PHIPA DECISION 73

Appeal PA15-493-2

Grand River Hospital

May 28, 2018

Summary: A requester sought access to records of communications between the hospital and external parties about a relative who had been a patient at the hospital, and about the ensuing internal reviews and actions taken by the hospital in response to complaints made by the requester. The hospital granted access in part, and the requester appealed this decision to the IPC. This decision considers the application of the Personal Health Information Protection Act and the Freedom of Information and Protection of Privacy Act  and finds the requester entitled to access to some of the information at issue.

Statutes Considered: Personal Health Information Protection Act, S.O. 2004, c. 3, Sched. A, sections 4(1) , 8(4) , 52(1) (c), 52(1) (f), 52(3) ; Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 13(1), 23, 24, 49(a).

Orders and Investigation Reports Considered: PHIPA Decisions 17 and 30; Order PO-3643

OVERVIEW:

[1]  The Grand River Hospital (the hospital) received a request under the Freedom of Information and Protection of Privacy Act  (FIPPA ) for a number of records related to the death of the requester’s relative at the hospital. The request was received through a series of emails. The hospital summarized the request as follows:

1. Copies of the press releases the hospital has issued regarding [the requester’s relative] and/or [a named physician] as they relate to the complaints [the requester] made against [the named physician].
2. A list of media outlets, individuals and all other entities, with which the hospital, its employees, directors or agents [including a named individual] have communicated regarding [the requester’s relative], the hospital’s internal reviews, actions taken by the hospital in response, and/or [the named physician] in relation to the complaints [the requester] made against him, as well as a copy of the information that was provided to those entities. This request is for all information communicated externally and is not to be limited to the information actually reported by the media.
3. Information pertaining to how [the requester’s relative] death was recorded for the purposes of calculating Grand River Hospital’s HSMR (Hospital’s Standardized Mortality Ratio). Specifically, how his death was recorded for the purpose of calculating GRH’s HSMR. This request includes but is not to be limited to whether it was recorded as an expected or unexpected death and whether that or any other determination was ever changed, and if so when, why, and by whom?
4. Information pertaining to how the medication error was recorded for the purpose of Grand River Hospital’s web-based incident and adverse event management system, Risk Monitor Pro. This request includes but is not limited to whether the severity of the medication error was recorded as “Level 2 – Temporary Harm”, “Level 3 – Permanent Harm”, or “Level 4 – Death” and whether that or any other determination was ever changed, and if so when, why, and by whom?

[2]  The hospital issued a decision under FIPPA in relation to parts 1, 3 and 4, as listed above, in which it granted access in full to the responsive records. A week later, the hospital issued another decision in relation to part 2, in which it provided partial access to records with severances made in full or in part pursuant to sections 13(1) (advice or recommendations), 19 (solicitor-client privilege), 21(1) (personal privacy) and 65(6)5 (hospital privileges) of FIPPA. The requester was also provided with indexes setting out a description of each responsive record, the type of disclosure (full or partial), and the section of FIPPA relied upon to deny access.

[3]  The requester, now the appellant, appealed the hospital’s decision to this office.

[4]  At mediation, the hospital determined that some of the records may contain personal health information to which the Personal Health Information Protection Act (PHIPA) would apply. The hospital issued a revised decision, in which it identified two of the records covered by part 2 of the request as records of personal health information. The hospital also provided the mediator and the appellant with a new Index of Records describing the severances.

[5]  In its revised decision, the hospital relied on sections 52(1)(f) of PHIPA in conjunction with sections 49(a) and 13(1) of FIPPA to deny access to the two records. The revised decision also explained that upon further review, the hospital determined that a record which had previously been partially disclosed after being identified as responsive was not, in fact, responsive to the appellant’s request.

[6]  As a result of mediation, the parties agreed that certain records were no longer at issue and the application of section 19 of FIPPA is now moot. The appellant maintains that the hospital narrowly interpreted his request and because the hospital originally issued an access decision under FIPPA, it may not have searched for responsive records of personal health information. As a result, the reasonableness of the hospital’s search was added as an issue in the appeal.

[7]  Mediation did not resolve the appeal and it was moved to the adjudication stage of the appeal process. I decided to conduct both an inquiry under FIPPA and a review under PHIPA. During my inquiry/review into the appeal, I sought and received representations from the hospital and from the appellant, which were shared with each other in accordance with the IPC’s Code of Procedure and Practice Direction 7. I indicated to the parties that I may address the issues raised under sections 21(1) and 65(6)5 of FIPPA at a later date, if necessary.

[8]  Although I have issued my determination as a PHIPA Decision, it contains findings under both PHIPA and FIPPA. In this Decision, I find the appellant is entitled to the personal health information of his relative in Record 2, but he does not have a right of access to Records 1, 1(a), 11 and 11(a) and the parts of Records 8, 9 and 10 at issue. I find Record 6 is not responsive. Finally, I reserve my findings on Records 5 and 7 pending receipt of submissions on the application of sections 21(1) and 65(6)5 of FIPPA.

RECORDS:

[9]  The only part of the request remaining at issue is part 2, as described above. The eleven records consist of seven email communications, a Health Insurance Reciprocal of Canada (HIROC) claim reporting form, and three Issues Notes. The following references are to IPC record numbers:

Record 1

Communication with HIROC - dated June 17, 2010

Record 1(a)

Communication with HIROC - dated June 17, 2010

Record 2

Communication with HIROC - dated September 16, 2010

Record 5

Email from [named individual] dated May 22, 2015

Record 6

Email to [named individual] dated June 22, 2015

Record 7

Email exchange dated June 3, 2015

Record 8

Issues note: version 3 dated June 3, 2015

Record 9

Issues note: dated June 3, 2015

Record 10

Issues note: dated June 4, 2015

Record 11

Communication with HIROC - dated June 9-17, 2015

Record 11(a)

Communication with HIROC - dated June 9-17, 2015

ISSUES:

1. Preliminary issues
2. Access under PHIPA
3. Access under FIPPA
4. Did the hospital exercise its discretion under PHIPA and FIPPA?
5. Did the hospital conduct a reasonable search for records?

