PHIPA DECISION 101

Complaint HA18-8

University Health Network

October 11, 2019

Summary: A requester, a patient of the University Health Network (the hospital), sought records from the hospital regarding allegations of improper conduct that were made against him by another patient. The hospital located one record responsive to the complainant’s request. The hospital issued a decision denying access to the record on the basis of the exemptions in the Freedom of Information and Protection of Privacy Act  (FIPPA ) for solicitor- client privilege (section 49 (a) in conjunction with section 19 ) and personal privacy (section 49 (b)), and the Personal Health Information Protection Act (PHIPA) exemptions for legal privilege (sections 52(1)(a)) and confidential source (section 52(1)(e)). The requester filed a complaint with the IPC about the access decision and also challenged the reasonableness of the hospital’s search for records.

In this decision, the adjudicator finds that the record contains personal health information of the complainant and another individual. The adjudicator considers the complainant’s right of access to his personal health information under PHIPA and FIPPA. She concludes that since the record is not dedicated primarily to the complainant’s own personal health information, he would be entitled to have access to only his reasonably severable personal health information. However, since the record as a whole is subject to solicitor-client privilege, which has not been waived, she upholds the hospital’s decision to deny access to the record in full.

The adjudicator also finds that the search conducted by the hospital in response to the complainant’s access request was not reasonable, and orders the hospital to conduct an additional search.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3 Sched. A , as amended, sections 2 (definitions), 3(1), 4(1), 4(3), 8(1), 8(4), 52, 53, and 54; Freedom of Information and Protection of Privacy Act,  RSO 1990, c F31 , as amended, sections 2(1) (definition of “personal information”), 17, 19, 47(1), and 49(a).

Decisions Considered: PHIPA Decisions 17, 18, 30, and 33.

BACKGROUND:

[1]  The access request that is the subject of this complaint arose after a meeting between the requester, who was a patient at the University Health Network - Toronto General Hospital (the hospital), and staff at the hospital. The meeting was intended to address an allegation of inappropriate behaviour that had been made against the requester by another patient.

[2]  Following the meeting, the requester submitted a 10-part request to the hospital under the Personal Health Information Protection Act, 2004  (PHIPA ) and the Freedom of Information and Protection of Privacy Act  (FIPPA ) seeking access to the following information:

1. The full name of my accuser;
2. The date and time these allegations were reported;
3. The person(s) these allegations were reported to;
4. The manner in which these allegations were reported (i.e. verbal and/or in writing);
5. A copy of any and all hand-written notes made by [named social worker] and/or [named nurse manager] in relation to these allegations;
6. The specific and exact verbal statements allegedly uttered;
7. Date(s) and time(s) of these alleged statements;
8. The alleged documents (emails and/or text messages and/or another form of written communication) that were forwarded to the accuser;
9. Full disclosure of ALL written documents (emails and/or text messages and/or another form of written communication) allegedly written to be considered inappropriate and/or construed as stalking, with the communication thread attached to same;
10. Any and all documents provided to me from this alleged accuser advising me to not communicate with her, as she has not provided consent for same.

[3]  The hospital responded by issuing a decision denying access to the information it identified as responsive to the request, which was a note made in the medical record of the other patient.

[4]  The requester filed a complaint with this office in response to the hospital’s decision, thereby becoming the complainant in this file. During the course of mediation, the requester explained that he does not seek access to the other patient’s medical record, and stated that he believes that the hospital must have created records regarding the allegations, given that the hospital’s staff met with him to discuss the allegations.

[5]  The mediator relayed this information to the hospital, which agreed to conduct a further search. Following that search, the hospital issued a revised decision, part of which states:

Please note we have since determined there are five pages of emails that are responsive to the request. There are no other responsive records.

[6]  The hospital issued a decision denying access to the emails on the basis of the exemptions in FIPPA for solicitor-client privilege (section 49(a) in conjunction with section 19) and personal privacy (section 49(b)), and the PHIPA  exemptions for legal privilege (section 52(1)(a)) and confidential source (section 52(1)(e)). The complainant was not satisfied with this response and confirmed that he would like this matter to proceed to adjudication.

