PHIPA DECISION 96

Complaint HA16-87-2

Family Services of Peel

July 30, 2019

Summary: A father requested information from Family Services of Peel (FSP) about any services that his children may have received from FSP. He complained to the IPC about FSP’s refusal of his request. The parties took conflicting positions on several issues, including the nature of the information at issue, the nature of the request for information, and the father’s entitlement to the information under the Personal Health Information Protection Act, 2004  (PHIPA ) or other legislation. In this decision, the adjudicator finds that PHIPA  is the applicable statute governing the father’s request for his children’s personal health information, and that he does not have a right of access to this information under Part V of PHIPA .

The adjudicator also finds, however, that the father has provided grounds for considering his request under several sections in Part IV of PHIPA that confer a discretion on health information custodians to disclose personal health information. Specifically, she finds that the father’s evidence raises the potential application of section 29 (a) of PHIPA , which permits disclosure with consent, and sections 41(1) (d)(i) and 43(1) (h) of PHIPA , which permit disclosure without consent. As FSP did not consider the request under these sections of PHIPA  permitting disclosure, she orders FSP to consider whether it can and should disclose the requested information under these sections, and provides guidance about some factors that it should take into account.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sch A, sections 2  (definitions), 3(1), 4(1), 5(1), 6(3), 23, 25, 29, 41(1)(d)(i), 43(1)(h) and 52; Freedom of Information and Protection of Privacy Act , RSO 1990, c F.31, sections 2  (definitions), 21(1)(d) and 49(b); Municipal Freedom of Information and Protection of Privacy Act , RSO 1990, c M.56, sections 2  (definitions), 14(1)(d) and 38(b); Divorce Act , RSC 1985, c 3 (2nd Supp ), sections 16(5) and 16(8); Children’s Law Reform Act , RSO 1990, c C.12,  sections  19 (a) and 20(5) ; Child, Youth and Family Services Act, 2017 , SO 2017, c 14, Sch 1, sections 1(1)  and 15(2) .

Decisions and Orders Considered: PHIPA Decisions 19, 21, 22 and 25; Orders M-787, PO- 3599 and MO-3351.

INTRODUCTION:

[1]  This decision arises from a father’s complaint about a health information custodian’s response to his request for information about his children. While this decision addresses the particular facts before the adjudicator, it may also provide general guidance to custodians who receive requests from parents for their children’s personal health information. These types of requests can raise challenging questions for a custodian about what entitlement, if any, the parent has to information about the child, and about how to respond to the request in accordance with the custodian’s statutory obligations. Among other things, this decision addresses the important distinction in the Personal Health Information Protection Act, 2004  (PHIPA ) between access to and disclosure of personal health information. In some cases, while a custodian may rightfully decide that a parent has no right of access to a child’s personal health information, it may still have a duty to consider whether PHIPA  nonetheless permits it to disclose the requested information.

BACKGROUND:

[2]  This complaint arises from a request made by a father to Family Services of Peel (FSP) for information about his two children. The father is divorced from the children’s mother, whom he describes as the custodial parent for the children. In a letter to FSP, the father wrote that he “would like to be provided a list of dates and times that appointments have been scheduled either regarding intake or the children’s counselling appointments.”

[3]  He reiterated his request in an email asking for “a list of dates of appointments that have been scheduled and attended (including intake appointments).” He also sent a second letter, asking that he be provided with:

... the documents and information that [the children’s mother] has been provided with as part of the referral and intake for my children. I also would like all documents and information provided to [the children’s mother] to execute the receiving of services from your organization.

[4]  FSP characterized the request as a request for information relating to clinical counselling services for the children. It denied the request, stating:

... parents require their child’s consent to access a record relating to counselling services, if the child is 12 or older... [S]ervice providers may also withhold information that parents or children would otherwise be entitled to if the provider is of the opinion that disclosure would cause emotional or physical harm to the child or a third party, or reveal the identity of a person who has provided information.

[5]  In support of this position, FSP cited sections of the Child and Family Services Act , the predecessor to the Child, Youth and Family Services Act, 2017 . [1]

[6]  The father complained to the Office of Information and Privacy Commissioner/Ontario (this office, or the IPC) about FSP’s decision. For ease of reading, I will use the terms “father” and “complainant” interchangeably in this decision.

[7]  During the intake stage of the IPC’s complaint process, FSP issued a revised decision in which it maintained its denial of the complainant’s request, this time under the Personal Health Information Protection Act, 2004  (PHIPA ). In this decision, FSP cited sections 23(2)  and 52  of PHIPA , and stated: “[W]e are not in possession of signed releases and/or court documentation directing us to release any information.”

[8]  Section 52  of PHIPA  concerns the right of access of an individual to his or her own personal health information.

