PHIPA DECISION 142

Appeal PA18-125

University Health Network

February 26, 2021

Summary: The appellant, on behalf of her brother, made an access request to UHN for a copy of security video footage relating to an incident involving her brother at a rehabilitation hospital. She did not seek the images of other patients or visitors. UHN issued a decision to release the footage, with images of all other patients, visitors, hospital staff and security personnel redacted. It also provided a fee estimate of $725. On appeal, the adjudicator makes findings on the appellant’s right of access pursuant to the Personal Health Information Protection Act and the Freedom of Information and Protection of Privacy Act . UHN is ordered to provide access to most of the information in the record, including images of staff and security personnel, and to issue a new fee estimate under PHIPA if it decides to charge a fee for access.

Statutes Considered: Personal Health Information Protection Act , 2004, S.O. 2004, c. 3, Sched. A, sections 3(1) , 4 , 8(4) , 52  and 54(10)  and (11) ; Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31, sections 2  (definition of “personal information”) and 47(1).

Orders and Decisions Considered: PHIPA Decisions 17, 117, 120 and 123, Order MO-2225.

BACKGROUND:

[1] This appeal concerns a request made to the University Health Network (UHN) for a copy of security video footage relating to an incident at a rehabilitation hospital (the hospital) that is part of UHN. The request was made by the appellant on behalf of a patient at the hospital. There is a dispute about what parts of the video footage the appellant is entitled to, and the correct fee for access to it. Related to both these issues is whether the access request should be treated as a request under the Personal Health Information Protection Act (PHIPA), the Freedom of Information and Protection of Privacy Act  (FIPPA ), or both.

[2] The appellant is the sister and power of attorney for personal care of a patient of the hospital who was involved in the incident. In her request, she provided an incident report number and asked for a copy of the video footage. [1]

[3] UHN confirmed receipt of the request and said that it was seeking outside assistance to convert and edit a copy of a security video. UHN required that the appellant pay the $5 request fee that is required for all requests made under FIPPA.

[4] UHN then issued a decision granting access to the video “for viewing purposes only.” UHN explained that

the video contains the personal information of other individuals, patients and staff, and dissemination of their images would constitute an invasion of personal privacy pursuant to section 21(1) of FIPPA. We will continue with our efforts to edit the video and a copy will be provided once that is done.

[5] A lawyer retained by the appellant wrote to UHN to raise some concerns about its response. The lawyer took the position that the video record responsive to the request contains the personal health information of the patient within the meaning of section 4 of PHIPA, and that the request ought therefore to have been treated as a request made under PHIPA and not a request under FIPPA. Given this, the lawyer asked that UHN return the $5 fee charged to the requester under FIPPA (PHIPA does not contain an equivalent request fee provision).

[6] The appellant’s lawyer agreed that any identifying information related to other patients and visitors should be severed from the record, and asked that UHN provide her clients with a copy of an edited video, severed to remove any information to which her clients do not have a right of access under PHIPA.

[7] After no further response from UHN, the appellant appealed its access decision to the IPC. [2] In this decision, I will refer to the patient as the “patient” and to his sister as the “appellant.” [3]

[8] During the mediation stage of the appeal process, UHN maintained its position that the video record does not contain the patient’s personal health information, because the hospital’s agents depicted in the record are security personnel, and the patient is not depicted receiving health care. On that basis, it continued to argue that FIPPA is the statute governing the appellant’s access rights.

[9] UHN also reported that it had found an outside party to sever information relating to other individuals appearing in the record. In a revised access and fee decision issued to the appellant’s lawyer, UHN stated:

I am pleased to advise that we have been able to secure the services of a digital editor who will be able to effectively blur the images of other individuals in the video. An invoice is attached for your review. The estimated cost for this work is $1125.00 plus HST. We will proceed with the project upon receipt of a deposit of 50% of the estimated amount …

With respect to your request for the return of your client’s application fee, we received the access request as submitted under FIPPA. Because the recording captures an exchange between your client’s brother and UHN agents we do not believe this constitutes his personal health information and feel it was appropriate to process under FIPPA. …

[10] The attached invoice from the third-party editor set out an estimate of 2.5 days to complete the work, at a rate of $450 per day ($225 per half day), for a total estimated cost of $1,125.

