PHIPA DECISION 148

Complaint HC17-13 and HC18-60

PHIPA Decision 144

The Ottawa Hospital

June 18, 2021

Summary: The complainant requested reconsideration of PHIPA Decision 144, on the basis that it contains errors of fact and jurisdictional defects. In this decision, the adjudicator partially upholds the request for reconsideration, finding that she omitted to fully address an allegation that a doctor disclosed the complainant’s personal health information to two other doctors, when it was not reasonably necessary for the provision of health care to the complainant. The adjudicator reviews this allegation and dismisses it.

Statutes Considered: Personal Health Information Protection Act, 2004,   S.O. 2004, c. 3,   section 30(2) .

Decisions Considered: PHIPA Decision 144.

Cases Considered: Chandler v. Alberta Association of Architects, [1989] 2 S.C.R. 848, at 861.

BACKGROUND:

[1] On April 20, 2021, I issued PHIPA 144, disposing of two complaints against the Ottawa Hospital under the Personal Health Information Protection Act, 2004  (PHIPA  or the Act ). By letter dated May 7, 2021, the complainant has requested that I reconsider that decision, alleging that it contains errors of fact and “jurisdictional excess”. For the reasons below, I allow the request for reconsideration, in part. I find that I did not address one allegation of unauthorized disclosure made by the complainant. However, in this decision, after reviewing the submissions on this issue and the circumstances before me, I dismiss the allegation.

GROUNDS FOR RECONSIDERATION:

[2] Section 27.01 of the Code of Procedure (the Code) applying to matters under the Act  sets out the grounds for reconsideration of a decision:

The IPC may reconsider a Decision, at the request of a person, who has an interest in the Decision or on the IPC’s own initiative, where it is established that:

a) there is a fundamental defect in the adjudication process;

b) there is some other jurisdictional defect in the Decision;

c) there is a clerical error, accidental error or omission or other similar error in the Decision; or,

d) new facts relating to an Order come to the IPC’s attention or there is a material change in circumstances relating to the Order.

[3] The IPC has stated that the reconsideration power is not intended to provide a forum for re-arguing or substantiating arguments made (or not made) during a review, nor is reconsideration intended to address a party’s disagreement with a decision or legal conclusion. [1] As Justice Sopinka commented in Chandler v. Alberta Association of Architects, “there is a sound policy basis for recognizing the finality of proceedings before administrative tribunals.” [2]

THE REQUEST FOR RECONSIDERATION:

[4] The complainant has not referred to the above sections of the Code although, as stated above, she contends the decision contains errors of fact and “jurisdictional excess”. She has made lengthy submissions expressing her disagreement with the findings in PHIPA Decision 144. She also states that I may accept her criticisms in keeping with section 66 (c) of the Act , under which the IPC may receive representations from the public concerning the operation of this Act . I will review each of the complainant’s arguments below, determining first whether a ground for reconsideration has been established. As will be explained, I find that there are sufficient grounds for reconsideration of one part of the decision.

Submission that the decision is wrong

[5] Most of the complainant’s submissions express her disagreement with the conclusions in PHIPA Decision 144. She states, among other things, that I did not perform my duty to enforce the Act  as it is written and according to legislative intent. She submits that I was wrong in not finding that a “technological barrier” preventing access to “lockboxed” electronic records was intended by the legislators. She states that “[a] definite technological barrier to access of consent directed electronic records is required by PHIPA .”

[6] She also submits that the evidence clearly indicates the EPIC system is the opposite of being a reasonable remedy and it contains compromises which do not bring it into compliance with the Act . The complainant asserts that I approved of its inadequacies resulting from its deliberate design to create a compromise with PHIPA  requirements instead of full compliance. She states that I ignored evidence that the EPIC system has not remedied the problem at the hospital.

[7] The complainant also submits that I interpreted her consent directive in one instance to mean something different than what was intended. She disagrees with my conclusion, stating that “I doubt that many legal minds would agree” with my findings “[h]ow desperate you appear to defend someone who had obviously, by her own record, knowingly violated my trust and the PHIPA .”

