PHIPA DECISION 29

HA15-4

RSRS Record Storage & Retrieval Services

June 8, 2016

Summary: A former patient of a deceased doctor complained about the actions of a medical storage company holding the records of the deceased doctor. The complainant wished to retrieve his original paper health file. He believes that the company is wrongfully in possession of his health record and, as well, that it wrongfully converted the paper file to an electronic copy, destroying the original as a result. This decision determines that the medical storage company is lawfully acting as an agent under the Personal Health Information Protection Act and did not violate the Act in converting the paper file to an electronic record.

Statutes considered: Personal Health Information Protection Act, 2004, sections 1(b), 2, 3(1), 3(12), 4, 10(3), 13(2), 17(1), 37(1), 52(1) and 54(9), Medicine Act, 1991, O.Reg. 114/94, sections 19 and 20.

Cases considered: McInerney v MacDonald, [1992] 2 SCR 138.

BACKGROUND:

[1]  In December of 2013, the complainant’s family physician passed away.

[2]  In January of 2014, Record Storage & Retrieval Service (RSRS) entered into a contract with the estate trustee of the complainant’s family physician and was provided with the records of personal health information belonging to his practice.

[3]  The complainant and RSRS disagree about the characterization of some of the events leading to this complaint but, essentially, the complainant contends that RSRS is not entitled to hold his former physician’s records, that he has the right to obtain the original paper health records compiled by his family physician about him, and that RSRS wrongfully destroyed these paper health records. RSRS takes the position that it is willing to release the scanned versions of the complainant’s records to him, and that it has acted in accordance with legal and professional requirements in scanning and destroying the original paper versions of the records.

[4]  The complainant states he made a request to RSRS for information on obtaining or ordering medical records relating to him and other family members. In response, RSRS sent the complainant two invoices. The first invoice was for a fee in the amount of $279.21 which represented the amount charged for copies of the records of personal health information of the complainant and two other family members. The second invoice was in relation to the complainant’s request for a third family member’s records of personal health information, and indicated that no additional fee was being charged for this person’s records. The invoices required the complainant and his family members to sign and return the invoices, along with payment. The invoices are incorporated into RSRS forms titled “Authorization for Medical Record Transfer.”

[5]  It appears that following receipt of the invoices, the complainant sent a letter to the estate trustee requesting that she retrieve his family’s medical records from RSRS, taking the position that they were in “illegal possession” of them. He stated his objection to the fee quoted by RSRS. The complainant also indicated, among other things, that he had asked RSRS for access to the original paper versions of the records.

[6]  The complainant then filed a complaint with this office alleging that RSRS is holding records of personal health information “for ransom.” Attached to his complaint was the letter to the estate trustee referred to above. The complainant later clarified to this office that this letter was intended to be the first step in an effort to retrieve medical records and transfer them to a new physician. RSRS clarified that it was not aware of this letter until this complaint.

[7]  During mediation of the complaint, RSRS advised the complainant that it would waive the fees associated with his request, and requested that the complainant sign and return a different form, titled “Request to Access Personal Health Information”, confirming his request. Regarding the complainant’s request for the personal health information of his family, RSRS enclosed additional “Request to Access Personal Health Information” forms for their completion. RSRS advised that it would respond to each individual directly.

[8]  In a letter dated April 20, 2015, RSRS provided the complainant with additional details regarding the scanning and destruction of his original records of personal health information. RSRS stated,

As per our usual practice when a request for records is made, we scanned your paper chart to ensure its long term survival and accessibility. At this point, in accordance with our standard practices and the guidelines of the College of Physicians and Surgeons of Ontario (CPSO Policy 4-12, Item 3) and the Canadian Medical Protective Association (Converting to electronic medical records published 2010-P1002-9-E), we destroyed the paper.

[9]  The complainant is of the view that RSRS is not legally permitted to have and/or destroy records of personal health information, and that the originals belong to the patients and should have been given to the patients upon the death of the family physician. The complainant would like this office to arrange for his and his family’s medical records to be returned to him. The complainant does not want to deal with RSRS directly and has not returned the forms that RSRS claims are required before it can send copies of the records of personal health information to the complainant and his family members.