[11] UHN advised the mediator that the video footage consists of six video clips, recorded from two cameras. UHN also confirmed that two of the video clips do not contain images of the patient. The appellant’s lawyer confirmed that the appellant does not seek access to the two clips that do not contain the patient’s image.

[12] In light of the above, UHN issued a revised decision containing a new fee estimate of $725 for access to severed copies of the four video clips that contain images of the patient. UHN also told the mediator that this fee is composed solely of the cost estimate provided by the third-party editor for blurring services and that UHN did not itself charge any other fees for access to the record. UHN advised that it is unable to reduce the fee further because it does not know the actual cost at this time.

[13] The appellant’s lawyer continued to take issue with the fee estimate provided by UHN, as well as with the $5 request fee charged by UHN under FIPPA. She also maintained that the appellant has a right of access under PHIPA to the images of hospital staff and security personnel that are contained in the video record. She confirmed that the appellant does not seek access to the images of other patients and visitors, and that these can be redacted from the record.

[14] As no further mediation was possible, the appeal was moved to the adjudication stage. The adjudicator originally assigned to the appeal sought and received representations from UHN and the appellant’s lawyer. She also notified and invited representations from six hospital staff and security personnel who appear in the video clips. Three of these six affected parties responded to the notification, and one of them consented to the release of her information to the appellant.

[15] The appeal was then transferred to me. I decided to give all parties the opportunity to comment on three recent IPC decisions that address access and fee issues relating to hospital video footage: PHIPA Decisions 117, 120 and 123. Only the appellant’s counsel provided representations in response.

[16] In this decision, I order UHN to grant the appellant access to the video in its entirety, with the exception of the images of other patients and visitors, and staff tending to another patient. While UHN may charge a fee, under PHIPA, reflecting reasonable cost recovery, if it does so it must obtain a new fee estimate, taking into account the limited redactions required in accordance with my findings.

RECORDS:

[17] The record at issue is a video recording consisting of the following four video clips, each of which contains images of the patient and others:

• File 170706210000 (Camera 10), timeframe 21:00-21:10 (Clip 1)
• File 170706211000 (Camera 10), timeframe 21:10-21:20 (Clip 2)
• File 170706210400 (Camera 15), timeframe 21:04-21:14 (Clip 3)
• File 170706213400 (Camera 15), timeframe 21:34-21:40 (Clip 4)

ISSUES:

1. Does PHIPA, or FIPPA, or both, apply in these circumstances?
2. What information does the appellant have a right of access to under PHIPA?
1. Does the record contain the patient’s “personal health information” as defined in section 4 of PHIPA?
2. Is the record “dedicated primarily” to the patient’s personal health information within the meaning of section 52(3) of PHIPA?
3. Can the patient’s personal health information reasonably be severed from the record?
4. Do any of the exemptions from the right of access in section 52(1) of PHIPA apply?
3. Is the appellant entitled to the remaining portions of the record under FIPPA? Does the personal privacy exemption at section 49(b) of FIPPA apply to those portions?
4. What is the appropriate statute under which to assess the applicable fee for access? Should UHN’s fee estimate be upheld?

DISCUSSION:

Issue A: Does PHIPA, or FIPPA, or both, apply in these circumstances?

[18] There is no dispute that UHN is a body subject to PHIPA pursuant to section 3(1) of PHIPA, and an institution subject to FIPPA within the meaning of section 2(1) of FIPPA.

[19] As a result, in certain circumstances, UHN is subject to both PHIPA and FIPPA. This means that when it receives a request for access to information, it must decide whether PHIPA, or FIPPA, or both, apply to the request.

[20] In making this decision, UHN must consider the nature of the request (i.e., whether the request is for personal health information, for information that is not personal health information, or both); the contents of the record(s) responsive to the request (i.e., whether the responsive record(s) contain personal health information, or information that is not personal health information); and, in the case of a request for personal health information, whether the requester is a person authorized under PHIPA to exercise a right of access to that information. [4]

[21] In this case, as noted above, there is no dispute that the appellant is the patient’s substitute decision-maker and that her request was for access to hospital video footage in which the patient appears. In these circumstances, she may have a right of access to this record under PHIPA or FIPPA, or both. In particular, if the record contains the patient’s personal health information, the appellant has a right of access under PHIPA. Furthermore, under section 8(4) of PHIPA, whether or not the appellant has a right of access under PHIPA, she may have a right of access under FIPPA to other information in the record that is not personal health information. [5]

[22] In situations where both PHIPA and FIPPA could apply to the information sought, the approach of this office is to first consider the extent of any right of access under PHIPA, and then consider the extent of any right of access under FIPPA to any information for which a determination under PHIPA has not been made. [6]

Issue B: What information does the appellant have a right of access to under PHIPA?

a. Does the record contain the patient’s “personal health information” as defined in section 4 of PHIPA?