DISCUSSION:

Issue A:  PRELIMINARY ISSUES

Responsiveness of Record 6

[10]  In its revised decision, the hospital advised the appellant that Record 6, which had previously been partially disclosed, was no longer considered responsive to the appellant’s request. The appellant challenged the hospital’s revised decision regarding the responsiveness of Record 6.

[11]  Section 24 of FIPPA imposes certain obligations on requesters and institutions when submitting and responding to requests for access to records. This section states, in part:

(1)  A person seeking access to a record shall,

(a)  make a request in writing to the institution that the person believes has custody or control of the record;

(b)  provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record;

. . .

(2)  If the request does not sufficiently describe the record sought, the institution shall inform the applicant of the defect and shall offer assistance in reformulating the request so as to comply with subsection (1).

[12]  Section 53 of PHIPA imposes similar obligations.

[13]  This office has stated that, in applying section 24 of FIPPA, institutions should adopt a liberal interpretation of a request, in order to best serve the purpose and spirit of the Act. Generally, ambiguity in the request should be resolved in the requester’s favour. [1]

[14]  To be considered responsive to the request, records must “reasonably relate” to the request. [2]

[15]  The hospital submits that the request, submitted through a series of emails, was detailed enough to identify responsive records. In an email dated June 26, 2015, the hospital summarized the request as follows:

A list of media outlets, individuals, and all other entities, with which the hospital, its employees, directors or agents [including a named individual] have communicated regarding [the appellant’s relative], the hospital’s internal reviews, actions taken by the hospital in response, and/or [a named physician] in relation to the complaints [the appellant] made against [the named physician], as well as a copy of the information that was provided to those entities. This request is for all information communicated externally and not limited to the information actually reported to the media. [emphasis added by hospital]

[16]  The appellant did not take issue with the hospital’s summary of his request.

[17]  The hospital submits that Record 6 is an email from a third party and is therefore not responsive. The hospital maintains that it did not adopt a narrow interpretation of the request, and that it would be unreasonable to expect institutions to foresee that a requester is interested in records that are beyond the scope of a request that has been reviewed with the requester.

[18]  The appellant submits that access to information requests should be interpreted liberally. He admits that he did not explicitly request information that was received by the hospital from external sources, but that it is reasonable that the hospital provide those in addition to the records it communicated externally.

[19]  I am satisfied that the original wording of the request and the hospital’s summary both clearly delineate the scope of the request as relating to information communicated externally by the hospital. Upon my review of Record 6, I am satisfied that it is an email from a third party to a hospital employee and is outside the scope of the request.

[20]  Accordingly, the rest of my decision will not consider Record 6.

Does PHIPA apply, or FIPPA, or both?

[21]  Both parties agree that the hospital is a body subject to PHIPA pursuant to section 3(1), and an institution subject to FIPPA within the meaning of section 2(1). The hospital did not take issue with the appellant’s authority to act on his relative’s behalf for the purpose of the request.

[22]  As previously mentioned, the hospital initially responded to the request as a request for information under FIPPA; however, it determined during mediation that PHIPA should apply to certain records as well. During the course of my inquiry/review, I asked both parties to make submissions on the nature of the records at issue, and the application of both PHIPA and FIPPA to the records.

The request

[23]  The appellant’s interest in this information arises out of his relative’s experience as a patient of the hospital. He wishes to know what the hospital has stated to external parties about his relative, as a patient of the hospital. This part of his request is a request for access to personal health information under section 52(1) of PHIPA, which states in part:

Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian…

[24]  However, the appellant also wishes to know what the hospital has communicated to external parties about its own internal reviews and actions taken in relation to the complaints made against a physician at the hospital. This part of the request is covered by FIPPA, in that these external communications were about complaints and actions following the relative’s experience, but not directly about that experience.

[25]  I conclude that in these circumstances, the appellant seeks personal health information relating to his relative under PHIPA, as well as information about the hospital’s external communications in response to the consequences of his relative’s experience, under FIPPA.

[26]  With this in mind, I will review the records at issue in this review to determine whether they are records of personal health information of the relative. For any records of his personal health information, I will determine the extent of the appellant’s right of access under PHIPA. I will then consider his right of access under FIPPA.

Issue B:  ACCESS UNDER PHIPA

Do the records contain the personal health information of the appellant’s relative?

[27]  “Personal health information” is defined in section 4 of PHIPA as follows:

(1) In this Act,

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,

(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,

(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,

(f) is the individual’s health number, or

(g) identifies an individual’s substitute decision-maker.

[28]  In addition, sections 4(2) and (3) of PHIPA provide:

(1) In this section,

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

(2) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[29]  PHIPA Decision 17 provides direction on this office’s interpretation of “records of personal health information”. In that Decision, I concluded that the phrase “relates to”, as it appears in sections 4(1)(a) and (b) of PHIPA, included information that was “connected in some way to the health” of a complainant’s wife and daughter or to the provision of care to them. [3] Examples of “records of personal health information” to which I found the complainant, on their behalf, had a right of access under PHIPA included:

• Emails containing details of care;
• Reviews of the care provided;
• Correspondence between a hospital and a regulated health profession’s regulatory body during a review by that body of the conduct of health professionals involved;
• Correspondence between a hospital and lawyers;
• Emails about measures to ensure staff safety;
• Minutes of board meetings;
• Drafts of letters. [4]

[30]  In determining that the above records constituted records of personal health information, I stated:

