PHIPA DECISION 35

HC15-105 and HC15-106

Dr. Fausto Michael Cianfrone

Woodview Medical Pharmacy

November 28, 2016

Summary: The complainants, the daughters of a deceased patient of Dr. Fausto Michael Cianfrone and Woodview Medical Pharmacy (the pharmacy), filed complaints about the pharmacy’s disclosure to Dr. Cianfrone, and Dr. Cianfrone’s concomitant collection, and subsequent use and disclosure, of their mother’s prescription information after her death. This information was relevant to an investigation by the College of Physicians and Surgeons of Ontario into the complainants’ allegations about Dr. Cianfrone’s treatment and care of their mother before her death, particularly in relation to his prescribing of medication to her.

In this decision, the adjudicator dismisses the doctor’s and the pharmacy’s claims that they had the mother’s consent to collect, use and disclose her personal health information after her death. She finds, however, that the collection, use and disclosure were permitted to be made without consent under the Personal Health Information Protection Act, 2004  (the Act ). In particular, she accepts that the pharmacy’s disclosure of the mother’s prescription information to the doctor was permitted to be made without consent under section 39(1) (d) of the Act , which permits the sharing of a patient’s information between health care providers of that patient for quality of care purposes. She finds that the doctor’s collection, use and disclosure of this same information were permitted to be made without consent under sections 36(1)(g) (collection where disclosure permitted or required by law), 37(1)(b) (use for purpose for which disclosure permitted or required by law) and 43(1)(b) (disclosure to a College) of the Act . She concludes that there has been no breach of the Act .

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sched A , as amended, ss 1 (purposes), 2 (definitions), 3(1), 4, 5(1), 18, 20(1), 20(2), 23(1)4, 25, 29, 30, 36(1)(g), 37(1)(b), 39(1)(d), 43(1)(b); O. Reg. 329/04 under the Personal Health Information Protection Act, 2004 , ss. 1(1) , 1(3)  (definitions); Regulated Health Professions Act ,  1991 , SO 1991, c 18 , Schedule 2, ss 2.1, 3, 10, 25, 26.

Decisions Considered: PHIPA Decision 15.

Cases Considered: Banner v. College of Physicians and Surgeons of Ontario, 2012 ONSC 5547.

BACKGROUND:

[1]  The complainants in this matter are the daughters and estate trustees of a former patient of Dr. Fausto Michael Cianfrone. Dr. Cianfrone cared for the complainants’ mother until her death in August 2014.

[2]  After their mother’s death, the complainants filed a complaint with the College of Physicians and Surgeons of Ontario (the College) about Dr. Cianfrone’s treatment and care of their mother while she was his patient. According to Dr. Cianfrone’s legal counsel, the complaint involved allegations about the doctor’s prescribing of medication to their mother, including allegations that he prescribed the wrong medication and prescribed the wrong amount.

[3]  After receiving notice of the complaint from the College in January 2015, Dr. Cianfrone contacted the pharmacy frequented by the complainants’ mother, Woodview Medical Pharmacy (the pharmacy) and requested a copy of the pharmacy’s prescription summary for the mother. The pharmacy responded to the doctor’s request in February 2015 by providing the doctor with the requested information.

[4]  On learning that the pharmacy had released this information to Dr. Cianfrone, the complainants filed complaints with this office against the doctor and the pharmacy. Complaint files HC15-105 and HC15-106 were opened to address the actions of the doctor and the pharmacy, respectively.

[5]  Complaint HC15-105 involves the complainants’ allegation that Dr. Cianfrone collected their mother’s personal health information from the pharmacy in violation of the Personal Health Information Protection Act, 2004 (the Act). Complaint HC15-106 involves the complainants’ allegation that the pharmacy disclosed their mother’s personal health information to Dr. Cianfrone in violation of the Act. In both cases, the complainants believe that their consent was required for any collection, use and disclosure of their mother’s personal health information after her death.