[9]  Section 23  of PHIPA  identifies persons who may consent on behalf of an individual in respect of the individual’s personal health information (and may thus make an access request on behalf of the individual: sections 5(1), 25, 52 and 53). While section 23(1) includes among these persons “a parent of the child” (except in certain circumstances that I will discuss later in this decision), section 23(2) clarifies that this does not include a parent who has only a right of access to the child.

[10]  In its revised decision, FSP quoted the text of sections 52(1)(a) through (e), which are exemptions from the right of access in section 52. FSP did not elaborate on how any of these sections might apply in the circumstances of the father’s request.

[11]  The complaint was then assigned to a mediator under section 57(1) (c) of PHIPA . During mediation, the complainant stated that he is seeking the following information from FSP:

1. • Information concerning whether intake occurred and whether FSP met with either the complainant’s children or the children’s mother, including confirmation that the children or their mother (on behalf of the children) have:

1. • Undergone the intake process;

2. • Filled out any intake forms with FSP; or

3. • Visited FSP.

2. • Intake documents concerning the children and their mother.

3. • Dates and times of appointments for the following:

1. • Counselling;

2. • Intake appointments;

3. • Health services.

[12]  The complainant stated that he is not seeking counselling notes. He takes the position that the information he is seeking is not personal health information but rather administrative records.

[13]  In his complaint to the IPC, the complainant referred to a court order issued in proceedings between him and the children’s mother. The complainant asserts that the court order stipulates that he be provided with any information about the children that is provided to the children’s mother.

[14]  In addition, the complainant stated that:

The stipulations of the court order ... [are] also in line with the Child and Family Services Act , the Children’s Law Reform Act  and various historical decisions of the Information and Privacy Commissioner of Ontario.

[15]  FSP confirmed that it considers the class of information at issue in this complaint to be personal health information. FSP refused to confirm or deny the existence of responsive records or information on the basis that doing so may reveal personal health information.

[16]  As no further mediation was possible, the complaint was transferred to the adjudication stage of the process. This office decided to conduct a review of the issues raised by the complaint and received representations from FSP and the complainant, which were shared between the parties in accordance with section 18 of the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004. The complaint file was transferred to me during the course of the review.

[17]  In this decision, I address, among other issues, whether the complainant’s request is governed by PHIPA , and, if so, whether FSP acted in accordance with PHIPA  in refusing the complainant’s request. I conclude that PHIPA  applies to the request. I find that the complainant does not have a right of access under PHIPA  to the children’s personal information. However, I also find that, in the particular circumstances of this case, FSP had a duty to consider the potential application of certain sections of PHIPA  that permit it to disclose personal health information where relevant conditions are met. As FSP did not do so, I will order FSP to consider the complainant’s request again under these sections, taking into account relevant factors that it may have failed to consider previously.

DISCUSSION:

[18]  Generally speaking, PHIPA  applies to the handling of personal health information by health information custodians. “Personal health information” and “health information custodian” are defined terms in PHIPA .

[19]  The request giving rise to this complaint is a request by the complainant to FSP for information about his children’s receipt of services from FSP. During the course of this complaint, FSP and the complainant each made arguments that amount to claims that PHIPA  does not apply to the facts of this case. I will address these briefly before considering the main issues raised by the complaint.

FSP is a health information custodian within the meaning of PHIPA

[20]  During the intake stage of the complaint process, and again during the review stage, FSP asserted that it is not a “health information custodian” subject to the requirements of PHIPA . This is in spite of FSP’s having specifically referred to PHIPA  (as the basis for refusing the complainant’s request) in its revised decision issued during the mediation stage. Additionally, during the intake stage, FSP described its services as including counselling services on “issues like depression, anxiety, etc., frequently referred to as ‘mental health,’” and further specified that these services are provided through its clinical staff, the majority of whom are registered social workers.

[21]  Section 3(1)  of PHIPA  lists a number of persons and organizations that may qualify as “health information custodians.” It states, in part:

In [PHIPA ],

“health information custodian”, subject to subsections (3) to (11) [which are not reproduced here as they are of no relevance in this complaint], means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any:

1. A health care practitioner or a person who operates a group practice of health care practitioners.

2. A service provider within the meaning of the Home Care and Community Services Act, 1994 who provides a community service to which that Act applies.

4. A person who operates one of the following facilities, programs or services:

vii. A centre, program or service for community health or mental health whose primary purpose is the provision of health care.

[22]  Section 2  of PHIPA  defines “health care practitioner” as: a person who is a member within the meaning of the Regulated Health Professions Act, 1991 or is a member of the Ontario College of Social Workers and Social Service Workers, and who provides health care; or any other person whose primary function is to provide health care for payment.