These records contain information that relates to, or has some connection to, their physical or mental health or to the providing of health care to them. […] The records contain information about them precisely because they were patients receiving health care from the hospital, and arise out of that relationship. Although these records may not have been created for the purpose of, or required for, their care, they contain information about the complainant’s wife and daughter that arises out of their experience as patients of the hospital, and is thus “related to” the hospital’s provision of health care to them. [5] [emphasis added]

[31]  On the above basis, I decided that the presence of any personal health information in the above records means they are records of personal health information, even where that information is merely a snippet. [6] This liberal interpretation of what constitutes a “record of personal health information” for the purpose of determining a right of access under PHIPA is qualified by a limitation on the right of access to the information in the record, based on the nature of the record and whether it is “dedicated primarily” to the personal health information of the requester. [7]

[32]  In the matter before me, the hospital submits that Records 1, 1(a) and 2 contain personal health information of the appellant’s relative, while Records 5, 7, 8, 9, 10, 11, and 11(a) do not. In support of its position, the hospital refers to IPC Order PO-3643, in which the adjudicator stated:

The prior personal knowledge of a few does not establish identifiability in the general public when the withheld information does not disclose any personal information about the deceased.

Identifiability does not flow from the information when people with prior personal knowledge see their knowledge reflected in the record. Identifiability through disclosure must flow from the information itself, or from the information in combination with other information that results in the identification of an individual.

[33]  The hospital maintains that identifiability does not flow from the information in Records 5, 7, 8, 9, 10, 11 and 11(a). Rather, the information contained in those records could only be linked to the appellant’s relative by someone with prior personal knowledge of the individual.

[34]  The appellant submits that the IPC’s analysis in Order PO-3643 on the “identifiability” of “personal information” under FIPPA is not relevant to this appeal because the nature of the information requested and the applicable legislation are distinguishable. He states that, in Order PO-3643, the issue was whether to deny a third party’s request under FIPPA, to protect the privacy of individuals.

[35]  The appellant submits that the circumstances in Order PO-3643 are distinguishable from the facts in this appeal, which is about an individual’s right of access to their own “personal health information” under PHIPA. The appellant notes that PHIPA Decision 17 indicates that records “alluding to the underlying incident [giving rise to the records]” [8] would constitute a PHIPA record. He submits that the records do not need to identify his relative by name; if they “allude to the underlying incident” that caused his relative’s death, then they constitute records of personal health information to which PHIPA would apply.

[36]  The hospital maintains that characterization of information must take place before determining access rights available under FIPPA and PHIPA. The hospital submits that if the approach suggested by the appellant is followed, then information that is not personal health information could become personal health information if requested by a person to whom it relates (or their representative), even if that information is de-identified. Rather than classifying information as personal or personal health information based on whether the requester is the person to whom the information relates, information must be classified using an objective test based on identifiability and related concepts.

[37]  The hospital submits that the fact that it identified records as responsive to the appellant’s request is immaterial to the issue of whether those records contain personal health information.

Analysis

[38]  In my decision below, I do not make any findings on Record 7, pending additional submissions from the parties on section 65(6)5 of FIPPA.

[39]  As set out above, the definition of “personal health information” requires that the information be “identifying information.” “Identifying information”, in turn, may be information on its own that identifies an individual, or it may be information that, in combination with other information, could reasonably lead to identification of an individual. In determining whether the prospect of identification is reasonable, the identity of the requester is relevant. Where a requester seeks their own personal information, it could hardly have been the intent of the Legislature that a record that contains extensive information about the requester, without identifiers, is not personal health information simply because other unrelated persons would not be able to make the connection between the requester and the information.

[40]  For this reason, I agree with the appellant that the circumstances giving rise to the “identifiability” analysis in Order PO-3643 are distinguishable from the facts of this appeal, and the analysis in that decision is of minimal assistance in deciding the issue before me.

[41]  I agree with the hospital’s assessment that Records 1, 1(a), and 2 are records of the appellant’s relative’s personal health information. Having reviewed Records 8, 9, 10, 11, and 11(a), I am satisfied that they also contain personal health information of the relative. These records include emails regarding the possibility of a media story, issues notes regarding media coverage on medical error, and communications with HIROC. They contain information about the relative that, while not identifying him in itself, would be readily identifiable to the appellant. Each record contains information that arose out of the relative’s experience as a patient at the hospital, and is therefore “related to” the hospital’s provision of care to him as contemplated by paragraphs (a) and (b) of section 4(1) of PHIPA.

[42]  I therefore find that the responsive records in this appeal, with the exception of Record 5, are records of personal health information of the appellant’s relative, to which the appellant has a right of access under PHIPA. On my review, and despite my preliminary assessment, I find that Record 5 does not contain personal health information as it does not contain any information about the appellant’s relative, and relates specifically to one aspect of the ensuing events that is not about the relative.

Are the records of personal health information “dedicated primarily” to the personal health information of the individual?

[43]  Section 52 of PHIPA establishes the extent of the appellant’s right of access to the records of his relative’s personal health information. This section reads, in part:

1. Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless […]
2. Despite subsection (1), an individual has a right of access to that part of a record of personal health information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of clauses (1) (a) to (f).
3. Despite subsection (1), if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[44]  Subject to any applicable exemptions, the right of access in PHIPA applies either to a whole record, or only to certain portions of a record. This is because while section 52(1) of PHIPA grants an individual (or his/her substitute decision-maker) a right of access to the entire record of his/her personal health information, section 52(3) of PHIPA limits the right of access where the record is not “dedicated primarily” to that personal health information.

[45]  The distinction is important because if a record is dedicated primarily to the personal health information of the individual, the individual has a right of access to the entire record, even if it incidentally contains information about other matters or other parties. If a record is not dedicated primarily to the personal health information of the individual, the right of access only applies to the information about the individual that can reasonably be severed from the record.

[46]  Therefore, the threshold question in determining the right of access under PHIPA is whether each record at issue is or is not a record “dedicated primarily” to the personal health information of the appellant’s relative.

