PHIPA DECISION 106

Complaint HA18-8

University Health Network

January 3, 2020

Summary: In this final decision, the adjudicator upholds the reasonableness of the search conducted by the hospital in response to PHIPA Decision 101. As the only remaining issue for determination in the complaint is now resolved, this complaint is dismissed.

Statutes Considered: Personal Health Information Protection Act, 2004,  SO 2004, c 3 Sched. A , as amended, section 54; Freedom of Information and Protection of Privacy Act, RSO 1990, c M.56, section 24 .

BACKGROUND:

[1] This final decision follows PHIPA Decision 101, in which I disposed of a number of issues arising from a requester’s complaint regarding the decision of the University Health Network (the hospital) in response to a request for records regarding allegations of improper conduct that were made against him by another patient. In PHIPA Decision 101, I upheld the hospital’s decision to deny access to the responsive records based on the grounds claimed in the Personal Health Information Protection Act (PHIPA) and the Freedom of Information and Protection of Privacy Act (FIPPA). However, I was not satisfied that the hospital conducted a reasonable search for records responsive to the complainant’s access request, and consequently found that the hospital had not satisfied its search obligations under the acts. I therefore ordered the hospital to conduct a further search for records reasonably related to the complainant’s request, and to issue a decision on access to any newly identified records.

[2] In response to PHIPA Decision 101, the hospital conducted further searches, which did not locate any additional responsive records. In accordance with the order provisions of PHIPA Decision 101, the hospital provided me with an affidavit describing its search efforts.

[3] A copy of the hospital’s affidavit was provided to the complainant for review. The complainant advised that he took “no position on the hospital’s affidavit,” and therefore was not submitting any representations in response.

[4] In this final decision, I find that through its additional search efforts, the hospital has satisfied its obligations under sections 24 of FIPPA and 54 of PHIPA and I dismiss the appeal.

DISCUSSION:

[5] As explained in PHIPA Decision 101, the hospital is both a “health information custodian” as defined by and subject to PHIPA, and an “institution” as defined by and subject to FIPPA. The sole issue remaining in this complaint is whether the hospital has conducted a reasonable search for responsive records as required by both of the acts.

[6] Where a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by section 54 of PHIPA and section 24 of FIPPA.

[7] The acts do not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [1] To be responsive, a record must be "reasonably related" to the request. [2]

[8] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [3]

[9] A further search will be ordered if the custodian does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [4]

[10] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [5] A requester’s lack of diligence in pursuing a request by not responding to requests from the custodian for clarification may result in a finding that all steps taken by the custodian to respond to the request were reasonable. [6]

[11] In PHIPA Decision 101, I determined that the hospital’s brief representations on this issue did not provide a sufficient basis for me to find that it had conducted a reasonable search for records. In particular, I noted that the hospital did not identify who conducted the searches, nor did it describe the locations that were searched or the search methods that were used. Without this information, I was unable to determine whether “an experienced employee knowledgeable in the subject matter of the request expend[ed] a reasonable effort to locate records which are reasonably related to the request.” [7] Therefore, I ordered the hospital to conduct a further search for responsive records and to submit an affidavit detailing its search efforts.

[12] In response to PHIPA Decision 101, I received an affidavit sworn by the hospital’s Manager, Access and Privacy Operations and Freedom of Information Coordinator (the manager). The manager attests to having been employed by the hospital for eight years and to being knowledgeable in its record-keeping policies and practices.

[13] The manager identifies the four hospital employees he originally asked to search for records responsive to the complainant’s request. The manager explains that two of the employees had met with the complainant to discuss the allegations made against him, and both advised that due to the sensitive nature of the issue, they did not take any notes of their discussion. The other two employees worked in the hospital’s legal office. These employees were contacted by email for advice on how to proceed with the allegations against the complainant. That email correspondence formed the record at issue in PHIPA Decision 101.

[14] Upon receipt of PHIPA Decision 101, the manager attests to requesting the same employees [8] to search “all documentation, including notebooks, emails, electronic and paper records for any documentation that would be responsive to the request.” All of the employees conducted an additional search as instructed, and advised that their search efforts did not locate any additional responsive records. The manager says that no other responsive records were created, and none were destroyed.

[15] The complainant declined to provide representations in response to the hospital’s affidavit.

[16] As mentioned above, in PHIPA Decision 101, I was unable to conclude that the hospital conducted a reasonable search because I had received insufficient evidence from the hospital on this issue. For example, in my initial review, the hospital did not provide any information about who conducted the search or what locations were searched. I am now satisfied, however, that the hospital’s affidavit of search has addressed these deficiencies, thereby enabling me to conclude that the hospital has conducted a reasonable search as required by the acts.

[17] The manager, who coordinated the hospital’s search effort, attests to his eight years of experience as a hospital employee and his familiarity with the scenario that gave rise to this complaint. The manager advises that he identified which hospital employees should be involved in the search based on their involvement with the matter involving the complainant. The employees that conducted a search included the Nurse Manager, Workplace Wellness Manager, and Director of Legal Operations and Privacy. Based on the evidence before me, I am satisfied that the hospital’s search was orchestrated and carried out by experienced employees who were knowledgeable in the subject matter of the complainant’s request.

[18] I am also satisfied that the hospital expended a reasonable effort to locate records that reasonably relate to the complainant’s request, based on the variety of records that the employees were instructed to search, and the fact that they were asked to locate “any documentation” that would be responsive to the request.

[19] In the absence of submissions from the appellant, I find that there is no reasonable basis to conclude that a further search would yield additional responsive records.

[20] Accordingly, for the reasons outlined above, I find that the hospital has demonstrated that it conducted a reasonable search for records responsive to the complainant’s requests, as required by the acts and in response to my findings in PHIPA Decision 101.

ORDER:

I uphold the reasonableness of the hospital’s search and I dismiss the complaint.