[23]  Section 2 also defines the term “health care” to include “any observation, examination, assessment, care, service or procedure that is done for a health‑related purpose” and that is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition, or to prevent disease or injury or to promote health.

[24]  This office provided FSP with its preliminary assessment that FSP is a health information custodian within the meaning of paragraph 1 of section 3(1) of PHIPA . Specifically, the services provided by FSP appear to meet the definition of “health care” in PHIPA , and these services appear to be provided by clinical staff who are members of a health regulatory college or the College of Social Workers and Social Service Workers, or who provide health care for payment.

[25]  When asked to comment on this preliminary assessment, FSP raised no objections. FSP also made submissions during the review stage that are premised on its being subject to PHIPA . It also appears possible, based on other information in the file, that FSP could qualify as a health information custodian under paragraph 2 or 4 of the definition at section 3(1)  of PHIPA . In the circumstances, I am satisfied that FSP is a health information custodian under one or more sections of the definition in PHIPA , and, as such, is subject to the requirements of PHIPA .

[26]  I confirm for the complainant’s benefit that FSP is not an “institution” within the meaning of that term in the Freedom of Information and Protection of Privacy Act  (FIPPA ) or the Municipal Freedom of Information and Protection of Privacy Act  (MFIPPA ). I specifically reject the complainant’s assertion that FSP is a “service provider organization within the meaning of section 17.1  of the Ministry of Government Services Act ,” as described in paragraph (a.1 ) of the definition of the term “institution” at section 2 of FIPPA. Section 17.1  of the Ministry of Government Services Act  [2] permits the Lieutenant Governor in Council to make regulations designating a ministry or a person or entity as a service provider organization. There is no regulation designating FSP as a service provider organization, and FSP does not qualify as an institution under any of the other heads of the definition in FIPPA or MFIPPA . As a result, FSP is not subject to FIPPA or MFIPPA , and the rights of access in those statutes do not apply to the complainant’s request.

The information at issue is personal health information within the meaning of PHIPA

[27]  As FSP is a health information custodian, it is subject to PHIPA ’s rules governing its handling of “personal health information.” That term is defined at section 4(1)  of PHIPA  to include identifying information about an individual in oral or recorded form that relates to the individual’s physical or mental health, or to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual [paragraphs (a) and (b)].

[28]  In this case, the complainant seeks information about his children’s receipt of services from FSP, including whether they received services at all. The complainant has characterized this information as being of an administrative nature, rather than personal health information, because he is not requesting the children’s counselling records. Instead, he wants to know whether his children have visited FSP or undergone the intake process at FSP, and details such as the dates and times of any counselling or other appointments. He also requests copies of any intake documents concerning the children (or their mother, on behalf of the children).

[29]  All this information is the personal health information of the children. At a minimum, the information sought by the complainant could identify FSP as a provider of health care to the children, which is explicitly included in the definition of personal health information at section 4(1)(b). Moreover, consistent with the broad interpretation of personal health information adopted by this office, [3] I find that, in the circumstances of this complaint, confirming that FSP is not a provider of health care to the children would also qualify as the children’s personal health information. In the particular context of this complaint, I am satisfied that the fact the children did or did not receive counselling or other services from FSP would reveal information about their physical or mental health or about the providing of health care to them, and in this way qualifies as their personal health information under PHIPA .

[30]  Based on the information before me, I am also satisfied that the complainant does not seek any personal health information of the children’s mother. Although portions of his request refer to the children’s mother, it is clear from the context and from the complainant’s representations that his interest is in obtaining information about his children, and only incidentally in obtaining information about the mother where it relates to the arrangement of services for the children. I conclude that any information responsive to the complainant’s request is the children’s personal health information, and not the mother’s.

[31]  Finally, there is no claim that any responsive information is the complainant’s own personal health information, and I find that it is not. [4]

[32]  I have found that PHIPA  applies to the complainant’s request to FSP for the personal health information of his children. I will now address the main issues in this complaint, which have to do with whether FSP acted in accordance with PHIPA  in refusing the complainant’s request.

Did FSP act in accordance with PHIPA in refusing the complainant’s request for his children’s personal health information?

[33]  Unlike FIPPA and MFIPPA , PHIPA  does not provide a general right of access to information held by the persons or organizations to which it applies. The only right of access in PHIPA  is the right of individuals, under Part V of PHIPA , to obtain their own personal health information in the custody or under the control of health information custodians, subject to limited and specific exclusions and exemptions. The right of access must be exercised by the individual to whom the personal health information relates, or by that individual’s lawfully authorized substitute decision-maker (sections 5(1), 25, 52 and 53). The health information custodian must respond to the request for access, and, if no exemptions apply, must provide access (section 54).

