Health Information and Privacy

Decision Information

Summary:

The complainant requested the video recordings of events leading up to, and including, his restraint and placement in a seclusion room by staff at Waypoint Centre for Mental Health Care (the hospital). The hospital denied the complainant access to the responsive records under section 52(1)(f) of the Personal Health Information and Protection Act, 2004 (PHIPA), with reference to section 49(a) of the Freedom of Information and Protection of Privacy Act (FIPPA), in conjunction with various law enforcement exemptions in section 14(1) of FIPPA.
The adjudicator finds that the records are not “dedicated primarily to” the complainant’s personal health information (PHI). Accordingly, the complainant’s right of access under PHIPA is limited to his PHI that can reasonably be severed from the remaining portions of the records. The adjudicator finds that some portions of the records containing the complainant’s PHI qualify for exemption under section 52(1)(f) of PHIPA, with reference to sections 49(a) and 14(1)(k) (security of a centre of lawful detention) of FIPPA.
The hospital is ordered to grant the complainant access to the portions of the video containing his PHI that can reasonably be severed from the exempt information.

Decision Content

Titre : Logo of the Information and Privacy Commissioner of Ontario, Canada / Logo du Commissaire à l'information et à la protection de la vie privée de l'Ontario, Canada - Description : Logo of the Information and Privacy Commissioner of Ontario, Canada / Logo du Commissaire à l'information et à la protection de la vie privée de l'Ontario, Canada

PHIPA DECISION 123

 PA16-440

Waypoint Centre for Mental Health Care

June 24, 2020

Summary: The complainant requested the video recordings of events leading up to, and including, his restraint and placement in a seclusion room by staff at Waypoint Centre for Mental Health Care (the hospital). The hospital denied the complainant access to the responsive records under section 52(1)(f) of the Personal Health Information and Protection Act, 2004 (PHIPA), with reference to section 49 (a) of the Freedom of Information and Protection of Privacy Act  (FIPPA ), in conjunction with various law enforcement exemptions in section 14(1) of FIPPA.

The adjudicator finds that the records are not “dedicated primarily to” the complainant’s personal health information (PHI). Accordingly, the complainant’s right of access under PHIPA is limited to his PHI that can reasonably be severed from the remaining portions of the records. The adjudicator finds that some portions of the records containing the complainant’s PHI qualify for exemption under section 52(1)(f) of PHIPA, with reference to sections 49(a) and 14(1)(k) (security of a centre of lawful detention) of FIPPA.

The hospital is ordered to grant the complainant access to the portions of the video containing his PHI that can reasonably be severed from the exempt information.

Statutes Considered: Personal Health Information and Protection Act, 2004, sections 2(1) (definitions), 3(1), 4(1), 4(3), 52(1)(e)(i), 52(1)(f), 52(2) and 52(3); Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c.F.31, sections 2(1)  (definition of “personal information”), 14(1)(k) and 49(a).

Orders and Investigation Reports Considered: PHIPA Decisions 17, 34, 100, 117 and 120; Orders PO-2332, PO-2911 and PO-3905.

OVERVIEW:

[1]  The complainant filed a request under the Personal Health Information Protection Act, 2004 (PHIPA) to Waypoint Centre for Mental Health Care (the hospital) for video footage of an incident involving himself. The hospital is the province’s only high security forensic mental health program for clients served by both the mental health and justice systems. The complainant was found not criminally responsible in relation to a Criminal Code  matter on account of mental disorder and is an inmate patient at the hospital. The hospital located responsive surveillance videos but, in an access decision made under the Freedom of Information and Protection of Privacy Act (FIPPA), denied the complainant access to them claiming that the video footage qualifies for exemption under various law enforcement provisions in section 14(1) of FIPPA.

[2]  The complainant appealed the hospital’s decision to this office and a mediator was appointed to explore settlement with the parties. During mediation, the hospital issued a revised access decision, this time under PHIPA, which stated:

Although the records contain personal health information (PHI) about you, they are not records that are “dedicated primarily” to PHI about you within the meaning of section 52(3) of PHIPA and any PHI in the records cannot reasonably be severed.

[The hospital] has determined that these records are exempt from disclosure pursuant to sections 14(1)(e)(i)(j)(k)(l) of FIPPA, available through section 52(1)(f) of PHIPA and section 49(a) of FIPPA.

[3]  A mediated resolution was not possible and the file was transferred to adjudication. Although the matter came to this office as an appeal under FIPPA, the majority of my analysis takes place under PHIPA. Accordingly, for the remainder of this decision I will refer to my adjudication of this matter as a review under PHIPA rather than an inquiry under FIPPA. During the review stage, the parties provided representations in response to the notice I sent to them which identified the outstanding issues. The non-confidential portions of the parties’ representations were exchanged and the hospital was invited to provide reply representations, which it did.

[4]  The complainant’s submissions did not specifically address the issues set out in the notice inviting his representations. The bulk of the complainant’s submissions raised concerns about his ability to present his case before the Ontario Review Board (ORB). [1] The complainant takes the position that the incident captured in the requested video was included in the hospital’s report to the Ontario Review Board. The complainant states:

By withholding such crucial and relevant information from me and others in my position – [We are] unable to prove our version of events. The [hospital’s] position becomes unchallengeable at Ontario Review Board Hearings, because they will not provide the information in their control that would support a viable challenge to the Hospital position, by the patient directly affected and requesting such information.

[5]  In response, the hospital submitted an affidavit to this office in which its former Privacy Officer states:

I have reviewed the Hospital Report which was prepared for the [complainant’s] upcoming ORB, in which it is recommended that the [complainant] remain at [the hospital]. I confirm that the Hospital Report does not rely on or reference the Records. In preparing the Hospital Report, … staff did not have access to the Records. Any references in the Hospital Report to the alleged incident with the [complainant] are based on the observations of [hospital] staff who were involved in the incident, as documented in the [complainant’s] record of personal health information, to which he does have access.

The Records do not form part of the Hospital Report and have not been made available to the ORB for consideration. The [complainant’s] lawyer has been given access to the Records. [2]

[6]  After reviewing the parties’ representations, I wrote to the hospital and sought further information regarding the identification of staff members whose images appear in the video recordings, along with the hospital’s position as to whether or not their images constitute the complainant’s PHI. The hospital responded that it could identify 30 staff members in the records. Of the 30 staff members identified, the hospital advised that five staff members were the subject of a patient abuse allegation filed by the complainant. I sent a Notice of Review to these five individuals notifying them of the complaint and inviting their representations. In response, the hospital provided additional information and representations on behalf of these five individuals which I was satisfied met this office’s confidentiality criteria. [3] As a result, this information was not shared with the complainant.

[7]  In this decision, I find that the records contain the complainant’s PHI. However, I find that none of the records are dedicated primarily to the complainant’s PHI, within the meaning of section 52(3). Accordingly, his right of access under PHIPA is limited to his PHI that can reasonably be severed from the remaining portions of each of the records. I also find that some of the complainant’s PHI qualifies for exemption under section 52(1)(f), with reference to FIPPA sections 49(a) and 14(1)((i) and (k) (security of a building/centre of lawful detention).