[10]  As mediation did not resolve the complaint, the file was transferred to adjudication, where I decided to conduct a review of the complaint. During my review, I sought and received representations from the parties (including requesting representations from the estate trustee), and additional clarification on the complainant’s request.

DISCUSSION:

Issue A:   Who is the “health information custodian” of the complainant’s records of personal health information?

[11]  The Personal Health Information Protection Act, 2004 (the “Act”) provides individuals with a right of access to their records of personal health information that are in the custody or under the control of a “health information custodian.” The term “health information custodian” is defined in section 3(1) of the Act, which reads, in part:

In this Act,

“health information custodian”, subject to subsections (3) and (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties of the work described in the paragraph, if any:

1. A health care practitioner or a person who operates a group practice of health care practitioners.

[12]  Section 3(12) of the Act deals with the death of a health information custodian:

If a health information custodian dies, the following person shall be deemed to be the health information custodian with respect to records of personal health information held by the deceased custodian until custody and control of the records, where applicable, passes to another person who is legally authorized to hold the records:

1. The estate trustee of the deceased custodian.

2. The person who has assumed responsibility for the administration of the deceased custodian’s estate, if the estate does not have an estate trustee.

Representations

[13]  RSRS submits that the estate trustee of the deceased physician is not a health information custodian. RSRS also states that the estate trustee has retained it as an “’agent’, acting as sole custodian” of the records. This quote is not clear because it appears to conflate two distinct roles under the Act: that of “agent” and that of health information custodian.

[14]  In its document “Your Health Records…Frequently Asked Questions”, RSRS states that it “stores patient records on behalf of retiring and relocating practitioners and practitioner estates” and describes itself as “legal custodians” for the records.

[15]  The complainant submits that the estate trustee is a health information custodian, and cites section 3(12) of the Act. The complainant notes that the Act stipulates that only a patient’s health care practitioner, provider or caregiver can be a health information custodian. He submits that RSRS does not fit any of these criteria.

[16]  The estate trustee did not provide any submissions in response to the Notice of Review.

Analysis

[17]  Having regard to section 3(12) and the information before me, I find that the estate trustee of the deceased physician is the health information custodian with respect to the records at issue. As noted above, section 3(12) of the Act specifically states that if a health information custodian dies, and the deceased custodian’s estate has an estate trustee, the estate trustee is deemed to be the health information custodian in relation to records of personal health information held by the deceased custodian, until custody and control of the records passes to “another person who is legally authorized to hold the records.” [1]

[18]  The deceased family physician’s former status as a health information custodian is not in dispute. Under section 3(12), upon the death of the family physician, his estate trustee became the health information custodian. There is nothing before me indicating that custody and control of the records has passed to another person who is “legally authorized” to hold the records in its own right, as opposed to as an agent of a health information custodian. If nothing else, section 3(12) would require the “other person” to whom custody and control of the records has passed to have legal authorization to hold the records. While RSRS seems to suggest that it is such a person, the only legal authority it refers to is its agreement with the estate trustee. I find that such an agreement cannot, by itself and without any other statutory or legal foundation, provide the “legal authority” for transfer of custody and control of records, thereby relieving the original health information custodian of its obligations under the Act with respect to those records. [2]

[19]  A finding that the estate trustee is no longer a health information custodian would be inconsistent with the scheme under the Act for assigning responsibility for the retention and safeguarding of patient records, and the prohibitions against collection, use and disclosure of personal health information unless permitted under the Act. If such a result is the intent of the agreement between RSRS and the estate trustee, it would also be inconsistent with the general principle that parties cannot contract out of statutory obligations.

[20]  I also find that RSRS is not a health information custodian with respect to the records at issue in this review. The meaning of the term “health information custodian” is set out in section 3 of the Act. Only persons who meet the criteria set out in that section, or are prescribed under that section, are health information custodians. RSRS has not suggested that it meets this statutory definition, nor does a plain reading of the Act suggest that a records storage company storing personal health information for a deceased physician is, independently, a health information custodian.