[23] It is not in dispute that the record contains images of the patient.

[24] In order to determine whether the appellant has a right of access to the record (or any portion of the record) under PHIPA, it is first necessary to determine whether the patient’s information in the record constitutes his “personal health information” within the meaning of PHIPA.

[25] “Personal health information” is defined in section 4 of PHIPA, in part, as follows:

(1) In this Act,

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(2) In this section,

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

(3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[26] In PHIPA Decision 17 and subsequent decisions, the IPC has adopted a broad interpretation of the phrase “personal health information.” [7]

Representations

[27] UHN notes that the video consists of four short clips shot from different angles, and that it contains the images of the patient, other patients and staff. It submits that the record does not contain the personal health information of the patient, nor does it form part of his patient file.

[28] The appellant’s lawyer submits that the patient was at the hospital to receive health care, and that therefore any information recorded about services provided by the hospital’s staff or agents is part of that record. She submits that this would include monitoring services by an agent such as a security guard. She submits that this information is no different than it would be if the incident were noted in a medical or health care chart. She argues, further, that decisions about her client’s care were made based on what transpired in the video. She argues that the security personnel and nurses were acting in a professional capacity and not in a personal capacity, and that patients are entitled to know who is providing care and services to them in the hospital.

[29] In her supplementary representations on Decisions 117, 120 and 123, she says that all three of these decisions state that security videotapes that capture images of a patient are personal health information and that their release is therefore governed by PHIPA. She notes that these decisions rejected the argument that the faces of staff members, including security guards, who were interacting with the patient and involved in the patient’s care, should be redacted. She again confirms that the appellant does not seek access to the images of other patients or visitors that may have been captured on the video.

Analysis and findings

[30] Based on my review of the video, I find that it is a record of personal health information of the patient within the meaning of section 4(1) of PHIPA. Among other things, the video reveals that he was a patient of the hospital, which, in my view, qualifies as identifying information about the patient that relates to the providing of health care to him, within the meaning section 4(1)(b) of PHIPA.

[31] Section 4(3) is also relevant to what constitutes the patient’s personal health information. That section states:

Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[32] I find, therefore, that the patient’s personal health information includes all footage containing his image. All of the footage containing his image identifies him as a patient of the hospital and therefore a person seeking health care, such that his images throughout the footage are his personal health information under section 4(1)(b). In any event, even if there were images that do not identify him as a person seeking health care, those images would be his personal health information by virtue of section 4(3).

[33] As noted above, the appellant does not seek access to the images of other patients or visitors. Therefore, I do not need to consider whether their images are included in the patient’s personal health information.

[34] The appellant does, however, seek access to the images of the two security guards and four nurses whose images are contained in the record.

[35] The question of whether images of hospital staff and security personnel are a patient’s personal health information was considered in PHIPA Decisions 120 and 123. In each of those decisions, the adjudicator found that the images of health care professional hospital staff, hospital security staff and other professionals interacting with a patient qualify as the patient’s personal health information under section 4(1)(b) of PHIPA. In PHIPA Decision 120, the adjudicator stated:

I include the images of health care professional hospital staff, hospital security staff and police officers who interact with the complainant in the video as identifying information about him that relates to the providing of health care to him. I do so because I am satisfied that these images in the video have some connection to the providing of health care to the complainant as required to fit within section 4(1)(b) of PHIPA. These images include health care professionals who are in physical contact with the complainant and those who appear to be observing or monitoring him because they are involved in providing health care to him. They also include hospital security staff and police officers who interact with the complainant during the hospital’s provision of health care to him.

[36] In PHIPA Decision 123, the adjudicator stated:

I find that all portions of the video capturing the complainant’s image with the images of other staff members, regardless of their role, constitutes the complainant’s [personal health information] as defined in paragraph (b) of section 4(1) of PHIPA. The definition of “health care” is broad and includes any observation, examination, assessment, care, service or procedure that is done for a health related purpose. Here, the complainant is a patient in a mental health facility who was the subject of a Code White incident. In the context of this complaint, the health care was provided to the complainant by various hospital staff, including security staff, who are observing, monitoring, transporting and restraining him during a Code White incident.