[8]  Although a requester may have a right of access under FIPPA to portions of records to which a PHIPA right of access does not apply, in this case, the complainant’s request is limited to video surveillance records in which he is shown. It is thus not necessary for me to consider whether the complainant has a residual right of access under FIPPA to portions of the records that do not contain his image.

[9]  As a result of my findings under PHIPA, I order the hospital to grant access to the portions of the complainant’s PHI that are not subject to an exemption and can reasonably be severed from exempt information.

RECORDS:

[10]  The records at issue in this matter are surveillance videos taken at the hospital from five different locations relating to a Code White incident involving the complainant. The records are described in the chart below in chronological order as opposed to the order they appear on the CD the hospital provided this office.

Number in sequence that footage appears on hospital’s CD

Camera location as described by the hospital in its letter to the complainant

Narrative summary provided by the hospital in its letter to the complainant

Length of video and of segments containing images of the complainant

5 (Part 1)

North corridor of the North Zone

“Staff call [the complainant] out of his room to observe a search. [The complainant] and staff walk down the north corridor towards [specified location]”

16 minutes (Part 1 and 2)

Complainant appears at approximately 43 seconds to 1:11 for about 28 seconds.

4

East corridor of the North Zone

“[The complainant] observes the search of his possessions … After a few moments, [the complainant] … walks away from [location to another location].”

15 min. 49 sec

Complainant appears at approximately 1:15 to 4:25 for about 3 minutes.

5 (Part 2)

South end of the north corridor of the North Zone

 “…Staff physically restrain [the complainant] at that location.”

Complainant re-appears in video at approximately 4:37 -4:39, 2 seconds

2

West corridor of the North Zone

“Staff carrying [the complainant] face down through the corridor towards the seclusion rooms.”

60 minutes

Complainant appears from approximately 28:09 to 28:32 for about 23 seconds.

1

Seclusion rooms corridor

“[The complainant] is carried by staff to a seclusion room door.”

13 minutes

Complainant appears at approximately 1:48 to 1:59 for about 11 seconds.

3

Seclusion room/ Seclusion rooms corridor

“While still holding [the complainant], staff help him stand at the seclusion room door … [the complainant] is physically directed to the far wall of the seclusion room…”

“1:1 staff monitoring [of the complainant] in the seclusion room and charting.”

4 minutes

Complainant appears in frame at approximately at 47 seconds for the remainder of the video for about 3 minutes.

ISSUES:

  1. Do the records contain “personal health information” of the complainant as defined in section 4(1) of PHIPA?
  2. Are the records “dedicated primarily” to the complainant’s personal health information within the meaning of section 52(3)? If not, can the complainant’s PHI be reasonably severed from the portions not containing his PHI?
  3. Does the exemption in section 52(1)(f) of PHIPA, with reference to sections 49(a) and 14(1)(k) of FIPPA, apply to the complainant’s reasonably severable PHI?
  4. Does the exemption in section 52(1)(e)(i) of PHIPA apply to the complainant’s reasonably severable PHI?
  5. Does section 52(2) give the complainant a right of access to portions of the records, despite the application of an exemption?
  6. Did the hospital properly exercise its discretion to withhold the records?

ACCESS RIGHTS UNDER PHIPA:

[11]  PHIPA provides a right of access to records of one’s own “personal health information” that are in the custody or under the control of a “health information custodian.” Unlike FIPPA and its municipal equivalent (MFIPPA), [4] PHIPA does not provide a general right of access to information held by the organizations to which it applies. The only right of access under PHIPA is the right of individuals to obtain access to their own personal health information under section 52(1). [5]

[12]  In this matter, there is no dispute that the hospital is an institution subject to FIPPA under section 2(1) [6] of that statute and is also subject to PHIPA as a health information custodian under section 3(1) of PHIPA. [7]

[13]  In situations where FIPPA and PHIPA could both apply, the approach of this office is to first consider the extent of any right of access under PHIPA, and then consider the extent of any right of access under FIPPA to any remaining portions of the record for which a determination has not been made under PHIPA. [8] In this matter, the complainant’s request is limited to video footage capturing the events leading up to and including his restraint and placement in a seclusion room. Below, I find that his right of access to this footage is to be determined under PHIPA and it is therefore not necessary to consider FIPPA.

A.  Do the records contain “personal health information” of the complainant as defined in section 4(1) of PHIPA?

[14]   The relevant parts of the definition of “personal health information” in section 4 of PHIPA state:

In [PHIPA],

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a)  relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, [or]

(b)  relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(2)  In this section:

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

(3)  Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[15]  Section 4(4) sets out limited exceptions. The hospital does not claim that any of the exceptions in section 4(4) apply in this matter, and I am satisfied that none apply. [9]

[16]  In PHIPA Decision 17, this office adopted a broad interpretation of the phrase “personal health information” and has applied it in subsequent orders and decisions.

Representations of the parties

[17]  The hospital concedes that the records contain the complainant’s personal health information as defined in section 4(1) of PHIPA. In its representations, the hospital states:

The Records are comprised of video surveillance footage of a Code White incident and restraint response involving the [complainant] which was captured and recorded by cameras installed on [specified area in the hospital]. A Code White is an emergency response which may be called when staff urgently require assistance in managing a situation, such as an assault or other behaviour.

The Records contain identifying information about the [complainant] that “relates to” the physical and mental health of the [complainant]. This includes the [complainant’s] negative behavioural response to a [specified activity by hospital staff] that triggered the Code White response, and the behavioural management interventions initiated in response to the [complainant’s] behaviours and associated risks, including restraint and seclusion.

[18]  In its supplemental representations, the hospital also states that:

[t]he Records also relate “to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual” in accordance with section 4(1)(b) of PHIPA.

[19]  The hospital notes that it is possible to identify hospital staff who responded to the Code White involving the complainant and submits that “any images relating to the [complainant] and/or any staff members depicted in the Records with the [complainant] would constitute his PHI.”

[20]  Finally, the hospital confirms that the records do not contain the images of any other patients. Accordingly, the only images captured in the frames are those of the complainant and hospital staff.

[21]  The complainant’s representations did not specifically address this issue.

Decision and analysis

[22]  In determining whether the records contain the complainant’s PHI, I am guided by the “record-by-record” approach that this office has adopted where the whole record, as opposed to individual paragraphs, sentences or words, are analyzed to determine if the record contains the personal information or PHI of an individual. [10] In the circumstances of this matterl, applying a “record-by-record” analysis requires me to review each video as a whole as opposed to segments.

Images of the complainant in the video footage

[23]  I have reviewed the records and am satisfied that the portions of the records which contain images of the complainant contain his PHI. Contained in the records are identifying images of the complainant during a Code White response which ended with him being restrained and placed in a seclusion room. Code White codes are emergency codes used almost exclusively in hospital or therapeutic settings to address actual or potential violent behaviour of a patient.

