PHIPA DECISION 80

Complaint HC16-87

A public hospital

A named doctor

January 10, 2019

Summary: The complainant, the wife of a former patient of a public hospital, had concerns about the care provided to her husband by a named doctor at the hospital. She also believed that during the hospital’s investigation of her care concerns, the doctor breached her husband’s privacy by speaking to a third party about the care provided to him. The complainant raised both concerns in a complaint to the hospital, and in a complaint made against the doctor to the College of Physicians and Surgeons of Ontario. The decision of the College’s Inquiries, Complaints and Reports Committee was later confirmed by the Health Professions Appeal and Review Board. Dissatisfied with the responses of the hospital and the College, the complainant filed a complaint to the Office of the Information and Privacy Commissioner/Ontario (IPC) under the Personal Health Information Protection Act, 2004  (the Act ). In her complaint to the IPC, the complainant alleged that the doctor had improperly disclosed her husband’s personal health information in contravention of the Act . She also alleged that the hospital had failed to respond to her privacy complaint or to comply with its duty to protect patient personal health information in accordance with its obligations under the Act .

In this decision, the adjudicator concludes that no review of the complaint is warranted in the circumstances. First, she determines that section 36(3)  of the Regulated Health Professions Act, 1991  does not prevent her from taking notice of the proceedings of the College and the Board for the purpose of deciding whether those proceedings appropriately dealt with the complaint before her. She then concludes that those proceedings appropriately dealt with the complaint about an improper disclosure of personal health information by the doctor, and she exercises her discretion under section 57(4) (b) of the Act  not to review this aspect of the complaint on this basis. She also finds that, through the IPC complaint process, the hospital has taken adequate steps to respond to the issues in the complaint. In the result, no review is conducted under the Act .

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3 , Sched A, sections 2  (definitions), 3(1), 4, 10, 12(1), 17, 56(2), 57(3) and 57(4); Regulated Health Professions Act, 1991 , SO 1991, c 18, section 36(3) ; Professional Misconduct, O Reg 856/93, section 1(1) paragraph 10.

Orders and Decisions Considered: Orders HO-002 and HO-010; PHIPA Decisions 16, 44, 68 and 74.

Cases Considered: British Columbia (Workers’ Compensation Board) v. Figliola, 2011 SCC 52 (CanLII); Penner v. Niagara (Regional Police Services Board), 2013 SCC 19 (CanLII); Tingling v. College of Psychologists of Ontario, 2017 HRTO 384 (CanLII); F. (M.) v. Dr. Sutherland, 2000 CanLII 5761 (ON CA); Frank v. Legate, 2015 ONCA 631 (CanLII); Rizzo & Rizzo Shoes Ltd. (Re), 1998 CanLII 837 (SCC); Hopkins v. Kay, 2015 ONCA 112 (CanLII).

OVERVIEW:

[1]  The complainant is the wife of a former patient (now deceased) of a public hospital. The complainant was dissatisfied with the care provided to her husband by a named doctor at the hospital. She also alleged that the doctor breached her husband’s privacy when the doctor spoke to a third party about her husband’s care. The complainant raised these concerns in complaints she made to the hospital and to the College of Physicians and Surgeons of Ontario, the regulatory body for the practice of medicine in Ontario.

[2]  The complainant was dissatisfied with the College’s decision in her complaint, and requested a review by the Health Professions Appeal and Review Board. Some time after requesting the review, but before the Board issued its decision, the complainant filed a complaint to the Office of the Information and Privacy Commissioner/Ontario (this office, or the IPC) under the Personal Health Information Protection Act, 2004 (the Act). In her complaint to the IPC, the complainant alleged that the doctor had improperly disclosed her husband’s personal health information in contravention of the Act. She also complained that the hospital had not adequately responded to her complaint.

[3]  Mediation of the IPC complaint was unsuccessful. Near the end of the mediation stage, the hospital wrote to the mediator to request that this office not proceed with the complaint, on grounds described in more detail below. At the adjudication stage of the complaint process, I wrote to the hospital, the complainant and the doctor to request submissions on whether I ought to conduct a review of this matter under the Act . I have taken into account the submissions of all the parties in arriving at my decision in this matter.

[4]  In this decision, I conclude that the circumstances of this complaint do not warrant a review under the Act . In particular, I find that the complaint alleging an improper disclosure of personal health information by the doctor has been appropriately dealt with by means of the College and Board proceedings, within the meaning of section 57(4)(b) of the Act . I also find that, through the IPC’s complaint process, the hospital has responded adequately to the privacy complaint, including by taking steps to comply with its duty to protect personal health information under the Act .

BACKGROUND:

[5]  In September 2013, while an inpatient at the hospital, the complainant’s husband (whom I will also describe in this decision as “the patient”) suffered a cardiac arrest. The complainant had concerns about the care provided to her husband leading up to and during the cardiac arrest, and brought these concerns to the attention of the hospital’s Manager of Risk Management, Quality and Patient Safety in October 2013.

[6]  In January 2014, as part of the hospital’s review of the complainant’s concerns, the Manager of Risk Management and the doctor (who was the attending physician at the time of the patient’s cardiac arrest) met with the complainant.

[7]  The complainant reports that after this meeting, the doctor approached her and revealed that he had had a telephone conversation with the wife of the individual who shared a hospital room with the patient. The doctor reported that he had asked the wife of the patient’s roommate what she knew of an incident involving the patient and the nursing care provided to the patient. The complainant alleges that the doctor’s actions amount to an inappropriate disclosure of her husband’s personal health information in contravention of the Act .

[8]  The hospital conducted an investigation of the complainant’s concerns, including the allegation of improper disclosure, and provided the following information from its review.

[9]  While the doctor acknowledged to the hospital that he had spoken to the wife of the patient’s roommate about the nursing care provided to the patient, he asserts that this discussion occurred in person (and not over the telephone), and that the discussion occurred without any disclosure of the patient’s personal health information. Among other things, the doctor advised the hospital that he had not mentioned the name of the patient during the discussion—that he had instead referred to the patient as the “neighbour” of the roommate—and that the roommate’s wife told the doctor that she had not been present at the relevant time.