[37] In the video before me, the patient is depicted being monitored by and/or otherwise interacting with nurses and security guards. I agree with the PHIPA Decision 123 adjudicator that the definition of “health care” is broad and includes any observation, examination, assessment, care, service or procedure that is done for a health related purpose. In my view, the security personnel and nursing staff depicted in the video before me are shown observing or providing other services to the patient for a health-related purpose. Even if I were to accept UHN’s submission that some of the interactions did not have a health-related purpose, those images are identifying information about the patient and constitute his personal health information by virtue of section 4(3).

[38] Because the record contains the patient’s personal health information, PHIPA applies to the appellant’s access request. I will now consider the extent of her access rights under PHIPA.

b. Is the record “dedicated primarily” to the patient’s personal health information within the meaning of section 52(3) of PHIPA?

Can the patient’s personal health information reasonably be severed from the record?

[39] The extent of the appellant’s right of access under PHIPA depends on whether the record is “dedicated primarily” to the patient’s personal health information. While section 52(1) of PHIPA provides a right of access to a record of personal health information, section 52(3) limits access where the record is not dedicated primarily to the individual’s personal health information. Section 52(3) of PHIPA states:

Despite subsection (1) [setting out exemptions from the right of access in PHIPA], if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[40] PHIPA Decision 17 sets out an approach to the interpretation of section 52(3) that has been consistently applied in subsequent IPC decisions. [8] In order to determine whether a record is “dedicated primarily” to the personal health information of the individual within the meaning of section 52(3), the IPC takes into consideration various factors, including:

• the quantity of personal health information of the requester in the record;
• whether there is personal health information of individuals other than the requester in the record;
• the purpose of the personal health information in the record;
• the reason for creation of the record;
• whether the personal health information of the requester is central to the purpose for which the record exists; and
• whether the record would exist “but for” the personal health information of the requester in it.

This list is not exhaustive.

Representations

[41] UHN submits that the primary purpose of the video was the monitoring of the facility in order to ensure the safety and security of patients and staff. It submits that it does not collect personal health information through the video surveillance system.

[42] The appellant’s lawyer did not address this issue in her initial representations. In her supplementary representations on PHIPA Decisions 117, 120 and 123, she observes that in each of those decisions, the adjudicator determined that while the primary purpose of the video was not the collection of the individual’s personal health information, the portion that included the patient’s image was indeed their personal health information and was ordered to be released.

Analysis and findings

[43] I find that the record before me is not dedicated primarily to the patient’s personal health information. I accept UHN’s submission that the primary purpose of the record’s creation was the security objective of maintaining safety and security for patients and staff. While the patient’s personal health information appears throughout the record, in my view it is incidental to the security purpose of the footage. The video would have existed regardless of the patient’s appearance in the clips in question.

[44] Since the record is not dedicated primarily to the patient’s personal health information, section 53(1)2 provides that the appellant has a right of access only to the portion of the patient’s personal health information that can reasonably be severed from the record.

[45] I have reviewed the record and it is my view that the images of the patient and the six nursing and security personnel who interact with him can reasonably be severed from the remainder of record. This can be accomplished by using appropriate redaction technology to obscure the images of the other patients and visitors in the footage in which the patient appears.

[46] Next, I will consider whether there are any exemptions from the appellant’s right of access to the images of the patient and the staff members who interact with him.

c. Do any of the exemptions from the right of access in section 52(1) of PHIPA apply?

[47] Section 52(1) sets out a number of exemptions from a requester’s right of access under PHIPA. Examples include information that is subject to a legal privilege, [9] and information that could, if access is granted, reasonably be expected to result in a risk of serious bodily harm to an individual. [10] There is no personal privacy exemption in PHIPA.

Representations

[48] UHN was invited to make representations on the applicability of any exemptions from the right of access found in section 52(1) of PHIPA. UHN did not do so, maintaining its position that FIPPA is the appropriate statute under which to consider the appellant’s right of access. However, it provided some arguments on its reasons for not wanting to grant access to the video in its entirety.

[49] UHN says that there has been no attempt to conceal the names of staff involved in the incident with the patient. The appellant was given the opportunity to review the video and was provided with a copy of the incident report containing staff names.