[7]  As no further mediation was possible, the file was transferred to the adjudication stage of the complaint process, where an adjudicator may conduct a review under PHIPA . During my review, I sought and received representations from both parties, which were shared between them in accordance with section 18 of the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004.

[8]  For the reasons that follow, I uphold the hospital’s decision to deny access to the record on the basis of legal privilege, but order the hospital to conduct an additional search for responsive records.

RECORDS:

[9]  There is one record at issue consisting of five pages of email correspondence between staff at the hospital.

PRELIMINARY MATTERS:

[10]  There is no dispute that the hospital is a body that is both a health information custodian within the meaning of section 3(1) of, and subject to, PHIPA , and an institution within the meaning of the definition in section 2(1) of, and subject to, FIPPA.

ISSUES:

1. Does PHIPA or FIPPA, or both, apply in the circumstances of this complaint?

Does the record contain “personal health information” as defined in section 4  of PHIPA ?

2. Access under PHIPA 

Is the record “dedicated primarily” to the complainant’s personal health information, within the meaning of section 52(3)  of PHIPA ?

Does the solicitor-client privilege exemption in PHIPA  apply to the personal health information to which the complainant otherwise has a right of access under PHIPA ?

3. Access under FIPPA

Does the solicitor-client privilege exemption in FIPPA apply to the information to which the complainant otherwise has a right of access under section 47(1) of FIPPA?

4. Did the hospital exercise its discretion under PHIPA and/or FIPPA?
5. Did the hospital conduct a reasonable search for records?

DISCUSSION:

Summary of findings

[11]  In the discussion that follows, I consider the application of PHIPA  first, and find that the record at issue is a record of the complainant’s personal health information. I find that, since the record is not dedicated primarily to the complainant’s personal health information, he is entitled, subject to any applicable exemptions, only to his personal health information that is reasonably severable from the remainder of the record. I find, however, that the solicitor-client privilege exemption applies to the appellant’s personal health information, and I uphold the hospital’s decision to withhold that information on this basis.

[12]  I then consider the application of FIPPA to the information for which I have not made a determination under PHIPA , i.e. the information other than the personal health information contained in the record. I find that the complainant has a right of access to the remainder of the information under section 47(1) of FIPPA, subject to any exemptions. I find again, however, that the solicitor-client privilege exemption applies to this information. As a result, I uphold the hospital’s decision to deny access to the entire record.

Issue A: Does PHIPA or FIPPA, or both, apply in the circumstances of this complaint?

[13]  PHIPA  (Part V) grants an individual a right of access to records of his or her personal health information that are in the custody or under the control of a health information custodian, subject to limited exceptions. FIPPA grants an individual a right of access to records of general information (Part II) and to an individual’s own personal information (Part III) in the custody or under the control of an institution, subject to certain exceptions. As the hospital is subject to both PHIPA and FIPPA, a preliminary matter for determination is whether the complainant’s right of access to the record at issue is to be determined under PHIPA , FIPPA, or both.

[14]  The complainant seeks access to records of correspondence relating to the hospital’s handling of an allegation made about his behaviour. The hospital has identified one record as responsive to the request.

[15]  In order to determine which statute governs the complainant’s right of access to the record, it is necessary to determine whether the record contains the complainant’s “personal health information,” as that term is defined in PHIPA . If it does, then the complainant’s right of access will initially be determined under PHIPA . If the record does not contain the complainant’s personal health information, then his right of access will only be determined under FIPPA.

[16]  In situations where both PHIPA and FIPPA could apply, the hospital must consider the interaction between the two statutes. [1] Sections 8(1)  and 8(4)  of PHIPA  provide guidance in this task. These sections state:

(1) Subject to subsection (2) [containing certain exceptions that are not relevant in this complaint], the Freedom of Information and Protection of Privacy Act  and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information in the custody or under the control of a health information custodian unless this Act specifies otherwise.

(4) This Act does not limit a person’s right of access under section 10  of the Freedom of Information and Protection of Privacy Act  or section 4 of the Municipal Freedom of Information and Protection of Privacy Act to a record of personal health information if all the types of information referred to in subsection 4 (1) are reasonably severed from the record.

