PHIPA DECISION 116

Complaint HA18-40-2

Slimband Weight Loss Clinic

April 14, 2020

Summary: An individual sought access under the Personal Health Information Protection Act (PHIPA or the Act) to her complete file from Slimband Weight Loss Clinic. The clinic issued a decision granting access to the responsive records in their entirety. The individual filed a complaint with the office on the basis of her belief that additional responsive records should exist. The sole issue in this complaint is whether the clinic conducted a reasonable search for responsive records. In this decision, the adjudicator upholds the clinic’s search as reasonable and dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, sections 53  and 54 .

BACKGROUND:

[1]  A former patient submitted a request to Slimband Weight Loss Clinic (Slimband or the clinic) under the Personal Health Information Protection Act (PHIPA or the Act) seeking access to the following:

… my entire medical file including invoices and receipts that pertain to the care and treatment I received […] & for my gastric banding at Slimband, and any & all subsequent care/treatment I received by Slimband (2012- 2016).

[2]  The clinic issued a decision granting access to the records that it identified as responsive to the request.

[3]  Upon receipt of the clinic’s decision, the requester filed a complaint with this office maintaining that additional records should exist. This complaint was opened to address the complainant’s concerns, and a mediator was appointed to explore the possibility of resolving the complaint.

[4]  During the mediation stage of the complaint process, the complainant identified the following records, which she said should exist but had not yet been located or provided to her in response to her request:

• Service level agreements between the complainant and Slimband;
• Payments the complainant made to Slimband;
• Invoices and/or receipts for (lump-sum and/or weekly) payments made;
• A paid in full letter for Loan [loan identification number];
• A letter for Loan [loan identification number] outlining the terms and repayment plan for $6,000.00;
• A patient assessment form;
• A “Slimpay” application form;
• An emergency contact form;
• A specified diagnostic imaging request;
• Medical and consultation notes and results relating to a specified gastro-intestinal procedure;
• Imaging results (i.e. the actual file and/or radiologists’ notes); and
• Notes from the nurse who provided “fills.”

[5]  The mediator provided this list of records to the clinic for its consideration. In response, the clinic stated:

…we have sent [the complainant] all the documents we have on file. We maintain patient charts as well as the financial documents electronically and on paper and [they] were easily retrieved. I forwarded all [of the complainant’s] medical file to her. Our accounting department sent all financial documents on file to her also.

[6]  The complainant was not satisfied with this response, and asked that her complaint proceed to the adjudication stage. As no further mediation was possible, the complaint was transferred to the adjudication stage.

[7]  During my review, I sought and received written representations from both parties, which were shared between them in accordance with section 18 of the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004 . For the reasons that follow, I find that the clinic has satisfied the search requirements in section 54 of the Act, and I dismiss the complaint.

DISCUSSION:

[8]  Neither party disputed the complainant’s right to seek access to records from the clinic under the Act, and the application of the Act to the issues in dispute. Although it is debatable whether the clinic is a health information for the purposes of the Act, it is not necessary for me to determine this issue since, for the reasons below, I find no basis to issue any orders in any event. In the following, I will assume, without deciding, that the clinic is a “health information custodian”, and that the records sought by the complainant are her records of “personal health information”, as defined in the Act. [1]

Did the clinic conduct a reasonable search for records responsive to the complainant’s request?

[9]  The sole issue for determination in this complaint is whether the clinic conducted a reasonable search for records responsive to the complainant’s request, as required by sections 53 and 54 of the Act. If I am not satisfied that the search carried out was reasonable in the circumstances, I may order the clinic to conduct further searches.

[10]  This office has extensively canvassed the issue of reasonable search in orders issued under the Freedom of Information and Protection of Privacy Act  (FIPPA ) [2] and its municipal counterpart, the Municipal Freedom of Information and Protection of Privacy Act  (MFIPPA ). [3] It has also addressed the issue of reasonable search under PHIPA. [4] In addition to what is set out in PHIPA Decision 18, principles outlined in orders of this office addressing reasonable search under FIPPA and MFIPPA  are instructive to the review of this issue under PHIPA.

[11]  PHIPA does not require the clinic to prove with absolute certainty that further records do not exist. However, the clinic must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [5] To be responsive, a record must be "reasonably related" to the request. [6] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [7]

[12]  This office may order a health information custodian to conduct a further search if it is not satisfied that the custodian has made a reasonable effort to identify and locate responsive records within its custody or control. [8]

Representations

[13]  The clinic itself is no longer in operation; however, a “patient support service” remains available to assist former patients. The patient support service is operated by the clinic’s former Post Operative Patient Consultant (the consultant). The consultant is the individual who provided representations explaining the clinic’s search efforts in response to the complainant’s access request.

[14]  The consultant explains that when the clinic was in operation, it used the following three methods for maintaining patient records: physical charts, Lifecharts, [9] and Salesforce. With respect to the physical charts, the consultant explains that the clinic’s nurse managers created and stored physical medical files in the filing system at the clinic’s facility. The consultant says that Lifecharts held a digital copy of the physical files, but “all of that data was lost” when Lifecharts went bankrupt in 2016. The consultant explains that after Lifecharts went bankrupt, the clinic’s IT Director backed up all of the clinic’s physical files onto a hard drive. The consultant advises that in doing so, complete patient files were scanned and filed electronically based on patients’ names and birthdates.

[15]  The consultant maintains that the clinic was still an operating business when the complainant originally submitted her access request. Therefore, staff in accounting and IT were able to access the Salesforce database and hard drive data in order to identify responsive records using the complainant’s name and birthdate. The consultant says that she was given some of the responsive records, which she then forwarded to the complainant. Others records were forwarded to the complainant directly from the clinic’s accounting department.