[24]  In confidential submissions made to this office, the hospital identified 30 staff members whose images appear in the records. Of the 30 staff members identified by the hospital, the hospital submits that five were directly involved in the incident and were the subject of an internal complaint filed by the complainant. The hospital refers to these five individuals as “escorting staff”. The hospital submits that there may be additional staff members whose images are captured on video but that they are not identifiable from these images.

[25]  Earlier in this decision, I catalogued the records in six parts based on the narrative summary provided by the hospital in a letter it sent the complainant. The following list provides a description of the records along with information the hospital provided about staff members whose images are captured in the footage that also contains the complainant’s image:

  • Staff call the complainant out of his room to observe a search. The hospital identified three nurses as the staff members who called the complainant from his room and walked down the corridor with him (part 1 of video 5).
  • Staff and the complainant observe a search. The complainant subsequently walks away and proceeds down the corridor. The hospital identified three security and three nursing staff in the first portion of this recording. The latter portion of this recording captures staff responding to the Code White incident involving the complainant. For the remainder of this decision, I will refer to the latter portion of the video segment as “the initial restraint” (video 4 and part 2 of video 5).
  • Staff carries the complainant face down through the corridor towards the seclusion room. For the remainder of this decision, I will refer to this video segment as the “front view of the complainant being transported to the seclusion room”. The hospital identified 15 health professionals, [11] in addition to three security staff members, in this video segment (video 2).
  • The complainant is carried by staff to the seclusion room door. For the remainder of this decision, I will refer to this video segment as the “side view of the complainant being transported to the seclusion room.” The hospital identified 11 health professionals, including nurses, along with two security and one housekeeping staff in this video segment (video 1).
  • Staff place the complainant in the seclusion room doorway. The hospital identified three health professionals and two security staff in this video segment as “escorting staff”. The remaining footage captures images of the complainant in the seclusion room and images of staff members outside the seclusion room monitoring the complainant (video 3).

[26]  I am satisfied that the records described above contain the complainant’s PHI under section 4(1)(b) because they relate to the provision of health care to him, including the identification of health care and security staff as providers of health care to him. [12] The complainant is a patient at the hospital and various hospital employees responded to the Code White incident. The video footage that contains the complainant’s image also includes the images of these other individuals who interact with him in the course of carrying out their professional duties relating to the Code White incident.

[27]  “Health care” is a broadly defined term in section 2 of PHIPA that includes any observation, examination, assessment, care, service or procedure that is done for a health related purpose and that:

(a)  is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b)  is carried out or provided to prevent disease or injury or to promote health[.]

[28]  I find that all portions of the video capturing the complainant’s image with the images of other staff members, regardless of their role, constitutes the complainant’s PHI as defined in paragraph (b) of section 4(1) of PHIPA. The definition of “health care” is broad and includes any observation, examination, assessment, care, service or procedure that is done for a health related purpose. Here, the complainant is a patient in a mental health facility who was the subject of a Code White incident. In the context of this complaint, the health care was provided to the complainant by various hospital staff, including security staff, who are observing, monitoring, transporting and restraining him during a Code White incident. For the purpose of section 4(1)(b), it also includes a housekeeper who walks towards the area where the complainant was initially restrained, and then becomes an indistinguishable part of the group of individuals (staff) involved in responding to the Code White.

[29]  These portions of the video also contain background images showing the layout of the corridor or room in which the complainant appears.

[30]  Given my finding under section 4(1)(b), it is not necessary for me to decide whether the images of the complainant in the records also fit within paragraph (a) of the definition of PHI in section 4(1) of PHIPA.

Video footage in which the complainant’s image is not captured

[31]  Each of the six video recordings containing the PHI of the complainant also contains footage in which the complainant’s image is not captured. These portions of the records capture the images of staff members in the corridors. No other patient images are captured in the records. I find that these portions of the records do not qualify as the complainant’s PHI.

[32]  Despite this finding, the complainant may have a right of access to the entire video, including the portions that do not contain his PHI, if the records are found to be dedicated primarily to his PHI.

B.  Are the records “dedicated primarily” to the complainant’s personal health information within the meaning of section 52(3)? If not, can the complainant’s PHI be reasonably severed from the portions not containing his PHI?

[33]  As noted previously, the complainant has a right of access to the records containing his personal health information under section 52 of PHIPA, subject to certain limitations. One of those limitations is section 52(3), which is relied upon by the hospital in this complaint.

[34]  To determine the extent of the complainant’s right of access to the records under PHIPA, I must review each record to determine whether it is “dedicated primarily” to the personal health information of the complainant. This is because the right of access in PHIPA applies either to a whole record under section 52(1) [13] or only to certain portions of a record of personal health information under section 52(3).

[35]  Section 52(3) states:

Despite subsection (1), if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[36]  If a record is dedicated primarily to the personal health information of the individual, the individual has a right of access to the entire record (subject to any applicable exemptions), even if it incidentally contains information about other matters or other parties.

[37]  If, on the other hand, a record is not dedicated primarily to the personal health information of the individual, the right of access only applies to any PHI of the individual that can reasonably be severed from the record (subject to the applicability of any exemptions).

[38]  This office’s approach to the interpretation of section 52(3) was established in PHIPA Decision 17. [14] To determine whether a record is “dedicated primarily” to the personal health information of an individual within the meaning of section 52(3), this office takes into consideration various factors, including:

  • the quantity of personal health information of the requester in the record;
  • whether there is personal health information of individuals other than the requester in the record;
  • the purpose of the personal health information in the record;
  • the reason for creation of the record;
  • whether the personal health information of the requester is central to the purpose for which the record exists; and
  • whether the record would exist “but for” the personal health information of the requester in it. [15]

This list is not exhaustive.

[39]  The hospital argues that the records are not “dedicated primarily” to the complainant’s PHI and, accordingly, that the complainant’s right of access is limited to his PHI that can reasonably be severed from the remaining information in the records. In support of its position, the hospital states:

The main purpose of the Records is to ensure the safety and security of [hospital] patients, staff and other individuals; to identify, prevent and discourage unlawful behaviour; and to augment other security mechanisms and processes.

[40]  The hospital further argues:

  • The quantity of the complainant’s PHI found in the record is “incidental to the security purpose” of the record. The complainant’s PHI is not the central purpose for which the records exist. In any event, the records would exist regardless of whether they contain the PHI of the complainant.
  • The records were created in accordance with the hospital’s usual monitoring and security practices. The hospital explains that while the cameras in question may capture and record patient images from time to time, the records were not created for reasons relating to the “physical or mental health of the [complainant] or the provision of health care to [him].”

[41]  The complainant’s submissions did not specifically address this issue.

[42]  There is no dispute between the parties that the records contain the complainant’s PHI. Considerable portions of each record depict the complainant as a patient in the hospital.