[34]  PHIPA  also contains rules governing the disclosure of personal health information (Part IV of PHIPA). Under PHIPA, a health information custodian may disclose an individual’s personal health information with the consent of the individual. PHIPA  also permits (and, in some cases, requires) a health information custodian to disclose personal health information without consent in specific circumstances. As will be seen below, the distinction in PHIPA  between access and disclosure means that requests for personal health information can yield different outcomes, depending on the nature and circumstances of each request.

[35]  In this complaint, there is a question about whether the complainant’s request is a request for “access” to his children’s personal health information, or is a request for “disclosure” of this same information to him. FSP’s reliance on certain sections of PHIPA  to refuse the complainant’s request indicates that FSP treated the request as a request for access to the children’s personal health information. At the same time, in his original request to FSP, the complainant referred to certain legal grounds as the basis for his entitlement to the information, which could be interpreted as raising sections of PHIPA  that permit the disclosure of personal health information. In light of this, both parties were asked whether the access or disclosure provisions of PHIPA  are applicable in the circumstances, and, in either case, whether FSP acted in accordance with PHIPA  in refusing the request for personal health information.

Access under PHIPA

The complainant does not have a right of access under PHIPA

[36]  The right of access to a record of personal health information is set out at section 52(1)  of PHIPA . This section states, in part:

Subject to this Part [Part V of PHIPA , which sets out rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless [...]

[37]  The complainant is not the individual to whom the personal health information at issue relates. Rather, he is the father of two children whose information he has requested. As a result, the complainant is only entitled to exercise a right of access to the children’s personal health information under PHIPA  if he is their lawfully authorized “substitute decision-maker” within the meaning of PHIPA  (sections 5(1) , 25 , 52 , 53 ).

[38]  Section 23  of PHIPA  sets out a list of persons who may act as substitute decision-makers for mentally capable individuals. [5] Potentially relevant in this complaint are paragraphs 1 and 2 of section 23(1), which state:

(1) If [PHIPA ] or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent:

1. If the individual is capable of consenting to the collection, use or disclosure of the information,

i.  the individual, or

ii.  if the individual is at least 16 years of age, any person who is capable of consenting, whom the individual has authorized in writing to act on his or her behalf and who, if a natural person, is at least 16 years of age.

2. If the individual is a child who is less than 16 years of age, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to,

i.  treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or

ii.  counselling in which the child has participated on his or her own under the Child, Youth and Family Services Act, 2017 . [6]

[39]  Section 23(2) qualifies the meaning of “parent” in paragraph 2 of section 23(1) to exclude a parent who has only a right of access to the child.

[40]  Section 23(3) further provides that in the case of a mentally capable child under 16, a decision of the capable child in respect of his or her own personal health information prevails over a conflicting decision of the substitute decision-maker.

[41]  In his representations, the complainant refers to the children’s mother as the custodial parent. He does not claim that he is also a custodial parent for the children. Instead, his argument about his entitlement under section 52  of PHIPA  appears to be based on his evidence that at one point in time, the children’s mother asked FSP to provide the complainant with certain information about the children. The complainant asserts that this qualifies as a request under section 52(1)  of PHIPA .

[42]  Assuming without deciding that children’s mother is the lawfully authorized substitute decision-maker for the children under PHIPA , [7] she would be entitled to request access to records of their personal health information on their behalf. In that case, however, the right of access—and the right to complain about a refusal of the request—would belong to the mother, and not to the complainant. If, instead, the complainant’s claim is that he is entitled to exercise his own right of access to the children’s personal health information, he has not provided evidence to support this claim.

[43]  In these circumstances, I am not satisfied that the complainant is entitled to act as the children’s substitute decision-maker within the meaning of PHIPA . He therefore has no right of access to the children’s personal health information under PHIPA .

[44]  FSP cited section 23(2) and various exemptions at section 52(1) in refusing the complainant’s request. Given my finding that the complainant cannot exercise a right of access on behalf of the children, it is unnecessary to consider either party’s arguments about exceptions to any substitute decision-making authority, or about any exemptions from a right of access in PHIPA .

Disclosure under PHIPA

[45]  Aside from the right of access in Part V of PHIPA , several sections in Part IV of PHIPA address the disclosure of personal health information. [8] In keeping with one of its central purposes to protect the confidentiality of personal health information and the privacy of individuals while facilitating the effective provision of health care, PHIPA  requires that disclosures of personal health information occur with consent, except in specified circumstances. Section 29  of PHIPA  states:

A health information custodian shall not collect, use or disclose personal health information about an individual unless,

a. it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or

b. the collection, use or disclosure, as the case may be, is permitted or required by this Act.

