PHIPA DECISION 54

HC15-74

Dr. Philip Solomon

September 29, 2017

Summary: The complainant, a patient of Dr. Philip Solomon, requested that Dr. Solomon disclose to another health information custodian records of her personal health information relating to a specified treatment. The complainant subsequently amended her consent in a number of follow-up communications with Dr. Solomon and his office.

In this decision, the adjudicator makes findings on the scope of the complainant’s consent to the disclosure of her personal health information following various amendments to her consent. The adjudicator concludes that Dr. Solomon disclosed to the recipient doctor some personal health information of the complainant outside the scope of the complainant’s consent, and in contravention of the Personal Health Information Protection Act, 2004. Dr. Solomon is ordered to develop and implement a written information practice that addresses how consents from patients to the disclosure of their personal health information are to be processed, documented and clarified.

Statutes Considered: Personal Health Information Protection Act, 2004, ss. 2 (definitions), 3, 4, 10(1) and (2), 18, 19, 29.

INTRODUCTION:

[1]  The complainant was a patient of Dr. Philip Solomon. In May 2015, the complainant sought an initial consultation with another doctor, and for this purpose asked Dr. Solomon to release records of her personal health information to the other doctor (the recipient doctor). The complainant alleges that Dr. Solomon disclosed to the recipient doctor more personal health information than she had consented to being disclosed. The complainant also alleges that Dr. Solomon failed to properly document the information that he disclosed to the recipient doctor, and that such failure is a contravention of the Personal Health Information Protection Act, 2004 (the Act).

[2]  As the parties were unable to resolve the issues through mediation, the complaint was transferred to the adjudication stage of the complaint process, and the previous adjudicator commenced a review under section 57(3) of the Act. During the course of her review, which was conducted in writing, she sought and received representations from Dr. Solomon, who was represented by legal counsel, and from the complainant. ^[1] Among other things, the parties were asked to comment on the scope of the complainant’s consent to the disclosure of her personal health information by Dr. Solomon to the recipient doctor, including the effect of certain amendments made by the complainant in relation to her consent, and on whether the Act requires health information custodians to maintain documentation of disclosures of personal health information.

[3]  The file was then transferred to me to complete the review.

[4]  In this decision, I conclude that Dr. Solomon disclosed some personal health information of the complainant outside the scope of her consent, and that the disclosure of this information was made in contravention of the Act. I issue an order to address the contravention.

BACKGROUND:

[5]  On May 12, 2015, the complainant sent Dr. Solomon a form entitled “Authorization to Release Information,” in which she consented to the release by Dr. Solomon to the recipient doctor of:

All of the information in regards to radiesse filler, all of the clinical notes and reports including the requested correction of the clinical notes and reports.

Please include requested corrections of the clinical notes.

[6]  The complainant asserts that on May 25, 2015, she spoke with Dr. Solomon’s receptionist regarding this consent, and that she clearly identified that only information relating to Radiesse should be disclosed to the recipient doctor.

[7]  The complainant asserts that on June 8 and 9, 2015, she requested via email that Dr. Solomon not release any of her personal health information to the recipient doctor prior to her review. The complainant reports that although Dr. Solomon’s office subsequently contacted her to advise her that the records were ready for pickup, she attended the office and was told that the file was not ready.

[8]  The complainant reports that on June 18, 2015, the recipient doctor’s secretary informed her via email that “Dr. Solomon’s office has notified me that you have withdrawn consent” to the release of her records to the recipient doctor.

[9]  The complainant reports that she sought an explanation from Dr. Solomon, and was advised by his receptionist that nothing had been sent to the recipient doctor based on Dr. Solomon’s understanding that the complainant had refused to pick up a copy of her records, and that she had orally withdrawn her consent to disclosure of her records to the recipient doctor.

[10]  The complainant denies that she refused to pick up a copy of her records or that she orally withdrew her consent to disclosure to the recipient doctor.

[11]  On June 23, 2015, the complainant had an email exchange with Dr. Solomon. In an email time-stamped “10:57 AM,” the complainant wrote:

For the third time.

Please I [ask] you to send everything in my chart in regards to my treatments with radiesse to [the recipient doctor].

They have not received anything until today.

[12]  In an email time-stamped “14:28,” Dr. Solomon responded “Ok.”