[17]  Read together, sections 8(1)  and 8(4)  of PHIPA  preserve an individual’s right of access under FIPPA to certain information in records of personal health information, the right of access to which is otherwise governed by PHIPA . [2]

[18]  Where a requester seeks access to a record of personal health information under both statutes, this office first considers the extent of any right of access under PHIPA , and then considers the extent of any right of access under FIPPA to portions of the record for which a determination under PHIPA  has not been made. [3] Therefore, the first step in my analysis is to determine which statute governs the complainant’s right of access to the record.

Does the record contain “personal health information” as defined in section 4 of PHIPA?

[19]  “Personal health information” is defined in section 4  of PHIPA  as follows, in part:

(1) “personal health information” subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual.

[20]  Subsection 4(2) defines “identifying information” as “information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.”

[21]  Section 4(3)  of PHIPA  states that personal health information includes “identifying information that is not personal health information … but that is contained in a record that contains personal health information…”

Representations

[22]  The hospital maintains that the record at issue is not a record of personal health information because the information “was not collected or used in any way that would directly affect [the complainant’s] care and treatment at the hospital and has not been entered into his medical record.” Rather than relating to the complainant’s treatment or health status, the hospital submits that the information relates to the complainant’s alleged behaviour at the clinic.

[23]  The hospital acknowledges that the record contains the complainant’s medical record number and makes note of his attendance at the clinic, but the hospital submits that this information was “included for identification and contextual purposes only.”

[24]  The complainant’s representations do not specifically address this issue, and focus more on the definition of “personal information,” which is relevant for the application of FIPPA. The complainant maintains that the record relates specifically to him and the allegations made against him, and therefore contains his personal information. In addition, he maintains that the record contains identifiable information about him if, as the hospital submits, it mentions his medical record number and information about his attendance at the clinic.

[25]  The complainant also maintains that, while he wants access to the name of his “accuser,” he “is not seeking personal information of the other patient and/or any other person.”

Analysis and findings

[26]  In PHIPA Decision 17, this office adopted a broad interpretation of the phrase “personal health information.” This office has applied this broad interpretation in subsequent decisions and orders. [4]

[27]  The presence of any personal health information in the record makes it a record of personal health information. With this method, the unit of analysis is the whole record, rather than individual paragraphs, sentences or words contained in the record. Additionally, the phrase “relates to”, found in sections 4(1) (a) and (b) of PHIPA , is to be read in its grammatical and ordinary sense, including information that is connected in some way to the health of the individual to whom the information relates, or to the provision of health care to them. [5] This interpretation best gives effect to one of the purposes of PHIPA , which is to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions.

[28]  Based on the evidence before me, I find that the record contains the personal health information of the complainant and another patient at the hospital, as that term is defined in PHIPA . In particular, the record contains these individuals’ names, along with their medical record numbers, information about the treatment they receive from a clinic at the hospital, and dates on which the individuals were scheduled to visit the clinic. Accordingly, I conclude that the record contains personal health information of both the complainant and another patient, as that term is defined in paragraphs (a) and (b) of the definition in section 4(1)  of PHIPA . In addition, I find that the record contains other identifying information about both the complainant and the other patient, which qualifies as their personal health information under section 4(3)  of PHIPA .

[29]  As a result of this finding, the complainant’s right of access to the record must be considered under PHIPA , initially.

Issue B: Access under PHIPA

Is the record “dedicated primarily” to the complainant’s personal health information, within the meaning of section 52(3) of PHIPA?

[30]  The complainant’s right of access to his personal health information under PHIPA  is governed by section 52. Section 52(1) grants individuals a right of access to records containing their personal health information. This right of access is limited, however, by section 52(3), which provides that an individual will only have a right of access to an entire record if the record is “dedicated primarily” to their personal health information. In particular, section 52(3) states:

Despite subsection (1), if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[31]  Therefore, subject to any applicable exemptions, the right of access in PHIPA  applies either to a whole record (under section 52(1)), or only to certain portions of a record of personal health information (under section 52(3)). If a record is dedicated primarily to the personal health information of the complainant, then he will have a right of access to the entire record, even if it incidentally contains information about other matters or other parties. If, on the other hand, the record is not dedicated primarily to the personal health information of the complainant, then his right of access under PHIPA  only applies to the information about him that can reasonably be severed from the record.