[8] The complainant also disagrees with my application of section 30(2) (the limitation principle), submitting that I “suggest that caregivers have unlimited scope to use a patient’s health records in providing them with care.” She states that she will always give her consent for health care providers to access the records which are necessary, adding “[t]hey will not have my consent to access records that are totally irrelevant to the health care and that is my right according to PHIPA .”

[9] Generally, the complainant submits that I have wrongly interpreted and applied the law.

[10] As indicated above, the power to reconsider a decision is not intended to provide a forum for re-arguing or substantiating arguments made (or not made) during a review, nor is reconsideration intended to address a party’s disagreement with a decision or legal conclusion. The finality of the IPC’s decisions would be undermined by a reconsideration process which provides parties with an opportunity to seek additional reasons or a different outcome, absent the exceptional circumstances set out in the Code. In adjudicating these complaints, I considered the issues the complainant raises above, and addressed them in my decision. While the complainant disagrees with my conclusions, her submissions do not establish any of the grounds justifying a reconsideration of that decision under section 27.01 of the Code.

Alleged errors of fact

[11] The complainant also asserts that I was incorrect in noting that her “first complaint” was filed in February 2017, stating that her original complaint was submitted to the IPC in December 2016.

[12] I find no error warranting correction or reconsideration. The reference in PHIPA Decision 144 to the “first complaint” addressed the earlier of the two complaints dealt with by that decision. It did not speak to any other complaints filed by the complainant.

[13] The complainant also asserts that it was an error to suggest that she accused health care providers of being “malicious.” This submission is also made in the complainant’s email of April 28, 2021. She is correct that I stated in PHIPA Decision 144 that she alleged that health care providers accessed her health information deliberately and maliciously. To clarify, the term “malice” has several meanings and, in the legal context, can apply to an act that is committed intentionally without just cause or excuse. [3] Throughout her submissions, the complainant described the actions of the hospital’s agents as deliberate and wilful violations of her privacy rights, done with the knowledge that their actions were wrong and with the belief that they would not be held to account.

[14] I acknowledge that the complainant did not use the term “malicious.” However, and with this clarification of its meaning, I find that my use of the term does not establish any of the grounds justifying a reconsideration of the decision under section 27.01 of the Code.

Assertion of “jurisdictional excess”

[15] The complainant objects to my reference to a decision of the Supreme Court of Canada, discussing the role of the Consent and Capacity Board. [4] She describes it as “insulting and irrelevant” and states that the “IPC ought to be ashamed to imply that an individual who wants to enjoy their PHIPA  privacy rights is foolish or making unwise health care choices.” She also describes it as “jurisdictional excess”, without explaining how it amounts to a “jurisdictional defect” within the meaning of the Code.

[16] In referring to that decision, I noted the potential for conflict between a caregiver’s perception of a patient’s best interests and the patient’s entitlement to make decisions about their own personal health information, pointing out the parallels between lock box rights under the Act and health care decision-making. I find that my reference to the Supreme Court’s decision does not establish any of the grounds justifying a reconsideration of the decision under section 27.01 of the Code and, in particular, does not amount to any jurisdictional defect.

Assertion of dishonesty

[17] The complainant asserts that I was “dishonest” in stating, at paragraph 158 of the decision, that I did not ask the hospital to address individual accesses shown in the audits. She states that I did just that in a letter to the hospital dated September 25, 2020 in which I asked for an explanation of references to “coaching” individuals to ask for consent.

[18] The complainant is correct that I asked the hospital about these references to “coaching”, shown in an audit report. However, I did not ask the hospital to explain the circumstances of the accesses by these individuals in order to determine whether or not they were authorized. Rather, I asked the hospital to explain, given its position that all accesses were in keeping with permissible uses under the Act , why “coaching” of individuals to ask for consent was necessary. The hospital did provide a response to my question and ultimately, I decided it was unnecessary for me to address this evidence in my decision.

[19] In any event, these submissions do not establish any of the grounds justifying a reconsideration of the decision under section 27.01 of the Code.

Section 20(2)

[20] The complainant submits that I omitted to include section 20(2), upon which she relied in withdrawing consent. She states that she quotes from that section in all her submissions, but that I chose only to reference section 19.

