PHIPA DECISION 93

HI17-24

A Public Hospital

May 30, 2019

Summary: The Office of the Information and Privacy Commissioner of Ontario received a complaint under the Personal Health Information Protection Act, 2004 (the Act) about the fees being charged by a public hospital (the hospital) for access to health records. This led to an investigation by this office into the hospital’s practices regarding access requests and the fees that it charged individuals to provide access to their health records. This decision concludes that some of the hospital’s practices were not in accordance with sections 54(1) and (10) of the Act. It also concludes that the hospital charged fees that exceeded “reasonable cost recovery” as that term is used in section 54(11) of the Act. However, in light of the steps taken by the hospital to amend these practices and its fee schedule, this decision finds that a review of this matter is not warranted.

Statutes considered: Personal Health Information Protection Act, 2004, sections 1(b), 53, 54 (1), (2), (3), (7), (9), (10) and (11), and 58(1).

Decisions considered: HO-009, HO-14 and PHIPA Decision 17.

BACKGROUND:

[1]  In March 2017, an individual made a written access request to a public hospital (the hospital) for copies of his health records. In response, the hospital issued a decision advising that it could not process the request because, in part, he had not paid the non-refundable fee of $100 required to cover the hospital’s file search. Moreover, the hospital advised that it could charge additional photocopying costs of $200 for up to 25 pages and, if applicable, an additional $1.00 for each page over 25 pages.

[2]  In April 2017, the Office of the Information and Privacy Commissioner of Ontario (the IPC or this office) received a complaint under the Personal Health Information Protection Act, 2004 (the Act or PHIPA) from this individual about the fees charged by the hospital for access to his health information. He believed that these fees were inconsistent with orders issued by the IPC.

[3]  The above matter was resolved. However, this office had concerns with the hospital’s practices for processing and responding to access requests under the Act, as well as the fees that it was charging for providing access to health records. As a result, a Commissioner-initiated file was opened at the Intake Stage of the IPC’s PHIPA process and assigned to an Analyst.

[4]  During the Intake Stage, the hospital submitted a response. After receiving this information, the matter was moved to the Investigation Stage of the IPC’s PHIPA process.

[5]  In this decision, I find that some of the hospital’s practices were not in accordance with sections 54(1) and (10) of the Act. I also find that the hospital was charging fees for access to health records that were inconsistent with the orders issued by this office and exceeded the “reasonable cost recovery” permitted by section 54(11) of the Act.

[6]  However, in light of the steps taken by the hospital to amend these practices and its schedule of fees, I conclude that no review is warranted under the Act.

[7]  As part of my investigation, I requested and received written representations from the hospital with respect to this matter. The information I obtained is described below.

ISSUES:

[8]  This decision addresses the following issues:

1. Did the hospital’s practices comply with section 54(1) of the Act?
2. Did the hospital’s practices regarding fees comply with sections 54(10) and (11) of the Act?
3. Is a review warranted under the Act?

RESULTS OF THE INVESTIGATION:

Issue 1: Did the hospital’s practices comply with section 54(1) of the Act?

[9]  One of the Act’s purposes is “to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions set out in this Act”. [1]

[10]  To this end, Part V of the Act sets out the rules governing how an individual can exercise their right of access to their health records and the obligations of a health information custodian (custodian) in responding to requests for access.

[11]  Section 53 of the Act states:

Request for access

(1) An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information.

Detail in request

(2) The request must contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts.

Assistance

(3) If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2).

[12]  In response to a request under section 53, section 54(1) of the Act generally requires that a custodian (i) provide access to the record, (ii) give written notice that the record does not exist, cannot be found or is not a record to which Part V of the Act applies, or (iii) give written notice that the request is being refused.

[13]  The custodian’s response must be given “as soon as possible in the circumstances but no later than 30 days after receiving the request”, unless the custodian, in certain circumstances, extends this time limit by a maximum of another 30 days. [2]

[14]  Moreover, pursuant to section 54(7) of the Act, where the custodian “does not respond to the request within the time limit or before the extension, if any, expires, the custodian shall be deemed to have refused the individual’s request for access.”