[43]  The other factors which must be considered are the purpose the information serves in the records, the reasons for the record’s creation, and its uses. This “qualitative approach” takes into account considerations such as whether the PHI at issue is central to the purpose for which the record exists, and whether the record would exist “but for” the personal health information of the individual in it. [16]

[44]  From a qualitative perspective, I agree with the hospital’s position that the presence of the complainant’s PHI in the records is “incidental” to the security purposes of the records. The hospital argues that video footage for the time period in question would exist regardless of the complainant’s appearance in it. In support of its position, the hospital provided me a copy of its Video Surveillance Policy and Procedure, which identifies the primary purposes for which its video surveillance system is used. A copy was not provided to the complainant for confidentiality reasons raised by the hospital. Without disclosing the content of the policy, I confirm that most of the purposes identified in the policy relate to facilitating a safe environment for patients, staff and visitors.

[45]  The records before me capture images of the complainant immediately before, during and after a Code White response to the incident involving him. The hospital states that a “…Code White is an emergency response which may be called when staff urgently require assistance in managing a situation, such as an assault or other behaviour.” The records also contain images of hospital staff observing the complainant, including clinical staff who accompany security staff as the complainant is being transported to the seclusion room, who then subsequently observe and chart the complainant from outside the room. Based on my review of the records along with the submissions of the parties, I am satisfied that none of the records are dedicated primarily to the complainant’s PHI. Though the hospital’s policy relating to its use of video surveillance indicates that videos could be created for patient observation purposes, there is insufficient evidence before me to establish that the video recordings at issue in this complaint were made to observe the complainant in a specific clinical situation. In my view, the videos were made for security purposes relating to the health and safety of patients and staff. I also note that in a recent decision, [17] this office found that a patient’s PHI contained in a video captured on a hospital’s video surveillance system was incidental to the security purpose of the footage and was not dedicated primarily to that individual’s PHI.

[46]  Having regard to the above, in applying the “record-by-record” method of analysis adopted by this office, I find that none of the five video recordings at issue is dedicated primarily to the complainant’s PHI.

[47]  Given my finding, the complainant’s right of access is limited to the portions of the records containing his PHI that can reasonably be severed from the remaining portions, subject to the applicability of any exemption. Earlier in this decision, I found that all the portions of the records capturing the images of the complainant, which include images of staff members who appear with the complainant, qualify as his PHI. However, I also found that the remaining portions of the records capturing the images of staff members and empty corridors that do not contain images of the complainant do not qualify as his PHI.

Can the complainant’s PHI reasonably be severed from the portions not containing his PHI?

[48]  Section 52(3) of PHIPA states:

Despite subsection (1) [setting out exemptions from the right of access in PHIPA], if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[49]  I am satisfied that the portions of the records containing the complainant’s PHI (which includes images of staff members interacting with him as well as background images), can reasonably be severed from the portions which do not contain his PHI.

[50]  This can be achieved by shortening the video footage to only capture the portions in which the complaint’s image appears in the frame. Accordingly, I find that the complainant has a right of access to the portions of the records which contain his image under section 52(3), unless one or more of the exemptions apply.

C.  Does the exemption in section 52(1)(f) of PHIPA, with reference to sections 49(a) and 14(1)(k) of FIPPA, apply to the complainant’s reasonably severable PHI in the records?

[51]  Section 52 of PHIPA grants an individual a right of access to a record of their own PHI that is in the custody or under the control of a health information custodian, subject to limited exceptions and exclusions. The hospital claims that section 52(1)(f)(ii)(A) of PHIPA applies in the circumstances of this matter. This section states:

52(1) Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(f)  the following conditions are met:

(i)  the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or Municipal Freedom of Information and Protection of Privacy Act or is acting as part of such an institution, and

(ii)  the custodian would refuse to grant access to the part of the record,

(A) under clause 49 (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record…

[52]  Section 52(1)(f)(ii)(A) permits the hospital to claim the application of certain FIPPA exemptions (as a “flow-through” FIPPA claim). In this matter, the hospital relies on section 52(1)(f)(ii)(A) of PHIPA, together with section 49(a) in conjunction with the law enforcement exemptions in sections 14(1)(e), (i), (j), (k) and (l) of FIPPA. In support of its position, the hospital states:

Based on the nature of the Records, the [complainant’s] criminal and psychiatric history and the nature of the broader patient population, there is a high probability that disclosure of these Records would result in harm to [the hospital’s] patients, staff or visitors, [hospital] property and/or the general public. Applying the tests established under section 14 of FIPPA, disclosure of the Records could reasonably be expected to:

endanger [the hospital’s] patients, staff, visitors and others (s.14(1)(e)): [18]

compromise the security of [the hospital’s] premises which require protection (s. 14(1)(i)); [19]

compromise [the hospital’s] systems and procedures that are reasonably required for the protection of items and for the protection of [hospital] patients, staff and visitors (s. 14(1)(i));

facilitate the escape of a [hospital] patient who “is in lawful custody” at [the hospital] pursuant to the Criminal Code  (s. 14(1) (j)); [20]

jeopardize the security of [the hospital] which is a centre of lawful detention for unfit and not criminally responsible patients pursuant to the Criminal Code  (s. 14(1) (k)); [21] and/or

facilitate the commission of an unlawful act or hamper [the hospital’s] ability to control criminal acts on its premises (s. 14(1)(l)). [22]

[53]  For the reasons set out below, I find that section 49(a), in conjunction with the law enforcement exemption at section 14(1)(k) of FIPPA, applies to the background images of the facility in the records, which includes the layout of the corridors and rooms. In my view, the hospital’s evidence in support of its claim that section 14(1)(k) applies is virtually the same evidence it adduced in support of its position that sections 14(1)(i), (j) and (l) apply. Accordingly, there is no need for me to also consider the hospital’s claims that sections 14(1)(i), (j) and (l) apply to the background images of the facility. The hospital’s claim that section 14(1)(e) also applies will be addressed later in this decision.

Representations of the parties

[54]  The hospital takes the position that disclosure of the records would reveal information about the layout of its facility, and states in the non-confidential portions of its representations that:

As part of its security systems, [the hospital] operates a video surveillance system that provides 24-7 video monitoring of the interior of the high security psychiatric facility, as well as other areas of its premises and grounds. The video surveillance equipment is installed at various strategic locations, including common areas, entrances, hallways, seclusion rooms and designated step down rooms.

The Records depict a Code White incident as it progressed, from different areas and viewpoints based on the camera’s specific location, angle and field of vision. While the Records contain the [complainant’s] PHI, they also contain sensitive information about [the hospital’s] security system that could, if disclosed, be used to identify the nature and extent of the video surveillance in these areas and be exploited by the complainant or by someone else.

Based on the nature of the Records, the [complainant’s] criminal and psychiatric history and the nature of the broader patient population, there is a high probability that disclosure of these Records would result in harm to [the hospital’s] patients, staff or visitors, [hospital] property and/or the general public.

[55]  The hospital’s confidential submissions in support of its position provide examples of recent security incidents and information about its use of video surveillance as a security measure. The hospital also made confidential submissions in which it identified another security concern related to its video surveillance system separate from the concerns relating to the facility’s layout.

[56]  The complainant’s submissions focussed on concerns relating to his ability to present his case at the Ontario Review Board. The complainant submits that the hospital’s security concerns would be addressed if it provided a copy of the records to his lawyer so that he could view the records in his lawyer’s presence.

