PHIPA DECISION 154

Complaint HC18-46

Sunnybrook Health Sciences Centre

July 27, 2021

Summary: The complainant, an employee of the hospital, complained about the hospital’s handling of information in her file in the hospital’s Occupational Health Services (OHS) department. The complainant’s OHS file contains identifying information about her, including medical documentation that she provided to address issues such as her capacity to work, entitlement to sick pay, and workplace accommodation needs. In this decision, the adjudicator finds that the complainant’s OHS file is maintained primarily for employment purposes, not for health care purposes, and is not a record of personal health information within the meaning of the Personal Health Information Protection Act, 2004  [section 4(4) ]. As a result, PHIPA does not apply to the hospital’s handling of information in the OHS file. She dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sch A, sections 2  (definition of “health care”), 4(1), 4(4), and 20(2); Occupational Health and Safety Act,  RSO 1990, c O.1, sections 63(2)  and (6) .

Decisions Considered: PHIPA Decision 15.

Cases Considered: Hooper v. College of Nurses of Ontario, 2006 CanLII 22656 (ON SCDC); Wyndowe v. Rousseau, 2008 FCA 39 (CanLII).

BACKGROUND:

[1] This decision concerns the exception to the definition of “personal health information” at section 4(4)  of the Personal Health Information Protection Act, 2004  (PHIPA ).

[2] An employee of Sunnybrook Health Sciences Centre (the hospital) filed a complaint with the Office of the Information and Privacy Commissioner/Ontario (the IPC) alleging that the hospital had violated PHIPA  in dealing with information in her file in the hospital’s Occupational Health Services (OHS) department. [1] Specifically, the complainant alleged that the hospital had not acted on her multiple requests to have a “lock box” implemented on her OHS file to prevent the hospital from sharing the file’s contents with other parties without her consent. She reported that the hospital had, in fact, shared this information in violation of her request. [2]

[3] There is no claim that the complainant is or was a patient of the hospital at the time of the events giving rise to this complaint.

[4] The hospital asserts that the complainant’s OHS file does not constitute a record of her “personal health information” within the meaning of PHIPA , and that, as a result, PHIPA  does not apply to her “lock box” request. However, the hospital observes that another statute, the Occupational Health and Safety Act , [3] applies to the OHS file, and effectively implements the restrictions that the complainant seeks to have placed on her OHS file through a lock box request under PHIPA .

[5] The complainant maintains that her OHS file is a record of her personal health information. In support, she cites a 2006 decision of the Ontario Divisional Court, Hooper v. College of Nurses of Ontario, [4] and particularly an extract from that decision containing the court’s finding that the OHS documents before the court in that case contained a hospital employee’s personal health information within the meaning of PHIPA .

[6] The complaint could not be resolved through mediation, and it moved to the adjudication stage of the complaint process. I conducted a review, beginning with the threshold issue of whether the complainant’s OHS file is a record of her “personal health information” within the meaning of PHIPA . If it is not personal health information, then the rights and obligations in PHIPA  (including the right to withdraw consent in relation to that information, and to complain to the IPC about a violation of that right) do not apply.

[7] In my request for representations on this issue, I provided guidance to the parties on the definition of personal health information and an exception to that definition in PHIPA , and on some relevant decisions issued after the release of the 2006 Hooper decision. Both parties provided representations. The complainant received and responded to the hospital’s representations. I did not find it necessary to share the complainant’s representations with the hospital. The complainant later indicated that she may wish to make additional submissions, but she did not do so despite follow-up from the IPC.

[8] In the discussion that follows, I find that the complainant’s OHS file contains identifying information about the complainant as an employee of the hospital, and is maintained primarily for employment purposes, not for health care purposes. This information falls squarely within the exception to the definition of personal health information at section 4(4)  of PHIPA , so is not personal health information. PHIPA  does not apply to the hospital’s handling of that information. I dismiss the complaint.