[15]  The hospital advised that it has a “Consent to Disclose Personal Health Information” form (the Access/Disclosure Form) that requesters can use to submit a request for access to (or to disclose) their health information. The hospital confirmed that requesters do not have to use this form, or any specific type of form, to make this request.

[16]  The hospital explained that it would process an access request that it deemed complete and for which the applicable fee under its schedule of fees (discussed below) was paid. Otherwise, the hospital advised that it would deem the request incomplete.

[17]  The hospital advised that a complete access request would require all of the following elements:

• witnessed;
• dated within 3 months;
• directed to the hospital;
• specifies what information is requested;
• specifies what date the requested information pertains to;
• specifies the purpose for the request;
• includes the patient’s name, address, signature, date of birth and/or health card number; and
• where the patient is unable to consent for themselves, then the SDM’s information must be provided (i.e. name, relationship, signature and proof of authorization if applicable – i.e. power of attorney documents, proof of guardianship, etc.).

[18]  According to the hospital, an incomplete access request would be returned to the requester, usually within one business day, with a letter explaining the deficiencies in the request (i.e. a “deficiency letter”). In this circumstance, the hospital keeps a log of the requester’s name, the date the request was received, the reason(s) why it found the request deficient and the date the request was returned.

[19]  Moreover, the hospital advised that incomplete access requests received via fax would be destroyed rather than returned to the sender and a deficiency letter would be sent.

[20]  Where an access request does not contain sufficient detail to enable the hospital to identify and locate the record with reasonable efforts or where it required clarification, the hospital advised that it would call the requester to help clarify the request. If the requester could not be reached by phone, the hospital advised that it would log the above-mentioned information about the request and return the original copy to the requester with a letter setting out what additional information is required. But, the hospital advised that it would not keep a copy of a returned request.

[21]  Significantly, where the hospital received an access request that was unwitnessed, not dated within three months or did not specify the purpose of the request (collectively, the 3 Elements), the hospital would deem it incomplete and return it to the requester with a deficiency letter.

[22]  In support of this practice, the hospital explained that it required that a request be witnessed to address its concerns about the requester’s identity. The hospital also explained that it requires that a request be dated within three months because it believed that there was a risk that the requester’s consent after this time period would be invalid. Lastly, the hospital claimed that it never denied a requester access to their health information based on the purpose of the request that they specified or where they did not specify one.

[23]  I accept that, in accordance with section 54(9) of the Act, custodians must “first take reasonable steps to be satisfied as to the individual’s identity” before making a health record available to them.

[24]  In my view, the reasonable steps required to confirm an individual’s identity depend on the circumstances. Asking a requester for photo identification, a copy of the power of attorney document in the case of a substitute decision-maker who claims to be authorized by that document and/or relying on an assertion made by the requestor may be appropriate. [3]

[25]  Further, I am not sure that a witness signature, by itself, is particularly strong evidence of the identity of the requester. In any event, I see no reason why the need to confirm an individual’s identity before giving them a record justifies treating an access request as invalid from the outset. In my view, a witness signature is not a requirement for all valid access requests under the Act.

[26]  I also acknowledge that an access request may become invalid after a certain period of time. However, the hospital did not provide me with any representations about why it believes that a requester’s consent becomes invalid in all cases after three months. Because of this belief, it appears that the hospital may deem otherwise valid access requests to be incomplete on the basis of an arbitrary time limit, without taking any further steps to confirm whether this is a proper conclusion. This three month time limit is not a requirement imposed by the Act.

[27]  In addition, the hospital did not provide me with any representations about why it requires that requesters give the purpose of their access requests. As such, the hospital has not given me any basis to conclude how, if ever, such purpose would be relevant to a custodian’s response to an access request under the Act. [4]

[28]  Further, in IPC Order HO-009 (HO-009), then Assistant Commissioner Brian Beamish stated:

With respect to Dr. Berndt’s position that he had no evidence before him suggesting that the records were necessary for the complainant’s health, it must be emphasized that the reason precipitating an individual’s request for access is irrelevant. An individual has a right of access to his or her records of personal health information regardless of the reason for which the access is requested and the amount of the fee that may be charged by a health information custodian in making the record of personal health information available or providing a copy of the record to the individual is not dependent on the reason for the request. [5]

[29]  The above quote is applicable to this matter, and I find no justification under the Act for the hospital to impose this requirement before responding to a request.