[16]  In addition to the written representations, the consultant provided this office with a copy of the documents that she said were provided to the complainant in response to her request. In total, the clinic provided this office with 82 pages of records, which included financial documents, such as a loan application and agreement, and a letter summarizing the payments that the clinic received from the complainant, as well as medical documents, such as a patient assessment, operating notes, lab results, and documents relating to the complainant’s pre- and post-operative care.

[17]  The consultant maintains that the clinic does not have any other records relating to the complainant.

[18]  Upon reviewing the clinic’s submissions, the complainant identified a number of records that she maintains were not provided to her in response to her request. The complainant provided copies of the records that she received from the clinic, so that I could verify which documents that she had, and had not, been given access to. In total, the complainant had been provided 24 pages of records.

[19]  As the complainant maintains that she only received a portion of the records that were provided to this office, she submits that the clinic has not complied with its obligations under the Act.

[20]  I invited the clinic to provide reply representations addressing the apparent discrepancy in what records had been provided to the complainant and this office. Rather than providing reply representations, the consultant sent the complainant all of the records that had previously been provided to this office.

[21]  After reviewing the complete package of records, the complainant advised that she was still not satisfied with the clinic’s search. In particular, she was concerned that she did not receive records documenting “individual transactions made by [her] to [the clinic].” She was also concerned that the records she received from the clinic did not contain any medical results or reports from a “radiologist/technologist” at a hospital where she had a particular procedure performed following her gastric banding procedure.

Analysis and findings

[22]  The complainant claims that additional responsive records exist beyond those identified by the clinic; therefore, I must determine whether the clinic has conducted a reasonable search as required by section 53 and 54 of the Act.

[23]  As mentioned above, the clinic is not required to establish with absolute certainty that additional records do not exist in order to satisfy the requirements of the Act. However, it must demonstrate that an experienced employee has made a reasonable effort to identify and locate records that are reasonably related to the complainant’s request. [10] Based on the evidence before me, I am satisfied that the clinic has done so.

[24]  To begin, I am not persuaded that the complainant’s concerns establish a basis for concluding that the clinic has not fulfilled its search requirements under the Act. The complainant’s objection to the clinic’s search is based on the fact that she has not received certain financial and medical records that she believes should exist. In my view, however, the complainant has not provided a reasonable basis for concluding that the financial records she seeks exist, or that the medical records, if they exist, could reasonably be expected to be in the clinic’s possession, rather than with another health information custodian, as I explain below.

[25]  With respect to the financial records in particular, the complainant says that she has not obtained any records evidencing the “individual payments” that she made to the clinic. Based on my view of the evidence before me, however, I am not persuaded that this particular type of record is one the clinic used and, therefore, could reasonably be expected to have been located during the clinic’s search.

[26]  Previous orders of this office have established that institutions under FIPPA and MFIPPA  are not required to create a record in response to an access request if one does not exist. [11] I agree with the reasoning in those orders. In the context of this complaint, the clinic did not locate and provide the complainant with records documenting the individual payments that she made to the clinic. It did, however, provide other financial and accounting records, such as a loan agreement and letters demonstrating the total payments that the complainant made each year. In other words, while the clinic did not provide the exact records that the complainant is looking for, it did identify and locate records containing similar responsive information. Accordingly, I am satisfied that the clinic understood that the complainant was seeking access to records containing this particular type of information, and that it made reasonable efforts to identify those records when conducting its search. I conclude, therefore, that the fact that the clinic did not locate records matching the description provided by the complainant does not undermine the reasonableness of its search.

[27]  I am similarly satisfied that the clinic understood that the complainant was seeking access to all medical files relating to her, which would have included any reports and results that it has relating to the procedure the complainant referred to in her representations. It may be that the complainant could have a reasonable basis for believing that such records exist, [12] but it does not follow that the clinic’s search was deficient because it failed to locate those records. I note that the records that the clinic provided to the complainant included other medical reports and results, such as consultation notes, operation notes, and lab results, which were located as a result of its search. Therefore, I am satisfied that the clinic sought to identify and locate medical reports and results relating to the complainant when conducting its search.

[28]  In the preceding paragraphs, I have addressed the specific arguments that were raised by the complainant during my review. Based on the evidence before me, I am also satisfied that the complainant’s request was clear and unequivocal and I accept that the clinic understood that she was seeking access to her entire file. There is no evidence before me to suggest that the clinic unilaterally or inadvertently narrowed the scope of the complainant’s request, and I am satisfied, based on the records and representations before me, that it has not done so.

[29]  I am also satisfied that the employees who conducted the search for responsive records are knowledgeable in the subject matter of the request, and expended a reasonable effort to locate records that are reasonably related to the request. [13] The consultant explains that the clinic’s hard drive of patient files was searched by the clinic’s former IT Director. I accept that he would be familiar with the types of records that could be found on the hard drive, given that he is the individual that created the hard drive and organized it based on patients’ names and dates of birth. I also accept that the individual in the clinic’s accounting department would be familiar with the types of financial and accounting records that the clinic maintained, and would be aware of how to locate the records relating to the complainant. Finally, I accept that the consultant who coordinated the search understood the clinic’s responsibility to conduct a thorough search and provide the complainant with access to records responsive to her request.

[30]  Accordingly, for the reasons outlined above, I find that the clinic conducted a reasonable search for records in compliance with its obligations under the Act. On that basis, I uphold the search and dismiss the complaint.

ORDER:

For the foregoing reasons, no order is issued.

Original signed by		April 14, 2020
Jaime Cardy
Adjudicator