DISCUSSION:

[9] There is no dispute that the person who operates the hospital is a “health information custodian” of “personal health information,” as those terms are defined in PHIPA  (sections 3  and 4 ). This means, among other things, that the hospital must comply with PHIPA ’s rules concerning the collection, use, and disclosure of personal health information in its custody or control, and that an individual can withdraw her consent to certain uses and disclosures of her personal health information by the hospital.

[10] A threshold issue in this complaint is whether the information in the complainant’s OHS file qualifies as “personal health information” so that PHIPA  governs the hospital’s handling of that information. That term is defined in section 4  of PHIPA  as follows:

(1) In this Act,

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,

(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,

(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,

(f) is the individual’s health number, or

(g) identifies an individual’s substitute decision-maker.

(2) In this section,

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

(3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[11] As seen in PHIPA Decision 17 and later decisions, the IPC has adopted a broad interpretation of the phrase “personal health information.” [5]

[12] However, section 4(4) of PHIPA  sets out an exception to the definition of personal health information that is relevant in this complaint. Section 4(4) states:

(4) Personal health information does not include identifying information contained in a record that is in the custody or under the control of a health information custodian if,

(a) the identifying information contained in the record relates primarily to one or more employees or other agents of the custodian; and

(b) the record is maintained primarily for a purpose other than the provision of health care or assistance in providing health care to the employees or other agents.

[13] The parties agree that the OHS file is in the custody and control of the hospital, and that it contains identifying information about the complainant.

[14] For the reasons that follow, I find that the exception at section 4(4) applies to this information.

The identifying information in the OHS file relates primarily to the complainant as an employee of the hospital

[15] There is no dispute that the complainant was an employee of the hospital. There is no claim that the complainant is or was a patient of the hospital.

[16] The IPC did not obtain a copy of the complainant’s OHS file, but at my request, the hospital provided a description of the types of documents that are contained in the file. These are:

• Medical documentation that was prepared by the complainant’s own health care provider, which the complainant provided to the OHS department [6] in person or by email for the following purposes:
• to substantiate an absence from work;
• to substantiate whether the complainant was capable and safe to return to or be at work;
• to substantiate whether the complainant should be entitled to sick pay; and
• to describe what kind of workplace accommodation the complainant may require in relation to a disability. (The hospital specifies that the workplace accommodation is not health care.)
• Immunization information about the complainant. (The hospital explains that having certain immunizations up to date is a health and safety matter for working in a hospital.)

[17] The hospital observes that these types of documents may generally be found in a hospital employee’s OHS file. An OHS file for an employee would also include any applicable Workplace Safety and Insurance Board claim information for the employee. (The hospital specifies that the complainant’s OHS file does not contain this type of information.)

[18] Based on the description of its contents, I am satisfied that the complainant’s OHS file contains identifying information relating primarily to the complainant in her capacity as an employee of the hospital. There is no evidence to suggest that identifying information in the file relates primarily to anyone who is not an employee or other agent of the hospital.

[19] I will next consider the purposes for which the hospital maintains the OHS file.

The complainant’s OHS file is maintained primarily for a purpose other than the provision of health care or assistance in providing health care

[20] The hospital asserts that the complainant’s OHS file is maintained primarily for employment purposes, and not for health care purposes, so is not personal health information subject to PHIPA . The hospital states, however, that the confidentiality of the complainant’s information is protected under the Occupational Health and Safety Act , which governs the compilation, use and disclosure of information in the OHS file. The hospital refers to sections 63(2) and (6) of that statute, which state:

(2) No employer shall seek to gain access, except by an order of the court or other tribunal or in order to comply with another statute, to a health record concerning a worker without the worker’s written consent.

(6) This section prevails despite anything to the contrary in the Personal Health Information Protection Act, 2004 .

[21] In the hospital’s submission, these sections of the Occupational Health and Safety Act  effectively implement the restrictions that the complainant seeks to have placed on her OHS file by means of PHIPA . In any case, the hospital says, the complainant has no right under PHIPA  to impose restrictions on her OHS file that would undermine the proper use of that file in accordance with the Occupational Health and Safety Act .