[30]  Moreover, the hospital did not explain the difference between its claim that it has never denied access where no purpose was provided and its practice of returning a request deemed incomplete because no purpose was provided. As such, it appears that the hospital is drawing a distinction between refusing and returning an access request where no purpose was provided. Regardless, this distinction does not indicate why the purpose for the request would be required.

[31]  Although the hospital did not explicitly refuse requests that were missing one of the 3 Elements, its practice was to deem them incomplete and return them to requesters with a deficiency letter. Above, I found that these elements were not required for an access request to be valid under the Act. In rejecting access requests that were lacking one of the 3 Elements, it appears that the hospital had a practice of not responding as required by section 54(1), where it received otherwise valid access requests. In dealing with requests in this manner, the hospital did not comply with its obligations under sections 54(1) and 54(2).

[32]  In response to inquiries made during this investigation, the hospital confirmed that, effective January 1, 2019, individuals seeking access to their health records no longer need to provide the 3 Elements as part of their access request. The hospital also confirmed that it has amended the Access/Disclosure Form by removing the sections on this form referring to these elements.

[33]  As indicated above, the hospital returns and does not keep copies of access requests it deems incomplete. Although the Act does not specifically require that the hospital keep copies of an insufficient and/or incomplete access request that it returns to a requester, in my view, failing to do so might make it difficult for the hospital to respond to access complaints, audit its own compliance and offer assistance in reformulating a request.

[34]  This is especially the case here, where the hospital’s representations lead to the conclusion that it had a practice of not responding to otherwise valid access requests because they were deemed incomplete on the basis of requirements not justified under the Act.

[35]  In response to this concern, the hospital confirmed that it will keep a copy of any access request that it returns to a requester.

[36]  Lastly, in light of the hospital’s use of the Access/Disclosure Form, I encourage the hospital to further refine its policies, practices and procedures to distinguish between access and disclosure under the Act. I note that different rules may apply in the context of requests that the hospital disclose personal health information to a third party, as opposed to requests for access to one’s own personal health information (including through a substitute decision-maker). Notably, requests for access under Part V of the Act trigger certain mandatory responses by the hospital, while requests for disclosure to third parties may not.

Issue 2: Did the hospital’s practices regarding fees comply with sections 54(10) and (11) of the Act?

[37]  Under the Act, custodians can charge a fee for providing an individual with access to their health record.

[38]  Section 54(10) of the Act states:

Fee for access

(10) A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

[39]  Further, section 54(11) of the Act states:

Amount of fee

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed. [6]

[40]  In October 2010, then Assistant Commissioner Beamish concluded in HO-009 that a regulation proposed by the Minister of Health and Long-Term Care in 2006 (the HO-009 Fee Scheme) provided the best framework for determining the amount of “reasonable cost recovery” under section 54(11).

The hospital’s schedule of fees

[41]  According to the hospital, it charges a requester a fee for access to their health information in accordance with the “Schedule of Fees” in its Release of Information Procedure Manual (the ROI Manual).

[42]  The hospital explained that this schedule used the same fee amounts set out in the “Release of Information Schedule of Fees” created in 2006 by the Central East Local Health Integration Network (CE LHIN). Under the CE LHIN’s schedule, different fee amounts could be charged based on the type of requester and the type of record requested, in addition to various research and miscellaneous fees.