[21]  I conclude, therefore, that the estate trustee continues to be the health information custodian in relation to the requested records. I also conclude that RSRS is not the health information custodian in relation to these patient records. It may refer to itself as a “custodian” of the records, but it is not a “health information custodian” within the meaning of the Act.

[22]  My conclusion does not mean that RSRS has no status or obligations under the Act, with respect to how it deals with the records. Its obligations do not arise from having the status of a “health information custodian” but, as discussed below, from its duties as an agent.

Issue B:   Is RSRS an “agent” of the health information custodian?

[23]  The term “agent” is defined in section 2 of the Act as follows:

“agent,” in relation to a health information custodian, means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by the custodian and whether or not the agent is being remunerated[.]

[24]  Section 6(1) of the Act deals with the provision of health information to an agent:

For the purposes of this Act, the providing of personal health information between a health information custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the person providing the information or a collection by the person to whom the information is provided.

Representations

[25]  Although RSRS does not rely on the definition above, it describes itself as an “’agent’, acting as sole custodian” of the records of personal health information. It also states that “[t]he Estate Trustee is relying on an external facility, RSRS, to retain the original medical records and only transfer copies to others.”

[26]  The complainant submits that RSRS is not an agent of the health information custodian. He submits that RSRS is “serving their own purpose in trying to sell us copies for profit.” The complainant also states that the estate trustee may only “assign her responsibilities as health information custodian to RSRS” with the consent of his family.

[27]  The estate trustee did not provide submissions in response to the Notice of Review.

Analysis

[28]  I find that RSRS is an agent of the health information custodian (the estate trustee). This is clear based on its own description of the services provided to the estate trustee. RSRS states that it has been “retained” by the estate trustee, who is:

relying on an external facility, RSRS, to retain the original medical records and only transfer copies to others. RSRS ensures that access to records is possible for authorized requesting parties as necessary for the duration of the retention term.

[29]  I find that the health information custodian retained RSRS to provide record storage and management services in respect of personal health information on the custodian’s behalf, and for the purposes of the custodian.

[30]  The complainant argues that RSRS is “serving their own purpose in trying to sell us copies for profit.” The fact that RSRS may be remunerated or otherwise compensated does not mean that RSRS is acting for its own purposes, as is suggested by the complainant. Many agents are paid by health information custodians. Indeed, the definition of “agent” in the Act, quoted above, recognizes that agents may be remunerated. In this case, RSRS has been retained to provide patients with access to records of personal health information under the Act. In providing this service, it is acting for the health information custodian’s purpose, as this is an obligation imposed on the health information custodian by the Act. As such, RSRS is an agent of the health information custodian.

[31]  In relation to the complainant’s assertion that the estate trustee must obtain an individual’s consent in order to “assign her responsibilities” to RSRS, the provisions of the Act permit custodians to delegate responsibilities for personal health information to agents without consent. In that regard, section 17(1) of the Act states:

A health information custodian is responsible for personal health information in the custody or control of the health information custodian and may permit the custodian’s agents to collect, use, disclose, retain or dispose of personal health information on the custodian’s behalf only if,

(a) the custodian is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be;

(b) the collection, use, disclosure, retention or disposition of the information, as the case may be, is in the course of the agent’s duties and not contrary to the limits imposed by the custodian, this Act or another law; and

(c) the prescribed requirements, if any, are met.

[32]  Further, section 37(2) of the Act permits an agent to use personal health information on behalf of a custodian, and be provided with the information for that purpose. Although consent of the affected individuals is not required for an agent to deal with the records, the agent’s actions in relation to the records, as expressed in the above, must be consistent with the custodian’s duties and legal requirements. Further, a custodian can only delegate to an agent such actions as the custodian herself or himself may take in relation to the records. In this case, as a health information custodian, the estate trustee has the obligation to respond to requests by patients for access to their records of personal health information, and is permitted to delegate that responsibility to RSRS. RSRS, in turn, is permitted to deal with the records for the purpose of responding to access requests. Below, I discuss whether the specific actions taken by RSRS, acting as an agent, were contrary to other legal requirements, as the complainant contends.

Issue C:   Does the complainant have a right to the original paper records?