[32]  PHIPA Decision 17 set out this office’s approach to the interpretation of section 52(3)  of PHIPA . In order to determine whether a record is “dedicated primarily” to the personal health information of a requester within the meaning of section 52(3), this office takes into consideration various factors, including:

• the quantity of personal health information of the requester in the record;
• whether there is personal health information of individuals other than the requester in the record;
• the purpose of the personal health information in the record;
• the reason for creation of the record;
• whether the personal health information of the requester is central to the purpose for which the record exists; and
• whether the record would exist “but for” the personal health information of the requester in it. [6]

[33]  This list is not exhaustive.

Representations

[34]  Given the hospital’s position that the record does not contain the complainant’s personal health information, the hospital maintained that his right of access would be governed by FIPPA instead of PHIPA . As a result, the hospital did not provide representations addressing whether the record is dedicated primarily to the complainant’s personal health information.

[35]  The hospital’s representations also did not directly address the severability of the record. However, the hospital submits that, as a result of the application of various exemptions, there is no severable information that can be disclosed to the complainant. The hospital also expresses concerns about providing a severed copy of the record. The hospital explains that due to the small number of patients at the clinic, even discrete portions of the record could lead to identification of the other patient whose personal information is in the record.

[36]  The complainant submits that the record he seeks is dedicated primarily to his personal health information. He maintains that the record, including the other patient’s name and information about the allegations against him, “belongs to him” and is his own personal health information.

Analysis and findings

[37]  I have reviewed the record and find that it is not dedicated primarily to the personal health information of the complainant within the meaning of section 52(3)  of PHIPA .

[38]  The record at issue is an email chain between staff at the hospital regarding allegations made against the complainant and how the hospital should respond. In my view, the complainant’s personal health information is not central to the purpose of the record. The purpose of the record was to discuss how to handle the allegation made against the complainant by a fellow patient. The complainant’s personal health information appears sporadically throughout the record and appears in roughly the same number of instances as the other patient’s personal health information. This information is included to provide context for the discussion and to identify the matter to which the record relates, but is not the main topic under discussion.

[39]  Given this finding, the complainant’s right of access under section 52(3) is limited to his personal health information in the record that can reasonably be severed for the purpose of providing access. Accordingly, the right of access in this matter does not extend to the personal health information of the other patient, which includes identifying information about that patient, such as their name. This right of access also does not extend to personal health information that would, if released, comprise only disconnected or meaningless snippets. Such portions are not considered “reasonably severable” within the meaning of section 52(3), and are not required to be released. [7]

[40]  The hospital claims that the records cannot reasonably be severed for the purpose of providing access; however, I find that some of the complainant’s personal health information can reasonably be severed for this purpose. Some of this information comprises near full sentences that can be meaningfully severed from the remainder of the record. The fact that the complainant may already be aware of the severable information is of no relevance to a determination of whether the information is severable for the purpose of providing access under section 52(3). [8]

[41]  The complainant’s right of access under PHIPA  is limited to his reasonably severable personal health information. As mentioned above, the complainant may have a residual right of access under FIPPA to the remaining information in the record that is not personal health information. I consider the complainant’s right of access under FIPPA at Issue C, below.

Does the solicitor-client privilege exemption in PHIPA apply to the personal health information to which the complainant otherwise has a right of access under PHIPA?