[50] UHN says, however, that it does take exception to the distribution of the employees' images as seen in the video and it maintains that these images constitute the employees' personal information. It says that, while providing access to the video for viewing only constitutes a minor risk to the other patients' privacy (given that the patient’s family has likely seen these patients in their visits to the facility), it does not want the video distributed. UHN says that it will not provide a copy to the appellant without an appropriate level of redaction applied to the faces of both patients [11] and staff who appear in it. It says that its staff reported that the appellant indicated that she would be sharing the record on social media. It states:

Even if the [appellant] states today that the video will not be shared, [she] may change their mind tomorrow. UHN must consider the potential privacy risk to its patients and staff in making any access decision concerning the record.

[51] UHN further states:

UHN fears that staff may be subject to such activities as "doxxing" where individuals actively search for and obtain the personal information of individuals allegedly engaged in improper behaviours. This information is then posted online in an effort to embarrass or punish them. UHN has an obligation to ensure that any personal information concerning our employees and agents including their image, is used in a manner consistent with its collection and in a context that the employee would expect.

[52] The appellant’s counsel denies that the appellant intends to post the video on social media. She specifically denies any intent to use the video for the purpose of “doxxing,” which she understands to be publishing the video on the internet for the purpose of publicly embarrassing or punishing the individuals shown in it.

Analysis and findings

[53] With respect to UHN’s argument that the images of staff are their personal information, I note that PHIPA does not contain an exemption for the personal information of others that may be contained in the record of the requester’s personal health information. In any event, as I explain below under Issue C, these images of staff are not their personal information.

[54] UHN also argues that the appellant intends to share the video on social media and engage in “doxxing.” However, it has not explained how such a possibility establishes any of the exemptions from the appellant’s right of access to the video under PHIPA. In any case, the appellant’s counsel has specifically stated that the appellant does not intend to post the video on social media or engage in “doxxing.”

[55] I conclude, therefore, that the appellant has a right of access under PHIPA to all of the patient’s reasonably severable personal health information in the video. As I noted above, this includes his image as well as the images of the staff who interact with him.

[56] This does not end the matter, because the appellant seeks access to the videos in their entirety, [12] not just these portions. There are stretches in each video clip, some lengthy, in which the patient does not appear. As I noted at the outset, UHN is a health information custodian under PHIPA and is also an institution under FIPPA. Having decided the extent of the appellant’s right of access under PHIPA, which is limited to the patient’s personal health information, I will now address her right of access under FIPPA to these remaining portions of the video. [13]

Issue C: Is the appellant entitled to the remaining portions of the record under FIPPA? Does the personal privacy exemption at section 49(b) of FIPPA apply to them?

[57] Above, I found that the appellant has a right of access under PHIPA to the portions of the record containing the patient’s personal health information, including images of the hospital’s staff and security personnel. In this section, I consider the appellant’s right of access under FIPPA to the remainder of the record. I am satisfied that any personal health information in the record can reasonably be severed, thus preserving the appellant’s rights under FIPPA: see section 8(4) of PHIPA.

[58] In particular, apart from the patient’s personal health information, described above, there is some personal health information of another patient in the record. That personal health information includes the images of staff tending to him, for the same reasons mentioned above. This information appears in Clip 1 at approximately 21:03:32-21:04:18 and 21:09:47-21:10:02, and Clip 2 at approximately 21:10:00-21:10:12.

[59] I find that this information, along with the personal health information of the appellant’s brother, can reasonably be severed under PHIPA section 8(4). What remains at issue is the remainder of the record, which contains images of staff and security personnel but no images of the appellant’s brother.

[60] Section 47(1) of FIPPA [14] gives individuals a right of access to records containing their own personal information. [15] The appellant, therefore, has a right of access to the portions of the record remaining at issue. [16] This right of access is subject to a number of exemptions.

[61] UHN takes the position that the images of its staff and security personnel are their personal information, and that none of these people had any expectation that the video would be used for any purpose other than for internal security. As mentioned above, UHN submits that the appellant intends to post the video online.

[62] UHN’s submissions raise the possible application of the personal privacy exemption in section 49(b) of FIPPA, which states:

A head may refuse to disclose to the individual to whom the information relates personal information,

(b) where the disclosure would constitute an unjustified invasion of another individual’s personal privacy[.]

[63] In order for the section 49(b) exemption to apply to the images of staff and security personnel, those images must be their personal information.