[43]  Effective January 1, 2018, the hospital updated its Schedule of Fees by basing it on the HO-009 Fee Scheme as follows [7] :

Chart viewing with staff	$30.00	first 20 pages; after: $0.25/page or $0.50/microfilm/microfiche copies
Chart printing/photocopy	$30.00	15 minutes; $6.75 every 15 min. thereafter
Hospital/Physician for patient care	$0.00
Other fees as per HO-009

[44]  HO-009 and, later IPC Order HO-14 (HO-14), considered the meaning of the phrase “reasonable cost recovery” in section 54(11). [8] Applying the purposive approach to statutory interpretation, HO-009 established that this phrase does not mean actual cost recovery or full recovery of all the costs borne by a custodian in fulfilling an access request.

[45]  That decision also stated that “the purpose of a ‘reasonable cost recovery’ scheme is to ensure that, in each individual case, a fee is set that reflects the specific and unique realities of that case.” (emphasis in original)

[46]  HO-009 also determined that section 54(11) must be interpreted in a way that avoids creating a financial barrier to the above-mentioned purpose of the Act, which is to grant a right of access to one’s own health information, subject to limited and specific exceptions. [9]

[47]  I accept and adopt the findings in HO-009 and HO-14.

[48]  In HO-14, the HO-009 Fee Scheme was reproduced as follows:

For the purposes of subsections 35(2) and 54(11) of the Act, the amount of the fee that may be charged shall not exceed $30 for any or all of the following:

1. Receipt and clarification, if necessary, of a request for a record.

2. Providing an estimate of the fee that will be payable under subsection 54(10) of the Act in connection with the request.

3. Locating and retrieving the record.

4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access or disclosure may or shall be refused.

5. Preparation of a response letter.

6. Preparation of the record for photocopying, printing or electronic transmission.

7. Photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages, excluding the printing of photographs from photographs stored in electronic form.

8. Packaging of the photocopied or printed copy of the record for shipping or faxing.

9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping or faxing the printed copy.

10. The cost of faxing a copy of the record to a fax number in Ontario or mailing a copy of the record by ordinary mail to an address in Canada.

11. Supervising examination of the original record for not more than 15 minutes.

In addition to the fee charged above, fees for the services set out in Column 1 of the Table below shall not, for the purposes of subsections 35(2) and 54(11) of the Act, exceed the amounts set out opposite the service in Column 2 of the Table below.

…

[49]  Although HO-009 was issued by this office in October 2010 and concluded that the HO-009 Fee Scheme provides the best framework for determining the amount of reasonable cost recovery under section 54(11), the hospital continued to use the CE LHIN’s schedule of fees until January 1, 2018.

[50]  Under this schedule, the hospital charged patients $100 for a record search and, for photocopying, $200 for up to 25 pages and an additional $1.00 per page thereafter. It also charged different fees based on the type of requester and the type of record requested, as well as various research and miscellaneous fees. The fees in this schedule substantially exceed those set out in the HO-009 Fee Scheme and, therefore, I find that they exceed a reasonable cost recovery framework.

[51]  More broadly, I also find that the hospital’s Schedule of Fees, during that time period, was excessive and imposed a barrier to individuals seeking access to their health information. I also find that it frustrated the Act‘s purpose “to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions”.

[52]  However, as previously mentioned, the hospital no longer charges those fees and has changed its practices for charging fees to be in accordance with the HO-009 Fee Scheme.

The hospital’s fee estimate practice

[53]  Section 54(10) requires that the hospital provide a requester with an estimate of the fee before charging them a fee for access to their health record.

[54]  The IPC’s Guideline on “Fees, Fee Estimates and Fee Waivers” (the Guideline), which provides provincial and municipal institutions with guidance on issuing a fee estimate under public sector access legislation, is informative in the circumstances of this investigation.

[55]  The Guideline advises that a fee estimate “provides the requester with a reasonable understanding of the costs involved in providing access…to help the requester make an informed decision as to whether or not to pay the fee and pursue access”. It also advises that the fee estimate “can also assist the requester in deciding whether to narrow the scope of a request in order to reduce the fees.”

[56]  I find that these passages in the Guideline are equally applicable in understanding the purpose of the fee estimate custodians are required to provide before charging a fee for access under the Act.