[42]  In its revised decision letter, the hospital relied on the exemptions under both PHIPA and FIPPA to deny access to the record at issue. In particular, the hospital relied on the legal privilege exemption (section 52(1)(a)) and the confidential source exemption (section 52(1)(e)) in PHIPA , and the solicitor-client privilege exemption (section 49(a) in conjunction with section 19) and personal privacy (section 49(b)) in FIPPA. Because I uphold the solicitor-client privilege exemption claim, I will only set out the relevant portions of the Acts below. Section 52(1)  of PHIPA  states, in part:

52(1) Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(f) the following conditions are met:

(i) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act  or the Municipal Freedom of Information and Protection of Privacy Act or is acting as part of such an institution, and

(ii) the custodian would refuse to grant access to the part of the record,

(A) under clause 49  (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act , if the request were made under that Act and that Act applied to the record. [9]

[43]  Section 52(1)(f)(ii)(A) of PHIPA , set out above, permits the hospital, as a body subject to both PHIPA and FIPPA, to claim the application of certain FIPPA exemptions (as “flow-through” FIPPA claims). In particular, the hospital relied on the exemption at 49(a) in conjunction with section 19 of FIPPA. These sections state:

49. A head may refuse to disclose to the individual to whom the information relates personal information,

(a) where section 12, 13, 14, 14.1, 14.2, 15, 15.1 16, 18, 19, 20 or 22 would apply to the disclosure of that personal information. [emphasis added]

19. A head may refuse to disclose a record,

(a) that is subject to solicitor-client privilege;

(b) that was prepared by or for Crown counsel for use in giving legal advice or in contemplation of or for use in litigation; or

(c) that was prepared by or for counsel employed or retained by an educational institution or a hospital for use in giving legal advice or in contemplation of or for use in litigation.

Does the legal privilege exemption apply to the information to which the complainant otherwise has a right of access under PHIPA?

[44]  The hospital relies on the legal privilege exemptions to deny access to the entirety of the record at issue. As noted above, the legal privilege exemption is available through section 52(1)(f)(ii)(A) of PHIPA , which flows through to section 49(a) of FIPPA in conjunction with section 19 of FIPPA.

[45]  In support of its position, the hospital explains that the record consists of a request for advice from legal counsel on how to proceed with a matter. In requesting this advice, hospital staff described the alleged incident to assist legal counsel in developing recommendations. Accordingly, the hospital maintains that the record is protected by solicitor-client privilege, as it was prepared by and for counsel employed by the hospital for use in giving legal advice. The hospital maintains that it has not waived privilege over the record at issue.

[46]  The complainant objects to the hospital’s reliance on the solicitor-client privilege exemptions. He submits that the information at issue was communicated to a hospital social worker at a cocktail party and therefore could not have been intended to be confidential or privileged. He maintains that as a result of the discussion at the cocktail party, any privilege that may have attached to the record has been waived. [10]

[47]  The complainant also submits that there is no ongoing or contemplated litigation.

Analysis and findings

[48]  The hospital’s representations spoke to the application of solicitor-client privilege exemptions to the record as a whole; however, for the purpose of the PHIPA  analysis I will first consider its application to the complainant’s reasonably severable personal health information, seen in the context of the record as a whole. [11]

[49]  Section 19(a) of FIPPA encompasses two types of privilege that are available under common law: solicitor-client communication privilege and litigation privilege. Solicitor-client communication privilege protects direct communications of a confidential nature between a solicitor and client, or their agents or employees, made for the purpose of obtaining or giving professional legal advice. [12] Litigation privilege protects records, including a lawyer’s work product and material going beyond solicitor-client communications, [13] created for the dominant purpose of litigation and within a “zone of privacy” intended to be protected by the litigation privilege. The litigation must be ongoing or reasonably contemplated. [14]

[50]  Section 19(c) of FIPPA is a statutory privilege that applies where the records were prepared by or for counsel employed or retained by the hospital for use in giving legal advice or in contemplation of or for use in litigation. The statutory privilege encompasses a statutory solicitor-client communication privilege and a statutory litigation privilege. The statutory and common law privileges, though not necessarily identical, exist for similar reasons. Unlike the common law litigation privilege, which generally comes to an end with the termination of litigation, [15] termination of litigation does not end the statutory litigation privilege in section 19. [16]

[51]  I have reviewed the record and the parties’ submissions, and I am satisfied that the record consists of communications between hospital staff and legal counsel for the purpose of obtaining legal advice, which is subject to solicitor-client communication privilege. I am satisfied that the record reveals advice sought or received from the hospital’s legal counsel as contemplated by the solicitor-client privilege exemptions in sections 19(a) and (c) of FIPPA.