[46]  In his representations, the complainant refers to the consent of the custodial parent, the existence of a court order and provisions of other statutes as bases for his entitlement to the information that he seeks. These arguments raise the potential application of various sections of PHIPA  that permit custodians to disclose personal health information in certain circumstances. As part of my review, I will examine whether and in what circumstances custodians may have a duty to consider a request for information under these sections of PHIPA , and whether such a duty arises in the particular circumstances of this complaint. First, I will briefly address this office’s authority to do so.

The IPC can review FSP’s decision not to disclose

[47]  In PHIPA Decision 19, Assistant Commissioner Sherry Liang considered a complaint about a health information custodian’s decision not to disclose personal health information under section 38(4) (c) of PHIPA . Like the disclosure provisions at issue in this complaint, section 38(4)(c) permits health information custodians to disclose personal health information in certain circumstances. Because the section is discretionary (permissive), a custodian is also permitted not to disclose that information.

[48]  PHIPA Decision 19 confirmed that in deciding whether or not to disclose personal health information under that permissive section of PHIPA , a custodian must make the decision in a proper manner, based on proper considerations, in good faith and for a proper purpose. If it does not, the IPC may order the custodian to consider the matter again, and may provide comments and recommendations to guide the custodian’s consideration.

[49]  As in that decision, this case involves a health information custodian’s refusal to release personal health information in circumstances where certain sections of PHIPA  may permit disclosure. The same principles articulated above apply here. Where a custodian is confronted with a request under sections of PHIPA  that permit disclosure, it must decide whether or not to disclose (in legal terms, it must “exercise its discretion”) under those sections in a proper manner. It must turn its mind to the request for disclosure, and to whether the person seeking the information meets the conditions permitting disclosure. [9]

[50]  I wish to emphasize that not all requests for information give rise to this duty. I will therefore describe why I have decided in this case that FSP was required to turn its mind to sections of PHIPA  permitting disclosure of personal health information.

FSP had a duty to consider the complainant’s request for disclosure under PHIPA

[51]  The complainant’s requests to FSP are reproduced above. In these requests, the complainant states that he “seeks” or wants to “be provided” with certain personal health information of his children. I observed, above, that FSP treated the father’s request as a request for access to the children’s personal health information under Part V of PHIPA ; I concluded that it was appropriate for FSP to refuse to grant the complainant access under that part of PHIPA . On the particular facts of this complaint, however, I conclude that FSP also had a duty to consider the complainant’s request as a request for disclosure of the same information under PHIPA .

[52]  A health information custodian will not be required in every case to assess a request for information to determine whether a requester without a right of access nonetheless has recourse to any of the disclosure provisions in PHIPA . But in this case, where the requester provided the custodian with evidence that certain conditions for disclosure under PHIPA  may have been met, the custodian had a duty to consider the request under the potentially applicable sections of PHIPA . This is consistent with the approach taken by the Assistant Commissioner in PHIPA Decision 21, where she decided that the reasons given by a requester for seeking disclosure under one section of PHIPA  could also support a request for disclosure under another section. In those circumstances, she found, the custodian should have considered the request under both sections, and she returned the matter to the custodian for a proper exercise of its discretionary power under those sections.

[53]  In this case, the complainant did not use the word “disclosure” or refer to any particular sections in Part IV of PHIPA when formulating his request. Nonetheless, in making his requests to FSP and during the complaint process, the complainant referred to the potential consent of the custodial parent, the existence of a court order, and provisions of other statutes as bases for his entitlement to the children’s information. These factors raise the potential application of three sections of PHIPA  that permit custodians to disclose personal health information: section 29(a), which permits disclosure with consent; and sections 41(1)(d)(i) and 43(1)(h), which permit disclosure without consent. For the reasons that follow, I conclude that FSP failed to properly exercise its discretion under any of these sections.

FSP failed to exercise its discretion in a proper manner

Disclosure with consent

Section 29(a) of PHIPA

[54]  Under section 29 (a) of PHIPA  (reproduced above), a health information custodian may disclose personal health information with consent where the disclosure, “to the best of the custodian’s knowledge, is necessary for a lawful purpose.”

[55]  In making his requests to FSP and during this complaint process, the complainant made submissions that amount to a claim that he has the consent of the children’s mother (whom he describes as the custodial parent) to the disclosure of the children’s personal health information to him. Specifically, the complainant relies on an email from the children’s mother to FSP staff, in which the mother asks FSP to confirm for the complainant whether, as of the date of that email, the mother and children had attended any counselling appointments at FSP.

[56]  The complainant also informed FSP of a final order in a court proceeding between him and the children’s mother. The court order states, in part:

The Respondent [the children’s mother] shall immediately execute all of the consents and documentation necessary to ...

permit the Applicant [the complainant] to obtain information about the children and their progress in counselling if such access to information is permitted by the agency’s mandate; and

permit all service providers to share, discuss and release with and to the Applicant any information or reports about the children which the Respondent also receives.