[64] “Personal information” is defined in section 2(1) as follows:

“personal information” means recorded information about an identifiable individual, including,

[65] The definition contains a non-exhaustive list of examples of personal information. Information that does not fall under paragraphs (a) to (h) of the definition may still be personal information.

[66] However, to qualify as personal information, the information must be about the individual in a personal capacity. Information associated with an individual in a professional, official or business capacity is not generally considered to be “about” the individual, unless it reveals something of a personal nature about the individual. [17]

[67] The images of the hospital staff and security personnel depict them in a professional capacity, carrying out their professional duties in the hospital. Having reviewed the video and the parties’ representations, I conclude that there is nothing in these images that reveals anything of a personal nature about these individuals. I find, therefore, that their images are not their personal information.

[68] It follows that the section 49(b) personal privacy exemption cannot apply to the images of the hospital staff and security personnel. UHN did not raise any other exemptions from the appellant’s right of access under section 47(1), and I will order it to disclose this information to her.

Conclusion on the appellant’s right of access to the video

[69] I have considered the appellant’s right of access to the video first under PHIPA, then under FIPPA for the portions of the video that do not contain the patient’s personal health information. For the above reasons, I will order UHN to provide access to all of the video with the exception of the images of patients and visitors, and any staff and security tending to another patient. These portions are to be severed using appropriate redaction technology.

Issue D: What is the appropriate statute under which to assess the applicable fee for access? Should UHN’s fee estimate be upheld?

Representations

[70] UHN says that it does not have software capable of editing raw footage and that the cost of purchasing such software and training staff would exceed the estimated cost of preparing the video for disclosure.

[71] Because UHN is unable to prepare the record in-house, it must rely on a third party for editing, and is unable to produce a firm cost for the editing of the video. UHN says that it contacted organizations with similar systems and was able to find one that could prepare the video for disclosure on a cost-recovery basis.

[72] UHN submits that the fee should be assessed under FIPPA. It says that under section 57(1) of FIPPA, an institution may charge b) the costs of preparing the record for disclosure, c) computer and other costs incurred in locating, retrieving processing and copying a record and e) any other costs incurred in responding to a request for access to a record. An institution is able to charge these costs if they are specified in an invoice that the institution has received. [18] UHN notes that in Orders PO-3823 and PO-3855, the IPC found that invoiced video editing services qualify as allowable costs under section 57(1)(c) of FIPPA. [19]

[73] UHN also notes that under PHIPA, the IPC has determined that an institution may charge an amount for "reasonable cost recovery." UHN maintains that the estimated cost is reasonable in consideration of the fact that the final cost to produce the record is unknown.

[74] UHN says that to ensure that the images are properly redacted requires tedious work, on a frame-by-frame basis. It has obtained a quote for this service and believes that the estimated cost provided is reasonable for the work involved.

[75] The appellant submits that while the request in this case is being made pursuant to PHIPA, PHIPA Decisions 117, 120 and 123 all indicate that FIPPA would also apply to the video. She notes, further, that the IPC’s Guidelines for the Use of Video Surveillance dated October 2015 sets out the IPC’s expectations with respect to access under FIPPA and MFIPPA:

In addition, your video surveillance should include the ability to remove or redact information from the video footage to protect exempted information – for example, by using tools and techniques such as:

• digitizing analogue footage to enable the use of more powerful editing tools

• blacking out or blurring images of individuals, and

• removing the sound of voices.

[76] In the appellant’s submission, UHN is required to have the ability to obscure video to meet its obligations under FIPPA and MFIPPA, and by analogy under PHIPA. She argues that access to personal health information is a right and costs cannot be a barrier. She says that hospitals are not entitled to full cost recovery for releasing information to a patient that they are entitled by law to be able to access.

Analysis and finding

What statute governs the applicable fee?