[6]  Prior to the adjudication stage of the complaint process, lawyers for Dr. Cianfrone and for the pharmacy provided some background on the circumstances of the collection, use and disclosure of the mother’s information at issue in the complaints. Legal counsel for Dr. Cianfrone explained that after receiving notice of the College complaint, Dr. Cianfrone sought a copy of the mother’s prescription summary from the pharmacy in order to have a complete record of the mother’s intake of medication. This was necessary because although the doctor kept records of the medications he had prescribed to the mother, his records would not indicate whether or how often the mother had filled any refills indicated on the prescriptions. In addition to this collection, Dr. Cianfrone acknowledged having used, and disclosed to the College, this same information for the purpose of responding to the College’s investigation of the complainants’ allegations. Legal counsel for the pharmacy clarified that the only information disclosed by the pharmacy to Dr. Cianfrone was information about the prescriptions that had been issued directly by him.

[7]  Both Dr. Cianfrone and the pharmacy confirmed that they were aware of mother’s death at the time of the collection, use and disclosure in question. They maintained that their handling of the mother’s personal health information was done in accordance with the Act . In particular, Dr. Cianfrone took the position that he was permitted to collect the mother’s personal health information on the basis of assumed implied consent, as he is within the circle of care for the mother. Alternatively, he claimed that he was entitled under the Act  to collect, use and disclose the information without consent. The pharmacy took the position that it had the mother’s express consent to disclose her personal health information to Dr. Cianfrone. Alternatively, the pharmacy claimed that it was entitled to disclose her personal health information without consent under the Act .

[8]  The complainants maintained their objection to the collection, use and disclosure of their mother’s personal health information without their consent after her death.

[9]  As no mediation was possible, both complaint files were transferred to the adjudication stage of the complaint process and I commenced reviews under section 57(3) of the Act . In the course of conducting the two reviews, I sought and received representations from the doctor, the pharmacy and the complainants. Given the overlap in the issues and the parties, I have decided to dispose of both reviews in one decision.

[10]  In the discussion that follows, I find that the collection, use and disclosure of the mother’s personal health information at issue in these complaints were made in accordance with the Act . While I reject the claims that the mother’s personal health information was collected, used and disclosed after her death with her consent, I conclude that the doctor and the pharmacy were permitted under the Act  to collect, use and disclose her personal health information without consent. Specifically, I find that the pharmacy’s disclosure of the mother’s personal health information to the doctor was permitted to be made without consent under section 39(1)(d) (disclosure to improve quality of care) of the Act , and that the doctor’s collection, use and disclosure of this same information were permitted to be made without consent under sections 36(1)(g) (collection where disclosure permitted or required by law), 37(1)(b) (use for purpose for which disclosure permitted or required by law) and 43(1)(b) (disclosure to a College) of the Act . I conclude, therefore, that there has been no breach of the Act .

PRELIMINARY MATTERS

[11]  The Act  establishes rules for the handling of individuals’ personal health information within the health sector. This includes rules for the collection, use and disclosure of this information by health information custodians, as those terms are defined in the Act .

[12]  The parties do not dispute that the issues in these complaints are governed by the Act . The doctor and the person who operates the pharmacy are “health information custodians” within the meaning of section 3(1) of the Act . [1] I am satisfied that the information at issue in these complaints—the summary of the complainants’ mother’s prescriptions compiled by the pharmacy—constitutes the mother’s “personal health information” within the meaning of section 4 of the Act . [2]

[13]  The parties also agree, and I find, that the issues in these complaints involve the collection, use and disclosure of the mother’s personal health information, as those terms are defined at section 2 of the Act :

“collect”, in relation to personal health information, means to gather, acquire, receive or obtain the information by any means from any source, and “collection” has a corresponding meaning;

“disclose”, in relation to personal health information in the custody or under the control of a health information custodian or a person, means to make the information available or to release it to another health information custodian or to another person, but does not include to use the information, and “disclosure” has a corresponding meaning; [3]

“use”, in relation to personal health information in the custody or under the control of a health information custodian or a person, means to handle or deal with the information, subject to subsection 6 (1), but does not include to disclose the information, and “use”, as a noun, has a corresponding meaning. [4]

[14]  Finally, there is no dispute in these complaints about the status of the complainants as estate trustees for their deceased mother. While any person with reasonable grounds to believe that another person has contravened the Act  may make a complaint to this office, [5] the complainants’ status as estate trustees is relevant to their arguments about their authority to consent to the collection, use or disclosure of their mother’s personal health information after her death. I will address this matter at Issue A, below.