[13]  In an email time-stamped “14:42,” the complainant wrote:

Send everything in regards to radiesse the story on clinical notes that was composed by you. Don’t send nothing of my requested corrections, don’t include my request. That part needs to be dealt with IPC.

[14]  On June 24, 2015, the recipient doctor’s office advised the complainant that it had received her records from Dr. Solomon.

[15]  On the same day, the complainant requested confirmation from Dr. Solomon of the information disclosed to the recipient doctor.

[16]  Dr. Solomon responded by email, stating: “[I]t was a copy of chart excluding your notes.” ^[2]

[17]  On June 26, 2015, the complainant picked up from Dr. Solomon’s office a package containing what Dr. Solomon described, in an email dated that same day, as “a package at the office with everything for you to pickup. It’s what was sent to your treating Dr.”

[18]  The complainant reports that she received copies of two faxes sent by Dr. Solomon to the recipient doctor dated June 23 and June 26, 2015, with fax cover pages indicating that the transmittals consisted of 88 pages and 18 pages, respectively. Upon review of this package, the complainant identified portions of her health records that she believes were disclosed by Dr. Solomon to the recipient doctor without her consent.

[19]  On this basis, the complainant filed a complaint with this office.

[20]  During the mediation stage, counsel for Dr. Solomon provided the following response to the complainant’s allegation of improper disclosure: ^[3]

All visits and interactions with Dr. Solomon were in relation to aesthetic procedures which included Radiesse treatment, and [the complainant’s] subsequent reaction to same. Any clinical notes and records are medical information arising from [the complainant’s] Radiesse injections, and related treatments, which in the custodian’s submissions are relevant to her ongoing care and were appropriately provided to [the recipient doctor] pursuant to her consent. In addition, [the complainant] requested all her clinical notes be sent to [the recipient doctor] (which by necessity relate to Radiesse) and include the examples provided by her which she alleges were improperly sent (clinical notes of December 3 and 23, 2014).

[21]  During the mediation stage, the mediator identified that the copy of the complainant’s health records provided by Dr. Solomon to this office ^[4] includes: a fax cover page addressed from Dr. Solomon’s office to the recipient doctor dated June 23, 2015, indicating a total transmittal of 88 pages; and a fax cover page addressed from Dr. Solomon’s office to the recipient doctor dated June 26, 2015, indicating a total transmittal of 18 pages. These fax cover pages are followed by 87 pages and 17 pages of records, respectively, for total page counts of 88 pages and 18 pages, respectively.

[22]  The mediator reported on his review of the records in his revised mediator’s report. As he indicated in his report, however:

The custodian [Dr. Solomon, through his legal counsel] informed the mediator that it could not confirm exactly what information from the patient’s health record was disclosed via the June 23, 2015 fax to [the recipient doctor] because a copy was not retained.

[23]  In the complainant’s view, this contradicts Dr. Solomon’s assurance to her that the package she picked up from his office on June 26, 2015 is a copy of what was sent to the recipient doctor.

[24]  Based on this, the complainant takes the position that Dr. Solomon failed to document the information he disclosed to the recipient doctor. She alleges that his failure to have done so is a contravention of the Act.

[25]  Dr. Solomon’s legal counsel confirms that disclosures occurred on June 23, 2015 (of 88 pages) and June 26, 2015 (of 18 pages). In response to a request for representations on the matter of record-keeping, his legal counsel states:

Contrary to the allegation of [the complainant], copies of the records were retained and are in [the complainant’s] medical record.

[26]  Counsel for Dr. Solomon also asserts:

[The complainant] was subsequently provided a copy of the medical records that was sent from Dr. Solomon’s office to [the recipient doctor].

[27]  and that:

I understand the IPC has a copy of same.

[28]  Given these statements, Dr. Solomon was asked to specify whether he is able to confirm what information he disclosed to the recipient doctor. It was brought to his attention that the account of events agreed upon at mediation indicates that Dr. Solomon was unable to confirm what information had been disclosed, because his office had not retained copies of the transmittals to the recipient doctor.