[47]  PHIPA Decision 17 outlines this office’s qualitative approach to the interpretation of section 52(3). In order to determine whether a record is “dedicated primarily” to the personal health information of a requester within the meaning of section 52(3), this office takes into consideration various factors, including:

• the quantity of personal health information of the requester in the record;
• whether there is personal health information of individuals other than the requester in the record;
• the purpose of the personal health information in the record;
• the reason for creation of the record;
• whether the personal health information of the requester is central to the purpose for which the record exists; and
• whether the record would exist “but for” the personal health information of the requester in it. [9]

[48]  This list is not exhaustive.

[49]  If, having consideration of these and other factors, a record is not mainly related to the personal health information of the individual but rather to other matters, then the individual only has a right of access to his or her own information that can reasonably be severed from the record.

[50]  The hospital submits that Records 1, 1(a), and 2 contain the appellant’s relative’s personal health information; however, it maintains that none of those three records is dedicated primarily to the relative’s personal health information. Accordingly, the hospital takes the position that the appellant’s right of access under PHIPA is limited to the personal health information that can be reasonably severed from the three records for the purpose of providing access.

[51]  With regard to Records 1 and 1(a), communications with HIROC, the hospital submits that the records consist of an email chain that includes communications with the appellant and HIROC. The purpose of the records was to seek and provide advice regarding risk management. The hospital submits that the records were not created in the usual course of the clinical interaction, and were not created to communicate personal health information.

[52]  For Record 2, another communication with HIROC, the hospital submits that the purpose of the record was to fulfil a contractual obligation to give notice of potential claims for insurance related purposes. Again, the hospital submits that the record was not created in the usual course of the clinical interaction, and is qualitatively related to matters outside the provision of health care.

[53]  With regard to Records 7, 8, 9, 10, 11, and 11(a), the hospital maintains that if the records contain the appellant’s relative’s personal health information, they would not be dedicated primarily to the relative’s personal health information within the meaning of section 52(3) of PHIPA. Rather, they are dedicated primarily to legal and risk management and a communications plan to provide context so as to avoid “unwarranted concern or fear of seeking treatment” at the hospital.

[54]  Specifically, the hospital submits that Records 7, 8, 9, and 10 are dedicated primarily to communications and risk management and Records 11 and 11(a) are dedicated primarily to legal and risk management.

[55]  The hospital submits that to the extent that there is personal health information in the records, severing that information would provide “only disconnected and meaningless snippets” within the meaning attributed to that phrase in PHIPA Decision 17. On that basis, the hospital maintains that the personal health information in the records is not severable for the purpose of section 52(3), and therefore the hospital has not endeavoured to provide access to that information. Regardless, the hospital submits that the appellant already has the portion of personal health information that can be severed from Records 1 and 10, as the name of the appellant’s relative was provided by the appellant in his email in Record 1, and the hospital provided access to the portion of Record 10 that refers to the relative.

[56]  The appellant submits that his relative’s personal health information is likely central to the purpose for which the records exist, and that the records would not exist “but for” the personal health information contained therein.

Analysis

[57]  As above, I reserve my findings on Record 7, pending additional submissions.

[58]  Records 1 and 1(a) are dedicated primarily to the appellant’s relative’s personal health information. Most of the content of these records relate to the relative’s personal health information, and it is clear from the records that the personal health information is central to the purpose of the records. Although these records would not typically be found within a patient’s medical file, they are qualitatively about the clinical experience of the appellant’s relative at the hospital. These records contain communications about the review conducted in respect of the relative’s care at the hospital, and information about the care provided to the relative during his time at the hospital.

[59]  As a result of this finding, the appellant exercises a right of access to Records 1 and 1(a) in their entirety under section 52(1), subject to any applicable exemptions.

[60]  I find that Records 2, 8, 9 10, 11 and 11(a) contain the relative’s personal health information but are substantively about other matters, such as reports to the hospital’s insurer about potential claims, [10] communications and risk management, [11] and legal and risk management. [12] Applying a qualitative approach to section 52(3), I find that these records are not dedicated primarily to the appellant’s relative’s personal health information. These records primarily address matters unrelated to the relative’s personal health information, such as legal strategy, communications, and approaches to dealing with the media and anticipated proceedings. The purpose of these records is to address issues that are several steps removed from the relative’s personal health information in the records.

[61]  In this case, for example, the records were not created in the usual course of clinical interaction, and would not typically be found in patient files alongside medical charts and other records that are qualitatively about the relative. Rather, the personal health information included in these records is for legal, communication, risk management and other purposes. Although it could be argued that these records would not exist “but for” the relative’s experience as a patient at the hospital, the creation of the records arises indirectly and several steps removed from that experience. [13]

[62]  I conclude, therefore, that Records 2, 8, 9, 10, 11 and 11(a) are not dedicated primarily to the personal health information of the relative. For these records, the appellant has a right of access under section 52(3) of PHIPA only to personal health information about his relative that can reasonably be severed. Personal health information that would comprise only meaningless snippets is not “reasonably severable” within the meaning of section 52(3). [14]

[63]  On my review, I find that the personal health information in Record 2 (which has been withheld in its entirety) can be reasonably severed, and the appellant is entitled to access to this information under PHIPA, subject to any applicable exemptions.

[64]  The hospital disclosed most of Records 8, 9 and 10, withholding only specific portions. These portions do not contain the relative’s personal health information and the appellant has no right of access to them under PHIPA.

[65]  Records 11 and 11(a) were withheld in their entirety. Personal health information in these records would, if released, comprise only disconnected or meaningless snippets. I find it is not reasonably severable within the meaning of section 52(3) and the appellant has no right of access to this information under PHIPA.