ISSUES:

1. Was the pharmacy’s disclosure, and the doctor’s collection, use and disclosure, of the mother’s personal health information made with consent?
2. Was the pharmacy’s disclosure of the mother’s personal health information to the doctor permitted to be made without consent under section 39(1)(d) (disclosure to improve quality of care) of the Act ?

Were the doctor’s collection, use and disclosure of the mother’s personal health information permitted or required to be made without consent under the Act ?

DISCUSSION:

A.  Was the pharmacy’s disclosure, and the doctor’s collection, use and disclosure, of the mother’s personal health information made with consent?

[15]  One of the purposes of the Act  is to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals, while facilitating the effective provision of health care. [6] One of the ways in which the Act  achieves this purpose is by requiring that collections, uses and disclosures of personal health information occur with the consent of the individual to whom the information relates, except in limited cases.

[16]  Section 29 of the Act  states:

A health information custodian shall not collect, use or disclose personal health information about an individual unless,

(a) it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or

(b) the collection, use or disclosure, as the case may be, is permitted or required by this Act .

[17]  Counsel for Dr. Cianfrone takes the position that the pharmacy’s disclosure and his collection of the mother’s personal health information were made on the basis of assumed implied consent.

[18]  Counsel for the pharmacy asserts that the mother’s personal health information was disclosed by the pharmacy to Dr. Cianfrone on the basis of the mother’s express consent.

[19]  Part III of the Act addresses consent for the collection, use or disclosure of personal health information, and the types of consent that are required in particular circumstances.

[20]  Section 18 sets out the requirements for a valid consent under the Act . The consent must come from the individual to whom the information relates, must be knowledgeable, must relate to the information, and must not be obtained through deception or coercion. [7] Consent is knowledgeable if it is reasonable in the circumstances to believe that the individual knows the purpose of the given collection, use or disclosure, and that she may give or withhold consent. [8]

[21]  A consent to the disclosure of one’s personal health information may be express or implied, unless the Act  requires express consent. [9] For example, a consent to the disclosure of personal health information by one health information custodian to another must be express, and not implied, where the disclosure is not made for the purposes of providing health care or assisting in providing health care. [10] By contrast, a health information custodian may rely on an individual’s implied consent to disclose personal health information to another health information custodian, and the receiving custodian may rely on the individual’s implied consent to collect, use and disclose (to another health information custodian) that personal health information, if the purpose of the collection, use or disclosure is to provide health care or to assist in providing health care. Unless it is not reasonable in the circumstances, a health information custodian who has obtained a consent is entitled to assume that the consent fulfils the requirements of the Act and that the individual has not withdrawn the consent. [11] In addition, where specified conditions are met, certain health information custodians are entitled to assume that they have an individual’s implied consent.

[22]  Dr. Cianfrone takes the position that he and the pharmacy were entitled to assume they had the mother’s implied consent, as he and the pharmacy are both within the mother’s “circle of care” and may therefore rely on section 20(2) of the Act .

[23]  The term “circle of care” is not defined in the Act . It has been used to describe the provisions of the Act  that enable certain health information custodians to assume an individual’s implied consent. Section 20(2) of the Act  specifies when implied consent may be assumed:

A health information custodian described in paragraph 1, 2, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), that receives personal health information about an individual from the individual, the individual’s substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the individual, is entitled to assume that it has the individual’s implied consent to collect, use or disclose the information for the purposes of providing health care or assisting in providing health care to the individual, unless the custodian that receives the information is aware that the individual has expressly withheld or withdrawn the consent.

[24]  In order to rely on assumed implied consent to collect, use or disclose personal health information, therefore, the following conditions must be met:

• the health information custodian must fall within a particular category of health information custodians; and
• the health information custodian must receive the personal health information from the individual to whom the information relates, or that individual’s substitute decision-maker or another health information custodian; and
• the health information custodian must receive that information for the purpose of providing health care or assisting in the provision of health care to the individual; and
• the purpose of the health information custodian’s collection, use or disclosure of that information must be for the purposes of providing health care or assisting in providing health care to the individual; and
• in the context of a disclosure, the disclosure of personal health information by the health information custodian must be to another health information custodian; [12] and
• the health information custodian that receives the information must not be aware that the individual to whom the personal health information relates has expressly withheld or withdrawn the consent.