[29]  In response, counsel for Dr. Solomon states:

Dr. Solomon did not need to make a copy of the facsimile as the records that were sent were bundled together in the patient file. A copy would be redundant. The IPC has a copy of [the complainant’s] medical records…

[30]  Based on this submission, I accept that the copy of the records provided by Dr. Solomon to this office accurately reflects the information disclosed by Dr. Solomon to the recipient doctor. Specifically, I find that the June 23, 2015 fax cover page and the 87 pages of records appearing directly following this page is an accurate reflection of the 88-page disclosure from Dr. Solomon to the recipient doctor on June 23, 2015. Similarly, I find that the June 26, 2015 fax cover page and the 17 pages of records appearing directly following that page is an accurate reflection of the 18-page disclosure from Dr. Solomon to the recipient doctor on June 26, 2015.

RECORDS:

[31]  At issue in this complaint are the records disclosed by Dr. Solomon to the recipient doctor by fax on June 23 and 26, 2015. Through his legal counsel, Dr. Solomon has confirmed that these records comprise:

• A fax cover page dated June 23, 2015 followed by 87 pages of records of the complainant’s personal health information (total transmittal of 88 pages); and
• A fax cover page dated June 26, 2015 followed by 17 pages of records of the complainant’s personal health information (total transmittal of 18 pages).

DISCUSSION:

[32]  I begin with the preliminary finding that Dr. Solomon is a “health information custodian” in relation to the complainant’s personal health information of which he has custody or control “as a result of or in connection with” his role as a health care practitioner. ^[5] The recipient doctor is also a health information custodian as a health care practitioner. I also find that the records at issue contain the “personal health information” of the complainant as that term is defined in section 4 of the Act. ^[6] Dr. Solomon’s handling of the complainant’s personal health information in his capacity as a health information custodian is governed by the Act.

Consent to disclosure under the Act

[33]  One of the purposes of the Act is to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of information and the privacy of individuals while facilitating the effective provision of health care. ^[7] One of the ways in which the Act achieves this purpose is by requiring that disclosures of personal health information occur with the consent of the individual to whom the information relates or their substitute decision-maker, except in limited cases.

[34]  Section 29 of the Act states:

A health information custodian shall not collect, use or disclose personal health information about an individual unless,

(a) it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or

(b) the collection, use or disclosure, as the case may be, is permitted or required by this Act.

[35]  Section 2 of the Act defines the term “disclose” as follows:

“disclose”, in relation to personal health information in the custody or under the control of a health information custodian or a person, means to make the information available or to release it to another health information custodian or to another person, but does not include to use the information, and “disclosure” has a corresponding meaning[.]

[36]  The parties do not dispute that there was a disclosure of the complainant’s personal health information by Dr. Solomon to another health information custodian, the recipient doctor. The main issue in this complaint is whether this disclosure was made in accordance with the Act. Specifically, the complainant asserts that Dr. Solomon disclosed to the recipient doctor personal health information going beyond the scope of her consent.

[37]  Part III of the Act addresses consent for the collection, use or disclosure of personal health information, and the types of consent that are required in particular circumstances.

[38]  Section 18 sets out the requirements for a valid consent under the Act. The consent must come from the individual to whom the information relates or their substitute decision-maker, must be knowledgeable, must relate to the information, and must not be obtained through deception or coercion. ^[8] A consent to the disclosure of one’s personal health information may be express or implied, unless the Act requires express consent. ^[9] A health information custodian may rely on an individual’s implied consent for the disclosure of personal health information to another health information custodian for health care purposes. The Act also allows certain health information custodians to assume an individual’s implied consent to collect, use, or disclose his or her personal health information in certain circumstances. ^[10]

[39]  Section 19 of the Act addresses the withdrawal of consent. It states:

(1) If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect.

(2) If an individual places a condition on his or her consent to have a health information custodian collect, use or disclose personal health information about the individual, the condition is not effective to the extent that it purports to prohibit or restrict any recording of personal health information by a health information custodian that is required by law or by established standards of professional practice or institutional practice.

[40]  While the withdrawal of consent to disclose personal health information does not have retroactive effect, a health information custodian must not disclose personal health information where an individual provides notice of the withdrawal, unless the Act permits or requires the disclosure to be made without consent.

[41]  Subject to the exceptions in section 19(2), an individual may place conditions on the collection, use or disclosure of his or her personal health information. Neither party suggests that any of the exceptions in section 19(2) applies on the facts of this complaint.