[33]  Section 52(1) of the Act provides that an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian, subject to limited and specific exceptions.

[34]  Section 4 of the Act defines personal health information as “identifying information about an individual in oral or recorded form”, relating to specified subjects.

Representations

[35]  RSRS submits that this issue is twofold: 1) does the complainant have the right to access the information, and 2) does he have the right to access the original paper record? Regarding the first component, RSRS states that the complainant has a right of access to the information, providing he submits a signed release form authorizing the release of his medical records. However, RSRS submits that the complainant does not have a right to the original paper record. RSRS refers to the finding in McInerney v MacDonald, [3] which determined that an original record of personal health information is the property and responsibility of the physician and his estate.

[36]  RSRS submits that the complaint is without merit, as it has not denied the complainant access to the requested records, and it has agreed to provide copies of the medical records to the complainant at no cost, providing the complainant provides a signed “Letter of Release.”

[37]  The complainant cites section 19 of Ontario Regulation 114/94 under the Medicine Act, 1991, regarding the retention of medical records. [4] Section 19 of the Regulation reads as follows:

19. (1) A member shall retain the records required by regulation for at least ten years after the date of the last entry in the record, or until ten years after the day on which the patient reached or would have reached the age of eighteen years, or until the member ceases to practise medicine, whichever occurs first, subject to subsection (2). 

(2) For records of family medicine and primary care, a member who ceases to practise medicine shall,

(a)   transfer them to a member with the same address and telephone number; or

(b)   notify each patient that the records will be destroyed two years after the notification and that the patient may obtain the records or have the member transfer the records to another physician within the two years.

(3) No person shall destroy records of family medicine or primary care except in accordance with subsection (1) or at least two years after compliance with clause (2) (b). 

[38]  The complainant submits that RSRS never informed him that his family could pick up their original paper records of personal health information, or have them transferred to their current family physician. He further submits that RSRS is acting in its own interest in attempting to sell his family copies of their own records for profit. He also states that,

If [the deceased physician] owned the physical medical records and the information belongs to us, it is a simple matter of shared ownership. Under accepted inheritance law, when one party dies, the survivor inherits the whole. If anyone owns our family’s medical records, it is us.

[39]  Regarding RSRS’ reliance on the finding in McInerney v MacDonald, the complainant submits that “it makes good sense that a doctor should retain ownership of the original medical records while they are looking after patients… but Ontario has different rules which apply when a physician closes their practice.”

Analysis

[40]  There is no dispute that the complainant has a right of access to his health records. The question here is whether he has the right to obtain the original paper records. I find that the Act does not require RSRS to provide the complainant with the original paper records formerly held by his physician.

[41]  Section 4 of the Act defines “personal health information” to include both oral or recorded information. Section 2 states that a “record” means a record of information “in any form or in any medium”. The right of access under section 52 of the Act applies to a “record” of personal health information, and the duty of a health information custodian in responding to a request for access is to make the “record” available for examination, or to provide a copy. None of these provisions require that patients be given the original paper records of their patient files. Rather, they require that a record be made available for examination or a copy provided. Further, as discussed below, they do not impose an obligation on a custodian to preserve patient records in their original format and do not prohibit the custodian from converting paper records to electronic format.

[42]  Supporting this conclusion is section 13(2) of the Act, which speaks to the obligation of a custodian to retain personal health information that is the subject of an access request:

…a health information custodian that has custody or control of personal health information that is the subject of a request for access under section 53 shall retain the information for as long as necessary to allow the individual to exhaust any recourse under this Act that he or she may have with respect to the request.

[43]  Notably, the obligation extends to the preservation of “information”, as opposed to the “record” of personal health information. This supports the conclusion that the Legislature did not intend to require preservation of an original record, as opposed to an accurate copy of the personal health information in that record, pending an access request.

[44]  I do not accept the complainant’s submission that his patient files are his “property”. The Supreme Court of Canada was clear in McInerney that the physician compiling the medical records owns the physical records. [5] The complainant’s right of access to his records under the Act does not vest in him any “property” interest in the original file. I see no legal authority for the theory that he has a “joint interest” in the file such that it passes to him alone on the death of his family physician. In fact, the role of the estate trustee as the deemed health information custodian under section 3(12) of the Act, suggests that the legislature did not intend for a property interest in records of personal health information to automatically pass to the patient.