[25]  In my Notice of Review to Dr. Cianfrone, I asked him to explain how these conditions were met in the circumstances of the pharmacy’s disclosure to him, and his collection from the pharmacy, of the mother’s personal health information after the mother’s death.

[26]  In response, Dr. Cianfrone submits that “the concept of ‘health care’ in this context must be defined broadly, to include the steps health care providers typically take after a patient’s death.” He cites the following extract from PHIPA Decision 15 of this office in support of the proposition that the definition of “health care” in section 20(2) ought to be given a wide interpretation:

The policy behind [subsection 20(2)] is to facilitate collections, uses and disclosures of personal health information in the health system that individuals generally expect to occur without express consent. [13]

[27]  Dr. Cianfrone reports that it is a common practice for family physicians to receive, from individuals or organizations within a patient’s circle of care, medical information about the patient after the patient’s death; he cites as examples hospital records and autopsy reports. He argues that a strict definition of the concept of “health care” in the Act  could disentitle physicians from receiving such information, which, he argues, physicians require for purposes including to consider issues arising from the death.

[28]  He also maintains that the other conditions for the application of section 20(2) have been met. He submits, therefore, that he and the pharmacy were entitled to assume the mother’s implied consent for their handling of her personal health information after her death.

[29]  The pharmacy acknowledges that its disclosure of the mother’s personal health information to Dr. Cianfrone was not made for the purpose of providing health care, and it does not principally claim that it could assume her implied consent for this disclosure. [14] Instead, the pharmacy takes the position (in the alternative to its main claim, which I address at Issue B, below) that its disclosure to Dr. Cianfrone of the mother’s personal health information was made with her express consent. This is based on an argument that a patient’s submission of a doctor’s prescription to a pharmacy may be treated as the patient’s express consent to future disclosures of her prescription information by the pharmacy to the prescribing doctor, including for non-health care purposes.

[30]  “Health care” is defined at section 2 of the Act  as:

... any observation, examination, assessment, care, service or procedure that is done for a health‑related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

(c) is carried out or provided as part of palliative care,

and includes

(d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and

(e) a community service that is described in subsection 2 (3) of the Home Care and Community Services Act, 1994 and provided by a service provider within the meaning of that Act [.]

[31]  Regulations made under the Act  add that “a procedure that is done for a health-related purpose” includes taking a donation of blood or blood products from an individual. [15]

[32]  I reject Dr. Cianfrone’s arguments that the collection and disclosure of the mother’s personal health information at issue in these complaints was done for the purpose of “providing health care or assisting in providing health care” to the mother, as required by section 20(2) of the Act . For one, the Act  limits the definition of health care to actions done for a “health-related purpose.” It cannot be said that the pharmacy’s disclosure or Dr. Cianfrone’s collection of the mother’s personal health information after her death were done for a health-related purpose, in order to provide the mother with health care six months after her death. Although Dr. Cianfrone reports that he regularly receives medical reports such as autopsy reports or hospital records from health information custodians after a patient’s death, he has not provided a basis for concluding that this is done on the basis of assumed implied consent, and that I thus ought to find that the sharing of this information is done for the purposes of providing health care or assisting in providing health care to deceased patients. Nor has Dr. Cianfrone provided any evidence to suggest that individuals would generally expect such disclosures after death to occur without express consent. If the Legislature had intended that “health care” to individuals include actions undertaken after their deaths, it could have specified so.

