicpark Health Clinic Inc. (“Vicpark”) operated a clinic providing health services located at 301-2901 Sheppard Ave. E., Toronto, ON M1T 3J3 (the “Sheppard Premises”) in office spaced leased from Pelican (Vic.Park) Commercial Inc. (“Pelican”);

• Viterna Health Centre Inc. (“Viterna”) operated a clinic providing health services located at 7828 Kennedy Road, Unit ID, Markham, ON L3P 5P1 (the “Markham Premises”) in office space leased from TSL Investments Ltd. and at 1571 Sandhurst Circle, Unit 414, Scarborough, ON MIV IV2 (the “Scarborough Premises”) in office space leased from Cominar 1 Inc. with Triovest Realty Advisors Inc. acting as property manager;

• 2081467 Ontario Inc. (“Vitality”) operated a clinic providing health services located at 103-111 Times Ave., Thornhill, ON L3T OA2 (the “Thornhill Premises”) in office space leased from Arya Investments Corp.;

• [four named individuals] were each directors and/or officers of one or more of Vicpark, Viterna, and Vitality;

• On September 4, 2015, Vicpark, Viterna, and Vitality made assignments in bankruptcy to A. Farber & Partners Inc. (“Farber”) of all of their property for the uses, intents, and purposes provided by the Bankruptcy and Insolvency Act  (the "Assignment "). Farber was appointed as trustee of the estate of these corporations; and,

• Subsequent to the Assignment , records of personal health information on the above noted premises were abandoned.

[4]  No respondent has claimed responsibility for the records. In fact, those respondents who have contacted the IPC have expressly disclaimed responsibility for the records.

Interim Order

[5]  The Notice of Review requested representations on whether an interim order should be issued to any respondent(s) requiring that records of personal health information be secured pending the completion of the review. After receiving representations, I issued an interim order (PHIPA Decision 23) on January 14, 2016 to Pelican requiring that it take steps to secure records of personal health information for a period of two months.

Steps Taken to Secure the Records

The Markham Premises

[6]  The IPC has been advised that a new health information custodian, Avitern Health Centre Inc. (“Avitern”), leased the Markham Premises after Viterna abandoned this location. As a result, Avitern is now in possession of the records reported abandoned to the IPC at this location.

[7]  Avitern is operated by a member of a Regulated Health Professions Act, 1991 (RHPA) college, and Avitern has specifically undertaken to comply with all the duties and responsibilities with respect to the records reported abandoned at this location that are imposed on health information custodians pursuant to the Act, including but not limited to, the provisions:

• respecting the collection, retention, use, modification, disclosure, transfer and disposal of personal health information;
• providing individuals with a right of access to records of personal health information about themselves, subject to the exceptions set out in the Act;
• providing individuals with a right to correct records of personal health information about themselves, subject to the exceptions set out in the Act; and
• requiring reasonable steps to be taken to ensure that personal health information is protected against theft, loss and unauthorized use or disclosure and requiring reasonable steps to be taken to ensure that records of personal health information are protected against unauthorized copying, modification or disposal.

[8]  Moreover, Avitern has undertaken to notify the individuals about whom the records relate of the fact that it has the records.

[9]  Before Avitern signed the above undertaking, the IPC was advised that one member of the College of Chiropractors of Ontario retrieved patient files relating to individuals to whom he provided services from this location.

The Scarborough Premises

[10]  The IPC has been advised that members of RHPA colleges who provided health services at the Scarborough Premises have retrieved patient files relating to individuals to whom each member provided services. As a result, the IPC understands that all patient files have been retrieved from the Scarborough Premises and are now with the health care practitioners who provided health services at these locations.

The Thornhill and Sheppard Premises

[11]  Like the Scarborough Premises, the IPC has been advised that members of RHPA colleges who provided health services at the Thornhill Premises have retrieved patient files relating to individuals to whom each member provided services. However, in the case of the Thornhill Premises, approximately thirty (30) banker’s boxes of records were left.

[12]  In the case of the Sheppard Premises, the IPC was advised that members of RHPA colleges had attempted to retrieve records. The IPC was also advised that the landlord for the Sheppard Premises, Pelican, had refused these attempts. As noted in PHIPA Decision 23, Pelican advised the IPC that approximately 15 bankers boxes of records remained at the Sheppard Premises.

[13]  Because records remained abandoned at the Thornhill and Scarborough Premises, I issued a determination pursuant to section 60(13) of the Act on January 18, 2016. This determination authorized IPC staff to inquire into, inspect, and require evidence of the records of personal health information at the Sheppard and Thornhill Premises for the purposes of this review under the Act. Pursuant to this determination, staff from the IPC attended the Sheppard and Thornhill Premises on January 21, 2016 and January 24, 2016, respectively. IPC staff prepared a list of the members of RHPA colleges who provided health services at the Thornhill and Sheppard Premises, and inspected the records.