[21] I find that I did not omit to include section 20(2) in the decision. In fact, at the outset of the decision, I discuss the right of an individual to withdraw consent to the collection, use or disclosure of their personal health information, with reference to section 20(2):

[8] The term “lock box” is not defined in the Act . It is a term commonly used to describe the right of individuals to withhold or withdraw their consent to the collection, use or disclosure of their personal health information for health care purposes and to provide express instructions to custodians not to use or disclose their personal health information for health care purposes without consent. This right is delineated by sections 19 , 20(2) , 37(1) (a), 38(1) (a) and 50(1) (e) of the Act  . Notably, section 19  of the Act  states:

(1) If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect.

(2) If an individual places a condition on his or her consent to have a health information custodian collect, use or disclose personal health information about the individual, the condition is not effective to the extent that it purports to prohibit or restrict any recording of personal health information by a health information custodian that is required by law or by established standards of professional practice or institutional practice.

[9] The importance of a lock-box often arises in the context of the assumed implied consent (or “circle of care”) provisions of the Act . Adjudicator Ryu explained these provisions in PHIPA Decision 35 as follows:

[23] The term “circle of care” is not defined in the Act . It has been used to describe the provisions of the Act  that enable certain health information custodians to assume an individual’s implied consent. Section 20(2)  of the Act  specifies when implied consent may be assumed:

A health information custodian described in paragraph 1, 2, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), that receives personal health information about an individual from the individual, the individual’s substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the individual, is entitled to assume that it has the individual’s implied consent to collect, use or disclose the information for the purposes of providing health care or assisting in providing health care to the individual, unless the custodian that receives the information is aware that the individual has expressly withheld or withdrawn the consent.

[24] In order to rely on assumed implied consent to collect, use or disclose personal health information, therefore, the following conditions must be met:

• the health information custodian must fall within a particular category of health information custodians; and

• the health information custodian must receive the personal health information from the individual to whom the information relates, or that in dividual’s substitute decision-maker or another health information custodian; and

• the health information custodian must receive that information for the purpose of providing health care or assisting in the provision of health care to the individual; and

• the purpose of the health information custodian’s collection, use or disclosure of that information must be for the purposes of providing health care or assisting in providing health care to the individual; and

• in the context of a disclosure, the disclosure of personal health information by the health information custodian must be to another health information custodian; and

• the health information custodian that receives the information must not be aware that the individual to whom the personal health information relates has expressly withheld or withdrawn the consent.

[10] As the last bullet in the above list indicates, custodians can only rely upon assumed implied consent where the custodian is not aware that the individual has expressly withheld or withdrawn consent. [emphasis added]

[22] As shown in the above excerpt from PHIPA Decision 144, I addressed section 20(2)  of the Act  in discussing the meaning of lock-box rights. There is no basis to conclude that any of the grounds justifying reconsideration under section 27.01 of the Code are present in relation to this part of the complainant’s request.

Reasons for not issuing an order

[23] The complainant also submits that I did not provide reasons for not issuing an order, as required by section 61(4)  of the Act , which states:

If, after conducting a review under section 57 or 58, the Commissioner does not make an order under subsection (1), the Commissioner shall give the complainant, if any, and the person whose activities the Commissioner reviewed a notice that sets out the Commissioner’s reasons for not making an order.

[24] She asks, given my findings of violations of her privacy rights, why the hospital’s actions did not warrant sanction.

[25] I do not find this submission to establish a basis to reconsider PHIPA Decision 144. In the decision, I state:

I find that the hospital contravened the Act  when it failed to take reasonable steps to implement the complainant’s lock-box request, or her “consent directives”, on the use of her personal health information. As a result, hospital caregivers continued to use her PHI without authority, despite those restrictions. I find that the hospital has remedied the deficiencies in its procedures for implementation of consent directives.

[26] I also state:

Although I find that in some instances hospital caregivers accessed her information contrary to the lock-box request, those actions are more attributable to failures by the hospital to adequately inform its agents of the request and its impact, than a failure on the part of those caregivers.

[27] The above, in conjunction with the rest of the decision, provides my reasons for not making an order. There is no basis to conclude that any of the grounds justifying reconsideration under section 27.01 of the Code are present in relation to this part of the complainant’s request.