Applicability of FIPPA

[66]  Above, I found that the appellant has a right of access to Records 1 and 1(a) under section 52(1) of PHIPA, and to the personal health information only in Records 2, 8, 9 and 10 under section 52(3) of PHIPA, all of which is subject to the hospital’s exemption claims.

[67]  I find he also has a right of access under FIPPA. All of these records are responsive to the part of his request in which he wishes to know what the hospital communicated to external parties about the complaints and internal review that followed from the relative’s experience at the hospital.

[68]  I will therefore consider, firstly, the appellant’s right to access personal health information under PHIPA and then the appellant’s right to access the other information in the records under FIPPA.

[69]  Before I turn to consider the issues and the parties’ submissions, I note that in some instances, the hospital’s submissions appear contradictory, in that it appears to rely on an exemption to deny access to certain records in one part of its submissions but not in another part [15] . Given the complexities raised by an access request that raises issues under both PHIPA and FIPPA, and that I asked the hospital to address some issues in the alternative, I find it fair to address the submissions as a whole, and on their substance.

Exemptions under PHIPA

Section 52(1)(c) – records created for use in a proceeding

[70]  Here, I will consider the hospital’s position that Records 1, 1(a), and 2 are exempt under section 52(1)(c) of PHIPA, which provides that the right of access does not apply if:

the information in the record was collected or created primarily in anticipation of or for use in a proceeding, and the proceeding, together with all appeals or processes resulting from it, have not been concluded…

[71]  I will reserve my findings on the hospital’s claim that Record 7 is also exempt under this section.

[72]  The hospital maintains that the correspondence in Records 1 and 1(a) and the form that comprises Record 2 were created in anticipation of a proceeding arising out of a medication error and related events. It submits that if a proceeding had not been contemplated, there would have been no reason for the hospital to consult with HIROC or engage in these communications. The hospital submits that an organization reporting to its liability insurance provider is clear evidence that one or more proceedings are anticipated, and that it assembled the information required under its insurance policy in anticipation of “a proceeding.”

[73]  The appellant submits that section 52(1)(c) of PHIPA requires that “the proceeding, together with all appeals or processes resulting from it, have not been concluded”. Given that no legal proceeding was ever commenced, and all complaints to regulatory bodies such as the College of Physicians and Surgeons of Ontario (CPSO), College of Nurses of Ontario, and Health Professions Appeal and Review Board (HPARB) have been resolved, the appellant maintains that the hospital is unable to rely on this exemption to deny access.

[74]  In response to this position, the hospital submits that the exemption in section 52(1)(c) does not apply solely to “legal” proceedings, nor does it apply only after a proceeding has been commenced. The hospital submits that there have been proceedings before the CPSO and HPARB, there is an ongoing proceeding before this office, and there remains the potential for civil and other proceedings.

Analysis

[75]  The section 52(1)(c) exemption has not yet been interpreted by this office; however, it appears to be consistent with the premise underlying litigation privilege – that it allows for a “zone of privacy” in which to investigate and prepare for a proceeding. The basis for the exemption is broader than that required for the litigation privilege in FIPPA, as it does not require the records to be prepared by or for counsel for the hospital. Rather, it merely requires that the records were collected or created primarily in anticipation of or for use in a proceeding, which is broadly defined in section 2 of the Act as:

a proceeding held in, before or under the rules of a court, a tribunal, a commission, a justice of the peace, a coroner, a committee of a College within the meaning of the Regulated Health Professions Act, 1991, a committee of the Board of Regents continued under the Drugless Practitioners Act, a committee of the Ontario College of Social Workers and Social Service Workers under the Social Work and Social Service Work Act, 1998, an arbitrator or a mediator.

[76]  On my review of the representations and records, I find that Records 1, 1(a) and 2 were created and sent to HIROC in anticipation of a proceeding. A proceeding before the CPSO, followed by the HPARB, did ensue from the events. However, the exemption does not apply where the proceeding has concluded. In this case, the proceeding before the HPARB has concluded.

[77]  The hospital argues that other proceedings were also anticipated at the time these records were created, that the “proceeding” before the IPC is ongoing, and there remains the potential for civil and other proceedings.

[78]  I accept that the hospital foresaw the potential for other proceedings, in addition to the one before the CPSO, at the time the records were created. However, in the eight years since, no other proceedings have been initiated. The hospital provides no evidence to support its contention that other proceedings may yet be commenced. While the exemption may apply where proceedings are merely anticipated and not necessarily commenced, the potential for those proceedings must be more than speculative.

[79]  In the courts, the litigation privilege may apply where proceedings are pending or “may reasonably be apprehended.” [16] Adopting the same standard of reasonableness in applying section 52(1)(c), there is a lack of evidence before me to support a conclusion that proceedings may be reasonably anticipated. Given especially the passage of time since the events, such a conclusion requires more than the hospital’s mere assertion.

[80]  I do not accept the hospital’s submission that the proceedings before the IPC could qualify as a “proceeding” for the purposes of this exemption. Among other things, I find no evidence to support the suggestion that these records were created in anticipation of or for use in an appeal before this office.

[81]  In sum, I find that Records 1, 1(a) and the personal health information in Record 2 is not exempt under section 52(1)(c) of PHIPA.

Section 52(1)(f) of PHIPA in conjunction with sections 49(a)/13(1) of FIPPA – the “flow-through” exemption

[82]  As a health information custodian under PHIPA that is also an institution under FIPPA, the hospital is able to rely on certain exemptions in FIPPA (through section 52(1) (f)(ii)(A) of PHIPA), as “flow-through” exemptions, to deny access to personal health information in the records. The hospital relies on the exemption in section 49(a) of FIPPA, in conjunction with section 13(1), in deciding to withhold Records 1, 1(a) and 2.