Decision and analysis

[57]  Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context. [23]

[58]  The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [24]

[59]  Having regard to the evidence of the parties, and the video recordings themselves, I find that disclosure of the information at issue could reasonably be expected to jeopardize the security of the facility, its staff, inmates and visitors. In making my decision, I have also taken into consideration this office’s past treatment of video surveillance records that contain information that would enable viewers to identify the layout of a correctional facility. In Order PO-2911, Adjudicator Diane Smith found that a 12-minute video capturing an incident between the requester and another inmate qualified for exemption under section 49(a) in conjunction with section 14(1)(k) of FIPPA. In that order, Adjudicator Smith considered Order PO-2332, in which Adjudicator Swaigen stated:

It is a matter of common sense and common knowledge that certain kinds of security measures, such as locks, fences and cameras would be present in certain locations and would be checked periodically in certain ways and that other practices and procedures described in the [security audit] would be routine. However, the Ministry points out that “to a knowledgeable individual, the absence of a particular topic, identified deficiencies, or the unavailability of certain security-enhancing measures at a given correctional facility could suggest a potential security vulnerability.”

I accept that even information that appears innocuous could reasonably be expected to be subject to use by some people in a manner that would jeopardize security. Knowledge of the matters dealt with in the security audit could permit a person to draw accurate inferences about the possible absence of other security precautions. Such inferences could reasonably be expected to jeopardize the security of the institution by aiding in the planning or execution of an escape attempt, a hostage-taking incident, or a disturbance within the detention centre. As the Ministry states, disclosure of the contents of the security audit to a requester can result in its dissemination to other members of the public as well.

[60]  In finding that section 49(a) in conjunction with section 14(1)(k) applied, Adjudicator Smith stated the following in Order PO-2911:

The video reveals the exact layout of the day space area. If the information was released to the general public, it could pose a security risk to the staff and the inmates of correction centres with the same layout. I find that the video could suggest potential security vulnerabilities by revealing the manner in which the day space is recorded by the video camera, thereby jeopardizing the security of the Correction Centre, as well as other centres for lawful detention which have the same or a similar layout.

[61]   More recently, this office considered an appeal with a similar fact scenario to the present matter before me. In Order PO-3905, Adjudicator Marian Sami considered whether section 49(a), in conjunction with section 14(1)(k) of FIPPA, applied to two video clips which captured an inmate’s restraint and placement in a cell. Adjudicator Sami found the exemption applied as the video recordings showed the layout of the correctional facility in question. In that decision, she stated:

The ministry persuasively argued that the reasoning in Order PO-2332 applied in Order PO-2911, and should be applied in this case. The layouts in question are different as between Order PO-2911 (a day space area) and this case (an admissions/discharge desk, clothing storage area, strip search bays, and a hallway leading to other areas with cells to the side). However, I find that if the exact layouts of these interior spaces at this maximum security institution were disclosed, such disclosure could reasonably be expected to jeopardize the security of the staff, inmates, and the correctional facility itself by exposing potential, exploitable security vulnerabilities. That would be true at least of the correctional facility in question, if not others with the same or similar layouts.

[62]  I adopt and apply the reasoning in Orders PO-2332, PO-2911 and PO-3905 to this matter and find that disclosing some of the information in the videos, specifically, the layout and security features of the facility, could reasonably be expected to result in the harms contemplated by section 14(1)(k) of FIPPA. I also am satisfied that the hospital’s submissions were sufficiently detailed to demonstrate that the potential of harm is well beyond the merely possible or speculative. The circumstances of this complaint are similar to those in the decisions set out above because the video recordings at issue contain information about the specific layout of a maximum security institution which houses inmates who pose a high risk to the community, other inmates and staff. In addition, I am persuaded by the hospital’s confidential submissions that disclosure of the records could reasonably be expected to jeopardize another aspect of its video surveillance system. Having regard to the records themselves and the submissions of the parties, I find that disclosure of the layout of the facility to the complainant could reasonably be expected to expose security vulnerabilities which would give rise to the harms in section 14(1)(k) of FIPPA.

[63]  Accordingly, given my finding that section 49(a) applies, in conjunction with section 14(1)(k) of FIPPA, I find that the exemption at section 52(1)(f) of PHIPA applies to the portions of the video recordings in question that would reveal the layout of the facility or other security features.

[64]  However, I find that this exemption does not apply to the images of the complainant and the staff who appear in close proximity to him in the video. I find that the hospital’s submissions fail to establish a connection between the contemplated harm and the portions of the records which contain the complainant’s image, along with staff, without the background layout. In my view, the general concerns the hospital raises about the harms resulting by reason of the criminal and psychiatric history of the complainant (and broader patient population) are speculative in nature.

[65]  For the same reasons I found that section 14(1)(k) does not apply to the images of the complainant and the staff appearing in close proximity to him, I find that section 14(1)(i) (security of a building, vehicle, system or procedure) also does not apply. In my view, the hospital’s evidence is not sufficiently detailed to establish how disclosure of the remaining information could reasonably be expected to endanger the security of the hospital or the video surveillance system established to secure the facility.

[66]  I also find that sections 14(1)(j) (escape from lawful custody) and (l) (commission of an unlawful act or hamper the control of crime) do not apply to the images of the complainant and staff that appear in close proximity to him in the video footage. In support of its claim that these sections apply, the hospital adduced virtually the same evidence it raised in support of the application of section 14(1)(k) to this information. I am not satisfied by the hospital’s evidence, which I find to be speculative in nature, that disclosure of the remaining portions of the records (the complainant’s image and the staff appearing in close proximity to him) could reasonably be expected to give rise to the harms contemplated by sections 14(1)(j) or (l).

D.  Does the exemption in section 52(1)(e)(i) of PHIPA apply to the complainant’s reasonably severable PHI in the records?

[67]  The hospital relies on section 52(1)(e)(i) to deny the complainant access to his PHI contained in the records. [25] This section states:

Subject to this Part [Part V of PHIPA, setting out the rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(e)  granting the access could reasonably be expected to,

(i)  result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person,

[68]  The purpose of section 52(1)(e)(i) is to protect the treatment, recovery and physical security of a patient and others. This exemption must be approached in a sensitive manner given the difficulty of predicting future events.

[69]  Section 52(1)(e)(i) of PHIPA is similar to the exemptions in sections 14(1)(e), 20, and 49(d) of FIPPA, which apply where disclosure could reasonably be expected to endanger the health, life or safety of an individual. [26] In order to satisfy the burden of proof under sections 14(1), 20, or 49(d), it is not enough for the institution denying access to take the position that the harms are self-evident from the record. The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [27]

[70]  In PHIPA Decision 34, Adjudicator John Higgins determined that the standard of proof required under section 52(1)(e)(i) of PHIPA is the same as the standard under sections 20 and 49(d) of FIPPA: the evidence must demonstrate a risk of harm that is well beyond the merely possible or speculative although the health information custodian need not prove that disclosure will in fact result in such harm.

