PHIPA DECISION 127

Complaint HA15-8-3

Unity Health Toronto

September 24, 2020

Summary: The complainant seeks access to his personal health information on the hospital’s electronic systems. The complainant sought a review of the hospital’s $900 fee representing programming costs to be paid to a third party to extract the requested information. In this decision, the adjudicator finds that the hospital’s fee is not in keeping with the reasonable cost recovery scheme contemplated by PHIPA. The hospital is ordered to issue a revised fee estimate as required by section 54(10) to the complainant if it seeks to recover any third party costs incurred to complete the request.

Statutes Considered: Personal Health Information Protection Act, 2004, sections 54(10), (11) and (12); Freedom of Information and Protection of Privacy Act, Regulation 460, section 6.1.

Decisions Considered: PHIPA Decisions 52, 117 and 120.

BACKGROUND:

[1]  The complaint relates to a previous request submitted by the complainant to Providence St. Joseph’s and St. Michael’s Hospital, now known as Unity Health Toronto (the custodian or hospital), under the Personal Health Information Protection Act (the Act), which resulted in the issuance of PHIPA Decision 52.

[2]  The original request was for access to all the underlying electronic data about the requester held by the hospital, in its native, industry-standard electronic format. PHIPA Decision 52 determined that the complainant was entitled to access data in the hospital’s electronic systems, devices or archives that could be extracted through custom software queries to the available reporting views identified by the hospital.

[3]  PHIPA Decision 52 ordered the hospital to issue or confirm its fee estimate in relation to the following systems:

• Carestream PACS
• SyngoWorkflow
• EPCare
• Muse
• Xcelera [1]

[4]  The hospital subsequently issued a fee estimate in the amount of $940 to the complainant for full access to the records. The hospital’s fee included a $10 charge representing its fee to provide the complainant with a CD containing the requested information and estimated a fee of $930 to extract the requested PHI, including executing custom queries.

[5]  The complainant filed a complaint with this office and a mediator was assigned. A mediated resolution was not reached and the matter was transferred to the adjudication stage of the complaint process.

[6]  As the adjudicator, I commenced a review and invited representations from the parties. [2] In addition, the hospital submitted reply representations in response to the complainant’s representations. In its reply representations, the hospital states that it could make the records available to the complainant through an encrypted file sharing program, rather than by CD. Accordingly, the portion of the hospital’s fee for the $10 CD is no longer at issue.

[7]  In this decision, I find that $900 of the hospital’s fee (beyond the initial $30 fee) does not represent “reasonable cost recovery” under PHIPA. The hospital is ordered to issue a revised fee estimate if it seeks to recover third party costs incurred to complete the request.

DISCUSSION:

Does the hospital’s estimated fee of $930 for access to the requested records exceed “reasonable cost recovery” as that term is used in PHIPA?

[8]  Sections 54(10) and (11) of PHIPA address fees that may be charged by a custodian for access to personal health information. Those sections read:

54(10) A health information custodian that makes a record of personal health information or a part of it available to an individual under [Part V of PHIPA] or provides a copy of it to an individual under clause (1)(a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

(11) the amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[9]  Section 54(11) of PHIPA prohibits a health information custodian from charging a fee that exceeds the “the prescribed amount” or the “amount of reasonable cost recovery.” Given the absence of a regulation prescribing the amount of the fee that may be charged, this office has the authority pursuant to Part VI of the Act to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery” within the meaning of the PHIPA.

[10]  The expression “amount of reasonable cost recovery” in section 54(11) is not defined in PHIPA. However, this office has previously considered the meaning of this phrase for the purposes of the fee provisions in PHIPA. [3] Applying the modern rule of statutory interpretation, this office concluded that the phrase “reasonable cost recovery” in PHIPA does not mean “actual cost recovery,” or full recovery of all the costs borne by a health information custodian in fulfilling a request for access to an individual’s own personal health information. [4] This office has also concluded that the use of the word “reasonable,” to describe cost recovery, suggests that costs should not be excessive, and that, as a whole, section 54(11) must be interpreted in a manner that avoids creating a financial barrier to the important purpose of PHIPA to grant a right of access to one’s own personal health information.

[11]  These past orders concluded that a fee scheme set out in a proposed regulation to PHIPA, published by the Minister of Health and Long-Term Care in 2006 (the “2006 framework”), [5] but never adopted, provides the best framework for determining the amount of “reasonable cost recovery” under PHIPA. I agree with the reasoning in Orders HO-009 and HO-014 as well as PHIPA Decision 17 [6] about the application of this framework, and apply it to my review of this matter.

[12]  However, I am mindful of Adjudicator Catherine Corban’s comments in PHIPA Decision 111 in which she stated:

Even accepting the 2006 framework as a guideline for calculating permissible fees under PHIPA, it does not provide a complete answer to all of the issues raised by this complaint. Moreover, in applying the guideline when calculating fees, the only principle that custodians are legislatively obliged to comply with is the requirement in section 54(11) of PHIPA that a fee not exceed the amount of “reasonable cost recovery.”