[57]  In view of the evidence provided by the complainant, I find that FSP had a duty to turn its mind to whether the conditions for disclosure with consent under section 29(a) were met. Yet there is no indication in FSP’s decision letters or in its representations during this complaint process that it ever considered the complainant’s request for disclosure on this basis. To remedy this breach of its duty, I will return the matter to FSP to consider the complainant’s request for disclosure on the basis of consent.

[58]  In deciding whether the conditions for disclosure under section 29(a) are met, FSP will have to determine who (if anyone) may provide consent on behalf of the children. I observe here that the children now appear to be over the age of 16, in which case only the children themselves, or a person with written authorization from the children, are entitled to consent in respect of their personal health information (section 23(1)1). [10] FSP must then decide whether the email produced by the complainant, or the court order, or both, are evidence of a consent of a person who is lawfully authorized to act for the children under PHIPA . FSP must also consider whether any purported consent meets the other requirements of a valid consent under PHIPA—including, for example, whether the consent relates to the particular personal health information being sought by the complainant [section 18(1)(c)].

[59]  In addition, FSP must consider whether, to the best of its knowledge, the disclosure is “necessary for a lawful purpose” within the meaning of section 29(a). While that phrase is not defined in PHIPA , a plain reading of that phrase indicates that, at a minimum, the custodian must not be aware that the requested disclosure is for a purpose contrary to law.

[60]  If FSP determines that these conditions for disclosure are not met, then section 29(a) does not give it permission to disclose.

[61]  If FSP instead determines that the conditions for disclosure under section 29(a) are met, then it must go on to exercise its discretion under that section. This means that FSP must decide whether or not, and how much personal health information, to disclose. Whatever its decision, FSP must show that it exercised its discretion under section 29(a) in a proper manner, and did not make its decision in bad faith or for an improper purpose. One way for FSP to do this is by providing reasons for its decision.

Disclosure without consent

[62]  Two other sections of PHIPA  that permit custodians to disclose personal health information may be applicable in these circumstances.

[63]  Section 41(1) (d)(i) of PHIPA  states:

A health information custodian may disclose personal health information about an individual for the purpose of complying with a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information.

[64]  The complainant relies on the court order described above, which also contains the following provision:

The Applicant [the complainant] shall be entitled to receive reports and information about the children from the third parties involved in the children’s health, education and welfare without the consent of the Respondent [the children’s mother] being required ...

[65]  Also potentially relevant in this complaint is section 43(1) (h) of PHIPA , which states:

A health information custodian may disclose personal health information about an individual subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada.

[66]  In his letter of complaint to this office, the complainant cited a number of statutory provisions that, he argues, support his entitlement to the children’s personal health information. [11] In representations made later during the review stage, the complainant explained that the children are children of his marriage to their mother, and focused his arguments on the applicability of section 16(5)  of the Divorce Act . [12] Section 16(5)  of the Divorce Act  states:

Unless the court orders otherwise, a spouse who is granted access to a child of the marriage has the right to make inquiries, and to be given information, as to the health, education and welfare of the child.

[67]  During the review stage, the parties were also asked to comment on the impact of section 6(3)  of PHIPA , which states, in part:

A provision of this Act that permits a health information custodian to disclose personal health information about an individual without the consent of the individual,

a. does not require the custodian to disclose it unless required to do so by law;

b. does not relieve the custodian from a legal requirement to disclose the information[.]

[68]  Through section 6(3) , PHIPA  clarifies that custodians considering disclosure under sections of PHIPA  that permit disclosure without consent are not required to disclose. Rather, these sections provide exceptions under which custodians may disclose personal health information without violating their obligations under PHIPA . At the same time, PHIPA  explicitly recognizes that custodians may be subject to mandatory legal requirements outside PHIPA . [13]

[69]  In this case, there is no indication in FSP’s decision letters that it considered the relevance of the court order or the various statutes cited by the complainant when making its decision on his request for the children’s personal health information. For this reason, FSP was specifically asked about the potential application of sections 41(1) (d)(i) and 43(1) (h) of PHIPA  in the circumstances of this complaint.

Section 41(1)(d)(i)

[70]  In its representations on the relevance of section 41(1)(d)(i), FSP denies the existence of any summons or order compelling it to release any information to the complainant. It also maintains that children over the age of 12 must give consent to disclosure of their records to their parents; in support, FSP relies on the same repealed legislation that it had cited in its decision letter. [14] FSP also asserts that consent of the children is “crucial given the history of the case,” referring to certain findings of the Office of the Children’s Lawyer about the relationship between the complainant and the children, and a fiduciary duty on FSP’s part to obtain consent from the children before discussing matters involving them with the complainant.