Representations of the parties

[71]  In its initial response to my request for representations, the hospital did not cite section 52(1)(e)(i) under PHIPA. However, in support of its initial position that the records qualify for exemption under section 49(a) in conjunction with section 14(1)(e) (life or physical safety) and 49(b) in conjunction with section 21(2)(e) (pecuniary or other harm) the hospital stated:

[Given] the nature of the Records, the [complainant’s] criminal and psychiatric history and the nature of the broader patient population, there is a high probability that disclosure of the Records would result in harm to [hospital] patients, staff or visitors, [hospital] property and/or the general public.”

[72]  In addition, the hospital argued that disclosing the images of certain staff members who were the subject of a patient abuse complaint filed by the complainant in relation to the same incident would constitute an unjustified invasion of their personal privacy under section 49(b) of FIPPA. [28] The hospital took the position that disclosing the images of the five staff members identified in the complainant’s patient abuse complaint would reveal something of a personal nature about them. The hospital did not argue that the personal privacy provisions in FIPPA applied to the images of any other staff members whose images are also captured in the records.

[73]  In response to my request for further information, the hospital provided supplemental representations. In these representations, the hospital raised the application of section 52(1)(e)(i) under PHIPA and stated:

These risks are not speculative but are based on a number of relevant factors including the [complainant’s] personal history and reasons for his detention at [the hospital], the unique characteristics of the broader patient population of the high secure facility, the nature of the services provided at [the hospital], [the hospital’s] premises, and historical information regarding security incidents.

[74]  The hospital states that taking into consideration the circumstances of this matter, it concludes that “granting the [complainant] access to the Records has a high probability of endangering patients, including the [complainant], staff, visitors and others” and “would put patients, staff and others at serious risk.”

[75]  I also asked the hospital to identify the staff members whose images are contained in the records. The hospital identified 30 staff members but said that additional staff members may be captured in the footage but that their images were not identifiable. The hospital also noted that in some video clips, such as the video footage of the complainant’s initial restraint, few staff members can be accurately identified. I agree with the hospital’s assessment that some video clips contain the images of staff members who are not identifiable.

[76]  The hospital identified the five staff members who were the subject of the complainant’s patient abuse complaint. The hospital refers to these staff members as “escorting staff” as they were responsible for transporting the complainant to the seclusion room after his initial restraint. The hospital advised that these individuals would have been involved in the complainant’s initial restraint, but that their images cannot be identified in that portion of the video footage. However, the hospital advised that these five individuals can be identified in the following video clips:

  • Front view of staff carrying the complainant face down through the corridor (Video 2);
  • Side view of staff carrying the complaint through the corridor (Video 1); and
  • Staff placing the complainant in the seclusion room and closing the door (Video 3).

[77]   During my review, the five “escorting staff members” received notice of this complaint and were invited to provide representations. [29] Four staff members responded to the notice and expressed concern about the possibility of their images being released to the complainant. The other staff member did not respond. The responding staff members expressed safety concerns for themselves or other staff and reiterated some of the other safety concerns identified in the hospital’s confidential representations.

[78]  The hospital’s confidential submissions relied on updated affidavit material in which the hospital takes the position that its concerns relating to the risk of serious bodily harm continue today and also extend to hospital staff. Without disclosing the hospital’s confidential submissions, I note that the hospital provided details of recent security concerns involving the complainant along with information it submits was presented and not contested at a recent ORB hearing.

Decision and analysis

[79]  At issue are the images of various staff, some identifiable and some not, who appear with the complainant in the video footage. The images of staff who are not in close proximity to the complainant are no longer at issue because they form part of the background that I found above to be exempt under the “flow through” exemption in section 52(1)(f), with reference to section 49(a) and section 14(1)(k) of FIPPA.

[80]  As mentioned above, in PHIPA Decision 34, Adjudicator Higgins determined that a custodian seeking to rely on the exemption at section 52(1)(e)(i) of PHIPA must provide evidence demonstrating a risk of harm that is well beyond the merely possible or speculative. The custodian does not need to prove that providing access will in fact result in the harms contemplated by the exemption. The type and quantity of evidence required is dependent on the type of issue and seriousness of the potential consequences.

[81]  I have reviewed the custodian’s confidential and non-confidential submissions, which included the views of certain staff members. Having done so, I am not satisfied that section 52(1)(e)(i) applies to the records in the particular circumstances of this complaint.

[82]  The circumstances in this matter are much different from those in PHIPA Decision 34. In that matter, Adjudicator Higgins found that granting a patient access to notes created by medical professionals could reasonably be expected to result in serious harm to the treatment or recovery of the patient in question or risk of serious bodily harm to others. In making his decision, Adjudicator Higgins relied on a statement provided by the patient’s treating psychiatrist. The treating psychiatrist stated that the complainant in that matter “would likely misinterpret the records and potentially incorporate the content into his delusional beliefs ultimately affecting nursing staff, with the result of possible violence against the authors of the drafted notes.”

[83]  Adjudicator Higgins ultimately found that the custodian’s evidence, provided by an expert, demonstrated a risk of harm that is well beyond the merely possible or speculative.

[84]  I have also looked at a more recent matter in which this office found that the exemption in section 52(1)(e)(i) applied. In PHIPA Decision 100, Adjudicator Jaime Cardy found that granting a patient access to records containing his PHI from his former psychotherapist could reasonably be expected to result in a risk of serious harm to his treatment or recovery or a risk of bodily harm to the psychotherapist or her colleagues. In making her decision, Adjudicator Cardy took into consideration the custodian’s evidence of violent and threatening behaviour by the complainant, which included police involvement and resulted in the complainant being arrested and charged. Also considered was the complainant’s new therapist’s statement that granting the complainant access to any records related to his treatment by his former psychotherapist would be “highly triggering.” In PHIPA Decision 100, Adjudicator Cardy stated:

Based on the parties’ submissions, including the specific and compelling evidence provided by the custodian, I am satisfied that section 52(1)(e)(i) applies to the records at issue. There is ample evidence before me demonstrating the complainant’s history of threatening behaviour directed toward himself and others, including the custodian. This includes evidence of the complainant misinterpreting communications as threatening and an attack on his health, safety, and well-being. I am satisfied that the complainant has acted in harmful ways against himself and others as a result of communications relating to his past treatment with the custodian, and that there is a reasonable prospect that reviewing the records may result in similar harm.

[85]  In the matter before me, the complainant was the subject of a Code White incident, which resulted in him filing a patient abuse complaint. Based on the submissions of the parties, it appears that the complainant is aware of the circumstances of his restraint and placement in a seclusion room, including information about the individuals he filed a complaint against. I note that affidavit evidence provided by the hospital states that the “observations of [hospital] staff who were involved in the incident [are] documented in the [complainant’s] record of personal health information, to which he does have access.” Accordingly, it would appear in this matter that the complainant already has in his possession information identifying the very staff members that the hospital appears to suggest are most at risk of the harms contemplated under section 52(1)(e)(i).