[10]  The doctor also maintains that he was informed of the existence of a witness to the patient’s cardiac arrest by the complainant herself. The complainant disputes this. She states that she provided the information about the witness to the Manager of Risk Management and not to the doctor; moreover, she maintains that she told the Manager of Risk Management that the witness was a “friend of the roommate’s family”—not the roommate’s wife.

[11]  Based on the information provided to it by the doctor, the hospital took the position that the doctor’s discussion with the roommate’s wife did not include a disclosure of the patient’s personal health information within the meaning of the Act .

[12]  The complainant and the hospital informed this office of a March 2014 complaint filed by the complainant to the College of Physicians and Surgeons of Ontario about the conduct and actions of the doctor in relation to the care provided to her husband. According to the parties, the College’s Inquiries, Complaints and Reports Committee issued a decision in August 2015 that addressed, in part, the complainant’s allegation that the doctor breached patient confidentiality by speaking to the wife of the patient’s roommate about the care provided to the patient.

[13]  The complainant was dissatisfied with the Committee’s decision and, in December 2015, requested a review by the Health Professions Appeal and Review Board. In March 2017, the Board issued its decision confirming the decision of the Committee.

[14]  The complainant’s complaint to this office was received on September 28, 2016.

[15]  During the intake and mediation stages of the complaint process, the hospital provided this office with information about its investigation into the complainant’s allegations, including a copy of the report produced by its Privacy Office at the conclusion of its investigation. The hospital also provided details of relevant policies and procedures and privacy training in place at the time of the events giving rise to the complaint, and about updates to its policies, procedures and training since that time.

[16]  Near the end of the mediation stage, the hospital raised certain grounds for not proceeding with the complaint, which I address below. In spite of this position, the hospital provided submissions in response to the mediator’s request for information on the issues in the complaint.

[17]  As the issues could not be resolved through mediation, the complaint was transferred to the adjudication stage. After considering the information before me, I wrote to the hospital and the complainant to request representations on whether I ought to conduct a review of this matter under the Act . With the complainant’s consent, I also invited the doctor to make representations on this topic.

[18]  The hospital and the doctor (the respondents in this complaint) provided representations in support of the position that the complaint ought not to proceed to the review stage. The complainant declined to respond directly to the respondents’ submissions. Instead, she asked that I consider a letter that she had sent to this office near the end of the mediation stage. In that letter, among other things, the complainant argues that her complaint has not been adequately addressed by the hospital, or through other proceedings.

[19]  For the reasons that follow, I conclude that the complaint alleging an improper disclosure of personal health information by the doctor has been appropriately dealt with through the College and Board proceedings. On this basis, I decline to conduct a review of this matter under section 57(4)(b) of the Act . I also find that, through the complaint process before this office, the hospital has responded adequately to the issues raised by the complaint.

DISCUSSION:

Preliminary Matters

The doctor is an agent of the hospital, which is operated by a health information custodian

[20]  As a preliminary matter, there is no dispute, and I find, that the person who operates the hospital is a “heath information custodian” within the meaning of section 3(1) of the Act  (paragraph 4.i).

[21]  There is also no dispute that at all relevant times, the doctor was acting as an “agent” of the hospital within the meaning of section 2 of the Act . As a result, the hospital had responsibilities in relation to the doctor’s handling of personal health information on the hospital’s behalf. I discuss some of these responsibilities in more detail later in this decision.

The complaint concerns a disclosure of the patient’s personal health information

[22]  One aspect of the complaint is the allegation that the doctor improperly disclosed the patient’s personal health information during a conversation with the wife of the patient’s hospital roommate. While some of the facts surrounding this incident are in dispute, the parties agree that there was a discussion between the doctor and the roommate’s wife about the nursing care provided to the patient.

[23]  After its investigation of the complainant’s concerns, the hospital took the position that the doctor had not disclosed any personal health information of the patient during this exchange. [1] This appears to be based on the doctor’s assertion that he did not refer to the patient by name or specifically refer to the patient’s cardiac arrest. Instead, the doctor indicated to the hospital that he had asked the roommate’s wife about what had happened to the neighbouring patient on a specified date, and about the nursing care provided to that patient.

[24]  The term “personal health information” is defined at section 4(1) of the Act  to mean identifying information about an individual in oral or recorded form falling within one or more enumerated categories that relate generally to an individual’s health or to his health care.

[25]  The term “identifying information” is defined at section 4(2) to mean “information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.”

[26]  It is evident from the doctor’s own account that he discussed with the wife of the patient’s roommate matters relating to the care of the patient. While the doctor may not have referred to the patient by name, the patient would nonetheless have been identifiable to the roommate’s wife based on the doctor’s description of the patient as the roommate’s hospital room neighbour, and from the nature of the doctor’s inquiries, which were about the health of the patient and the nursing care provided to him. As described in PHIPA Decision 17, the definition of personal health information is broad. Information about the physical health of the patient qualifies as his personal health information within the meaning of section 4(1) [paragraph (a)], as does information about the providing of health care to the patient, including merely the identification of the hospital as a provider of health care to the patient [paragraph (b)].

[27]  I am satisfied, further, that the discussion between the doctor and the roommate’s wife involved a “disclosure” of the patient’s personal health information by the doctor within the meaning of the Act . [2] ^{, [3]}

[28]  The Act  applies to this disclosure of personal health information. This means, among other things, that a person may complain to this office if she has reasonable grounds to believe that the disclosure was made in contravention of the Act  [section 56(1)].

[29]  In this complaint, the complainant alleges that the doctor improperly disclosed her husband’s personal health information in contravention of the Act . She also alleges that the hospital failed to provide an adequate response to her concerns in accordance with its obligations under the Act .

[30]  Section 57 of the Act  sets out steps that may be taken by this office after receiving a complaint. This includes a discretion to review or not to review the subject-matter of a complaint in certain circumstances. I will consider these discretionary powers next.

Commissioner’s discretion to review or not to review a complaint

[31]  Sections 57(3) and (4) of the Act  state, in part:

(3) If the Commissioner does not take an action described in clause (1) (b) or (c) [which relate to attempts at settlement] or if the Commissioner takes an action described in one of those clauses but no settlement is effected within the time period specified, the Commissioner may review the subject-matter of a complaint made under this Act  if satisfied that there are reasonable grounds to do so.