[42]  In this case, the parties do not dispute the validity of the complainant’s express, written consent to the disclosure of her personal health information to the recipient doctor, or that the complainant subsequently withdrew her consent to the disclosure of certain information. The parties disagree on the scope of that withdrawal, and whether the complainant later provided a new consent authorizing the disclosure of some of the same information. There is no claim that the disclosure was made on the basis of implied consent or assumed implied consent. ^[11] In addition, neither party has claimed that the disclosure was permitted or required to be made without consent under the Act. The question, therefore, is whether Dr. Solomon’s disclosure of the complainant’s personal health information was done with the complainant’s consent. To decide this, it is first necessary to determine the scope of the complainant’s consent to disclosure.

Scope of the complainant’s consent to disclosure

[43]  The complainant first provided Dr. Solomon with express, written consent to disclose her personal health information to the recipient doctor on May 12, 2015. In this initial consent, the complainant specified that she consents to the disclosure of:

All of the information in regards to radiesse filler, all of the clinical notes and reports including the requested correction of the clinical notes and reports.

Please include requested corrections of the clinical notes.

[44]  The parties agree that, prior to any disclosure by Dr. Solomon, the complainant modified the scope of her initial consent. Both parties refer to a series of emails exchanged between the complainant and Dr. Solomon on June 23, 2015. One of the emails sent by the complainant to Dr. Solomon on this date reads, in part:

Send everything in regards to radiesse the story on clinical notes that was composed by you. Don’t send nothing of my requested corrections, don’t include my request. ...

[45]  In initial representations filed by his legal counsel, Dr. Solomon characterizes the complainant’s initial, May 12, 2015, consent as “a very broad request” that “includes a significant portion of” the complainant’s medical records. He states that the complainant subsequently sent correspondence “to sort out what [the complainant] would like done with her medical records as it relates to disclosure to [the recipient doctor].” He cites the above extract from the complainant’s June 23, 2015 email. He describes this email as adding to her initial request a request to “send everything in regards to radiesse story on clinical notes that was composed by you,” and also as narrowing her consent to not include her correction requests.

[46]  Dr. Solomon goes on to state that the complainant was provided with a copy of the medical records sent from his office to the recipient doctor. Through his legal counsel, he states:

Dr. Solomon disclosed personal health information on June 23, 2015 (88 pages), and June 26 (18 pages) which included his clinical notes, consultation reports, and hospital records relating to [the complainant’s] Radiesse chronology of care.

Dr. Solomon disclosed to [the recipient doctor] personal health information within the scope of her request. [The complainant] had a complicated and unusual presentation from Radiesse injections. Dr. Solomon’s clinical notes, including those of December 3 and [23], ^[12] 2014 are a part of her Radiesse chronology of care, including her reactions to Radiesse, proposed treatments, and her reactions to the care provided. This all relates to her Radiesse story.

[47]  In his initial representations, therefore, Dr. Solomon appears to agree that by her email of June 23, 2015, the complainant narrowed her consent to exclude her correction requests.

[48]  The complainant states that in spite of this, Dr. Solomon disclosed on June 23, 2015 information relating to her correction requests. She also complains that in his follow-up correspondence to her on June 24 and 25, 2015, Dr. Solomon misled her by assuring her that he had not disclosed her correction requests to the recipient doctor.

[49]  Dr. Solomon was subsequently also asked for clarification on how he interpreted the limitation of the complainant’s consent relating to Radiesse, and what records, if any, were withheld as not relating to Radiesse.

[50]  In response, Dr. Solomon’s legal counsel states:

[T]he complainant limited her request to documentation relating to Radiesse. Accordingly, only documentation relating to her Radiesse clinical presentation was disclosed. She specifically excluded from her request her correction requests to Mackenzie Health. In the June 23, 2015 package sent to [the recipient doctor], [the complainant’s] correction request addendum Hospital records were not forwarded in accordance with her instructions. However, on June 25, 2015 via e-mail [the complainant] explicitly requested these documents be provided. As a result, on June 26, 2015 these records were sent to [the recipient doctor] under separate facsimile.

It is Dr. Solomon’s position that all of the information provided to [the recipient doctor] was squarely within [the complainant’s] consent. ...

[51]  Dr. Solomon was asked to provide a copy of the June 25, 2015 email to which he refers, which he did. This email from the complainant to Dr. Solomon reads, in part:

... please now include all of the corrections to the file and send to [the recipient doctor] until it’s resolved this issue with IPC.

Please have the office sent ASAP all of the corrections I have sent through email and hand in the office. All of them until You will hear from IPC to further assist me with altered modified withheld informations.