[22] The complainant disagrees. She repeatedly describes the documents in her OHS file as her “healthcare documents,” including because, she says, they relate directly to her physical or mental health and to the providing of health care to her, referring to the definition of personal health information at paragraphs (a) and (b) of section 4(1).

[23] In further support of her position, she reports that the hospital provided her OHS file to an outside IME (independent medical examination) physician to conduct an IME to assess her fitness to return to work. She characterizes such an assessment as a health care assessment. The complainant makes certain allegations about the hospital’s motives in providing the IME physician with her OHS file before that examination, which I will not address here because they are not relevant to the issue of whether PHIPA  applies to this information. However, I have considered her submissions to the extent they advance an argument that the primary purpose of maintaining the OHS file is a health care purpose.

[24] Section 2  of PHIPA  defines “health care” to mean:

… any observation, examination, assessment, care, service or procedure that is done for a health‑related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

(c) is carried out or provided as part of palliative are,

and includes

(d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and

(e) a community service that is described in subsection 2 (3) of the Home Care and Community Services Act, 1994 and provided by a service provider within the meaning of that Act[.]

[25] The complainant asserts that the IME qualifies as “health care” because the hospital directed the IME physician to assess her and to make any applicable diagnosis, and to assess the health impact of her workplace concerns, without which assessment she could be re-injured on her return to work. In making these assertions, she refers to sections (a) and (b) of the definition of health care. She also submits that the IME assessment of her fitness to return to work is an assessment made for health-related purposes, referring to the opening words of the definition.

[26] I do not agree that the IME qualifies as “health care” within the meaning of PHIPA . Although it is an examination, it was not done for a health-related purpose, but rather for the employment-related purpose of assessing the complainant’s state of health to assist the hospital in making any necessary accommodations for her return to work. This employment-related purpose is set out explicitly in correspondence from the hospital’s OHS department to the complainant (which the complainant provided to me as part of her representations), in which the hospital explains its reasons for requesting that she undergo an IME. There is no evidence to suggest that the IME instead (or additionally) served a health-related purpose (such as improving the complainant’s health condition) independent of the hospital’s stated purpose and interest as an employer in determining its employee’s workplace accommodation needs. For instance, I have no reason to believe that the hospital would have requested an IME had the complainant not been an employee of the hospital.

[27] My finding that the IME does not qualify as “health care” does not, in itself, preclude the possibility that the complainant’s OHS file is or was maintained for a health care purpose. However, besides her argument that the hospital provided her OHS file to the IME physician in advance of the IME, the complainant provides little evidence to support her position.

[28] I understand the complainant’s inclination to describe the documents in her OHS file as health care documents, in that they include medical documentation from her own health care providers. These documents are likely to include detailed health information about the complainant. However, the relevant question under section 4(4)(b) is the hospital’s primary purpose in maintaining the OHS file. I find no basis to conclude that the primary purpose is to provide health care or to assist in providing health care to the complainant (or to any other employee or agent of the hospital). There is no evidence that the complainant is or was a patient of the hospital, and that the OHS file is relevant to her treatment as patient.

[29] By contrast, I find persuasive the hospital’s explanation of the uses to which it put the information in the complainant’s OHS file. As described above, the OHS file contains medical documentation about the complainant that is relevant to managing workplace issues such as an absence from work, capacity to work, entitlement to sick pay, and workplace accommodation needs. It also contains information about her immunization status because this is relevant to her ability to work in the hospital. All these are matters in which the hospital has an interest as the complainant’s employer, and concern the complainant in her role as an employee. I am satisfied that the hospital’s purpose in maintaining this information in the OHS file is to address employment-related matters such as the rights and duties of the parties arising out of their relationship as employer and employee.

[30] Because I find the OHS file is maintained primarily for a purpose other than the provision of health care or assistance in providing health care, the second part of the section 4(4) exception is met. I therefore find that the OHS file is not a record of personal health information within the meaning of PHIPA .