[86]  This is quite different from the situations in PHIPA Decision 34 and 100. In PHIPA Decision 34, the complainant was not aware of the names of the individuals who collaborated with the authors responsible for preparing the requested notes. The adjudicator in PHIPA Decision 34 concluded that granting the patient access to information that would identify the authors, along with the content of the notes, could reasonably be expected to give rise to the harms in section 52(1)(e)(i). Similarly, in PHIPA Decision 100, the complainant was noted to “not know the full content of the records.” In that matter, the adjudicator concluded that releasing the complete treatment records to the complainant could reasonably be expected to result in a risk of serious harm to his treatment or recovery or a risk of bodily harm to the psychotherapist.

[87]  Having regard to the totality of the evidence presented and the circumstances of this matter, I find that there is insufficient evidence before me to establish that granting the complainant access to portions of the video which contain the images of staff members could reasonably be expected to result in a risk of serious harm to the “escorting staff” or any other staff members who appear in close proximity to the complainant. I am also not persuaded by the hospital’s submission that disclosure of the information remaining at issue could reasonably be expected to result in a risk of serious harm to the complainant or another patient.

[88]  I find that the hospital’s evidence falls short of demonstrating a risk of harm that is well beyond the merely possible or speculative. In my view, much of the hospital’s evidence, including its confidential submissions, speaks to the general concerns inherent in managing a patient population in a forensic facility. With respect to the specific security concerns identified in the hospital’s confidential submissions, I find that the incidents referenced by the hospital relate to the physical layout of the facility, which I already found qualifies for exemption under section 52(1)(f), as opposed to one of the harms set out in section 52(1)(e)(i). In addition, I find that the hospital adduced insufficient evidence to establish that disclosure could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the complainant.

[89]  Based on the above reasons, I find that there is insufficient evidence before me demonstrating that the exemption in section 52(1)(e)(i) applies to the remaining information at issue in this complaint. For similar reasons, I also find that the exemption under section 52(1)(f) with reference to sections 49(a) and 14(1)(e) (endanger the life or physical safety of [any person]) does not apply.

E.  Does section 52(2) give the complainant a right of access to portions of the records, despite the application of an exemption?

[90]  Even where a record contains information exempted by section 52(1) of PHIPA, section 52(2) may apply to give the individual a right of access to part of the record. This section states:

(2) Despite subsection (1), an individual has a right of access to that part of a record of personal health information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of clauses (1) (a) to (f).

[91]  Accordingly, I must consider whether the video recordings can be severed in a manner that provides the complainant with access to his PHI but not the information that I have found to be exempt under section 52(1)(f) of PHIPA, specifically the layout of the facility. The hospital submits that the records cannot reasonably be severed without disclosing information that could reasonably be expected to jeopardize the security of its facility. The hospital explains that:

The exempted information cannot be severed from the [complainant’s] PHI under section 52(2) of PHIPA, since it is imbedded in the images themselves.

Even if it were possible, [the hospital] does not have the tools or capability to sever (i.e. redact, blur or otherwise alter or manipulate the images) the exempted information from the Records.

[92]  In support of its position that it does not have technical capability to obscure the exempt information from the video recordings, the hospital provided this office with an affidavit prepared by its former privacy officer. The hospital’s privacy officer advises that she consulted with the hospital’s Information Technology Department who confirmed that the department does not have “the tools or capability to blur or otherwise redact information contained in the Records.” In addition, the hospital’s privacy officer advises that she received a similar response from the hospital’s video surveillance vendor who confirmed that it also does not have the editing software that would be required to obscure the exempt information from the records.

[93]  The complainant’s submissions did not specifically address the issue of whether his PHI to which he has access could reasonably be severed from the portions containing information qualifying for exemption.

Decision and analysis

[94]  I have reviewed the records and am not persuaded by the hospital’s submission. In making my decision, I note that the portions of the video recordings that contain the complainant’s PHI, which he is entitled to access under PHIPA, show him leaving his room and staff standing by in a corridor. The complainant can also be seen walking away from staff and, subsequently, being restrained by staff and moved into a seclusion room.

[95]  In my view, most of the video footage containing the complainant’s image can reasonably be severed by using obscuring technology to withhold the portions that are exempt under section 52(1)(f) while disclosing the portions of the videos containing images of the complainant, and the images of staff members that are included in his PHI. I note that previous decisions from this office have ordered institutions to use obscuring technology to sever exempt information from the portions of videos that contain identifiable images of the requester. [30]

[96]  Having regard to the above, I am satisfied that the hospital, or a third party provider if necessary, can use obscuring technology to obscure the background, which would reveal information relating to the facility’s physical layout or video surveillance system. I also am satisfied that the hospital can use editing software to sever and provide the portions of the record in which the complainant appears in the frame in a manner that is conducive to obscuring background images. In my view, the combination of shortening the frames in videos 2, 3, 4, and part 1 of video 5 to only those segments in which the complainant appears, along with obscuring the background in those videos, would provide the complainant with portions of the video which relate to him, while protecting the information qualifying for exemption under section 52(1)(f).

[97]  However, I find that the entire footage of the initial restraint of the complainant in part 2 of video 5 and the side view of him being transported to the seclusion room in video 1 cannot reasonably be severed in a manner that does not disclose the information I found qualifies for exemption under section 52(1)(f).

[98]  In arriving at my decision, I considered the hospital’s submission that it cannot reasonably sever the records because neither it nor its vendor currently owns the required technology or software to allow for the required severance and obscuring of portions of the records. However, the required redaction and obscuring technology is commonplace and is routinely used by police and other agencies throughout Ontario. The hospital has the option of retaining the services of a third party. I note that PHIPA contains provisions which allow health information custodians to charge a fee for the preparation of records containing PHI for disclosure. [31] If the hospital decides to charge the complainant a fee for access, it must first give him an estimate of the fee. [32] This office has the authority pursuant to Part VI of PHIPA to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery” within the meaning of PHIPA. [33] The hospital may also waive its fee. [34]

G.  Did the hospital properly exercise its discretion to withhold the records?

[99]  The discretionary exemptions at sections 49(a) and 14(1)(k), which are available to the hospital in relation to these records through section 52(1)(f) of PHIPA, permit an institution or custodian to disclose information, despite the fact that it could withhold it. The hospital must exercise its discretion. On appeal, I may determine whether the hospital failed to do so.

[100]  In PHIPA Decision 17, this office found that considerations which may be relevant to an institution’s exercise of discretion under FIPPA may also be applicable to an exercise of discretion under PHIPA. Accordingly, this office may find that the institution erred in exercising its discretion where, for example:

  • it does so in bad faith or for an improper purpose
  • it takes into account irrelevant considerations
  • it fails to take into account relevant considerations.

[101]  Through orders under FIPPA and MFIPPA, this office has developed a list of relevant considerations in determining whether an institution properly exercised its discretion, and this list has been adopted in a review of a health information custodian’s exercise of discretion under PHIPA.

[102]  If I determine that the hospital failed to exercise its discretion, or that it erred in exercising its discretion, I may send the matter back to it for a re-exercise of discretion. [35]

[103]  The hospital states:

[The hospital] maintains that it exercised its discretion in good faith in withholding Records, taking into account relevant facts and significant factors and not taking into consideration irrelevant considerations. It did not act in bad faith or for an improper purpose.