Thank you

Please send ASAP so [the recipient doctor] has the correct informations so he can provide me with treatment.

[52]  The complainant was asked to respond to Dr. Solomon’s claim that although the complainant had, by her June 23, 2015 email, modified her disclosure request to exclude her correction requests, she had, by her June 25, 2015 email, subsequently requested that her correction requests be disclosed to the recipient doctor. Enclosed with this request was a copy of the June 25, 2015 email provided by Dr. Solomon.

[53]  In reply, the complainant states:

It is clear in the email …, I did not request of Dr. Solomon to release my Personal health records excluding corrections to Mackenzie health. In other words, my June 23rd request had nothing to do with Mackenzie health or any hospital records for that matter. Plainly, my request was to send my Personal health records excluding the corrections to his office notes not mackenzie health corrections as stated by counsel.

It was not my initial request (on June 23rd) to have my Personal health records including my corrections released to [the recipient doctor]. Note: by corrections I mean the ones made to his office not the corrections to Makenzie health.

[54]  The complainant also attached emails and a USB key which she described as evidence that she had “never limited my request by excluding corrections request to Mackenzie health (again, my initial request relates to corrections request to his office not Mackenize health.)” I have reviewed this additional information and find it is not relevant to the issues to be decided in this complaint.

[55]  The complainant later wrote to clarify:

my request not to release mackenize Health clinic notes was verbal to dr Solomons office.

Findings on scope of consent

[56]  It is clear from the parties’ representations that they have differing views about the effect of certain actions taken by the complainant after providing her initial written consent on May 12, 2015. In making my findings on the scope of the complainant’s consent, I have taken into account the evidence of both parties, including the documentary evidence (including multiple emails) provided by both parties.

[57]  I find that the effect of the June 23, 2015 email, quoted above, was to withdraw from the complainant’s initial consent any corrections that she had requested be made to her health records, and any records of her personal health information that were not “composed by” Dr. Solomon. I therefore find that, as of June 23, 2015, the complainant’s consent to disclosure encompassed records of her personal health information that relate to her Radiesse treatments and that were “composed by” Dr. Solomon, excluding any correction requests made by the complainant.

[58]  I also accept Dr. Solomon’s evidence that the complainant further modified her consent in her June 25, 2015 email. This email states, in part:

... please now include all of the corrections to the file and send to [the recipient doctor] ...

Please have the office sent ASAP all of the corrections I have sent through email and hand in the office. All of them ...

Please send ASAP ...

[59]  When asked to comment on the effect of her June 25, 2015 email, the complainant complains about conflicting information she received from Dr. Solomon on June 24 and 25 regarding the contents of the June 23, 2015 disclosure, and she states that “[d]ue to my confusion, frustration and in attempt to find out the truth, I requested of Dr. Solomon to send my corrections as well.”

[60]  I find that the June 25, 2015 email effectively retracted the complainant’s June 23 withdrawal of consent to Dr. Solomon disclosing any corrections that she had requested be made to her records. In other words, I find that by her June 25, 2015 email, the complainant consented to disclosing her corrections that she had requested be made to her records.

[61]  In arriving at this finding, I have considered the complainant’s submission that her consent was limited to disclosure of Dr. Solomon’s “office notes” as distinct from any hospital records. ^[13] While this may have been the complainant’s intention, her consent cannot reasonably be interpreted in this manner.

[62]  I have also considered the complainant’s assertion that she subsequently orally withdrew her consent to the disclosure of Mackenzie Health records to the recipient doctor. However, the complainant does not provide evidence on the timing of any oral withdrawal in relation to the disclosures made by Dr. Solomon; as such, I am unable to conclude that this oral withdrawal of consent was communicated before the June 26, 2015 disclosure was made. In view of Dr. Solomon’s opposite position and the documentary evidence before me, I accept that the complainant’s June 25, 2015 email amounted to a consent authorizing Dr. Solomon to disclose to the recipient doctor her corrections that she had requested be made to her records.

[63]  Dr. Solomon states that in accordance with the complainant’s June 25 consent, he disclosed on June 26, 2015 the complainant’s correction request addendum hospital records, which had been withheld from the June 23 disclosure in accordance with her consent at that time.