[31] In making this finding, I acknowledge that the Ontario Divisional Court made an opposite finding about an OHS file in 2006. In Hooper v. College of Nurses of Ontario, cited above, the court considered the exception at section 4(4), but in those circumstances concluded that information contained in the OHS file of a hospital employee constituted that employee’s “personal health information” within the meaning of PHIPA . The court found in that case that the file was not primarily an employment file, and that a number of the documents in the file were created for a health-related purpose. [7] The court also found that the hospital’s Occupational Health and Safety department, which maintained the file, was providing “health care” to the employee within the meaning of section 2  of PHIPA ; [8] specifically, the court held that the department’s assessment of the employee’s fitness to return to work safely was an assessment made for a health-related purpose. The complainant cited Hooper in challenging the hospital’s position in this complaint.

[32] Since the Divisional Court issued its decision in Hooper in 2006, the IPC has had occasion to consider the meaning of the term “health care” as it appears in PHIPA . Of relevance to this complaint, the IPC has declined to follow Hooper as it relates to the interpretation of “health care” for the purposes of PHIPA .

[33] In PHIPA Decision 15, the IPC considered whether a psychologist retained to conduct a custody and access assessment within the meaning of the Children’s Law Reform Act was a “health information custodian” as defined in PHIPA  in relation to this activity. This required consideration of whether the psychologist was providing “health care” as that term is defined in section 2  of PHIPA , as the definition of health information custodian applicable in those circumstances required, among other things, that the psychologist be providing “health care.”

[34] In PHIPA Decision 15, the adjudicator noted that “health care,” as defined in section 2  of PHIPA , must be for a “health-related purpose.” She decided that the service provided by the psychologist in that case was not provided for a health-related purpose, but rather for the purpose of assisting in the development of a parenting plan in the best interests of the child; as a result, she found that the psychologist was not a health information custodian when providing a service in this capacity, and PHIPA  was therefore inapplicable in the circumstances. The adjudicator found support for this interpretation of PHIPA  in a previous decision of this office (Complaint HC-050014-1), public guidance provided by the Ministry of Health, a decision of the Federal Court of Appeal, and the policy behind subsection 20(2)  of PHIPA . [9]

[35] In Complaint HC-050014-1, decided in 2006 after the release of the court’s decision in Hooper, the IPC concluded that disability management services provided by a nurse working in the employee assistance unit of a municipality was not “health care” within the meaning of PHIPA . In that case, the IPC found that the services were provided for the purpose of assisting in the development and implementation of employee return-to-work plans rather than for health-related purposes, and that, as a result, neither the nurse nor the municipality could be said to be providing “health care” in that capacity.

[36] More recently, the IPC has applied this interpretative approach in decisions finding that the provision of co-parenting counselling services (to manage parenting issues) [10] and services to coordinate individuals’ access to third-party programs [11] do not qualify as “health care” within the meaning of PHIPA .

[37] The IPC’s approach is consistent with the Ministry of Health’s own interpretation of “health care.” In its public guidance on PHIPA , the ministry cites a “nurse advising employer with respect to back to work requirements for an injured employee” as an example of a health professional who is not providing “health care” within the meaning of PHIPA . [12] It is also consistent with the Federal Court of Appeal’s statement that PHIPA  does not apply to doctors performing IMEs. [13]

[38] As the adjudicator observed in PHIPA Decision 15, the interpretation of “health care” applied by the IPC is also consistent with the policy behind section 20(2)  of PHIPA , which permits certain health information custodians to assume an individual’s implied consent to collect, use and disclose his or her personal health information for the purpose of providing health care, unless the individual has expressly withheld or withdrawn consent. [14]

[39] As described in the Guide to the Ontario Personal Health Information Protection Act, [15] the policy behind section 20(2) is to facilitate collections, uses and disclosures of personal health information in the health care system that individuals generally expect to occur without requiring express consent. A very broad interpretation of “health care” could expand the scope of personal health information that may be collected, used or disclosed without express consent beyond what is contemplated by this policy. In PHIPA Decision 15, for example, the adjudicator observed that interpreting “health care” to include the preparation of a custody and access assessment report would permit health information custodians to disclose personal health information to the report’s author, and permit the author to disclose the report to other health information custodians, in accordance with section 20(2) on the basis of assumed implied consent. The adjudicator held that it would not be reasonable to assume an individual’s implied consent to such activities.