[77] Because I have decided the appellant’s access rights predominantly under PHIPA, in my view it is appropriate to determine the appropriate fee under PHIPA, rather than FIPPA. While it is true that Decisions 120 and 123 all referenced FIPPA, in addition to PHIPA, in deciding the requesters’ access rights, the decisions determined the fees for access under PHIPA. For example, in PHIPA Decision 120, the adjudicator stated:

Because I have primarily applied PHIPA in this decision and have decided access to most of the requested information under it, I find it appropriate to refer to the fee and fee waiver provisions in PHIPA, rather than those in FIPPA, in order to determine the appropriate fee for access. [20]

[78] PHIPA Decision 17 established some criteria for determining which statute’s fee provisions to apply where access rights have been determined under both PHIPA and FIPPA. Assistant Commissioner Sherry Liang noted important differences between the fee provisions of each statute, and set out her approach for deciding which provisions to apply in any given case:

As described in detail above, PHIPA governs the right of access to most of the records at issue in this review, while FIPPA governs the right of access to some information in some of the PHIPA records and the non-PHIPA records. While both statutes contain provisions addressing fees for access and fee waiver, they differ in important ways.

First, the fee and fee waiver provisions in PHIPA are discretionary, while the analogous provisions in FIPPA are mandatory. Together, sections 54(10) and (11) of PHIPA confer a discretion on the hospital to charge an individual who requests access to records of her own personal health information a fee for access that cannot exceed the “prescribed amount,” if one exists, or the “amount of reasonable cost recovery.” Similarly, section 54(12) of PHIPA gives the hospital discretion to waive payment of all or any part of the fee if, in the hospital’s opinion, it is “fair and equitable to do so.”

By contrast, FIPPA requires the hospital to charge fees for requests made under FIPPA, including requests for access to an individual’s own personal information (section 57(1)). Regulations to FIPPA prescribe specific charges for tasks associated with fulfilling a request for access to one’s own personal information (section 6.1 of Regulation 460 to FIPPA). FIPPA also requires the hospital to waive fees, in whole or in part, if, in the hospital’s opinion, it is “fair and equitable to do so.” FIPPA and its regulations set out the matters for consideration in determining whether a fee waiver is required (section 57(4) of FIPPA; section 8 of Regulation 460).

…

In the circumstances of this review, I find it appropriate to apply the fee and fee waiver provisions in PHIPA to the complainant’s requests for access to information and for waiver of the fee. As I found above, nearly all the records at issue in this review are subject to PHIPA, with some of the PHIPA records also being subject to the complainant’s FIPPA request. In addition, a small number of the records are subject only to FIPPA. For the subset of records subject to both acts, or only to FIPPA, although access may be granted under PHIPA or FIPPA, or both, I find it an unnecessary exercise to allocate specific fees between the two statutes. This is because the vast majority of the total amount of information released to the complainant as a result of his request is the personal health information of his wife and daughter, with access being granted under PHIPA, with only a small amount being the complainant’s own personal information disclosed under FIPPA. This result is consistent with the understanding of his request, set out above, as a request primarily for the personal health information of his wife and daughter, made on their behalf, with only a discrete component being a request for his own personal information.

[79] I agree with the approach set out in PHIPA Decision 17, and will apply it here. In my view, the appropriate fee provisions to apply here are those set out in PHIPA. This is consistent with my understanding of the appellant’s request as a request primarily for the patient’s personal health information. It is true that, as I have noted above, there are long stretches of video footage that do not contain the patient’s personal health information. Access to these portions is being ordered under FIPPA. However, in my view, these access rights are secondary to the appellant’s main focus, which was to obtain access to the patient’s own personal health information – his image along with those of the staff interacting with him. Although I do not preclude the possibility of it being appropriate to allocate fees between the two statutes in some cases, in my view it would not be appropriate or practicable here, where there is only one record at issue.

Should UHN’s fee be upheld?

[80] UHN’s revised fee estimate is $725 for access to a severed copy of the four video clips that contain images of the appellant.

[81] Sections 54(10) and (11) of PHIPA provide as follows:

(10) A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1)(a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[82] Section 54(11) of PHIPA prohibits a health information custodian from charging a fee that exceeds “the prescribed amount” or the “amount of reasonable cost recovery.” Where there is no regulation prescribing the amount of the fee that may be charged for a particular activity, the IPC has the authority pursuant to Part VI of PHIPA to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery” within the meaning of PHIPA.