The disclosure exceeded the scope of the complainant’s consent

[64]  As described above, the parties appear to have had different understandings of the scope of the complainant’s consent to disclosure, and particularly of the effect of certain amendments she made to her initial consent. On the complainant’s review of the records disclosed to the recipient doctor, she identified certain personal health information that she alleges was disclosed without her consent. She specifically identifies her correction requests, as well as clinical notes dated December 3 and 23, 2014, documenting Dr. Solomon’s accounts of his interactions with the complainant on those dates, as containing information that is untrue or is unrelated to the type of care she was receiving from Dr. Solomon. ^[14]

[65]  I found above that, at the time of the June 23, 2015 disclosure, the complainant’s consent to disclosure encompassed records of her personal health information “composed by” Dr. Solomon relating to her Radiesse treatments, with the exception of any correction requests made by the complainant.

[66]  I also found that, at the time of the June 26, 2015 disclosure, the complainant consented to the disclosure of her correction requests.

[67]  On my review of the copy of the records disclosed by Dr. Solomon to the recipient doctor on June 23 and 26, 2015, I conclude that Dr. Solomon disclosed some personal health information for which the complainant had withdrawn her consent.

[68]  Some personal health information disclosed on June 23, 2015 is contained in an “office note” dated June 12, 2015. This note documents the complainant’s request that her own notes describing her view of events that occurred while under Dr. Solomon’s care (and written by her) be included in her health records, and documents Dr. Solomon’s decision to include them as an addendum. The addendum was also disclosed to the recipient doctor on June 23, 2015. Above I found that the complainant’s June 23 instruction to Dr. Solomon that he “[d]on’t send nothing of my requested corrections, don’t include my request” amounted to an express withdrawal of her consent to the disclosure of her correction requests. In my view, this includes records written by her documenting her disagreement with Dr. Solomon’s views of events, and the June 12 note made by Dr. Solomon regarding her request. As the disclosure of this information was made outside of the scope of the complainant’s consent, and no party has claimed this disclosure was permitted or required to be made without consent under the Act, I conclude that the disclosure was made in contravention of the Act.

[69]  By contrast, I find that Dr. Solomon’s disclosure of the other records of personal health information was made in accordance with the complainant’s consent. First, I accepted above that the effect of the complainant’s June 25, 2015 email was to re-incorporate into the scope of her consent the disclosure of the correction requests made by the complainant. All the records disclosed to the recipient doctor on June 26, 2015 contain headings indicating that they are addenda or revisions/corrections to previous hospital reports, and appear to have been created in response to the complainant’s requests for correction or other changes to her health records. I find that the disclosure of these records was made in accordance with the complainant’s consent as outlined in her June 25, 2015 email.

[70]  I also accept that the remainder of the records disclosed on June 23, 2015 fall within the scope of the complainant’s consent to the disclosure of “[e]verything in regards to radiesse the story.” I accept Dr. Solomon’s evidence that these records document the story of the care the complainant received in connection with her Radiesse treatments. These include records referring to Radiesse and to another facial procedure for which the complainant sought care from Dr. Solomon, which I accept are part of a chronology of care relating to her Radiesse story; records documenting the complainant’s reactions to the treatments, including her complaints about the after-effects of the treatments; records documenting proposed care for these reactions; and other information about the relationship between Dr. Solomon and the complainant, which I accept is in regards to the Radiesse care he provided to her.

[71]  The complainant characterizes some of the personal health information in these records as being wholly unrelated to the Radiesse treatments for which she sought care from Dr. Solomon. Among other things, she alleges that the records include diagnoses that Dr. Solomon is not qualified to make, inaccurate accounts of her interactions with him, and information about other health issues that are unrelated to the reason for which she was seeking an initial consultation with the recipient doctor. She observes in particular that a December 23, 2014 clinic note does not contain any mention of Radiesse at all.

[72]  I have reviewed the records, and I am satisfied that they fall within the scope of the complainant’s June 23, 2015 consent that Dr. Solomon disclose to the recipient doctor “everything in regards to radiesse the story on clinical notes.” I find that this consent is broad and encompasses records that document not only the providing of Radiesse treatments, but also records documenting the various after-effects and complications that the complainant experienced following these treatments, the steps taken to address these after-effects, and Dr. Solomon’s account of the complainant’s dissatisfaction with the care provided by him in relation to these treatments.