[104]  In support of its position, the hospital submits that it took into account:

  • the complainant’s right to access his own information along with whether he has a sympathetic and compelling need to receive the information and provided him with a narrative summary to address those issues. In addition, the hospital allowed the complainant’s lawyer to view the video recordings on-site;
  • the purpose of the law enforcement exemption and the sensitive nature of the information and its significance to the hospital; and
  • whether disclosure would increase public confidence in the hospital, but determined that it would not.

[105]  Though the complainant’s representations did not specifically address the issue of whether the hospital properly exercised its discretion, the complainant takes the position that the records should be disclosed to him on the basis that they contain his information.

[106]  Having regard to the submissions of the parties, I am satisfied that the hospital properly exercised its discretion under PHIPA to withhold the portions of the video recordings I found exempt. I am satisfied that in applying the exemptions, the hospital took into account relevant factors such as the purpose of the law enforcement exemption and the sensitive nature of the information. In my view, there is no evidence that the hospital took into account any irrelevant considerations or acted in bad faith.

[107]  Having considered the circumstances and evidence before me, I find that the hospital properly exercised its discretion in relying on section 52(1)(f) of PHIPA to withhold the portions of the records I have found exempt from disclosure. Accordingly, I uphold the hospital’s exercise of discretion.

ORDER:

  1. I order the hospital to provide the complainant with access to videos 2, 3, 4, and part 1 of video 5, obscuring the layout of the hospital corridors or rooms I found exempt under section 52(1)(f), in conjunction with section 14(1)(k) of FIPPA, as follows:
    • West corridor of the North Zone – 28:09 to 28:32 minutes (2nd video on disc);
    • Seclusion room/ Seclusion rooms corridor – 47 seconds to 4 minutes (3rd video on disc);
    • East corridor of the North Zone – 1:15 to 4:25 minutes (4th video on disc); and
    • North corridor of the North Zone/ South end of the north corridor of the north zone – 43 seconds to 1:11 minutes (part 1 of 5th video on disc).
  2. If the hospital decides to charge a fee for access, it is to give the complainant an estimate of the fee in accordance with section 54(10).
  3. For the purposes of order provisions 1 and 2, the date of this decision should be treated as the date of the access request.
  4. The timelines referred to in order provisions 2 and 3 may be extended if the hospital is unable to comply in light of the current COVID-19 situation. I remain seized of the complaint to address any request by the hospital relating to the timelines.

Original Signed by:

 

June 24, 2020

Jennifer James

 

 

Adjudicator

 

 

 



[1] The Ontario Review Board annually reviews the status of every person who has been found to be not criminally responsible or unfit to stand trial for criminal offences on account of a mental disorder.

[2] During mediation, the hospital provided this office with copies of letters the complainant’s lawyer sent to the hospital’s privacy officer. I have reviewed these letters and am satisfied that the complainant’s lawyer was given an opportunity to view the requested video footage onsite.

[3] See Section 18.03 of the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004.

[4] Municipal Freedom of Information and Protection of Privacy Act.

[5] PHIPA Decision 19.

[6] Section 2(1) of FIPPA (definition of “institution”).

[7] The term “health information custodian” is defined in section 2(1) of PHIPA as having the meaning set out in section 3. The term is defined in section 3(1)(4)(vii) as:

3 (1) In this Act,

“health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any:

vii.  A centre, program or service for community health or mental health whose primary purpose is the provision of health care.

[8] PHIPA Decisions 17, 27 and 30.

[9] For example, the hospital did not submit that the identifying information in the records relates primarily to one or more of its employees as contemplated by the PHI exception in section 4(4)(a).

[10] The “record-by-record” approach for dealing with requests for records of personal information is set out in Order M-352. This approach has been adopted by this office in reviewing records that may contain PHI in PHIPA Decisions 17, 27 and 30.

[11] These health care professionals include nurses, patient care assistants and development support workers.

[12] See paragraph 21 of PHIPA Decision 120 for the finding that images of hospital staff and police officers who interact with a patient during the hospital’s provision of health care to the patient constitute the patient’s PHI under section 4(1)(b) of PHIPA.

[13] Section 52(1) provides that an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless certain exemptions or conditions listed in paragraphs (a) to (f) apply.

[14] See also PHIPA Decisions 24, 30, 33, 53 and 73.

[15] PHIPA Decision 17, para 95.

[16] PHIPA Decision 17.

[17] PHIPA Decision 117; see also PHIPA Decision 120.

[18] Section 14(1)(e) states: A head may refuse to disclose a record where the disclosure could reasonably be expected to endanger the life or physical safety of a law enforcement officer or any other person.

[19] Section 14(1)(i) states: A head may refuse to disclose a record where the disclosure could reasonably be expected to endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required.

[20] Section 14(1)(j) states: A head may refuse to disclose a record where the disclosure could reasonably be expected to facilitate the escape from custody of a person who is under lawful detention;

[21] Section 14(1)(k) states: A head may refuse to disclose a record where the disclosure could reasonably be expected to jeopardize the security of a centre for lawful detention.

[22] Section 14(1)(l) states: A head may refuse to disclose a record where the disclosure could reasonably be expected to facilitate the commission of an unlawful act or hamper the control of crime.

[23] Ontario (Attorney General) v. Fineberg (1994), 19 O.R. (3d) 197 (Div. Ct.).

[24] Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31 (CanLII) at paras. 52-4.

[25] The hospital formally raised section 52(1)(e)(i) late in my review of this matter. Given my disposition of the issue, it is unnecessary to seek the complainant’s submissions as to whether he would be prejudiced by the late raising of section 52(1)(e)(i).

[26] Section 14(1)(e) states that a head may refuse to disclose a record where the disclosure could reasonably be expected to endanger the life or physical safety of a law enforcement officer or any other person. Section 20 states that a head may refuse to disclose a record where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual. Section 49(d) states that a head may refuse to disclose to the individual to whom the information relates personal information that is medical information where the disclosure could reasonably be expected to prejudice the mental or physical health of the individual.

[27] Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31 (CanLII) at paras. 52-4.

[28] PHIPA contains no personal privacy exemption analogous to that in section 49(b) of FIPPA.

[29] The hospital facilitated the notification of these five individuals by contacting them by telephone and/or mail and forwarding them copies of the Notice prepared by this office.

[30] See for example, Order PO-3905 and PHIPA Decisions 117 and 120.

[31] For a discussion of the fee provisions in PHIPA, see PHIPA Decisions 93, 111, 117 and 120.

[32] Section 54(10) states:

A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

[33] Section 54(11) states:

The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[34] Section 54(12) states:

A health information custodian mentioned in subsection (1) may waive the payment of all or any part of the fee that an individual is required to pay under that subsection if, in the custodian’s opinion, it is fair and equitable to do so.

[35] This office’s authority to review a custodian’s exercise of discretion under PHIPA was affirmed in PHIPA Decisions 17, 19 (upheld on reconsideration in PHIPA Decision 25) and 27.

 You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.