[71]  It may be that FSP is unaware of the court order relied upon by the complainant, despite the evidence indicating that the complainant sent a copy of the order to FSP. Or it may be FSP’s position that the court order does not qualify as a “summons, order or similar requirement,” or fails to meet some other condition in section 41(1)(d)(i). The basis for any decision under section 41(1)(d)(i) is not entirely clear from its representations.

[72]  In any case, I conclude that FSP’s consideration of section 41(1)(d)(i) was flawed. Either FSP did not even consider this section of PHIPA , or it did but failed to exercise its discretion in a proper manner. Among other things, to the extent FSP denied the request solely on the basis that it lacks consent from the children, it failed to give proper consideration to the request under a section of PHIPA  that permits disclosure without consent. FSP’s apparent reliance on repealed legislation may also reflect improper consideration of an irrelevant factor.

[73]  For these reasons, I will order FSP to consider the complainant’s request again under section 41(1) (d)(i) of PHIPA . This will require FSP to decide whether the court order produced by the complainant fulfils the conditions for disclosure under that section. In making this determination, FSP should consider, among other things, whether it is satisfied that the court order provided by the complainant is currently valid, and whether and how the court order addresses the children’s personal health information that is the subject of the request for disclosure.

[74]  If FSP decides that the conditions for disclosure under section 41(1)(d)(i) are not met, it should make this clear in its decision. However, if FSP decides that the court order requires disclosure of the information sought by the complainant, then PHIPA  is not a barrier to disclosure [section 6(3)(b)].

[75]  Ultimately, if a requester believes that a custodian has failed to comply with a valid court order that requires disclosure, the requester may wish to seek enforcement of the order through the courts. While in a case like this, the IPC can order a custodian to properly consider a request for disclosure of personal health information, the IPC cannot order release of the information.

Section 43(1)(h)

[76]  In its representations addressing section 43(1) (h) of PHIPA , FSP states only that this section does not apply because it lacks consent from the children, and because it does not provide “health and education services.”

[77]  On the matter of the children’s consent, for the same reasons given above, I find that to the extent FSP decided the request solely on the basis of consent, it failed to give proper consideration to the request. While consent of the children may be a relevant factor, it cannot be treated as the only relevant factor in deciding whether or not to disclose under this section of PHIPA  that permits disclosure without consent.

[78]  I interpret FSP’s comment about its not providing health and education services to be a reference to the language used in section 16(5)  of the Divorce Act  to describe the information to which an access parent may be entitled. I reproduce section 16(5)  of the Divorce Act  again here for convenience:

Unless the court orders otherwise, a spouse who is granted access to a child of the marriage has the right to make inquiries, and to be given information, as to the health, education and welfare of the child.

[79]  FSP may be asserting that the children’s personal health information at issue in this complaint does not qualify as “information ... as to the health, education and welfare of the child” within the meaning of that section, so that the entitlement of an access parent to a child’s information does not apply. Whether this is FSP’s claim, or FSP has another reason for refusing the request under section 43(1) (h) of PHIPA , it must say so explicitly. As I lack evidence to conclude that FSP properly considered the request under this potentially applicable section of PHIPA , I will order FSP to consider the complainant’s request again under this section.

[80]  In its new decision under section 43(1)(h), FSP should address the complainant’s claim that section 16(5)  of the Divorce Act  [15] is applicable in these circumstances. As stated above, for example, FSP should clearly articulate its position and its reasons for deciding whether the information sought by the complainant is or is not of a type authorized to be given to an access parent under the Divorce Act . [16]

[81]  The complainant also cites Order M-787 in support of the proposition that releasing the children’s personal health information to him would be in line with historical decisions of the IPC. Order M-787 and a number of later orders of this office considered the potential application of section 16(5)  of the Divorce Act  and the similarly worded provision in section 20(5) of the CLRA to requests for information under MFIPPA and its provincial equivalent, FIPPA. These orders affirmed that section 16(5)  of the Divorce Act  and section 20(5) of the CLRA are statutory provisions on which access parents may rely in seeking information about their children under MFIPPA and FIPPA. [17]

[82]  More recent orders of this office have recognized that those authorizing provisions may not be applicable in all circumstances. In some cases, for instance, applying those sections of the Divorce Act  or the CLRA may be inconsistent with other sections of those statutes that codify “the best interests of the child” as a key guiding principle in matters concerning custody and access (which include an access parent’s entitlement to information about the child). [18]

[83]  In Order PO-3599, for example, the adjudicator found that section 16(5)  of the Divorce Act  and section 20(5) of the CLRA did not apply in the context of a request under FIPPA for information relating to the requester’s alleged abuse of one of his children. In arriving at his conclusions, the adjudicator took into account the best interests of the children. Similar reasoning was applied in Order MO-3351.