[52]  I am not persuaded by the complainant’s position that any privilege attaching to the record has been waived by the hospital. The complainant submits that the other patient initially communicated her allegations against him to a social worker during a cocktail party. This does not, however, establish that the privilege over the information subsequently contained in the email between the hospital staff and its legal counsel has been waived. Given that the communication is between solicitor and client for the purposes of obtaining legal advice, it is immaterial whether some of the information in the record may exist elsewhere. Accordingly, I accept that the hospital has not waived privilege over the information contained in the record.

[53]  Accordingly, I conclude that the complainant’s personal health information in the record has been properly withheld on the basis of legal privilege. Specifically, I find that section 49(a), in conjunction with sections 19(a) and (c) of FIPPA, through section 52(1)(f)(ii)(A) of PHIPA , apply to the complainant’s personal health information in the record. As I find that privilege attaches to all of the complainant’s personal health information, there is no non-exempt personal health information in the record that could be severed and provided to the complainant under section 52(2)  of PHIPA .

[54]  Given that the exemptions in section 52(1) (f) of PHIPA  [17] and section 49(a) of FIPPA confer a discretion on the hospital to deny access to the record on the basis of section 19, this finding is subject to my review of the hospital’s exercise of discretion under Issue D, below.

[55]  As a result of this finding, I do not need to consider the hospital’s alternative exemption claims under PHIPA .

Issue C: Access under FIPPA

[56]  As mentioned above, the complainant has a right of access under FIPPA to information for which I have not made a determination under PHIPA . In other words, the complainant’s right of access under FIPPA relates to any information in the record that is not the complainant’s reasonably severable personal health information or the personal health information of the other patient.

[57]  The hospital relied on the personal privacy exemption at section 49(b) of FIPPA, as well as the exemption at section 49(a) in conjunction with the solicitor-client privilege exemption at section 19 of FIPPA to deny access to the record as a whole.

[58]  I will begin by considering the hospital’s claim that the remainder of the information at issue is exempt from disclosure because of solicitor-client privilege.

Does the solicitor-client privilege exemption in FIPPA apply to the information to which the complainant otherwise has a right of access under section 47(1) of FIPPA?

[59]  In order to determine which sections of FIPPA are relevant, I must determine whether the record contains “personal information” and if so, to whom that information relates.

[60]  “Personal information” is defined in section 2(1) of FIPPA as follows, in part:

“personal information” means recorded information about an identifiable individual, including:

(e) the personal opinions or views of the individual except where they relate to another individual,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[61]  I found above that the record contains the complainant’s personal health information. Such information is also his “personal information” under FIPPA. The record also contains both the complainant and other patient’s personal views or opinions, the views or opinions of the other patient about the complainant, and other information that, in conjunction with the individuals’ names, reveals personal information about both people. Therefore, I find that the record contains their personal information as that term is defined in paragraphs (e), (g), and (h) of the definition in section 2(1) of FIPPA.

[62]  Given that the record contains the complainant’s personal information, his right of access under FIPPA must be determined under section 47(1), which gives requesters a general right to their own personal information, subject to limited exemptions. [18] In the circumstances of this complaint, the hospital relies on the exemption at section 49(a) in conjunction with the solicitor-client privilege exemption in section 19. [19]

[63]  I have already accepted the hospital’s claim that the record consists of communications between hospital staff and legal counsel for the purpose of obtaining legal advice, and that the record reveals advice sought or received from legal counsel. On this basis, I found that the complainant’s personal health information to which he would otherwise have a right of access under PHIPA  had been properly withheld on the basis of legal privilege.

[64]  For the same reasons, I find that the remaining information in the record, to which the complainant otherwise has a right of access under FIPPA, is subject to solicitor-client privilege under section 19(a) and (c) in conjunction with section 49(a) of FIPPA. As a result, it is not necessary for me to also consider the hospital’s reliance on the personal privacy exemption at section 49(b) of FIPPA with respect to the personal information of the other patient.

[65]  I therefore find that the record is exempt in full, under PHIPA and FIPPA, on the basis of solicitor-client privilege.