[83] “Reasonable cost recovery” is not defined in PHIPA. However, the IPC has previously considered the meaning of this phrase, [21] and has concluded it does not mean “actual cost recovery,” or full recovery of all the costs borne by a health information custodian in fulfilling a request for access to an individual’s own personal health information. [22] The use of the word “reasonable,” to describe cost recovery, suggests that costs should not be excessive, and that, as a whole, section 54(11) must be interpreted in a manner that avoids creating a financial barrier to the important purpose of PHIPA to grant a right of access to one’s own personal health information. [23]

[84] These past decisions have also concluded that a fee scheme set out in a proposed regulation to PHIPA, published by the Minister of Health and Long-Term Care in 2006 (the “2006 framework”), [24] though never adopted, provides the best framework for determining the amount of “reasonable cost recovery” under PHIPA. [25]

[85] The 2006 framework adopted in those decisions establishes a set fee of $30 that the custodian may charge to complete specifically defined work required to respond to a request, as well as fees that a custodian may charge over and above that set fee. The 2006 framework reads, in part, as follows:

Fees for access to records

25.1(1) For the purposes of subsection 54(11) of [PHIPA], the amount of the fee that may be charged to an individual shall not exceed $30 for any or all of the following:

1. Receipt and clarification, if necessary, of a request for a record.

2. Providing an estimate of the fee that will be payable under subsection 54(10) of [PHIPA] in connection with the request.

3. Locating and retrieving the record.

4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access may be refused.

5. Preparation of a response letter to the individual.

6. Preparation of the record for photocopying, printing or electronic transmission.

7. Photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages, excluding the printing of photographs from photographs stored in electronic form.

8. Packaging of the photocopied or printed copy of the record for shipping or faxing.

9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping or faxing the printed copy.

10. The cost of faxing a copy of the record to a fax number in Ontario or mailing a copy of the record by ordinary mail to an address in Canada.

11. Supervising the individual’s examination of the original record for not more than 15 minutes.

(2) In addition to the fee charged under subsection (1), fees for the services set out in Column 1 of Table 1 shall not, for the purposes of subsection 54(11) of [PHIPA], exceed the amounts set out opposite the service in Column 2 of the Table.

[86] Section 25.1(2) of the 2006 framework states that a custodian may charge fees over and above the set $30 in amounts set out in an attached table. Fees for severing video footage prior to granting access to it are not included in that table. However, in my view, it is reasonable to allow a health information custodian to claim costs, representing reasonable cost recovery, of the services of a third party for severing a record of personal health information for the purpose of granting access to the remainder. Recent decisions have come to the same conclusion. [26]

[87] The appellant relies on a 2015 guidance document of the IPC for the proposition that UHN should not have to outsource the necessary editing of the video. It is not entirely clear to me whether that is the thrust of the passage the appellant quotes. In any event, the IPC decisions referred to above have since confirmed that under PHIPA, such outsourcing is permissible, provided that the fee charged to the person requesting access is reasonable.

[88] Before charging the fee, UHN must first give the appellant a revised estimate of the fee, as required under section 54(10) of PHIPA. UHN’s submissions on its fee estimate of $725 were based on its assumption that all images of patients, visitors, staff and agents were to be obscured. I have found, however, that only the images of patients and visitors are to be obscured, along with two short sections depicting staff interacting with another patient. If UHN is unable to obscure the video itself, it may obtain a revised quote for the obscuring from a third party, which I anticipate will be lower than $725.

[89] In conclusion, UHN may charge the appellant an invoiced amount for the obscuring of the video if it must outsource this severing of the record, provided that the invoiced amount represents reasonable cost recovery, and provided it first gives the appellant an estimate of the fee, as required under section 54(10) of PHIPA. [27] It is open to the appellant to complain to the IPC about the new fee estimate for severing the video.

[90] I also draw the parties’ attention to section 54(12) of PHIPA, which permits UHN to waive the payment of all or any part of the fee if, in its opinion, it is fair and equitable to do so. It is open to the appellant to ask UHN to waive its fee, or for UHN to do so on its own initiative.

ORDER:

1. I order UHN to provide the appellant with access to the record at issue. A copy of the record in its entirety is to be provided to her, except that images of visitors and patients other than the appellant’s brother are to be obscured. Images of staff and security tending to another patient in the first two video clips are also to be obscured.
2. If UHN decides to charge a fee for access, it is to give the appellant an estimate of the fee in accordance with section 54(10).
3. For the purposes of order provisions 1 and 2, the date of this decision should be treated as the date of the access request.
4. The timelines referred to in order provision 3 may be extended if UHN is unable to comply with them in light of the current COVID-19 situation. I remain seized of the appeal to address any resulting extension request.

Original Signed by:		February 26, 2021
Gillian Shaw
Senior Adjudicator