[45]  I do not view subsection 19(2) of Ontario Regulation 114/94 under the Medicine Act to support the complainant’s claim to have a property interest in the records. Specifically, that section requires physicians who cease to practice medicine to either transfer the records to another physician at the same address or to, among other things, notify patients that they may pick-up the records. A plain reading of this section does not suggest that any property interest is automatically created simply because the physician ceases to practice.

[46]  Since the complainant objected to signing and returning any forms sent to him by RSRS, and RSRS has stated that it will only provide access once the complainant signs a “release”, I will address whether use of its forms is necessary or consistent with its duties in responding to the complainant’s request for access. The Act provides, in section 53, that the right of access under section 52 is to be exercised through a written request. Although a health information custodian may respond to an oral request for access, it may also reasonably request that such a request be confirmed in writing before providing the records.

[47]  There is no requirement on the complainant to use the particular forms set by RSRS. Section 53 refers to a “written request” but does not prescribe any particular format in which such a request needs to be made. This office has issued a template form that may be used by individuals seeking access under the Act. [6] The form is for the assistance of patients and health information custodians and is not mandatory. Use of this form, however, helps in ensuring clarity and compliance with mandatory requirements, such as provision of sufficient detail to enable a custodian to identify and locate the record. The first form sent by RSRS [7] to the complainant differs from the IPC’s suggested template in that requires him to agree that it is exercising “good faith and reasonable action”. This language extends beyond what is reasonably required to exercise a right of access. The second form [8] is consistent with the IPC form, and I recommend that RSRS continue to use this, rather than the first one, in the future.

Issue D:   Did RSRS breach the Act by scanning and then destroying the original paper record?

Representations

[48]  RSRS states that the physician has the right to scan the original record of personal health information, and shred the original, under the circumstances outlined in policies and handbooks of the Canadian Medical Protective Association (CMPA) and the College of Physicians and Surgeons of Ontario.

[49]  RSRS cites the CMPA’s “Electronic Records Handbook,” [9] which states,

When the appropriate steps have been taken, it may be reasonable for practitioners to destroy the original record. However, in exceptional cases, such as when the quality of the paper records makes the converted document difficult to read, it may be prudent to retain the paper records for at least the period of retention recommended by the CMPA: at least 10 years from the date of the last entry or, in the case of minors, 10 years from the date on which the minor reaches the age of majority… The eventual destruction of the paper records should be in keeping with the physician’s obligation of confidentiality as well as any applicable legislative and College requirements. [10]

[50]  RSRS claims that since the electronic version of the records was “thoroughly quality-assured,” there was no need to retain the original paper record. RSRS notes that it,

. . . provides copies of medical records to patients and authorized third parties upon receipt of an authorized (and signed) request. In this case, the complainant has requested for [sic] an original record and has refused to sign a proper release form to authorize the release of a copy. In such a case, it would be a breach of RSRS’ contractual duties to release any information at all to the complainant. [11]

[51]  With its submissions, RSRS provided a copy of Policy #4-12 (Medical Records) of the College of Physicians and Surgeons of Ontario. Among other things, that Policy states, in relation to the conversion of paper records to electronic format:

When a physician converts paper records into an electronic format, the original paper records may be destroyed in accordance with the principles set out in this policy, provided that:

• Written procedures for scanning are developed and consistently followed,

• Appropriate safeguards are used to ensure reliability of digital copies,

• A quality assurance process is established, followed, and documented (e.g., comparing scanned copies to originals to ensure that they have been accurately converted), and

• Scanned copies are saved in “read-only” format.

[52]  The complainant does not disagree that his former physician had the right to scan his original health record and destroy the paper version. As described above, based on his position that RSRS had no right to obtain his records at all, he asserts that RSRS acted wrongfully in converting his paper records.