(4) The Commissioner may decide not to review the subject-matter of the complaint for whatever reason the Commissioner considers proper, including if satisfied that,

(a)  the person about which the complaint is made has responded adequately to the complaint;

(b)   the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure, other than a complaint under this Act ;

(c)  the length of time that has elapsed between the date when the subject-matter of the complaint arose and the date the complaint was made is such that a review under this section would likely result in undue prejudice to any person[.]

[32]  The hospital and the doctor submit that this office should not proceed with the complaint based on the grounds set out in sections 57(4)(a) and/or (b) and/or (c). The hospital also refers to the time limitation for submitting a written complaint in section 56(2)(a) of the Act .

[33]  I will briefly comment on the respondents’ timeliness arguments first.

[34]  The events giving rise to this complaint appear to have occurred around October 2013. The complainant reports that she learned about the doctor’s discussion with a third party around January 2014. The complaint to this office was filed in September 2016.

[35]  Section 56(2) of the Act  sets out timeframes for making a complaint to this office about a contravention or potential contravention of the Act  or its regulations. This section states:

A complaint that a person makes under [section 56(1)] must be in writing and must be filed within,

(a)  one year after the subject-matter of the complaint first came to the attention of the complainant or should reasonably have come to the attention of the complainant, whichever is the shorter; or

(b)  whatever longer period of time that the Commissioner permits if the Commissioner is satisfied that it does not result in any prejudice to any person.

[36]  Although it participated in the complaint process at the intake and mediation stages, the hospital raised the issue of timeliness of the complaint near the end of mediation. The hospital observed that the complaint had been filed after the one-year period set out in section 56(2)(a), and argued against permitting a longer time period under section 56(2)(b). The hospital and the doctor also argued against conducting a review of the complaint based on section 57(4)(c) of the Act .

[37]   Both sections 56(2)(b) and 57(4)(c) of the Act  require consideration of the prejudice to any person of proceeding with a complaint. For section 56(2)(b) to apply, this office must be satisfied that permitting a longer time period for filing a complaint “does not result in any prejudice to any person.” Under section 57(4)(c), this office may decide not to review the subject-matter of a complaint (after the complaint has been accepted) where doing so “would likely result in undue prejudice to any person.”

[38]  I asked the parties for submissions on the prejudice to any person of proceeding with the complaint. In addition, although neither section explicitly refers to it, I asked the parties to address the prejudice to any person of not proceeding with the complaint, and the effect that any such prejudice ought to have on my exercise of discretion under these sections.

[39]  The hospital and the doctor submit that proceeding with the complaint will result in prejudice to them—including, particularly, the prejudice of having to commit time and resources to address a complaint that (they claim) has already been dealt with through other proceedings. The doctor submits that the respondents ought to be able to rely on the finality of those earlier proceedings, and that the parties are prejudiced by the possibility of conflicting decisions on the same issues.

[40]  The respondents also assert that not proceeding with the complaint will not prejudice the complainant. This too is based on a claim that the subject-matter of the complaint has already been addressed through other proceedings.

[41]  The respondents’ arguments about prejudice are directly related to the claim that the complaint has been appropriately dealt with by means of another procedure. This is the very question for determination under section 57(4)(b), on which topic the respondents provided detailed submissions.

[42]  I will directly address the claim about the relevance of other proceedings in considering the application of section 57(4)(b) of the Act  in these circumstances. It is unnecessary, therefore, for me to address this same claim in relation to the respondents’ arguments about prejudice and timeliness under sections 56(2)(b) and 57(4)(c) of the Act , and I decline to do so.

Has the allegation of improper disclosure by the doctor been appropriately dealt with by means of another procedure, within the meaning of section 57(4)(b) of the Act?

[43]  All the parties referred me to now-concluded proceedings before the College of Physicians and Surgeons of Ontario and the Health Professions Appeal and Review Board.

[44]  The complainant acknowledges that her March 2014 complaint to the College about the doctor included a complaint about the doctor’s conversation about the patient with the wife of the patient’s roommate, and that the decision of the College’s Inquiries, Complaints and Reports Committee addressed this aspect of her complaint. She also indicates that she agrees with the Committee’s finding on this aspect of her complaint. She disagrees, however, with the Committee’s disposition in her complaint, and with the decision of the Board, in response to her request for a review of the Committee’s decision, to confirm the Committee’s decision.

[45]  The respondents submit that the complainant’s concerns about improper disclosure have been appropriately dealt with through the College and Board proceedings, which “squarely dealt with the confidentiality issue” now raised by the complainant in her complaint to this office.

[46]  Section 57(4)(b) of the Act  permits this office not to review the subject-matter of a complaint where the complaint has been or could be more appropriately dealt with by means of another procedure. The thrust of section 57(4)(b) is to confer a discretion on this office not to proceed with a complaint where doing so would amount to a re-litigation of issues appropriately addressed in another forum, or where the complaint could be more appropriately dealt with by another procedure.

[47]  In British Columbia (Workers’ Compensation Board) v. Figliola, the Supreme Court of Canada considered the purpose of a statutory provision that, like section 57(4)(b) of the Act , grants discretion to a decision-maker not to hear a complaint whose substance has been appropriately dealt with in another proceeding. [4] The Court observed that this type of statutory mechanism reflects the principles behind common law doctrines meant to prevent abuse of the decision-making process. Their purpose is to ensure the finality, fairness and integrity of the justice system by preventing unnecessary inconsistency, multiplicity and delay. [5]

[48]  In Figliola and a subsequent decision, Penner v. Niagara (Regional Police Services Board), ^[6] the Supreme Court considered the application of these principles in the context of prior administrative proceedings. Together these decisions set out some factors for consideration by a decision-maker in exercising her discretion to proceed or not to proceed with a matter on the basis of a prior proceeding. These include: whether there was concurrent jurisdiction in the prior proceeding to decide the issues at hand; whether the previously decided legal issue was essentially the same as what is now being complained of; and whether there was an opportunity in the prior proceeding for the complainants or their privies to know the case to be met and have the chance to meet it, regardless of how closely the previous process procedurally mirrored the one the decision-maker prefers or uses. As described in Figliola, these questions “go to determining whether the substance of a complaint has been ‘appropriately dealt with.’” ^[7]

[49]  In addition, the Court in Penner observed that other considerations of fairness to the parties are relevant to the exercise of discretion. In Penner, the majority of the Court found that even where the preconditions for applying the common law finality doctrine of issue estoppel had been met, it was unfair in the circumstances to have done so to bar an appellant’s civil action on the basis of a prior administrative proceeding. Among other fairness factors that ought to have informed the exercise of discretion in that case were significant differences in the purpose and scope of the different proceedings, and the reasonable expectations of the parties about the impact of the prior proceedings on their broader legal rights. ^[8]

[50]  In my view, the above-noted considerations of judicial finality, economy and fairness to the parties are relevant to the exercise of discretion under section 57(4)(b) of the Act .