[66]  As with my finding under section 52(1) (f) of PHIPA , this finding is subject to my review of the hospital’s exercise of discretion, which I will consider next.

Issue D: Did the hospital exercise its discretion under PHIPA and/or FIPPA?

[67]  As noted above, the exemptions at section 52(1)(f) of PHIPA and sections 49(a) and 19 of FIPPA are discretionary. Where exemptions are discretionary, the hospital has the discretion to grant access to information despite the fact that it could withhold it. The hospital must exercise its discretion. As part of my review, I must determine whether the hospital exercised its discretion under PHIPA and FIPPA.

[68]  In PHIPA Decisions 17 and 30, this office found that considerations that may be relevant to an institution’s exercise of discretion under FIPPA may also be relevant to an exercise of discretion under PHIPA . Through orders issued under FIPPA and its municipal counterpart, this office has developed a list of such considerations. These include:

• the purpose of the legislation, including the principles that:
• information should be available to the public
• individuals should have a right of access to their own personal information
• exemptions from the right of access should be limited and specific
• the privacy of individuals should be protected;
• the wording of the exemption and the interests it seeks to protect;
• whether the requester is seeking his or her own personal information;
• whether the requester has a sympathetic or compelling need to receive the information;
• whether the requester is an individual or an organization;
• the relationship between the requester and any affected persons;
• whether disclosure will increase public confidence in the operation of the institution;
• the nature of the information and the extent to which it is significant and/or sensitive to the institution, the requester or any affected person;
• the age of the information; and
• the historic practice of the institution with respect to similar information.

[69]  Not all these considerations will necessarily be relevant, and additional unlisted considerations may be relevant. [20]

[70]  If I were to determine that the hospital failed to exercise its discretion, or that it erred in exercising its discretion, I may send the matter back to the hospital for a re- exercise of discretion. I may not, however, substitute my own discretion for that of the hospital. [21]

Representations

[71]  The hospital submits that it considered a number of factors when making its decision to deny access to the record. The hospital says that its primary concern was the well-being of the other patient who made a complaint about the complainant. The hospital explains that patients “often feel vulnerable when receiving treatment so it is essential [to] create an atmosphere of safety and security when they are at the hospital.” The hospital also considered the fact that the patient made the complaint in confidence and with the expectation that they would not be identified.

[72]  In addition, the hospital maintains that the complainant is already aware of the details of the complaint against him, as they were communicated to him during a meeting with hospital staff in December 2017. At that time, he was advised that no further action was contemplated, and no further investigation would take place. This was confirmed to him in a follow-up letter from the hospital. The hospital also explains that it assured the complainant that none of his personal health information was shared with any other parties during its investigation.

[73]  The complainant submits that in exercising its discretion, the hospital failed to consider many factors including, but not limited to, severing of the record and whether there is a compelling public interest in its release for his own investigative purposes.

Analysis and finding

[74]  I accept that in denying access to the record at issue, the hospital properly exercised its discretion under PHIPA and FIPPA. I am satisfied that the hospital considered the nature of the information in the record and the interests the solicitor- client privilege exemption seeks to protect, which are significant. In addition, I accept that the hospital considered the fact that the record contains another patient’s personal health information and information that was communicated to the hospital in confidence. I note that the hospital also considered the relationship between the complainant and the other patient, and contemplated the potential impact that providing access would have on the other patient.

[75]  The complainant emphasizes his need to obtain access to the record; however, I am satisfied that the hospital took this factor into account. The hospital explained the allegations against the complainant to him during a meeting in December 2017. The issue was communicated to the complainant without revealing the other patient’s personal health information, and without revealing information that is subject to solicitor-client privilege.

[76]  There is no evidence before me to suggest that the hospital took into account any irrelevant factors, acted in bad faith, or made an error in its exercise of discretion. Therefore, I uphold the hospital’s exercise of discretion, and its decision to deny access to the record under PHIPA and FIPPA.

Issue E: Did the hospital conduct a reasonable search for records?

[77]  Where a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53 and 54 of PHIPA and section 24 of FIPPA.