Analysis

[53]  Above, I find that RSRS is an agent of the estate trustee, a health information custodian. As set out in section 17(1), a health information custodian may delegate its responsibilities over health records to an agent, subject to the requirements set out in that section. One of the requirements is that it can only delegate functions that the custodian is permitted to perform. The Act does not prohibit or prevent a health information custodian from retaining personal health information in an electronic health record. In fact, section 10(3) contemplates that health information custodians may use electronic means to collect, use, modify, disclose, retain or dispose of personal health information:

(3) A health information custodian that uses electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any.

[54]  Further, the Act does not provide individuals with the right to specify that their personal health information may only be retained on paper rather than electronically.

[55]  As noted above, the Act distinguishes between “personal health information” and a “record” containing “personal health information.” Section 13(2) of the Act does not require that a “record” be retained for the purposes of an access request, but only the “information”. This suggests that the legislature did not intend to require that information be retained in a particular format pending the completion of an access request.

[56]  I see nothing in the regulation under the Medicine Act that prevents a health information custodian from converting paper health records to electronic records and destroying the original paper records. Indeed, section 20 of that regulation provides that records may be made and maintained in an electronic computer system. Policy #4-12 (Medical Records) of the College of Physicians and Surgeons of Ontario, quoted above, supports this interpretation. In the context of this complaint, I see no reason to depart from the College of Physicians and Surgeons of Ontario’s interpretation of Ontario Regulation 114/94 under the Medicine Act. [12] Once a record is converted, the retention obligations imposed by that regulation apply to such electronic records and the original paper records may be destroyed.

[57]  The complainant has stated that he specifically told RSRS that he did not wish it to scan his records, as part of his general contention that it had no authority to deal with his records.

[58]  Taking the complainant’s arguments at their highest, this raises a question about whether his objection to the scanning of his record results in a use contrary to section 37(1) of the Act, which states, in part:

A health information custodian may use personal health information about an individual,

(a) for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but not if the information was collected with the consent of the individual or under clause 36 (1) (b) and the individual expressly instructs otherwise;

(b) for a purpose for which this Act, another Act or an Act of Canada permits or requires a person to disclose it to the custodian;

…

(f) in a manner consistent with Part II, for the purpose of disposing of the information or modifying the information in order to conceal the identity of the individual;

…

[59]  “Use” is defined in section 2 of the Act as:

“use”, in relation to personal health information in the custody or under the control of a health information custodian or a person, means to handle or deal with the information, subject to subsection 6(1), but does not include to disclose the information, and “use”, as a noun, has a corresponding meaning.

[60]  Put another way, is converting records of personal health information from paper to electronic format, over the objection of patients, a permitted use under the Act? If the effect of the complainant’s arguments is that it is not, this an unreasonable interpretation of the Act. If this argument were accepted, a patient could prevent a health information custodian from upgrading its records keeping system, or potentially require that the health information custodian maintain a separate records system for particular records of personal health information. This is not practicable.

[61]  Among the purposes of the Act are the establishment of rules, in section 1(a),

...for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care [emphasis added]

[62]  It is evident that having accurate and complete records of personal health information facilitates the effective provision of health care. The Act should not be interpreted so that health information custodians are unable to upgrade or improve the format in which their records are retained. The Act plainly permits health information custodians to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information. I find that the ability to scan a paper record into electronic format is necessarily ancillary to the ability to keep electronic records of personal health information. As such, this use is permitted by section 37(1)(b), quoted above. [13]

[63]  I therefore find no violation of the Act by RSRS in scanning the complainant’s paper patient file and offering to provide a copy of his records on a CD. As noted above, the Act does not require that original records be maintained in any particular format. Further, section 37(1)(f), quoted above, permits the use of personal health information for the disposal of personal health information. As such, I find no violation of the Act in destroying the original records once records have been scanned with appropriate safeguards for quality assurance and accuracy. It goes without saying, however, that given the complainant’s expressed view that he wished to have his original file, misunderstandings and recriminations might have been avoided had RSRS offered to allow him to inspect the paper record before it was scanned and destroyed.

NO ORDER:

For the foregoing reasons, no order is issued.

Original Signed by:		June 8, 2016
Sherry Liang
Assistant Commissioner