[57]  Based on its latest Schedule of Fees, the hospital informs requesters that there is a $30 fee to process their request for a copy of their health record and charges them this amount. The hospital also informs the requester that this fee could increase at the rate of $0.25 for each page after the first 20 pages.

[58]  The hospital explained that, without printing the requested health record, its electronic chart system does not allow it to determine the number of responsive pages. The hospital advised that, only after it prints out the record, is it able to determine the total number of pages and, as a result, calculate the remaining balance of the fee, if any. A balance would, generally, be owing where a record contains more than 20 pages.

[59]  However, the hospital also advised that, where a request appears to be for a record containing a large number of pages, it would contact the requester to confirm the information that they are requesting and discuss the potential fee. [10]

[60]  After printing the record, the hospital advised that it charged the remaining balance to the requester and informed them of it when informing them that their record was ready. If the requester did not pay the balance at the time of pick-up, the hospital advised that it released the record along with an invoice for the balance.

[61]  Further, the hospital advised that it mailed a requester’s record to them with this invoice where they did not pick up the record within three months or asked to receive their record by mail. In the event that a requester did not pay their invoice, the ROI Manual required that the hospital send them a first and, if applicable, a second “ROI Outstanding Fee Letter”, as well as attempt to contact them by telephone.

[62]  Accordingly, where the hospital receives a request for a copy of a health record that contains no more than 20 pages, it gives requesters the fee estimate of $30 before charging them this amount. In my view, this practice is consistent with section 54(10).

[63]  However, based on the above, where the hospital receives a request for a copy of a health record containing more than 20 pages, it does not calculate the balance owing until it is charged to the requester.

[64]  Further, although the hospital would discuss a request that appears to be for a large number of records, the requester would still not have a reasonable understanding of how many pages there will be. As a result, they would only know, in a general way, that there will be a lot of pages, but not what it costs for them.

[65]  In my view, this is not enough information for requesters to have a reasonable understanding of the costs involved in providing access and, therefore, be able to make an informed decision about whether to pursue access or narrow their request.

[66]  I find that these practices are not in accordance with section 54(10), in that requesters are not given an estimate of the total fee before being charged for access to their health record.

[67]  In response to inquiries made during this investigation, the hospital confirmed that, effective April 2019, it changed these practices. Where the hospital receives a request for a copy of a health record, it will print the responsive record, calculate the fee and provide the requester with a detailed statement of fee letter that sets out, in particular, the following:

• a detailed calculation of the total fee, which includes the $30 fee portion and the remaining balance portion, if any;
• that the requester must pay the fee in order to proceed with their access request;
• where the $30 portion has been paid, that the requester is entitled to the first 20 pages of the record; and
• that the requester can submit a fee waiver request to the hospital.

[68]  Where the requesters asks to receive the copy by mail, the hospital advised that it will mail this fee letter to them or call them to provide the aforementioned information.

[69]  As a result of this change, a requester would now have a reasonable understanding of the costs involved in the hospital providing them with access and, therefore, be in the position to make an informed decision as to whether or not to pay the fee in order to proceed with their access request or narrow it. Further, it appears that the requester would have this understanding before being obliged to pay the fee.

Issue 4: Is a review warranted under the Act?

[70]  Section 58(1) of the Act sets out the Commissioner’s discretionary authority to conduct a review as follows:

Commissioner’s self-initiated review

The Commissioner may, on his or her own initiative, conduct a review of any matter if the Commissioner has reasonable grounds to believe that a person has contravened or is about to contravene a provision of this Act or its regulations and that the subject-matter of the review relates to the contravention.

[71]  In accordance with my delegated authority to determine whether this matter warrants a review under section 58(1) and the above reasons, I find that a review is not warranted.

[72]  Although I have found that the hospital’s previous practices did not comply with its obligations under sections 54(1), (10) and (11) of the Act, during the course of this investigation it has taken steps to comply. There is no purpose to be served by conducting a review.

DECISION:

For the foregoing reasons, no review of this matter will be conducted under PART VI of the Act.

Original Signed by:		May 30, 2019
John Gayle
Investigator