[73]  In this context, I find irrelevant the complainant’s allegations that Dr. Solomon’s observations may be inaccurate or made outside the scope of his professional expertise. Although the complainant may object to the content of some of the records, I accept Dr. Solomon’s evidence that these records pertain to his providing of care to the complainant in relation to her Radiesse treatments. I acknowledge that the December 3 and 23, 2014 clinical notes to which the complainant specifically directs my attention do not refer to Radiesse, and contain language and descriptions of the complainant’s behaviour that she finds objectionable or inaccurate. I also acknowledge that, when viewed in isolation, these records’ connection to the Radiesse treatments provided by Dr. Solomon may not be evident. However, having reviewed the two sets of disclosed records in their entirety, I am satisfied that the December 3 and 23, 2014 notes document follow-up visits connected to the complainant’s Radiesse treatments, and refer to ongoing issues in the doctor-patient relationship connected to the complainant’s dissatisfaction with the care she received in relation to these treatments. My review of the records preceding the December 3 and 23 notes supports this conclusion. In the circumstances, I am satisfied that all these records fall within the scope of the complainant’s consent that Dr. Solomon disclose “everything in regards to radiesse the story.”

[74]  In making this finding, I recognize that the complainant has concerns about the manner in which Dr. Solomon described her and the issues arising from her Radiesse treatment in some of the records, and that she challenges the accuracy and the propriety of some of his observations. However, this has no bearing on the issue before me, which is whether the disclosure was made in accordance with the Act. I observe that the complainant has indicated that she is pursuing, or has pursued, other avenues to address these matters, including by making requests for corrections to her records of personal health information under the Act, and by filing a complaint with the regulatory college for physicians in Ontario.

[75]  Finally, the complainant alleged that Dr. Solomon failed to document the information he disclosed to the recipient doctor, which she believes is a contravention of the Act.

[76]  I accepted, above, Dr. Solomon’s statement through his counsel that the copy of records provided by Dr. Solomon to the complainant and to this office accurately reflects the disclosures made to the recipient doctor on June 23 and 26, 2015. Given this, I accept that Dr. Solomon is able to identify the specific personal health information disclosed to the recipient doctor. As such, it is unnecessary to further address the question of any record-keeping obligations in relation to disclosures under the Act. ^[15]

[77]  Having found that Dr. Solomon disclosed some personal health information outside the scope of the complainant’s consent, I will next consider the role that Dr. Solomon’s information practices may have played in this contravention of the Act.

Dr. Solomon’s information practices

[78]  Part II of the Act sets out practices to protect personal health information. Sections 10(1) and (2) state:

(1) A health information custodian that has custody or control of personal health information shall have in place information practices that comply with the requirements of this Act and its regulations.

(2) A health information custodian shall comply with its information practices.

[79]  Section 2 of the Act defines “information practices” as follows:

“information practices”, in relation to a health information custodian, means the policy of the custodian for actions in relation to personal health information, including,

(a)  when, how and the purposes for which the custodian routinely collects, uses, modifies, discloses, retains or disposes of personal health information, and

(b)  the administrative, technical and physical safeguards and practices that the custodian maintains with respect to the information[.]

[80]  In addition to having in place information practices that are compliant with the Act, health information custodians must also take steps to ensure that their agents are aware of and understand their obligations under the Act and under the custodian’s information practices, and the consequences of failing to comply with these obligations. ^[16]

[81]  “Agent” is defined at section 2 of the Act as follows:

“agent”, in relation to a health information custodian, means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by the custodian and whether or not the agent is being remunerated[.]

[82]  As described above, the parties agree that the complainant initially provided Dr. Solomon with express, written consent to the disclosure of some of her personal health information to the recipient doctor, and that she subsequently amended her consent. The parties disagree on the interpretation and the effect of the complainant’s initial consent and amendments to her consent, and on whether Dr. Solomon acted in accordance with her consent. Above, I found that Dr. Solomon disclosed some of the complainant’s personal health information without consent, and in contravention of the Act.