[83]  Since I have found that the appellant is entitled to access under PHIPA to Records 1 and 1(a) in their entirety, the flow-through exemption is relevant with respect to those records as a whole. By contrast, since I have found that his PHIPA right of access only applies to the personal health information in Record 2, the flow-through exemption is relevant only with respect to those portions containing personal health information.

Sections 49(a)/13(1) of FIPPA – advice or recommendations

[84]  Section 49(a) applies when a record contains personal information of a requester, and gives an institution discretion to withhold the information if other exemptions apply, or grant the information despite the exemption. Section 13(1) permits an institution to refuse to disclose a record where the disclosure would reveal “advice or recommendations of a public servant, any other person employed in the service of an institution or a consultant retained by an institution”.

[85]  The purpose of section 13 is to preserve an effective and neutral public service by ensuring that people employed or retained by institutions are able to freely and frankly advise and make recommendations within the deliberative process of government decision-making and policy-making. [17]

[86]  “Advice” and “recommendations” have distinct meanings. “Recommendations” refers to material that relates to a suggested course of action that will ultimately be accepted or rejected by the person being advised, and can be express or inferred. “Advice” has a broader meaning than “recommendations”. It includes “policy options”, which are lists of alternative courses of action to be accepted or rejected in relation to a decision that is to be made, and the public servant’s identification and consideration of alternative decisions that could be made. “Advice” includes the views or opinions of a public servant as to the range of policy options to be considered by the decision maker even if they do not include a specific recommendation on which option to take. “Advice” involves an evaluative analysis of information. Neither of the terms “advice” or “recommendations” extends to “objective information” or factual material.

[87]  Advice or recommendations may be revealed in two ways:

• the information itself consists of advice or recommendations
• the information, if disclosed, would permit the drawing of accurate inferences as to the nature of the actual advice or recommendations.

[88]  The application of section 13(1) is assessed as of the time the public servant or consultant prepared the advice or recommendations. Section 13(1) does not require the institution to prove that the advice or recommendation was subsequently communicated. Evidence of an intention to communicate is also not required for section 13(1) to apply as that intention is inherent to the job of policy development, whether by a public servant or consultant.

[89]  Section 13(1) covers earlier drafts of material containing advice or recommendations. This is so even if the content of a draft is not included in the final version. The advice or recommendations contained in draft policy papers form a part of the deliberative process leading to a final decision and are protected by section 13(1).

[90]  Examples of the types of information that have been found not to qualify as advice or recommendations include

• factual or background information
• a supervisor’s direction to staff on how to conduct an investigation
• information prepared for public dissemination

[91]  Sections 13(2) and (3) set out a list of mandatory exceptions to the section 13(1) exemption, none of which appears to be applicable in the circumstances of this complaint.

[92]  In its non-confidential representations, the hospital describes Records 1 and 1(a) as correspondence with HIROC regarding communication with the appellant in response to a complaint, and advice from HIROC. In confidential representations it provides more details about the exchange.

[93]  The appellant submits that section 13(1) cannot apply to communications from HIROC, as HIROC is an insurance provider, and not a public servant, person employed by the institution, or a consultant retained by the institution. The appellant submits that HIROC would have been a party to any proceedings dealing with the liability of the hospital, and it cannot be both a party to a proceeding and a consultant at the same time.

[94]  He also requests that I consider whether section 23 of FIPPA (public interest override) should apply to the records to which the hospital has applied the section 13(1) exemption.

[95]  In response to the appellant’s submissions, the hospital maintains that HIROC is a unique insurance provider in that in addition to providing insurance coverage, it also focuses on health care risk management and patient safety. HIROC provides its subscribers with professional expertise in identifying, reporting and managing its operational risk. The hospital submits that a plain language reading of section 13(1) supports the application of this exemption to the records at issue.

Analysis

[96]  To begin with, all the records at issue here contain the personal health information of the appellant’s relative, which raises the application of the exemption in section 49(a) of FIPPA. Further, I accept the hospital’s description of the expertise offered by HIROC to subscribing hospitals. Its role as an insurance provider does not preclude it from also offering expert advice to the hospital. I am satisfied that HIROC qualifies as a consultant retained by the hospital, in these circumstances. I also find that Records 1 and 1(a) contain advice or recommendations given by HIROC to the hospital within the meaning of section 13(1) of FIPPA. Applying section 52(1)(f) of PHIPA, in conjunction with sections 49(a) and 13(1) of FIPPA, I conclude that the appellant does not have a right of access to Records 1 and 1(a).

[97]  The public interest override available through section 23 of FIPPA does not apply to personal health information covered by PHIPA. I will consider below whether it applies to information covered by an exemption under FIPPA.

[98]  On my review of the severable personal health information in Record 2, I am not convinced that it contains or would reveal any advice or recommendations of a public servant, employee or consultant to the hospital. These portions contain information serving to identify the relative as having been a patient of the hospital, or other facts about him. I conclude that sections 49(a)/13(1) of FIPPA, available through section 52(1)(f) of PHIPA, do not apply to exempt the personal health information in Record 2 from disclosure under PHIPA. The appellant has a right of access to this information.

Issue C:  ACCESS UNDER FIPPA

Section 49(a)/13(1) – advice or recommendations

[99]  In this section, I will consider the hospital’s application of section 49(a)/13(1) under FIPPA to those records or portions of the records for which I have not made a determination on access under PHIPA. These consist of portions of Records 2, 8, 9, 10 and all of Records 11 and 11(a).

[100]  Record 2. Above, I found that this exemption does not apply to the personal health information in that record. I reach the same conclusion with respect to the remaining information in Record 2. The hospital’s own submission is that Record 2 was sent to HIROC to fulfill a contractual obligation to give notice of potential claims for insurance-related purposes. The contents of this record do not qualify as advice or recommendations.