[13]  I agree with Adjudicator Corban that the 2006 framework may not provide a complete answer to all the issues raised in any given complaint. The complaint before me falls in this category, as I will explain below.

Relevant parts of the 2006 framework

[14]  The relevant parts of the 2006 framework in this complaint are:

Fees for access to records

25.1(1) For the purposes of subsection 54(11) of [PHIPA], the amount of the fee that may be charged to an individual shall not exceed $30 for any or all of the following:

1. Receipt and clarification, if necessary, of a request for a record.

2. Providing an estimate of the fee that will be payable under subsection 54(1) of [PHIPA] in connection with the request.

3. Locating and retrieving the record.

4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access may be refused.

5. Preparation of a response letter to the individual.

6. Preparation of the record for photocopying, printing or electronic transmission.

…

9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping or faxing the printed copy.

(2) In addition to the fee charged under subsection (1) fees for the services set out in Column 1 of Table 1 shall not, for the purposes of subsection 54(11) of [PHIPA], exceed the amounts set out opposite the service in Column 2 of the Table.

[15]  Section 25.1(2) of the 2006 framework indicates that the hospital may charge fees over and above the set $30 in the amounts set out in the Table 1. [7]

The breakdown of the hospital’s $930 fee estimate

[16]  The hospital provided the following breakdown explaining its $930 estimated fee, as follows:

• Administration fee: $30; and
• Executing the custom queries to extract the PHI requested:$900 (12 hours@ $75/h)

[17]  The hospital’s fee is based on the $30 fee set out in 25.1(1) of the 2006 framework. The complainant does not dispute this part of the hospital’s fee.

[18]  Section 25.1(2) of the 2006 framework allows the hospital to charge a fee over and above the set $30 in the amounts set out in the Table 1. However, the hospital’s fee estimate did not reference a table amount in its explanation of its $900 fee.

[19]  I have reviewed Table 1 and am satisfied that none of the set table amounts apply to the portion of the hospital’s fee representing the work to be done to execute custom queries to extract the responsive personal health information. The parties refer to this portion of the hospital’s fee in their representations as “programming costs.”

Representations of the parties

[20]  The hospital argued that its $900 fee is in keeping with “reasonable cost recovery” and stated:

… that the hourly rate of $75 to execute custom queries is based on an average contract rate - the Hospital does not have the internal capacity to create the queries. The estimated time includes time for formatting, the search efforts and the time required to create queries in the systems to extract all transactions based on encounters/medical record number. As noted previously, these hours are based on the assumption that the output will be in a readable format …

[21]  The complainant responded:

As noted in my representations on HA15-8-2, the programming should be unnecessary because the Regulations of the Medicine Act require the hospital's [electronic medical records] infrastructure to keep its [electronic records] in a "systematic manner", per [Ontario Regulation 114/94 and section 18(3)(b) of the Medicine Act], and to incorporate the capabilities of:

·  searching by name or by OHIP number; and,

·  promptly printing of the records retrieved.

[22]  In its reply representations, the hospital stated:

The complainant has expressed that the programming costs associated with the fee constitutes a barrier to access. As stated in our [representations] to the IPC, the estimated time includes time for formatting, the search efforts and the time required to create queries in the systems to extract all transactions based on encounters/medical record number. PHIPA specifically provides for "reasonable cost recovery" for access. This is a legitimate and very reasonable cost recovery; and we appreciate that reasonable cost recovery does not mean 100% cost recovery. As noted previously, to date, the complainant has not been charged for the access he has already received to any of the personal health information provided to him by the Hospital as part of his request.

[23]  The hospital also submits that this office already rejected the complainant’s argument that it failed to maintain its record-holdings in accordance with the Medicine Act in PHIPA Decision 52.

Is the hospital entitled to recover its $900 estimated fee for “programming”?

[24]  The complainant appears to take the position that had the hospital maintained its electronic record holdings in accordance with the requirements set out in the Medicine Act, programming costs would not be necessary to extract the requested information. In support of this argument, the complainant referred to sections 18(3)(a) and (b) of the regulation related to record keeping practices in the Medicine Act. These sections provide that patient records shall be kept in a “systematic manner” and in accordance with section 20 of the Medicine Act, which provides that the custodian’s electronic computer system must have certain features, including the ability to extract records by the patient’s name and Ontario health number, if available. Assistant Commissioner Sherry Liang considered the complainant’s submission in PHIPA Decision 52 and stated:

With respect to the requirements of the Medicine Act, and without determining whether the obligations under that statute apply to the hospital, if the complainant is suggesting that all raw data in the hospital’s electronic systems is subject to those requirements, I see no basis for that conclusion. Moreover, I see no basis for concluding that the search methods employed by the hospital were unable to produce results commensurate with what would be produced by searching a single patient record. I am satisfied that search methods used and/or proposed by the hospital are able to produce a complete holding of what I have determined to be records of personal health information for the purposes of the Act.