[40] For similar reasons, in the context of this complaint, I find it unreasonable to interpret “health care” in the overly broad manner proposed by the complainant. One of the consequences of such an interpretation would be that information about a custodian’s employees, maintained by the custodian for employment-related purposes, could be collected, used, and disclosed in accordance with section 20(2) on the basis of the employees’ assumed implied consent. In my view, such an outcome is not in keeping with the reasonable expectations of employees, or with the purposes of PHIPA . The fact that the employer in this case is a hospital (whose handling of health information in other circumstances may be subject to PHIPA ) is irrelevant.

[41] I find support in the Ministry of Health’s own guidance on the application of the exception at section 4(4). The ministry notes that, generally, personal health information does not include identifying information held by health information custodians as employers. The ministry cites as an example information contained in the hospital human resources file of a nurse employed by the hospital, for purposes such as accommodating a disability, providing sick leave, or monitoring employee performance. This type of information is not personal health information of the nurse. (By contrast, if the employee nurse were treated as a patient in the hospital, information in the medical file would be considered personal health information.) [16]

[42] The Guide to the Ontario Personal Health Information Protection Act [17] provides further examples of information that is excepted from the definition of personal health information, and helpful elaboration on the rationale for this approach:

For instance, records that a health information custodian holds about the disability accommodation needs of an employee would fall outside the definition of personal health information. Although relating to the health of the employee, such records are specifically excluded from the definition of personal health information for the purposes of PHIPA . Likewise, generally, records concerning a custodian’s employee’s Workplace Safety and Insurance Board claim or concerning an occupational illness from which a custodian’s employee suffers are not considered records of personal health information when held by the custodian in its role as employer [footnote reference to provisions of the Occupational Health and Safety Act  omitted]. The rationale for this approach seems clear. It is appropriate to regulate health information custodians, as employers, in the same manner as other employers with respect to the privacy of their employees’ personal health information. As [PHIPA] does not focus on the regulation of the collection, use, and disclosure of employee health information by employers generally [footnote reference to another chapter of the Guide omitted], health information custodians are not regulated differently in this regard by [PHIPA ] ... .

[43] The authors observe that similar exceptions are found in Ontario’s public sector privacy and access legislation (referring to sections 65(6) of the Freedom of Information and Protection of Privacy Act and section 52(3) of the Municipal Freedom of Information and Protection of Privacy Act).

[44] I agree with the analogy proposed by the Guide’s authors to the provisions of public sector legislation that exclude from the operation of those statutes certain records when they are held by public sector bodies in their role as employers. The text of section 4(4) and the above-noted guidance indicate that the purpose of the exception is to remove from the scope of PHIPA  identifying information of employees and other agents when it is held by health information custodians in their capacity as employers, for employment-related purposes and not for health care purposes.

[45] For these reasons, like the adjudicator in PHIPA Decision 15, I decline to adopt the Divisional Court’s interpretation of “health care” in Hooper in deciding on the application of section 4(4) to the facts before me. [18] I am satisfied that a narrower interpretation of that term better accords with the text of section 4(4) and PHIPA  more broadly, and with the scheme of the statute, its purposes, and the intention of the Legislature.

[46] For all these reasons, I find the complainant’s OHS file is not a record of personal health information within the meaning of PHIPA . PHIPA  does not apply in the circumstances. I dismiss the complaint.

NO ORDER:

For the foregoing reasons, I dismiss the complaint and issue no order.

Original signed by		July 27, 2021
Jenny Ryu
Adjudicator