Summary

[28] With one exception, to be discussed below, I find there is no basis to conclude that any of the grounds justifying reconsideration under section 27.01  of the Act  are present.

Allegation of unauthorized disclosure

[29] The complainant asserts that I failed to address an allegation that a named doctor disclosed her health information to other caregivers, without authority. I find that as a result of an oversight, I did not address one aspect of the complainant’s allegations in this regard, specifically, as it relates to the application of section 30(2)  of the Act . This allegation was made in the course of the review but was accidentally omitted from PHIPA Decision 144. This was an error on my part within the meaning of section 27.01(c) of the Code.

[30] As background, in PHIPA Decision 144, I addressed the allegation that this doctor used and disclosed the complainant’s health information contrary to the complainant’s consent directive. I found that there was no consent directive in place on the date that this doctor dealt with the complainant’s health information. My finding with respect to this allegation, among others, is found at paragraph 67 of the decision:

[67] It follows from my finding above that between August 2013 and October 2016, there was no consent directive in place. This disposes of the allegations that agents of the hospital who were collecting, using or disclosing the complainant’s health information for the purpose of providing health care or assisting in providing health care to her during the period from August 2013 to October 2016, were not authorized to do so on the basis of assumed implied consent.

[31] In the decision, I also addressed the allegation that this doctor used more of the complainant’s health information than was reasonably necessary to the provision of health care by this doctor, when she reviewed the complainant’s mental health records. [5] In addressing the allegation concerning this doctor as well as others, I stated:

[76] The complainant submits that other hospital caregivers involved with her care did not use her mental health records, thus proving her contention that they were unnecessary to her care in these instances. In short, the complainant submits that no reasonable person would conclude that the provision of health care by these providers would require review of psychiatric records. The complainant submits that “necessary means necessary”, and these caregivers were snooping into her records.

[77] The hospital provided evidence from some of its agents explaining their rationale for reviewing the records at issue. One physician, a radiation oncologist, stated that a patient’s physical, psychological and emotional well-being are integral parts of a treatment plan, and that she would be negligent in her role as physician if she did not take all of these aspects into account. Another physician, involved in an assessment for osteoporosis, states that such an assessment includes a review of medication, and that some commonly used in psychiatry can cause bone loss. Thus, as an endocrinologist, she would look at psychiatric records in a patient’s EHR for such information.

[78] The rehabilitation consultant documents on a form that she reviewed the complainant’s records related to cancer treatment and psychiatric care, in arriving at an informed decision about her ability to participate in a structured rehabilitation program following her fracture.

[79] In general, the hospital states that when physicians and staff assess any new patient, they review previous dictations, consultations, imaging and pathology reports. The hospital refers to the World Health Organization’s definition of health as “a state of complete physical, mental, and social well-being and not merely the absence of disease or infirmity.” It states that to satisfy their professional obligations, its staff are required to review all relevant information for patients who are referred to them, and that a patient’s physical, psychological and emotional well-being are an integral part of a treatment plan.

[80] I find no violation of section 30(2) in the circumstances of this case. The requirement in section 30(2) is based on “reasonable” necessity, which is a more expansive concept than the complainant’s formulation of “necessary means necessary”.

[81] The agents who reviewed the complainant’s mental health records were involved in the provision of health care to her and were reviewing her medical history in preparation for consultations with her. I find convincing the explanations from the hospital about the health care rationale for review of the complainant’s medical history for the purpose of those consultations including, in some instances, her mental health records. The age of the mental health records does not point to indiscriminate browsing through irrelevant and outdated records, as the complainant suggests. None of these records was created more than four years before these events.

….

[83] Although the complainant asserts that mental health records can only be reasonably necessary to mental health care and not other medical care, there is no evidence to support this assertion. While the complainant strongly disagrees with the hospital’s submission that the uses of her mental records were “reasonably necessary” to provide health care to her, I find no persuasive evidence to support her allegation that these uses were unauthorized under section 30(2). Her views, vehement as they are, are not reasonably supported or convincing in the face of the hospital’s submissions on this point.

[84] In arriving at these findings I do not mean to suggest that caregivers have unlimited scope to use a patient’s health records in providing them with care. In this case, the complainant has made broad and unsupported assertions that what is reasonably necessary to provide health care is limited only to information about the specific medical issue which is the subject of a health care consultation, which I do not find to be reasonable or factually supported.