[25]  I agree and adopt the Assistant Commissioner’s reasoning in PHIPA Decision 52. I find that there is insufficient evidence before me to conclude that the raw data responsive to the complainant’s request is subject to the requirements of the Medicine Act.” [8]

[26]  Furthermore, I also accept the hospital’s evidence that it does not have the capacity to extract the responsive information from its record holdings without the help of a third party provider. I will now determine whether the hospital is entitled to recover third party costs to complete the complainant’s request.

Is the hospital entitled to recover reasonable third party costs?

[27]  The hospital did not reference any of the prescribed table amounts set out in section 25.1(2) of the 2006 framework to explain the $900 fee that went beyond the $30 set fee.

As noted above, though I accept the 2006 framework as a guideline, it does not always provide a complete answer to the issues raised in any given matter. In this case, the hospital issued its fee estimate following PHIPA Decision 52, in which the Assistant Commissioner a) found the complainant had a right of access to data about him that may be extracted through custom software queries against reporting views and b) this right of access is subject to the hospital’s right to reasonable cost recovery. In that decision, the Assistant Commissioner also noted the novelty of the request, stating that “the creation of custom queries in itself involves effort and expense for which there was no precedent for the hospital’s right to reasonable cost recovery.”

[28]  Despite the absence of any reference in the 2006 framework to “programming costs”, in the circumstances of this case, and given the findings in PHIPA Decision 52, I accept that the hospital is entitled to reasonable cost recovery for its efforts to provide access to the complainant’s records through the development and application of custom software queries. However, I find that the hospital’s evidence in support of its position that its $900 fee represents “reasonable cost recovery” falls short of the type of evidence required to support the reasonableness of the programming costs required to respond to the complainant’s request. In this case, the time required for a third party to create custom queries to extract the responsive information is estimated at 12 hours. Very little information was provided by the hospital to support why this amount of time was estimated to be required. In addition, the $75 hourly fee ascribed to the work to be done was said to be based on an “average contract rate,” but the hospital provided no other evidence supporting its contention that the $75 hourly fee is “average” or reasonable for the work to be completed.

[29]  I am not saying that in every case, a custodian must submit an invoice from a service provider for it succeed in its claim for third party costs under PHIPA. There is no requirement in PHIPA, unlike in FIPPA and MFIPPA, [9]  that such costs must be specified in an invoice. However, I find that information describing the exact nature of the work to be completed along with the estimated time the third party claims it will take to complete the work should accompany a custodian’s fee estimate. In the matter before me, there is no evidence suggesting that any third party provider contemplated the actual request and applied its professional judgement to the estimated fee requested from the complainant.

[30]  Given the deficiency in the hospital’s explanation of this portion of its fee, I find that its $900 fee is not in keeping with the principle of “reasonable cost recovery” for the purpose of the fee scheme under PHIPA.

[31]  However, having regard to the principle that health information custodians may charge requesters a fee [10] along with my finding that the custodian in this matter is entitled to reasonable cost recovery for the effort of creating custom queries in order to provide the complainant with the requested records, I have decided that the custodian may issue a revised fee estimate.

[32]  In conclusion, I uphold the hospital’s $30 set fee which was not contested by the complainant. If the hospital wishes to charge a fee for third party costs it anticipates it will incur to create the required queries to extract the requested information, it must issue a revised fee estimate to the complainant, as required under section 54(10) of PHIPA.

[33]  The revised fee estimate should describe the nature of the work the third party provider is to complete. In addition, the revised fee estimate should include information provided by the third party as to how long it estimates the work will take based on the specific request.

[34]  As mentioned above, “reasonable cost recovery” does not mean actual recovery of all the costs borne by the custodian. Accordingly, in this case the hospital may not be permitted under PHIPA to recover the full costs of completing the request, even if it submits an invoiced amount with its fee estimate. The fee charged or sought by a custodian must represent “reasonable” cost recovery and may be the subject of a complaint to this office. Accordingly, the complainant may file a complaint if he takes the position that the hospital’s revised fee estimate does not represent reasonable cost recovery.

[35]  Finally, section 54(12) of PHIPA, permits the hospital to waive the payment of all or any part of the fee if, in its opinion, it is fair and equitable to do so. Thus, the complainant may also submit a written fee waiver request to the hospital upon his receipt of its revised fee estimate.

ORDER:

1. I uphold the hospital’s $30 initial fee.
2. If the hospital decides to charge a fee for third party costs to complete the request, it is to issue a revised fee estimate in accordance with section 54(10).
3. For the purposes of order provision 2, the date of this decision should be treated as the date of the access request.
4. The timelines referenced in order provision 3 may be extended if the hospital is unable to comply in light of the current COVID-19 situation. I remain seized of the complaint to address any such request.

Original Signed by:		September 24, 2020
Jennifer James
Adjudicator