PHIPA DECISION 105

Complaint HI15-59

Dr. Mary McIntyre

December 16, 2019

Summary: The Information and Privacy Commissioner of Ontario (IPC) initiated a complaint under the Personal Health Information Protection Act, 2004 (PHIPA), relating to an incident in which a physician left behind records of personal health information at a property that she had been renting. The adjudicator obtained evidence from the physician about the steps that she has taken to address various issues relating to this incident. In this decision, the adjudicator finds, in accordance with section 57(4)(a) of PHIPA, that it is not necessary to review the subject-matter of this complaint because the physician has responded adequately to it.

Statutes Considered: Personal Health Information Protection Act, 2004, section 57(4)(a).

BACKGROUND:

[1]  This decision addresses a complaint initiated by the Information and Privacy Commissioner of Ontario (IPC) under the Personal Health Information Protection Act (PHIPA) relating to an incident in which a physician left behind records of personal health information at a property that she has been renting. The landlord destroyed most of these records but delivered three binders of records to the College of Physicians and Surgeons of Ontario (CPSO).

[2]  There have been several complaints before the IPC with respect to this physician, including relating to the incident described above, and this complaint appears to be the only one that has issues that remain unresolved. The purpose of this IPC initiated complaint is to determine whether there are reasonable grounds for believing that the physician has contravened sections 12 (security), 13 (handling of records) and 16 (written public statement) of PHIPA.

[3]  At the outset, an IPC analyst wrote to the physician’s legal counsel and requested confirmation that the physician had retrieved the three binders from the CPSO and that all records of personal health information in the physician’s custody and control (including the three binders) had been transferred to a storage facility. The analyst did not receive a response confirming that the physician had taken these steps.

[4]  This matter was then referred to legal counsel at the IPC, who sent a follow-up letter to the physician’s legal counsel. In addition to asking for the information requested by the analyst, the IPC’s legal counsel asked that the physician’s legal counsel provide specific contact information that could be used by the physician’s former patients to access their records of personal health information.

[5]  The IPC’s legal counsel was unable to obtain the requested information from the physician’s legal counsel by a specified deadline, and this complaint was then transferred to me to consider whether it is necessary to review the subject-matter of the complaint under PHIPA.

DECISION:

[6]  There is no dispute that the physician is a “health information custodian,” as that term is defined in section 3(1) of PHIPA, and that the records in her custody or control contain “personal health information,” as that term is defined in section 4(1). Accordingly, the physician must comply with the requirements of PHIPA, including sections 12, 13 and 16.

[7]  I wrote to the physician’s legal counsel and asked him to provide the same information that had been previously requested by the IPC’s analyst and legal counsel. In response, the physician’s legal counsel provided me with evidence that confirms the following:

• The physician retrieved the three binders of records of personal health information from the CPSO.
• She transferred these binders to a secure storage facility where she keeps the records of personal health information of her former patients.
• All records of her former patients’ personal health information that still exist are kept in this secure storage facility, and to the best of her knowledge, there are no stray records in other locations.

[8]  The physician’s legal counsel also provided the physician’s contact details, which are provided to former patients who are seeking access to records of their personal health information.

[9]  Section 57(4) of PHIPA sets out the grounds upon which the Commissioner may decide not to review the subject-matter of a complaint. In particular, section 57(4)(a) states:

The Commissioner may decide not to review the subject-matter of the complaint for whatever reason the Commissioner considers proper, including if satisfied that,

(a) the person about which the complaint is made has responded adequately to the complaint;

[10]  Based on the evidence provided by the physician, I have decided not to review the subject-matter of this complaint because she has responded adequately to it.

[11]  As a matter of practice, the IPC does not usually identify the health information custodian in those PHIPA decisions in which it decides not to review the subject-matter of a complaint. In my view, however, several factors weigh in favour of identifying the physician in this particular decision. First, the incident that triggered this complaint was publicized in the media. Second, the IPC has issued at least one previous PHIPA decision in which it has identified this physician. [1] Third, and most importantly, some of the physician’s former patients may still be seeking access to their records of personal health information. In these circumstances, I have decided to identify the physician in this decision.

NO REVIEW:

For the foregoing reasons, no review of this matter will be conducted under Part VI of PHIPA.

Original signed by:		December 16, 2019
Colin Bhattacharjee
Adjudicator