[32] However, in the above discussion, I did not address the complainant’s allegation that this same doctor, a radiation oncologist, disclosed her personal health information contrary to section 30(2). [6] This allegation arises out of a clinical note dictated by this doctor on the date of a consultation with the complainant. The note discusses the diagnosis which led to the consultation, the reason for referral, history of recent illness, past medical history and other history, the doctor’s observations of her physical examination of the complainant and her assessment. It includes references to a history of and medication for mental health conditions. The note indicates that it was sent to two doctors. One of the doctors is the physician who referred the complainant to the radiation oncologist. The other doctor is described by the hospital as the complainant’s “attending physician”, having seen her during nine of her visits to the hospital.

[33] The complainant submits that neither of the doctors to whom this information was disclosed required it to provide psychiatric health care to the complainant. She submits that the information disclosed to these doctors was not “reasonably necessary” for any health care they provided and was outside the expertise and license parameters of the radiation oncologist’s practice of medicine.

[34] In a letter sent by this doctor to the complainant, the doctor explained the rationale for her review of the complainant’s mental health records, stating, among other things:

When I assess any new patient in consultation, I do my best to incorporate all the relevant health records and this necessitates reviewing previous dictations, consultations, imaging and pathology reports. You may be aware of the WHO definition of health which states that “Health is a state of complete physical, mental and social well-being and not merely the absence of disease or infirmity.” I would be negligent in my duties were I not to review relevant information for patients who are referred to me and this does include notes from other health care practitioners including psychiatry. You were upset that I read these notes. As you are aware the diagnosis of breast cancer can be a very challenging and stressful situation for patients, hence previous psychiatric history is both relevant and important.

I would disagree with your statement that an individual’s mental state could not interfere with the effects of radiation treatment. In fact, a patient’s physical, psychological and emotional well-being are an integral part of the treatment plan. I would be negligent in my role as a physician if I did not take all of these aspects into account.

[35] I note that one of the doctors to whom the clinical note was sent may have been an agent of the hospital at this time, in which case sending the note to them may have been a “use” and not a “disclosure” of the complainant’s health information (see section 6  of the Act ). In any event, it is unnecessary to determine the precise status of these doctors in relation to the hospital. The requirements of section 30(2) apply to both uses and disclosures.

[36] For the same reasons I dismissed the complainant’s allegation that the use of the complainant’s mental health records was contrary to section 30(2), I also find that it was not a violation of section 30(2) for the radiation oncologist to send the clinical note containing information about the complainant’s history and treatment for mental health conditions to the two doctors.

[37] As I stated in PHIPA Decision 144, the requirement in section 30(2) is based on “reasonable” necessity, which is a more expansive concept than the complainant’s formulation of “necessary means necessary”. While the complainant asserts that only a doctor providing psychiatric care to her is justified in reviewing or being given information about her mental health history, she has provided no basis other than her opinion to support this. To the contrary, I find that the hospital’s evidence on this doctor’s use of this information establishes that it was “reasonably necessary” to the provision of health care to the complainant. That evidence also supports the disclosure of the information to other doctors providing care to her.

LATE SUBMISSION

[38] As I was preparing to issue this decision, I received a lengthy further submission from the complainant, dated June 14, 2021. Section 27.02 of the Code requires that the complainant’s request for reconsideration be made within 21 days of PHIPA Decision 144. Section 27.03 of the Code also states that a request for reconsideration must include all relevant information in support of the request, including the reasons for the request and the reasons why the request fits within the grounds listed in section 27.01 of the Code.

[39] PHIPA Decision 144 was issued on April 20, 2021. To the extent this submission raise new arguments in support of reconsideration, they are out of time. In any event, I have reviewed them and they do not affect my determinations on the reconsideration request.

CONCLUSION

For the foregoing reasons, I allow one aspect of the complainant’s request for reconsideration of PHIPA Decision 144 but, in reviewing the allegation which I omitted to address in the decision, I dismiss it.

Original Signed by:		June 18, 2021
Sherry Liang
Assistant Commissioner Tribunal Services