[33]  A purposive reading of the Act  also supports a narrower, rather than a broader, reading of “health care.” As noted, one of the purposes of the Act  is to protect the confidentiality of individuals’ personal health information and individuals’ privacy, while at the same time facilitating the effective provision of health care. In the extract from PHIPA Decision 15 cited by Dr. Cianfrone, the adjudicator observes that the policy behind section 20(2) is to facilitate collections, uses and disclosures of personal health information within the health system that individuals generally expect to occur without the need for express consent. Dr. Cianfrone proposes that this policy supports a broad interpretation of “health care to the individual” that would include steps taken by health care providers after an individual’s death. I do not agree. In a portion of PHIPA Decision 15 not cited by Dr. Cianfrone, the adjudicator went on to observe that a broad interpretation of “health care” would enlarge the scope of personal health information that could be collected, used or disclosed without express consent in other circumstances; she suggested that such a reading could conflict with individuals’ expectations and the policy behind section 20(2).

[34]  I agree that an overbroad reading of “health care” in the Act  could run contrary to most people’s expectations about allowable collections, uses and disclosures of their personal health information without express consent. For instance, I would not expect most people to characterize the collection, use and disclosure of their personal health information after their deaths as being done for the purpose of providing, or assisting in providing, health care to them, or that their personal health information could be collected, used and disclosed after their deaths on the basis of their assumed implied consent.

[35]  Given this, I find that the pharmacy was not entitled to rely on assumed implied consent to disclose the mother’s personal health information to Dr. Cianfrone after the mother’s death, and that Dr. Cianfrone was not entitled to rely on assumed implied consent to collect this information from the pharmacy after her death.

Similarly, I reject the pharmacy’s argument that it had obtained an express consent to disclose the mother’s personal health information to Dr. Cianfrone. While the Act does not define express consent, this office has described express consent as an oral or written consent that has been clearly and unmistakably given by an individual. [16] The Guide to the Ontario Personal Health Information Protection Act describes express consent as a consent that the patient explicitly or positively states in some manner, whether in writing or orally—for example, by signing a document, filling out a form, or making an explicit oral statement. [17] I agree with these characterizations of express consent for the purposes of the Act  as requiring an explicit indication, oral or written, on the part of the individual about her intentions regarding the collection, use or disclosure of her personal health information.

[36]  Applying this concept, I reject the pharmacy’s claim that the mother’s act of submitting Dr. Cianfrone’s prescriptions to the pharmacy amounts to a clear and unmistakable expression of the mother’s consent to the pharmacy’s disclosure of her prescription summary to Dr. Cianfrone for non-health care purposes after her death. There is no obvious connection between the act of submitting a prescription and the pharmacy’s disclosure of her personal health information to Dr. Cianfrone after her death. The pharmacy has provided no other evidence that the mother gave an express consent to this disclosure that fulfills all the elements of consent. [18]

[37]  Neither respondent claims to have relied on the mother’s implied consent (as opposed to express or assumed implied consent) in order to collect, use or disclose her personal health information. I acknowledge that, unlike section 20(2), section 18(3) does not explicitly require that the provision of “health care” be to the individual to whom the personal health information relates. Arguably, the respondents could have submitted that sections 18(2) and 18(3) of the Act  permit the disclosure of personal health information on the basis of implied consent for the purpose of providing, or assisting in providing, health care to an individual other than the individual to whom the personal health information relates. For the reasons that follow, I do not have decide this issue of statutory interpretation in this case.

[38]  In order to rely on implied consent, a health information custodian must ensure that all the required elements of consent are fulfilled. I found it unreasonable in the circumstances to conclude that Dr. Cianfrone or the pharmacy had obtained the mother’s consent; given this, the assumption of validity of consent at section 20(1) of the Act  has no application. I would also find it unreasonable to assume that any alleged consent meets the requirements of the Act . Both the pharmacy and the doctor have acknowledged that they were aware of the mother’s death at the time of the collection, use and disclosure at issue in these complaints. Neither party has provided a basis for believing that, before her death, the mother gave a knowledgeable consent (or that the pharmacy and the doctor could assume the mother’s knowledgeable consent) to the pharmacy’s disclosure and Dr. Cianfrone’s collection, use and disclosure of her personal health information after her death for the purpose of providing health care to other individuals, or to respond to a College investigation about allegations about the care the doctor provided to her, or for any other purpose.

[39]  I therefore reject the claims that the collection, use and disclosure of the mother’s personal health information at issue in these complaints were made on the basis of the mother’s express or implied consent given before her death. I also observe that consent in relation to the mother’s personal health information can only be given after her death by the complainants, as her substitute decision-makers under the Act . [19] The complainants deny having consented to any collection, use or disclosure of their mother’s personal heath information on her behalf, and the doctor and the pharmacy do not claim they sought, or that they had, consent from the complainants after their mother’s death.