[84]  The above orders were decided under FIPPA and MFIPPA , rather than under PHIPA , and are not directly applicable to the circumstances before me. Among other things, those orders addressed the application of sections of those statutes that have no equivalent in PHIPA . [19] More generally, the access regime under FIPPA and MFIPPA  is fundamentally different from PHIPA ’s treatment of requests for another individual’s personal health information: As described above, PHIPA  confers a right of access only in respect of one’s own personal health information, and not a general right of access to information about other individuals. [20]

[85]  Nevertheless, this office’s finding in those orders (and others) supports the argument that the same sections of the Divorce Act  and the CLRA could “permit or require” disclosure of personal health information by a custodian under section 43(1) (h) of PHIPA . At the same time, I agree with the approach taken by the adjudicators in Orders PO-3599 and MO-3351 that the “best interests of the child” may be a relevant consideration in applying those sections.

[86]  As noted above, if another statute outside PHIPA  applies to require disclosure of the information sought by the complainant, PHIPA  is not a barrier to disclosure [section 6(3)(a)]. As above, a requester may wish to seek recourse through the courts for a custodian’s failure to comply with legal requirements outside PHIPA . As in the case of section 41(1)(d)(i), in this situation, while the IPC can order a custodian to properly consider a request for disclosure of personal health information, it cannot order release of the information.

[87]  Finally, I acknowledge that during this review, the complainant raised a number of issues with FSP’s exercise of discretion in responding to his request. Among these are allegations that FSP considered irrelevant factors (such as its assessment of the complainant’s motives and his relationship with the children), and that it failed to take into account relevant factors (such as the court order), in deciding to refuse his request.

[88]  As a result of my decision in this complaint, FSP will be required to revisit the request for disclosure under relevant sections of PHIPA  in accordance with its statutory duties and the guidance provided in this decision. It is therefore unnecessary to address the complainant’s allegations of other defects in FSP’s original decision-making, and I will not do so here.

Conclusion and summary

[89]  In this decision, I found that FSP breached its duty under PHIPA  to properly consider the complainant’s request for his children’s personal health information under certain sections of PHIPA  that permit disclosure. Although this duty will not arise in every request for information, there may be situations where a requester provides evidence that raises the potential application of sections of PHIPA  that permit or require disclosure. In those cases, the custodian may have a duty to consider the request for disclosure under PHIPA .

[90]  In this review, I found that the complainant’s evidence gave rise to a duty on the part of FSP to consider the potential application of three sections of PHIPA  that permit disclosure: sections 29(a) (disclosure with consent), 41(1)(d)(i) (court order), and 43(1)(h) (other statute). As FSP did not show that it properly considered these sections of PHIPA , I will remedy this breach of its duty by ordering FSP to reconsider the complainant’s request under each these sections.

[91]  This will require FSP to decide whether the conditions for disclosure under each of these sections of PHIPA  are met. In doing so, FSP must consider, among other things, whether the complainant has provided evidence of a valid consent to disclose the requested personal health information [section 29(a)], and whether the court order or another statute is applicable and addresses disclosure of this information [section 41(1)(d)(i) or section 43(1)(h)].

[92]  If FSP decides that the conditions for discretionary disclosure are not met, then PHIPA  does not give it permission to disclose.

[93]  If, on the other hand, FSP decides that the conditions for discretionary disclosure under one or more of these sections are met, then it must go on to exercise its discretion under PHIPA . This means that FSP must decide whether or not, and how much information, to disclose. If FSP determines that a court order or statute outside PHIPA  requires disclosure of the personal health information that is the subject of the request, PHIPA  is not a barrier to the mandatory disclosure [section 6(3)].

[94]  Ultimately, if a requester believes that a custodian has failed to comply with a legal requirement to disclose, the requester may wish to seek enforcement through the courts. While in situations like these, the IPC can order a custodian to properly consider a request for disclosure of personal health information, the IPC cannot order release of the information.

ORDER:

1. For the foregoing reasons, and pursuant to section 61(1)  of PHIPA , I order FSP to consider the complainant’s request for disclosure of his children’s personal health information under sections 29 (a), 41(1) (d)(i) and 43(1) (h) of PHIPA , and to provide a response under each of these sections explaining why it decided to disclose or not to disclose the information. FSP should be guided in this exercise by the principles outlined in this decision.
2. I order FSP to provide the complainant with its decision and reasons by August 21, 2019. To confirm compliance with this order, I direct FSP to provide me with a copy of its decision and reasons at the same time.

Original signed by		July 30, 2019
Jenny Ryu
Adjudicator