[101]  Records 8, 9 and 10. The hospital describes these records as Issues Notes or Q & A’s, containing advice and recommendations for responding to media inquiries about the care provided to the appellant’s relative. The hospital has disclosed most of the information in these records to the appellant, withholding only certain portions. Records 8 and 9 are described as draft Q & A’s, as distinct from Record 10, which appears to be the final version. The hospital submits that these three records form part of the communications plan recommended by the Directors of Communication and Community Engagement, and reveals their advice on addressing media inquiries.

[102]  I am satisfied that the contents of these records contain the advice and recommendations of the hospital’s communications staff on how to address media inquiries concerning the events at issue. They are more than simply factual in nature. Although it is possible to view the contents of the Q & A’s as intended for public dissemination, the recommended responses could be accepted or rejected by the hospital’s decision-makers. I therefore find these records, and in particular, the withheld portions of these records, covered by the section 13(1) exemption in FIPPA.

[103]  Records 11 and 11(a). Above, I concluded that any personal health information in these records is not reasonably severable for the purpose of granting access under PHIPA, as it would comprise meaningless snippets. This is a separate question from whether this personal health information may be reasonably severed within the meaning of section 8(4), for the purpose of preserving access rights under FIPPA. Section 8(4) states:

This Act does not limit a person’s right of access under section 10  of the Freedom of Information and Protection of Privacy Act  or section 4 of the Municipal Freedom of Information and Protection of Privacy Act to a record of personal health information if all the types of information referred to in subsection 4 (1) are reasonably severed from the record.

[104]  In this case, the personal health information to which PHIPA access rights do not apply (because they are meaningless snippets of information) are nonetheless reasonably severable from the records under section 8(4). [18] As a result, the appellant has a right of access to these records under FIPPA, subject to the hospital’s exemption claim.

[105]  As these records contain personal information of the relative, the applicable exemption is section 49(a), in conjunction with section 13(1). Above, I concluded that HIROC qualifies as a consultant retained to give advice to the hospital, within the meaning of section 13(1) of FIPPA. Records 11 and 11(a) document an exchange between the hospital and HIROC in which the hospital seeks and receives HIROC’s risk management advice. I find this information exempt under section 13(1). Any objective information or factual material in the records is so intertwined with the exempt information that severance is not reasonably possible. I therefore find Records 11 and 11(a) exempt under sections 49(a)/13(1) of FIPPA.

Section 21(1) – personal privacy

[106]  I have found that Record 5 does not contain the personal health information of the relative. Access to this record is therefore to be determined under FIPPA alone. The hospital has withheld one portion of this record, as well as Record 7, relying on the personal privacy exemption in section 21(1) of FIPPA. The parties were not asked to make submissions on this exemption, and I will therefore reserve my findings on this exemption claim until they have been given an opportunity to do so.

Section 23 - the public interest override

[107]  The appellant requested that I consider the application of section 23 of FIPPA to the information withheld under section 13(1), being parts of Records 8, 9, 10 and all of 11 and 11(a). Section 23 provides that the section 13(1) exemption, among others, does not apply “where a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption.”

[108]  For section 23 to apply, two requirements must be met. First, there must be a compelling public interest in disclosure of the records. Second, this interest must clearly outweigh the purpose of the exemption. This office has stated that section 23 does not apply where the interests being advanced are essentially private in nature. ^[19]

[109]  The appellant submits that the hospital has been found by the CPSO and HPARB to have deceived his family. He submits that if the insurance provider was involved in the deception, the public interest in this information being made public cannot be overstated. He states that the efforts of the hospital to obfuscate the cause of his relative’s death is a pressing public safety issue and that disclosure of internal communications relating to its handling of media inquiries on the subject are directly relevant to addressing the systemic failures that led to his relative’s death.

[110]  I have considered the appellant’s submissions and reviewed the records in light of those submissions and the surrounding circumstances. I am satisfied that there is no compelling public interest in disclosure of the records. While I cannot provide a more detailed reason without revealing the contents of the records, even assuming the issues raised by the appellant relate to a public, as opposed to a private interest, the records do not shed light on them.

Section 65(6)5 – hospital privileges

[111]  The hospital relied on the exclusion in section 65(6)5 of FIPPA in its decision to withhold Record 7, and portions of Records 8, 9 and 10. Since I have found those portions of Records 8, 9 and 10 exempt under sections 49(a)/13(1), it is not necessary for me to determine whether they may be covered by this exclusion.

[112]  I will reserve my determination on Record 7 pending additional submissions from the parties.

Issue D:  DID THE HOSPITAL EXERCISE ITS DISCRETION UNDER PHIPA AND FIPPA?

[113]  The exemptions at sections 52(1)(f) of PHIPA and 49(a) of FIPPA are discretionary. [20] The section 13(1) exemption in FIPPA is also discretionary.

[114]  Where exemptions are discretionary, the hospital has the discretion to grant access to information despite the fact that it could withhold it. The hospital must exercise its discretion. As part of my review, I must determine whether the hospital exercised its discretion under PHIPA and FIPPA, and whether its exercise of discretion was proper.

[115]  In PHIPA Decisions 17, 30 and 33, this office found that considerations which may be relevant to an institution’s exercise of discretion under FIPPA and its municipal equivalent may also be applicable to an exercise of discretion under PHIPA.

[116]  Through orders issued under FIPPA and its municipal equivalent, this office has developed a list of such considerations. These include:

• the purposes of the acts, including the principles that
• information should be available to the public
• individuals should have a right of access to their own personal information
• exemptions from the right of access should be limited and specific
• the privacy of individuals should be protected
• the wording of the exemption and the interests it seeks to protect
• whether the requester is seeking his or her own personal information
• whether the requester has a sympathetic or compelling need to receive the information
• whether the requester is an individual or an organization
• the relationship between the requester and any affected persons
• whether disclosure will increase public confidence in the operation of the institution
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person
• the age of the information
• the historic practice of the institution with respect to similar information.