[40]  Having found that the collection, use and disclosure at issue in these complaints were not made on the basis of consent, I will next consider the pharmacy’s main argument, and the doctor’s alternative argument, that the collection, use and disclosure were permitted or required by the Act  to be made without consent.

B.  Was the pharmacy’s disclosure of the mother’s personal health information to the doctor permitted to be made without consent under section 39(1)(d) (disclosure to improve quality of care) of the Act?

Were the doctor’s collection, use and disclosure of the mother’s personal health information permitted or required to be made without consent under the Act?

[41]  Sections 38-48 and 50 of the Act  set out circumstances in which health information custodians are permitted or required to disclose personal health information of an individual without consent. Both the pharmacy and Dr. Cianfrone claim the pharmacy was permitted to disclose the mother’s personal health information to the doctor without consent on the basis of section 39(1)(d). This section states:

39. (1) Subject to the requirements and restrictions, if any, that are prescribed, a health information custodian may disclose personal health information about an individual,

(d) where,

(i) the disclosure is to another custodian described in paragraph 1, 2, 3 or 4 of the definition of “health information custodian” in subsection 3 (1),

(ii) the individual to whom the information relates is one to whom both the disclosing custodian and recipient custodian provide health care or assist in the provision of health care or have previously provided health care or assisted in the provision of health care, and

(iii) the disclosure is for the purpose of activities to improve or maintain the quality of care provided by the receiving custodian to the individual to whom the information relates or individuals provided with similar health care.

[42]  The pharmacy maintains that all these conditions were met in the case of its disclosure of the mother’s prescription summary to Dr. Cianfrone. It observes that Dr. Cianfrone is a health information custodian within the meaning of paragraph 1 of the definition at section 3(1) of the Act , and that the mother is an individual to whom both the pharmacy and the doctor provided health care before her death.

[43]  The pharmacy also asserts that the disclosure was made for the purpose of improving the quality of care provided by the doctor to other patients to whom he provides health care similar to the care he provided to the mother.

[44]  Dr. Cianfrone explains that he needed the mother’s personal health information in order to respond to the College of Physicians and Surgeons of Ontario in its review of the allegations made by the complainants against him about the care he provided to their mother. These allegations, including claims that he improperly prescribed medication to the complainants’ mother and that he prescribed the wrong amount, were investigated by the College’s Inquiries, Complaints and Reports Committee. [20] Dr. Cianfrone explains that he requested from the pharmacy personal health information of the mother that precisely addresses the issue of medication use, which was central to the College’s investigation, and that he used, and disclosed to the College, this same information in connection with this investigation.

[45]  The authority, role and powers of the College are set out in the Regulated Health Professions Act, [21] the Health Professions Procedural Code (the Code) [22] and the Medicine Act ,  1991 . [23] The duty and objects of the College are set out at sections 2.1 and 3 of the Code:

2.1 It is the duty of the College to work in consultation with the Minister to ensure, as a matter of public interest, that the people of Ontario have access to adequate numbers of qualified, skilled and competent regulated health professionals.

3. (1) The College has the following objects:

1. To regulate the practice of the profession and to govern the members in accordance with the health profession Act , this Code and the Regulated Health Professions Act, 1991  and the regulations and by-laws.

2. To develop, establish and maintain standards of qualification for persons to be issued certificates of registration.

3. To develop, establish and maintain programs and standards of practice to assure the quality of the practice of the profession.

4. To develop, establish and maintain standards of knowledge and skill and programs to promote continuing evaluation, competence and improvement among the members.

4.1 To develop, in collaboration and consultation with other Colleges, standards of knowledge, skill and judgment relating to the performance of controlled acts common among health professions to enhance interprofessional collaboration, while respecting the unique character of individual health professions and their members.

5. To develop, establish and maintain standards of professional ethics for the members.

6. To develop, establish and maintain programs to assist individuals to exercise their rights under this Code and the Regulated Health Professions Act, 1991 .