[83]  As this complaint raises issues around how Dr. Solomon dealt with the complainant’s consent and subsequent withdrawal, Dr. Solomon was invited to provide representations about his information practices under section 10 of the Act with respect to “consent management”. ^[17] In particular, Dr. Solomon was asked:

• What policies, practices and procedures relating to consent management were in place at the time of the disclosures at issue (June 23 and June 26, 2015)?
• Prior to the disclosures at issue, what training was provided to Dr. Solomon’s agents, as defined in the Act, in relation to these policies, practices, and procedures?
• Did Dr. Solomon and/or his agents comply with these policies, practices and procedures in relation to consent management in the circumstances of this complaint?
• Have any policies, practices and procedures, or any training, relating to consent management been implemented or changed since the disclosures at issue in this complaint? ^[18]

[84]  In response, Dr. Solomon states, through his counsel:

Dr. Solomon’s office complies with the College of Physicians and Surgeons of Ontario’s policy – Medical Records Policy Number #4-12. Dr. Solomon’s office practice is to disclose personal health information when a signed consent form is received. Dr. Solomon’s staff prepare the disclosure package for his review prior to disclosure. Dr. Solomon reviews the package to ensure it complies with the consent. If the consent is unclear, staff or Dr. Solomon seek clarification of the consent to ensure only the information that [the] patient wants disclosed is disclosed.

Dr. Solomon’s staff member [named individual] prepared the disclosure package of [the complainant]. [Named individual] has over 25 years’ experience in the medical field and over 12 years’ experience working with Dr. Solomon. Dr. Solomon’s staff, [named individual and two others], have received training to ensure they understand consent from the appropriate person is required to disclose personal health information, and to ensure consent forms are clear and the scope of the consent is understood.

Dr. Solomon’s staff complied with their office practices.

Following this complaint, Dr. Solomon’s practices have been reinforced with staff.

[85]  Dr. Solomon maintains that only records falling within the scope of the complainant’s consent were disclosed to the recipient doctor. He also states:

[The complainant’s] consent changed constantly and were conveyed in written form via e-mail, via in person communications, and conversations over the telephone. Dr. Solomon and his staff worked hard to clarify and comply with [the complainant’s] changing requests to ensure that only the information [the complainant] wished to be disclosed was. [Named individual] and Dr. Solomon both believed that everything prepared and sent was within her request.

[86]  I have considered Dr. Solomon’s representations, as well as the College policy statement to which he refers, ^[19] which sets out physicians’ professional and legal obligations with respect to medical record-keeping in a general way. ^[20] In addition to his reliance on the College policy, Dr. Solomon describes, in a general way, his office practices concerning how consents are dealt with. Among other things, he reports that his office practice is to ensure that consent forms are clear and the scope of consent is understood, and for Dr. Solomon or his staff to seek clarification of a consent if it is unclear. He does not indicate that he has any written office policies, practices and procedures relating to consent, or provide details about the training provided to his agents in relation to consent policies, practices and procedures. Except for some general statements, he has also failed to explain how he and his staff documented, clarified and confirmed the scope of the complainant’s consent in accordance with his office practice in this particular case.

[87]  I found that Dr. Solomon disclosed some of the complainant’s personal health information without consent, and in contravention of the Act. In my view, the reasons for this include the somewhat ambiguous wording of the amendments to the consent, and the failure by Dr. Solomon to properly clarify the amended consent (despite Dr. Solomon’s stated, and apparently unwritten, practice of seeking clarifications where consents are unclear). Rather than clarify with the complainant what she meant by the wording of her amendments to the consent, advise her of his understanding of the amendments, or provide her with a copy of the records he intended to disclose, Dr. Solomon disclosed the information based on his interpretation of the wording of the amendments to the consent. Above, I found that Dr. Solomon’s interpretation of some portions of the amendment to the consent was incorrect. I find that the absence of a written information practice regarding consent to disclosure of a patient’s personal health information contributed to this contravention. As a result, I will order Dr. Solomon to develop and implement a written information practice on consent that includes a requirement for clarifying consent in situations of potential ambiguity or where there are conflicting instructions.

CONCLUSION:

[88]  I find that Dr. Solomon disclosed some of the complainant’s personal health information outside the scope of the complainant’s June 23, 2015 consent, in contravention of the Act, and that a written information practice regarding consent management is reasonably necessary in order to achieve compliance with the Act and its regulations. I issue an order to address these findings.

ORDER:

1. I order Dr. Solomon to develop and implement a written information practice that addresses how consents from patients to the disclosure of their personal health information are to be processed, documented and clarified, and to ensure that this written information practice includes a requirement for clarifying consent in situations of potential ambiguity or where there are conflicting instructions.

Original Signed by:		September 29, 2017
Frank DeVries
Senior Adjudicator