[117]  Not all these considerations will necessarily be relevant, and additional unlisted considerations may be relevant. [21]

[118]  The hospital submits that it carefully considered the application of both FIPPA and PHIPA to the Records, including the application of discretionary exemptions, and requests that this office uphold its exercise of discretion.

[119]  The hospital notes that it did not have the benefit of PHIPA Decision 17 when it issued its first decision in September 2015, but that it carefully considered PHIPA Decision 17 when issuing its second decision in April 2016. The hospital also submits that it reviewed IPC orders addressing the meaning of personal information and personal health information, and solicited and reviewed representations of affected parties before exercising its discretion.

[120]  The hospital lists a number of considerations that informed its decision, including: the purposes of FIPPA; the right of access under PHIPA; IPC jurisprudence; affected parties’ positions; the importance of institutions being able to avail themselves of advice from their insurance provider without confidentiality concerns; the importance of institutions not losing insurance coverage by failing to report information about a potential claim; the harm to affected parties and the hospital that is reasonably expected to arise from disclosure of the information.

[121]  The hospital submits that it applied both FIPPA and PHIPA in good faith. In support of this position, the hospital maintains that it disclosed almost all of the records requested by the appellant, that it created records for the appellant’s ease of reference, and that it sought records that were not in its possession or under its control in order to respond to the appellant’s request. The hospital maintains that it considered all relevant factors when exercising its discretion under the two Acts.

[122]  The appellant maintains that the hospital did not consider its discretionary power until it was requested to do so by this office. In support of this position, he notes that the hospital did not have the benefit of PHIPA Decision 17 when issuing its initial decision, and he believes the hospital is being disingenuous in claiming to have considered it subsequently.

[123]  I am satisfied that the hospital took into consideration relevant factors in exercising its discretion, including the nature of the information, its interests in seeking advice and the interests of other parties. I am also satisfied that the hospital did not base its access decision on irrelevant factors. There is no evidence to suggest that the hospital exercised its discretion in bad faith or for an improper purpose, or that it made an error when doing so. I uphold its exercise of discretion in applying sections 52(1)(f) of PHIPA and 49(a) and 13(1) of FIPPA.

Issue E:  DID THE HOSPITAL CONDUCT A REASONABLE SEARCH FOR RECORDS?

[124]  The appellant maintains that the hospital narrowly interpreted his request and is concerned that because the hospital originally issued an access decision under FIPPA, it may not have searched for responsive records of personal health information.

[125]  Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 24 of FIPPA. [22] In this case, section 53 of PHIPA is also applicable. If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision. If I am not satisfied, I may order further searches.

[126]  The Acts do not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [23] To be responsive, a record must be "reasonably related" to the request. [24]

[127]  A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [25]

[128]  A further search will be ordered if the institution does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [26]

[129]  Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [27]

[130]  In order to decide whether the hospital has conducted a reasonable search for records as required by section 53 of PHIPA and section 24 of FIPPA, I requested that the hospital provide, by way of affidavit, a written summary of all steps taken in response to the appellant’s request.

Representations

[131]  The hospital provided an affidavit by the hospital’s Chief Information Management and Chief Privacy Officer, as well as attestations by the staff who carried out the search for responsive records.

[132]  The affidavit explains that the hospital received the request through a series of emails, which were summarized to the appellant in an email on June 26, 2015. The affidavit describes the search parameters employed by the hospital staff in carrying out a search for responsive records. In particular, staff were instructed to search “at a minimum, […] all electronic files, email inboxes/outboxes, filing cabinets,” and to take the following steps:

• Identify all possible locations of records for the request (e.g. electronic files, shared drives, email inbox/outbox, hard copy files onsite, hard copy files offsite).
• Locate and retrieve each hard copy file from filing cabinets.
• Review each hard copy file to identified responsive records.
• Search for responsive emails and electronic documents by entering in key search terms, based on the subject, in order to narrow down the number of emails.
• Scan all emails generated by the key word search in order to locate responsive emails. This would be essential as a key word search may bring up, for example, email correspondence that pertains to the requested topic, but that is not necessarily communication related to this request. Current staff members’ email correspondence is accessible on their desktop or laptop computers, however, for past staff members, restoration of email boxes from archived back-up tapes was required before conducting the email search.

[133]  The records produced by searches were then reviewed by the hospital’s Privacy and Access Office to determine if they are responsive to the request. 

[134]  The appellant submits that there are a number of reasons to believe that the hospital’s searches are unreasonable and incomplete. First, he maintains that the hospital has demonstrated a misunderstanding of what constitutes personal health information, and it is therefore reasonable to assume additional responsive records exist that have not yet been identified. The appellant also submits that the searches conducted appear to have been uncoordinated and haphazard. He maintains that the only way to ensure that no responsive records were missed is to have a single individual search the archived back-up tapes for all staff, not only those who no longer work at the hospital. Finally, the appellant maintains that the hospital’s narrow interpretation of his request also gives reason to believe that the search for responsive records was incomplete.

Analysis

[135]  I am satisfied that the hospital’s search for records was reasonable and there is no reason to believe additional responsive records exist. The hospital identified any staff who may hold responsive records, and provided detailed direction on their searches. The searches covered the relevant date parameters and subject matter, and electronic and paper records.

[136]  The fact that the hospital did not initially view the request to cover personal health information does not detract from the thoroughness of the search. The search was based on the appellant’s request, and produced any records responsive to that request. Employees were directed to search for any records relating to the appellant’s relative’s hospital stay and ensuing events, regardless of any characterization of the information in the records as personal health information or general information. In this context, I have no reason to question the reasonableness of the search.

ORDER:

1. I order the hospital to provide access to Record 2 in its entirety, by June 27, 2018.
2. I reserve my determinations on Records 5 and 7 pending additional submissions.

Original Signed by:		May 28, 2018
Sherry Liang
Assistant Commissioner