7. To administer the health profession Act , this Code and the Regulated Health Professions Act, 1991  as it relates to the profession and to perform the other duties and exercise the other powers that are imposed or conferred on the College.

8. To promote and enhance relations between the College and its members, other health profession colleges, key stakeholders, and the public.

9. To promote inter-professional collaboration with other health profession colleges.

10. To develop, establish, and maintain standards and programs to promote the ability of members to respond to changes in practice environments, advances in technology and other emerging issues.

11. Any other objects relating to human health care that the Council considers desirable.

(2) In carrying out its objects, the College has a duty to serve and protect the public interest.

[46]  The Inquiries, Complaints and Reports Committee of the College is established under the Code to investigate complaints about physicians’ care and conduct. The committee is required to dispose of investigations with a decision. This may include a decision to caution a physician, to refer allegations to the College’s Discipline Committee, or to require a physician to complete a specified education or remediation program. [24] In this way, Dr. Cianfrone suggests, the committee’s work serves the College’s broader mandate to maintain and improve the quality of care for the public, which includes other patients to whom Dr. Cianfrone provides health care.

[47]  In order for section 39(1)(d) to apply, the following conditions must be met:

• the disclosure must be made by one health information custodian to another custodian described in paragraph 1, 2, 3 or 4 of section 3(1); and
• the individual to whom the information relates must be one to whom both health information custodians provide (or assist in providing) or previously provided (or assisted in providing) health care; and
• the disclosure must be for the purpose of activities to improve or maintain the quality of care provided by the receiving custodian to the individual to whom the information relates, or to individuals provided with similar health care.

[48]  With respect to the disclosure by the pharmacy to Dr. Cianfrone, I accept that the first two conditions have been met. The disclosure was made by the pharmacy, a health information custodian, to Dr. Cianfrone, a health information custodian described in paragraph 1 of section 3(1) of the Act . There is no dispute that both the pharmacy and Dr. Cianfrone provided health care to the complainants’ mother while she was living.

[49]  I am also satisfied that the pharmacy’s disclosure of the mother’s personal health information to Dr. Cianfrone was made for “the purpose of activities to improve or maintain the quality of care” provided by Dr. Cianfrone to other patients to whom he provides health care similar to that he provided to the complainants’ mother, and, as such, is a permissible disclosure under section 39(1)(d). This is because I accept that the quality of care purpose in section 39(1)(d) encompasses activities of the College in furtherance of its general mandate to ensure and to improve the quality of care provided by its member physicians to the public. One of the ways in which the College achieves this mandate is by investigating complaints about physicians’ care and conduct, and, where appropriate, requiring physicians to complete education or remediation programs. [25] The College’s important duty to serve and protect the public interest, and the public interest purposes of such programs under the Code, have been recognized by the Divisional Court. [26] Dr. Cianfrone maintains, and the complainants do not deny, that he requested their mother’s prescription information from the pharmacy in order to respond to the College in its investigation of their allegations about the care he provided to their mother. The information that he sought from the pharmacy, and that the pharmacy disclosed to him, was directly relevant to the quality of care issue being investigated by the College.

[50]  The complainants argue that Dr. Cianfrone ought to have had up-to-date prescription information for their mother in his own records, and that this should have obviated any need for him to request this information from the pharmacy. The complainants cite sections of the College’s policy on medical records that refer to the need for members to maintain complete and accurate medical records that meet legal, regulatory and auditing requirements. [27] I find this argument unconvincing. I accept Dr. Cianfrone’s evidence that the pharmacy could reasonably be expected to have additional information about their mother’s prescription history—namely, about whether the mother had filled the prescriptions he had written for her, and the frequency of any refills—that he would not have in his own records, and that would be directly relevant to the subject matter of the College’s investigation. Based on the evidence before me, I accept that the pharmacy only disclosed to Dr. Cianfrone personal health information of the complainant’s mother that was directly relevant to this purpose, and no other personal health information. Given this, I am satisfied that the pharmacy’s disclosure (and Dr. Cianfrone’s consequent collection and subsequent use and disclosure) of the mother’s personal health information were made in accordance with the data minimization principle at section 30 of the Act . [28]