[51]  I asked the parties to explain whether section 57(4)(b) applies to this complaint in light of the considerations identified above. Among other things, I asked that they address whether it would be unfair or unjust not to proceed with a review in the circumstances of this complaint.

[52]  I also asked the parties to address what impact, if any, section 36(3)  of the Regulated Health Professions Act, 1991 (the RHPA) [9] ought to have on this office’s exercise of discretion under section 57(4)(b). Section 36(3)  of the RHPA states:

No record of a proceeding under this Act , a health profession Act  or the Drug and Pharmacies Regulation Act, no report, document or thing prepared for or statement given at such a proceeding and no order or decision made in such a proceeding is admissible in a civil proceeding other than a proceeding under this Act , a health profession Act  or the Drug and Pharmacies Regulation Act or a proceeding relating to an order under section 11.1 or 11.2 of the Ontario Drug Benefit Act.

[53]  Arguably, read broadly, this section would preclude the IPC from relying on proceedings of the College or the Board in making a determination under section 57(4)(b) of the Act .

Parties’ representations

[54]  The respondents take the position that section 36(3) of the RHPA  does not preclude the IPC from taking notice of the fact that the College (through its Inquiries, Complaints and Reports Committee) and Board have issued decisions in proceedings addressing the same issue as that raised in the present complaint.

[55]  For reasons set out in my findings, below, I agree that merely taking notice of the existence of the prior proceedings, in order to make a determination under section 57(4)(b) of the Act , does not engage section 36(3) of the RHPA .

[56]  Here, I will set out the respondents’ arguments about how these prior proceedings appropriately dealt with the complaint about improper disclosure, and why I ought to decline to review this aspect of the complaint on this basis.

[57]  First, the respondents submit that the College and the Board had jurisdiction to consider and to address the complainant’s concerns about the doctor, including the complaint about his discussion with a third party. The hospital reports that colleges established under the RHPA  regularly adjudicate complaints in connection with their members’ privacy and confidentiality duties toward patients: the College is well-placed to review and assess the appropriateness of the doctor’s overall professional conduct, including privacy concerns, and did so in this case.

[58]  All the parties agree that the College’s Inquiries, Complaints and Reports Committee heard the parties’ submissions on matters including the doctor’s conversation with a third party about the patient, and that the Committee’s decision addressed this aspect of the complaint.

[59]  The complainant requested a review of the Committee’s decision by the Health Professions Appeal and Review Board. The hospital reports that the Board heard and considered the complainant’s concerns about the Committee’s decision, and ultimately issued a decision confirming the Committee’s decision.

[60]  The respondents submit that the College and Board proceedings were procedurally fair. The complainant had an opportunity to participate in both proceedings, including by making submissions for consideration by the decision-makers. The hospital observes that the fact the complainant did not get the outcome she was seeking does not mean the proceedings were procedurally unfair.

[61]  Finally, the respondents submit that no unfairness or injustice would result from a decision not to review the subject-matter of this complaint under the Act . The hospital observes that the complainant indicates that she wishes to pursue this complaint in order to see a public decision issued, and to prevent another family from having a similar experience. The hospital submits that these are not different forms of remedy than what was available through the College and Board proceedings. The hospital notes that the College, through the Committee, made findings and issued a disposition addressing the doctor’s conduct and that the Board’s decision, confirming the Committee’s decision, is publicly available.

[62]  The doctor additionally submits that this office should seek to avoid conflicting decisions arising from the same issues, as is possible in this case where the Committee and the Board have already issued decisions on these same matters. The doctor and the hospital ought to be able to rely on the finality of those prior proceedings.

[63]  Although invited to, the complainant declined to respond directly to the respondents’ submissions. Instead, she relies on an earlier submission that she made to the mediator near the end of the mediation stage of the complaint process, and which she consented to share for the purpose of my addressing this complaint. I will address relevant portions of the complainant’s submission in my findings, below.

Analysis and findings

[64]  For the reasons that follow, I conclude that section 36(3) of the RHPA  does not prevent me from taking notice of the proceedings before the College (through the Committee) and the Board in order to make a determination under section 57(4)(b) of the Act . Then, taking notice of those proceedings for this limited purpose, I find the prior proceedings appropriately dealt with this aspect of the complaint, and I exercise my discretion to decline to review the matter on this basis.

Section 36(3) of the RHPA is not engaged in these circumstances

[65]  Section 36(3) of the RHPA  makes inadmissible certain materials from proceedings under the RHPA  (like the College and Board proceedings discussed here) in some civil proceedings. I reproduce section 36(3) again here for ease of reference:

No record of a proceeding under this Act , a health profession Act  or the Drug and Pharmacies Regulation Act, no report, document or thing prepared for or statement given at such a proceeding and no order or decision made in such a proceeding is admissible in a civil proceeding other than a proceeding under this Act , a health profession Act  or the Drug and Pharmacies Regulation Act or a proceeding relating to an order under section 11.1 or 11.2 of the Ontario Drug Benefit Act.

[66]   This raises the question of whether, and to what extent, I may refer to the College and Board proceedings in making a determination under section 57(4)(b) of the Act .