[14]  The IPC has been in contact with the RHPA colleges that regulate the health care practitioners who provided health services at these locations. These colleges have taken responsibility for those patient files at the Thornhill and Sheppard Premises that were not secured by their respective members. Representatives of each of these colleges attended at the Thornhill and Sheppard Premises on March 14, 2016 and retrieved these patient files. The IPC understands that each RHPA college will either provide individuals with access to their health records, or will provide the records to the members who provided health services to each individual. The IPC further understands that each college that retains patient files will establish a system to advise individuals that their patient files are now in the possession of the college. The IPC would like to thank these RHPA colleges for promptly taking responsibility for the abandoned records at the Thornhill and Sheppard Premises.

[15]  When attending the Sheppard and Thornhill Premises pursuant to the determination issued under section 60(13) of the Act, IPC staff noted that, in addition to the patient files, there were also other records (such as billing and scheduling records) abandoned on site. These other records were largely unorganized and tended to relate to multiple individuals. The landlords for the Thornhill and Sheppard Premises have stated that, in the event these Premises are re-leased, the landlord will securely destroy these records in accordance with the guidance provided by the IPC in our “Fact Sheet: Secure Destruction of Personal Information.”

DISCUSSION

[16]  In this case, the IPC was advised that records of personal health information had been abandoned, in circumstances that raised concerns about potential breaches of patient privacy. Our office took action to ensure that the records were secured to limit the potential for breaches of patient privacy. Once the records were secured, we sought to ensure that individuals would be able to exercise their right of access to the records and be notified of the location of their records for the purpose of seeking access.

[17]  As noted above, none of the respondents to this review have claimed responsibility for the records. In fact, those respondents who have submitted representations have tended to disclaim responsibility for the records. However, after discussions with various parties and other persons with an interest in the matter, I am satisfied that adequate arrangements and undertakings have been made for the security of the records and provision of access rights. In these circumstances, I find it is not necessary to continue with the review or to make any determinations about which entity or entities holds responsibility for the records under the Act.

Members of RHPA Colleges

[18]  The IPC has been advised that all patient files have been retrieved from the Scarborough Premises by members of RHPA colleges who provided health services at this location. The IPC has been advised that no further records remain on site. Similarly, the IPC has been advised that members of RHPA colleges attended to the Thornhill Premises and retrieved patient files relating to individuals to whom they provided health services. Furthermore, one member of the College of Chiropractors of Ontario retrieved records from the Markham Premises related to individuals to whom he provided health services.

[19]  I note that members of RHPA colleges will be subject to professional (and other legal) obligations (including as set out in the Act) regarding confidentiality, secure retention of the records and provision of access to the records. The IPC has received the names of members of RHPA colleges who retrieved records from the Scarborough, Thornhill, and Markham Premises. The IPC has written to each member to state the IPC’s expectation that they will comply with all of the obligations imposed by the Act with respect to records of personal health information in the custody or control of health information custodians, and notify their patients that they now hold these records.

New Health Information Custodian

[20]  As indicated above, at the Markham Premises, Avitern, a health information custodian that has re-leased the Premises, has undertaken to comply with the obligations imposed on health information custodians under the Act with respect to the records, and to notify patients that Avitern now holds these records.

RHPA Colleges

[21]  As indicated above, with respect to records abandoned at the Thornhill and Sheppard Premises all individual patient files that were not retrieved by members of RHPA colleges have been secured by each of the colleges themselves. The IPC understands that the RHPA colleges will either facilitate patient access to these Records, or will provide the records to the applicable member. Where the RHPA colleges retain the records, they will establish a system to advise individuals that their patient files are now with the college. College staff are subject to confidentiality obligations under the RHPA.

Conclusion

[22]  The patient files reported abandoned at each of the four Premises have been retrieved by individuals with a legal obligation to keep these records secure. Furthermore, individuals will have a right of access to their patient files. In these circumstances, I find it is not necessary to continue with this review and determine which, if any, of the respondents is required to take responsibility for the records.

[23]  In concluding that it is not necessary to continue with this review, I have not made any determinations about the legal rights and obligations of the individuals and organizations who ultimately secured the records. The primary purpose of this review was to identify the person responsible for these records and require that person to keep the records secure and provide individuals with a right of access. Where the individuals and organizations described have taken responsibility for the records, it is not necessary to continue with this review.

[24]  This review is now concluded and no order will be issued.

NO ORDER:

For the foregoing reasons, no order is issued.

Original Signed by:		April 26, 2016
Sherry Liang
Assistant Commissioner