[51]  In summary, I accept that the pharmacy’s disclosure to Dr. Cianfrone of the complainant’s mother’s prescription information was made for the purpose of enabling the doctor to participate in the College’s investigation of allegations about the quality of care he provided to the complainants’ mother. I also accept that, in accordance with the College’s mandate, a broader purpose of the College’s activities in investigating complaints about the quality of care provided by a member physician is to improve or maintain the quality of care provided by its members to the general public. On this basis, I am satisfied that the pharmacy’s disclosure of the mother’s personal health information to Dr. Cianfrone was made for the purpose of activities to improve or maintain the quality of care provided by Dr. Cianfrone to his patients, including individuals to whom he provides health care similar to that provided to the complainants’ mother. I conclude that this disclosure fits within the broad wording of section 39(1)(d) of the Act . I observe that this finding is in keeping with section 9(2) of the Act , which sets out a number of matters with which the Act  shall not be construed to interfere, including, at paragraph (e), the regulatory activities of the College. [29]

[52]  Having found that the pharmacy’s disclosure of the mother’s personal health information to Dr. Cianfrone was permitted to be made without consent under the Act , I find that Dr. Cianfrone’s concomitant collection of this same information, and his subsequent use and disclosure of this information, were also permitted to be made without consent under the Act .

[53]  Specifically, Dr. Cianfrone’s collection of the mother’s personal health information was permitted to be made without consent under section 36(1)(g) of the Act , which states:

36. (1) A health information custodian may collect personal health information about an individual indirectly if,

(g) the custodian collects the information from a person who is permitted or required by law or by a treaty, agreement or arrangement made under an Act  or an Act of Canada to disclose it to the custodian[.]

[54]  As I found the pharmacy’s disclosure of personal health information to Dr. Cianfrone was permitted to be made under section 39(1)(d) of the Act , the doctor’s collection of this same information is permitted under section 36(1)(g).

[55]  Dr. Cianfrone also used, and disclosed to the College, the mother’s personal health information for the same purpose for which the pharmacy disclosed this information to him—namely, to respond to the College’s investigation into the quality of care he provided to the complainants’ mother. In these circumstances, I find that Dr. Cianfrone’s use of this information was permitted to be made without consent under section 37(1)(b) of the Ac t . This section states:

37. (1) A health information custodian may use personal health information about an individual,

(b) for a purpose for which this Act , another Act  or an Act of Canada permits or requires a person to disclose it to the custodian;

[56]  I also accept Dr. Cianfrone’s claim that his disclosure of the mother’s personal health information to the College in the course of its investigation was permitted to be made without consent under section 43(1)(b) of the Act . This section states:

43. (1) A health information custodian may disclose personal health information about an individual,

(b) to a College within the meaning of the Regulated Health Professions Act, 1991  for the purpose of the administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991  or an Act  named in Schedule 1 to that Act [.]

[57]  I therefore find that the pharmacy’s disclosure to Dr. Cianfrone and Dr. Cianfrone’s collection, use and disclosure of the complainants’ mother’s personal health information were permitted to be made without consent under the above-noted sections of the Act . [30]

[58]  I observe that these sections of the Act  are discretionary. In determining whether to collect, use or disclose personal health information without consent under these sections, a health information custodian must exercise its discretion, and must do so based on proper considerations. I am satisfied that the pharmacy and the doctor exercised their discretion under these sections, and did so properly. The pharmacy and the doctor provided reasonable explanations for their handling of the mother’s personal health information without consent, and, in doing so, limited the amount of personal health information to the minimum amount that would serve the purpose of the collection, use and disclosure. There is no evidence that the pharmacy or the doctor acted in bad faith or for an improper purpose, or exercised their discretion based on irrelevant considerations. I uphold their exercise of discretion under the Act .

[59]  In conclusion, I find that the pharmacy’s disclosure, and Dr. Cianfrone’s collection, use and disclosure, of the complainants’ mother’s personal health information were permitted to be made without consent under the Act . I find there has been no breach of the Act .

NO ORDER:

For the foregoing reasons, no order is issued.

Original signed by:		November 28, 2016
Jenny Ryu
Adjudicator