[67]  In the alternative to its main argument (namely, that section 36(3) of the RHPA  does not apply in the particular circumstances of this complaint), the hospital proposes that section 36(3) cannot apply, in any circumstances, to proceedings before this office. In the hospital’s submission, a decision by the IPC to review or not to review a complaint, or the IPC’s review of complaint, are not civil proceedings within the meaning of section 36(3) of the RHPA , and the prohibition in section 36(3) therefore cannot apply. Among other reasons, the hospital submits that a proceeding before the IPC does not affect the private civil rights of the parties to the same extent as a civil action.

[68]  In the absence of explicit language, I find no basis for limiting the meaning of the term “civil proceeding” in section 36(3) of the RHPA  to proceedings before a court. In setting out exceptions to its application, section 36(3) itself describes as “other” civil proceedings certain kinds of non-court proceedings, including those under the RHPA . This office has already recognized that the prohibition in section 36(3) can apply to matters before the IPC; [10] other administrative tribunals have also explicitly recognized that the term “civil proceeding” in section 36(3) of the RHPA  applies to proceedings before those tribunals. [11] I also note that while the term is not defined in the RHPA , a broad definition of civil proceeding in this context accords with the definition of the term “proceeding” in other legislation including the Act , which includes proceedings before a court as well as proceedings before non-court bodies, such as tribunals. [12]

[69]  In answer to this argument made by the hospital, I also observe that although they are not court proceedings, quasi-judicial proceedings may have significant impacts on an individual’s rights. For example, through its proceedings, the IPC may address complaints about contraventions of the Act ’s rules to protect the privacy of individuals in respect of their personal health information, and about their rights of access to and to require the correction of that information. Moreover, as the hospital recognizes, a proceeding before the IPC may result in an order to remedy a contravention or potential contravention of the Act ; the Act  also establishes a statutory right for a person affected by an order of this office to seek damages in some circumstances. I find no basis to distinguish proceedings before the IPC from the civil proceedings referred to in section 36(3) on the ground the former have a lesser impact on an individual’s rights.

[70]  Having determined that section 36(3) of the RHPA  can apply to proceedings before this office under the Act , I now consider the respondents’ main argument that section 36(3) does not apply to the circumstances before me. The respondents submit that the prohibition in section 36(3) does not prevent me from taking notice of the College and Board proceedings for the limited purpose of making a determination under section 57(4)(b) of the Act . In making this argument, the respondents rely on the reasoning set out in Tingling v. College of Psychologists of Ontario, [13] a decision of the Human Rights Tribunal of Ontario (HRTO) whose relevance I had asked the parties to consider.

[71]  In Tingling, a vice-chair of the HRTO considered the impact of section 36(3) of the RHPA  on his exercise of discretion under section 45.1  of the Ontario  Human Rights Code  (the Code ), [14] which contains language similar to section 57(4)(b) of the Act . Under section 45.1  of the Code , the HRTO may dismiss an application made to it under the Code  where the HRTO is of the opinion that another proceeding has appropriately dealt with the substance of the application. The parties to the application before the vice-chair had been involved in proceedings—first before a regulatory college, and then before the Health Professions Appeal and Review Board—concerning the applicant’s registration for membership in a regulated health profession. It was not in dispute that the same Code  issues identified in the application before the HRTO had been addressed by the Board. The question before the vice-chair was whether the prohibition in section 36(3) of the RHPA  prevented him from taking notice of this fact when deciding whether to dismiss the application before him under section 45.1  of the Code .

[72]  The vice-chair concluded that it does not. In doing so, he recognized that he was departing from previous HRTO decisions that had considered the impact of section 36(3) of the RHPA  on the exercise of discretion under section 45.1  of the Code . In those previous decisions, the HRTO had interpreted section 36(3) as preventing it from considering a prior decision in a proceeding covered by that section. The vice-chair observed that this interpretation of section 36(3) has the effect of removing the HRTO’s discretion to address clearly duplicative litigation in certain cases—namely, where the prior proceedings were conducted under the RHPA and other legislation specified in section 36(3). He found this result to be incompatible with the intent and purpose of the statutory discretion in section 45.1  of the Code  to prevent the re-litigation of disputes and to ensure fairness for parties and the overall integrity of the administrative justice system.

[73]  He found it possible to avoid this result by recognizing a distinction between admitting into evidence a decision made in a prior proceeding [which is prohibited by section 36(3)], and taking notice of the existence of the decision for the limited purpose of determining what issues were raised in the prior proceeding. He found support for this interpretation of section 36(3) in the distinction recognized by the Court of Appeal between the admissibility of a document protected by that section and the fact that the document exists. [15] He was also satisfied that the case law relied upon by the HRTO in its earlier decisions did not stand for the proposition that merely taking notice of a decision contravenes section 36(3) of the RHPA . To the extent the earlier HRTO decisions had failed to recognize this distinction, he declined to follow them. [16] He concluded that a decision in a proceeding covered by section 36(3) of the RHPA  may be referred to in some circumstances, including in an exercise of discretion under section 45.1  of the Code .

[74]  Accordingly, the vice-chair found that he was entitled to take notice of the public decision of the Board, and to refer to the contents of the decision for the limited purpose of determining what issues were raised in that proceeding. He found that the issue before him had been raised and adjudicated in the proceeding before the Board. Based on this and other factors, he exercised his discretion under section 45.1  of the Code  to dismiss the application on the ground the Board proceeding had appropriately dealt with the substance of the application before him.

[75]  The vice-chair’s interpretation of section 36(3) of the RHPA  is in line with the modern principle of statutory interpretation, which provides that the words of a legislative text must be read in their ordinary sense harmoniously with the scheme and objects of the act and the intention of the legislature. [17] I find his interpretation accords with the plain meaning of the words of section 36(3) and with its purpose, as described by the Court of Appeal, to encourage the reporting of complaints under the RHPA and other specified acts, and to keep those complaint proceedings separate from civil proceedings. [18]

[76]  At the same time, by recognizing that section 36(3) does not prevent a decision-maker from taking notice of a decision made in a prior proceeding, in order to determine what issues were raised in that proceeding, this approach also serves the intent and purpose of statutory mechanisms to prevent the re-litigation of disputes already decided in another forum. It is also consistent with the interpretation given to section 36(3) by the Court of Appeal, which acknowledged that the prohibition in that section does not preclude mere reference in a subsequent proceeding to a prior proceeding covered by section 36(3). [19]

[77]  This all supports the vice-chair’s reasoning in Tingling, which I find to be persuasive and equally applicable to the exercise of discretion under section 57(4)(b) of the Act . As a practical matter, I observe that it would not be uncommon for there to be overlap in proceedings under the RHPA and the Act in matters concerning regulated health professionals’ handling of personal health information. An interpretation of section 36(3) that would permit the possibility of different findings on the same facts should generally be avoided. It is possible to avoid this undesirable result by interpreting section 36(3) of the RHPA  in a manner that preserves, rather than precludes, this office’s discretion under the Act  to address clearly duplicative litigation, and is at the same time consistent with the aims of section 36(3) and the guidance provided by the courts.