[78]  This office has extensively canvassed the issue of reasonable search in orders issued under FIPPA and its municipal counterpart. It has also addressed the issue of reasonable search under PHIPA . [22] In addition to what is set out in PHIPA Decision 18, principles outlined in orders of this office addressing reasonable search under FIPPA and its municipal counterpart are instructive to the review of this issue under PHIPA .

[79]  The Acts do not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [23] To be responsive, a record must be "reasonably related" to the request. [24]

[80]  A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [25]

[81]  A further search will be ordered if the custodian does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [26]

[82]  Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [27] A requester’s lack of diligence in pursuing a request by not responding to requests from the custodian for clarification may result in a finding that all steps taken by the custodian to respond to the request were reasonable. [28]

Representations

[83]  The hospital submits that it conducted a reasonable search for records responsive to the complainant’s request. During the mediation stage of the complaint process, the hospital located five pages of email correspondence that comprise the record at issue. The hospital submits that “all staff involved in this incident were […] contacted and have since confirmed that there were no other records either created by themselves or from the individual who initiated the complaint [against the complainant].” The hospital advises that no records concerning this incident were placed in the complainant’s medical file.

[84]  The complainant submits that the hospital has not conducted a reasonable search for records responsive to his request. He maintains that the hospital has not provided sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate responsive records. He also submits that the hospital did not contact him in order to clarify the request.

Analysis and findings

[85]  As stated above, the Acts do not require the hospital to prove with absolute certainty that additional records do not exist. However, it must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. In the circumstances of this complaint, I am not satisfied that the hospital has done so.

[86]  The complainant maintains that the hospital has not conducted an adequate search on the basis that he was not asked to clarify his request. I am satisfied that the complainant’s request was sufficiently clear. Therefore, the fact that the hospital did not solicit further input from the complainant does not undermine the adequacy of its search efforts.

[87]  That being said, during the course of my inquiry, the hospital was asked to provide details of the searches that were carried out, including who conducted the searches, what places and files were searched, and the results of the searches. Despite these questions, the hospital provided very few details about the searches that it conducted in order to locate records responsive to the complainant’s request. The hospital did not identify the individuals who conducted the searches, nor did it describe the locations that were searched or the search methods that were used. As such, I am unable to determine whether “an experienced employee knowledgeable in the subject matter of the request expend[ed] a reasonable effort to locate records which are reasonably related to the request.” [29] The hospital also did not address the possibility that records existed at one time, but no longer exist.

[88]  Therefore, based on the evidence before me, I am unable to conclude that the hospital conducted a reasonable search for records responsive to the complainant’s request as required by sections 53 and 54 of PHIPA and section 24 of FIPPA. As a result, I will order the hospital to conduct a further search for records.

ORDER:

1. I uphold the hospital’s decision to deny access to the record under PHIPA and FIPPA.
2. I order the hospital to conduct an additional search for records responsive to the complainant’s access request.
3. I order the hospital to issue an access decision to the complainant regarding any records located as a result of the search order in provision 2, in accordance with PHIPA and FIPPA, treating the date of this decision as the date of the request. The complainant retains his right to appeal the hospital’s future access decision relating to additional records, if there are any, to this office.
4. I order the hospital to provide me with an affidavit sworn by the individual(s) who conduct the search by November 11, 2019 describing the search efforts. At a minimum, the affidavit(s) should include the following information:
1. The names and positions of the individuals who conducted the search;
2. Information about the types of files searched, the nature and location of the search, and the steps taken in conducting the search;
3. The results of the search; and
4. Details of whether additional records could have been destroyed, including information about record maintenance polices and practices and retention schedules.

The hospital’s affidavit and any accompanying representations may be shared with the complainant, unless there is an overriding confidentiality concern. The hospital should indicate whether it consents to the sharing of their representations and affidavit(s) with the complainant.

5. I remain seized of the complaint in order to deal with any outstanding issues arising from order provisions 2 and 4.
6. I reserve the right to require the hospital to provide me with a copy of the access decision referred to in order provision 3.

Original Signed By:		October 11, 2019
Jaime Cardy
Adjudicator