[78]  For all these reasons, I conclude that section 36(3) of the RHPA  does not prevent me from taking notice of the existence of the prior proceedings before the College and the Board, and of the issues considered in those proceedings, for the purpose of making a determination under section 57(4)(b) of the Act . [20] Given my finding, I will next address the effect of these prior proceedings on my exercise of discretion to review or not to review the aspect of the complaint alleging an improper disclosure of personal health information by the doctor.

The complaint about improper disclosure has been appropriately dealt with by means of the College and Board proceedings

[79]  Above, I described certain considerations of judicial finality, economy and fairness that are relevant to an exercise of discretion under section 57(4)(b) of the Act . Applying these factors, I conclude that the complaint alleging improper disclosure by the doctor has been appropriately dealt with by means of the College and Board proceedings, and that there is no unfairness to the parties in declining to review this matter under the Act .

[80]  On the question of jurisdiction, I am satisfied that the College had the authority to address the complainant’s allegation of a privacy breach by the doctor as part of the College’s mandate to respond to public complaints about its members’ conduct and actions and to regulate its members in the public interest. This may include investigating complaints about a member’s failure to maintain the confidentiality of patient information in accordance with his professional and legal obligations. The complainant then requested that the Board review the decision of the College’s Inquiries, Complaints and Reports Committee, which the Board did in accordance with its authority under the RHPA .

[81]  There is no dispute that the parties to the proceedings had the opportunity to participate, and that they did, including by making submissions on the issues. There is no suggestion that the prior proceedings were procedurally unfair.

[82]  I must consider whether the previously decided legal issue was essentially the same as the matter now before me. The College, through the Committee proceedings, heard the complainant’s allegation about the doctor’s discussion with a third party, and made findings on this issue. The Board confirmed the decision of the Committee, including on this aspect of the complaint. The complainant now asks that I make a determination on this same matter under the Act . I conclude that, despite some differences in their purpose and scope—which I discuss further in my consideration of the Penner factors, below—the earlier proceedings addressed facts and issues in dispute that are essentially the same as those before me now.

[83]  Given all this, in consideration of the factors outlined by the Court in Figliola, I am satisfied that the earlier proceedings “appropriately dealt with” this aspect of the complaint.

[84]  I must now consider whether I ought nonetheless to conduct a review of this same matter because it would be unfair not to do so in the circumstances. This requires consideration of the fairness factors identified by the Court in Penner, including significant differences in the purpose and scope of the different proceedings, and the reasonable expectations of the parties about the impact of the prior proceedings.

[85]  I am satisfied that differences in the proceedings before the College and the Board, and the IPC, in light of the bodies’ different mandates, do not play a significant role in these circumstances. The IPC’s mandate to receive and respond to health privacy complaints under the Act  may overlap with the College’s role to regulate its members in the public interest. This may occur, as here, in the case of a complaint about a member’s actions or conduct in respect of patient personal health information. This type of complaint may raise issues of professional misconduct, [21] the member’s compliance with the Act ’s rules governing the collection, use and disclosure of personal health information, and other issues.

[86]  The College is empowered to address this type of complaint through the Committee’s investigation and decision-making process, which may result in remedial action against the College member. [22] The IPC may decide to review a complaint alleging a breach of the Act and, following its review, may make orders and recommendations to remedy contraventions of the Act . [23] The IPC has recognized that orders and recommendations made by this office are different from the outcome of College proceedings, and serve a different purpose. [24] In particular, dispositions issued by the Committee are generally directed at improving a member’s conduct or future practice, or disciplining the member where appropriate, while the IPC’s focus is on addressing systemic issues arising from complaints. [25] In this case, however, I am satisfied that these differences do not warrant a re-litigation of this matter before this office.

[87]  In requesting a review by the IPC, the complainant acknowledges that she brought the same privacy breach allegation to the College, as part of her broader complaint about the doctor’s actions and conduct. She also acknowledges that the College’s Inquiries, Complaints and Reports Committee made what she describes as an appropriate finding on the matter. She asserts, however, that the Committee’s manner of dealing with the issue was “light,” by which I understand the complainant to mean the disposition was too lenient in her view. She states that, as a result, she had no choice but to bring her concern to this office.

[88]  I agree with the hospital that some of the remedies now being sought by the complainant though the IPC process do not differ significantly from those that were available through the Committee process. In particular, remedial dispositions aimed at improving a member’s practice, professionalism and conduct, and sanctioning a member for deficiencies in these areas, are within the purview of the College. In my view, the fairness considerations in Penner are not engaged simply because the complainant believes that the Committee ought to have disposed of the complaint against the doctor in a different way. For example, this office has affirmed, in a different context, that its statutory role is not to evaluate the severity or appropriateness of particular sanctions imposed against a party for a violation of the Act . [26]

[89]  I confirm that in taking notice of the prior proceedings for the purpose of making a determination under section 57(4)(b) of the Act , I have not otherwise relied on the Committee and Board decisions, or any other materials that are subject to the prohibition in section 36(3) of the RHPA . My determinations here are not based on the particular findings of the decision-makers or the outcomes in those proceedings. The Board was the proper forum for the complainant to raise her concerns about the reasonableness of the Committee’s decision, including in view of its manner of disposing of the matter, and this is what the complainant did. I find no unfairness in requiring the parties to be bound by the Board’s decision upholding the Committee in this matter.

[90]  I recognize that the complainant also suggests that her complaint raises systemic issues that ought to be addressed through the IPC’s review process. Among other things, the complainant challenges the doctor’s credibility and proposes that the IPC proceedings are necessary to hold the doctor publicly to account. She also takes issue with the hospital’s initial position that the doctor’s actions did not contravene the Act , and with the Committee’s failure to comment on the hospital’s privacy policies and procedures in place at the time of the incident. She submits that the IPC, through its statutory mandate to examine privacy breaches for the benefit of the public at large, may make use of remedial tools not available to the hospital or to the Committee to address systemic issues at the hospital. She explains that she has an interest in seeing improvements not only to the doctor’s practices but also to the hospital’s policies to ensure that other families do not go through the same experience. She also alludes to the educative purpose of a public decision on this issue.

[91]  Under the next heading, I address the complainant’s concerns regarding the hospital’s response to the privacy complaint, and the potential systemic issues that the complainant has identified. As will be seen below, I conclude that the hospital has responded adequately to these concerns through the course of this complaint.

[92]  Under this heading, I considered the aspect of the complaint alleging a contravention of the Act  by the doctor, and found that this matter was appropriately dealt with by means of the College and Broad proceedings. I acknowledge that the complainant has identified what she describes as a number of discrepancies between the accounts of events given by the doctor to the College and to this office during this complaint process. These discrepancies relate to whether the doctor spoke to the roommate’s wife by telephone or in person, and the circumstances under which the doctor initiated contact with the roommate’s wife. Even if I were to accept that this establishes a lack of credibility on the doctor’s part, I would not conclude from this that there remain continuing or systemic issues that would benefit from a review by this office.

[93]  In any event, these discrepancies would not affect my finding, above, that the oral exchange between the doctor and the third party included a disclosure of personal health information and, as such, was governed by the Act . My findings appear in this public decision. I observe that the College now makes publicly available information about the outcomes of its investigations of its members in some circumstances, [27] and that decisions of the Board are public. The public availability of the IPC and Board decisions in this matter should go some way toward addressing the complainant’s interest in raising awareness about the application of the Act to these types of interactions between doctors and third parties, and in educating the public about the consequences of privacy breaches more generally.

[94]  For all these reasons, in consideration of the prior proceedings that have appropriately dealt with this same matter, I decline to review this aspect of the complaint under section 57(4)(b) of the Act .

Has the hospital provided an adequate response to the complaint?

[95]  This aspect of the complaint concerns the adequacy of the hospital’s response to the privacy concerns raised by the complainant. The complainant alleges that the hospital failed to provide her with any information about its investigation of her complaint. She also questions the adequacy of the hospital’s privacy policies and procedures to protect the confidentiality of patients’ personal health information.

[96]  The hospital’s responsibility to investigate and respond to a privacy breach arises from its obligations under section 12 of the Act . Section 12(1) states:

A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.

[97]  The duty to take reasonable steps to protect personal health information includes a duty to respond adequately to a complaint of a privacy breach. Among other things, a proper response will help ensure that any breach is contained and will not re-occur. [28]

[98]  In addition, section 10 of the Act  requires health information custodians to have in place and to comply with information practices, including administrative, technical and physical safeguards and practices to protect personal health information in their custody or control [sections 2, 10(1) and 10(2)].

[99]  Section 17 of the Act  addresses the relationship between health information custodians and their agents, including their respective responsibilities under the Act . Among other things, health information custodians must take steps to ensure that their agents are aware of and understand their obligations under the Act and under the custodian’s information practices, and the consequences of failing to comply with these obligations. [29]

[100]  I asked the hospital and the complainant to address the allegation that the hospital failed to respond to the privacy concerns raised by the complainant. I also asked about the hospital’s compliance with the Act ’s requirements concerning its information practices.

[101]  The hospital reports that the complainant first raised her privacy concerns with the hospital in early October 2016, in connection with her separate complaint regarding aspects of the clinical care provided to her husband. On the same day, the hospital was notified by the IPC about a privacy complaint filed by the complainant against the hospital; however, the nature of the complaint to the IPC was not made clear until several weeks later. Despite this, the hospital reports, it immediately began an investigation based on the information it had received directly from the complainant about the doctor’s discussion with a third party about matters involving the patient’s care.

[102]  The hospital provided regular updates on its investigation—at first directly to the complainant, and then through the IPC—in October and December 2016. The hospital’s updates to this office during the course of the complaint process were shared with the complainant. The hospital’s investigation culminated in a final investigation report, completed in February 2017. Among other things, the report sets out the hospital’s understanding of the allegations (the privacy breach allegation, as well as a second allegation later made by the complainant, which does not form part of this complaint), the steps taken by the hospital to investigate both allegations, and the basis for its findings, including the finding that there was no inappropriate disclosure of the patient’s personal health information by the doctor. As one of the concerns raised by the complainant was the hospital’s failure to provide her with information about its investigation, I asked the hospital to provide the complainant with a copy of its final investigation report, which it did.

[103]  During the complaint process, the hospital also provided this office with copies of relevant policies and procedures in force at the time of the events giving rise to the complaint, as well as updated versions where applicable. These include historical and current versions of the hospital’s “Office of the Patient Experience Protocol PC-0042” for conducting internal investigations of clinical care, its policy titled “Privacy and Security of Personal Health Information,” and its “Privacy Breach Protocol.”

[104]  The hospital was asked for details of any privacy training provided to the doctor prior to the events giving rise to the complaint, and any updates to that training, and details of any changes to hospital policies or processes made as a result of this complaint. The hospital explains that while privacy training was available for all hospital personnel, including physicians, in 2013, this training was not mandatory. In fall 2014, the hospital introduced mandatory privacy training as a condition of initial authorization and annual reauthorization of all clinical users, including physicians, in order to access the hospital’s main clinical management system. Users who do not initially complete or who fail to annually complete the training are immediately prevented from using the system until their successful completion of the training module. The hospital’s Privacy Office logs and is able to audit users’ completion of the training module. This approach ensures that individual users read, understand and acknowledge their privacy obligations as a condition of their use of the system; furthermore, because in most cases use of the system is critical to their ability to perform their clinical duties, users’ self-motivation to complete the training is high.

[105]  The hospital also observes that, apart from its obligations under the Act , it is contractually required to provide privacy and security training to its agents as a condition of its participation in various provincial shared electronic health records systems, including eHealth Ontario’s “Connecting Ontario” system. The hospital notes that these policy requirements were developed with the participation of the IPC and the hospital’s Privacy Office, among others.

[106]  The hospital also provided details of the privacy training and education requirements imposed specifically on physicians. The hospital explains that the Toronto Academic Health Sciences Network (TAHSN) hospital group, of which it is a part, identified the need for a common, mandatory physician privacy training module among TAHSN member sites, particularly to support the network’s many cross-appointed physicians. The hospital participated in the creation of an online physician training module for TAHSN members in 2016, and, in December 2017, received approval from the hospital board’s Medical Advisory Committee to implement the training as a mandatory annual condition for physician appointment or reappointment to the hospital starting in January 2018. The hospital reports that many of its academic hospital peers have implemented similar training and appointment requirements, and that the existence of a common training module recognized across participating sites will support physician credentialing and privacy assurance at the hospital and across network member sites.

[107]  In addition, the hospital reports that starting in 2015 and annually since that time, it has required all physicians to acknowledge their agreement to abide by relevant policies and by-laws, including its policy regarding the privacy and security of personal health information. The hospital provided a copy of the physician reappointment letter that all members of its medical, dental and midwifery staff are required to sign annually.

[108]  Finally, the hospital informed this office of some changes that it has made, since the filing of this complaint, to its process for reviewing complaints about patient care. The hospital explains that the practice of its Quality and Patient Safety department is to inform the individual bringing the complaint that its review will include accessing the patient’s health record and speaking with the clinical team. Complaint reviews can only proceed with patient consent. In the course of some reviews, the department may be required to consult with internal clinical experts or others who may have relevant information, such as witnesses. The hospital reports that in order to make the review process more transparent, the department now informs the individual that its review may include discussions with individuals identified as witnesses to a patient’s care, and that, where possible, interviews with witnesses will be conducted in a manner that does not require the disclosure of a patient’s personal health information.

[109]  I shared the hospital’s representations with the complainant. While the complainant declined to provide specific comments in response, at her request I have considered the written submission she made at an earlier stage of the complaint process.

[110]  Based on all the information before me, I am satisfied that through this complaint process, the hospital has taken adequate steps to respond to the issues raised by this complaint, including the deficiency in its initial response that I identify, below.

[111]  The evidence indicates that upon receipt of the privacy complaint, the hospital began an immediate investigation in accordance with its protocol for investigating patient complaints and other applicable policies. Its investigation included coordination between the Privacy Office and other hospital offices to determine the degree of overlap between the privacy complaint and other concerns raised by the complainant concerning the care provided to the patient. The Privacy Office’s investigation into the matter included, among other things, reviews of the hospital’s Risk Management and Office of the Patient Experience files related to the complaint, discussions with the doctor (through his legal counsel), and consideration of relevant hospital policies. These steps are set out in some detail in the final investigation report, a copy of which has now been shared with the complainant.

[112]  I have considered the hospital’s evidence of its policies and practices in place at the time of the events giving rise to this complaint, and implemented since that time, to protect personal health information in its custody or control. Among others, the hospital’s current “Privacy and Security of Personal Health Information” policy and “Privacy Breach Protocol” address its agents’ collection, use and disclosure of personal health information and include in the definition of a privacy breach an unauthorized disclosure of personal health information. These policies also reproduce the definition of personal health information contained in the Act , including the proviso that such information includes information for which there is a reasonable basis to believe that an individual could be identified. The hospital’s evidence is that its agents now undergo mandatory annual privacy training and education, including on these policies, and that physicians are subject to additional privacy training and acknowledgement requirements as a condition of their appointment to the hospital.

[113]  I have also considered the change made by the hospital to its complaints review process since the time of the events giving rise to this complaint. I appreciate that the hospital means to provide more transparency about its complaints review process by advising complainants that its review may include interviews with third parties, such as witnesses. However, I question the assumption that witness interviews could be conducted in some cases in a manner that would not entail the disclosure of a patient’s personal health information. Given the broad definition of personal health information, and considering the context in which information would be sought from witnesses, I find it likely that these discussions would include patient personal health information.

[114]  It may be that any collection, use and disclosure of personal health information in these circumstances could be done on the basis of consent, or permitted or required to be made without consent under the Act . I make no finding in this regard. Nonetheless, the hospital’s failure to recognize the potential application of the Act in these circumstances raises concerns that relate to one of the criticisms made by the complainant about the hospital’s response. The complainant has observed that neither the doctor nor the hospital admitted at the conclusion of the hospital’s investigation that the doctor improperly disclosed personal health information in contravention of the Act . I found, above, that the allegation of a privacy breach by the doctor has been appropriately dealt with by means of the College and Board proceedings against the doctor, and I declined to make my own findings on this aspect of the complaint. However, I acknowledge the complainant’s concern about the hospital’s initial position that the doctor’s discussion with a third party did not involve any disclosure of personal health information within the meaning of the Act .

[115]  Above, I set out my view that the oral exchange between the doctor and the third party included a disclosure of personal health information and, as such, was governed by the Act . Although the hospital failed to recognize this in its initial response to the complainant’s concerns, it has since acknowledged through the course of this complaint that the Act  applies in these circumstances. It has also answered the complainant’s request for more information about its investigation of her complaint, and taken steps to implement changes to its privacy training and other practices to ensure that its agents’ collections, uses and disclosures of personal health information are made in compliance with the Act . This training should reinforce that the definition of personal health information set out in the Act  (and reflected in the hospital’s policies) is broad, and can include information about unnamed individuals. As well, the guidance provided through this public decision should assist the hospital in ensuring future compliance with its obligations under sections 10 and 12(1) of the Act .

[116]  Overall, I am satisfied that through the complaint process before this office, the hospital has taken steps to comply with its obligations under the Act , and there is no purpose served in proceeding with a review of this matter.

NO REVIEW:

For all the foregoing reasons, no review of this matter will be conducted under Part VI of the Act.

Original Signed by:		January 10, 2019
Jenny Ryu
Adjudicator