PHIPA DECISION 159

Complaints HA18-00191, HA18-00192 and HA18-00193

Public Health Ontario

September 17, 2021

Summary: The complainant made three access requests to Public Health Ontario (PHO) for information relating to her and her two minor children in respect of laboratory testing for Lyme disease, including the names of staff members who accessed her and her children’s electronic health record. After clarifying the request, PHO issued a decision granting partial access to responsive records, withholding the staff names citing privacy concerns, but not claiming any exemptions under the Personal Health Information Protection Act (PHIPA). During the mediation of the complaint, PHO claimed the application of the discretionary exemption in section 20 (threat to health and safety) of the Freedom of Information and Protection of Privacy Act  (FIPPA ) through the flow-through provision in sections 52(1) (f)(i) and (ii)(A) of PHIPA. Also during mediation, the complainant raised the issue of search, believing that other records relating to her and her children exist.

During the review of the complaint, PHO further raised the application of sections 18(1)(c) and (d) (economic and other interests) of FIPPA, through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA.

In this decision, the adjudicator finds that PHO is a health information custodian, and the records at issue qualify as the personal health information of the complainant and her children. She further finds that each record is dedicated primarily to the personal health information of the patient that the audit report relates to.

She goes on to find that the information at issue is not exempt from the right of access in section 52(1) under sections 18(1)(c), 18(1)(d) or 20 of FIPPA through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA. Lastly, she upholds PHO’s search for records responsive to the request.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3 , (PHIPA ) sections 3, 4, 52(1), 52(1)(f)(i) and (ii)(A), 52(3) 53, and 54; O. Reg Regulation 329/04 of PHIPA , section 3(3) . Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, (FIPPA ) sections 18(1)(c), 18(1)(d), 20 and 49(a); R.R.O. 1990 Regulation 460 of FIPPA, section 1(1).

Decisions Considered: Orders PO-1940, PO-2917, PO-3972; PHIPA Decisions 17, 34, 53, 90 and 152.

BACKGROUND:

[1] This decision deals with the issues raised as a result of three complaints made to the Information and Privacy Commissioner/Ontario (the IPC) under the Personal Health Information Protection Act (PHIPA). A parent made three access requests to Public Health Ontario (PHO) for information relating to herself and her two minor children in respect of laboratory testing for Lyme disease. The requests, made under the Freedom of Information and Protection of Privacy Act  (FIPPA ), were for:

all records, both in hard copy and electronic versions, relating to her and her children; a list of all staff who were or had been involved in her circle of care; a list of all staff who corresponded with any staff involved in her circle of care; and a list of all staff or non-staff who accessed any part of her record.

[2] The requester specified that all records included hard copy records, email correspondence, film, electronic records, hand written notes, presentations, voicemail messages, memos, sound recordings, DVDs and CDs.

[3] In response, PHO addressed all three requests by way of one decision letter, under PHIPA , advising the requester of the following:

. . . Pursuant to section 24(1) of O. Reg. 329/04 under the Personal Health Information Protection Act . . . PHO does not provide individuals with access to laboratory results generated in connection with tests requested by health care providers.

Public Health Ontario Laboratory testing pertains to a variety of important and complex diseases that, in our view, require the guidance of healthcare providers to interpret in the context of their patient’s clinical signs and symptoms to make patient management decisions. As a result, we encourage you to obtain the requested laboratory test results directly from the healthcare provider involved in your and your children’s circle of care. . .

[4] The requester then contacted PHO to clarify her request. PHO subsequently issued a supplementary decision stating the following, in part:

PHO responded to your request on [date specified]. Subsequently, you clarified your request and indicated that you would like PHO to provide:

1. A list of staff who have accessed your electronic health record;

2. Emails and all other communications between, to, from or among staff at PHO; and

3. Details of the excluded records and the reasons for its exclusion, if applicable.

In response to your request, we searched PHO’s laboratory information system and are able to provide you with three pages of responsive records (one page per person). The records describe the date on which your health records were accessed. These records were accessed by PHO staff for the purposes of conducting laboratory services. Please note, to protect the privacy of patients, identifying information about individuals is not transmitted by email at PHO.

To protect the privacy of our employees, names of individual staff members have not been disclosed.

[5] After receiving the above decision, the requester (now the complainant) filed three complaints with the IPC. [1]

[6] During the mediation of the complaints, the complainant clarified that her issues relate to obtaining the names of the staff members who accessed her and her children’s records of personal health information, as well as any emails and/or correspondence about her and her children. In response, PHO wrote to this office, confirming its position and stated the following in relation to the withheld information:

. . . PHO searched the laboratory information system and provided the requester with responsive records. To protect the privacy of PHO employees, names of individual staff members were not disclosed. The records indicate the operational role of the PHO staff who accessed the record. In this request the exemption was applied as follows: The request was sent as a broader request under the Freedom of Information and

Protection Act (FIPPA). Following a preliminary search and discussion with the requester, the request as clarified was a request for personal health information (PHIPA). PHO applied PHIPA  s. 52(1) (f) supported by FIPPA s. 20. PHO does not disclose the names of individual staff members where there are health and safety concerns.

[7] In a further email to the mediator, PHO also confirmed there were no specific health and safety concerns in relation to the complainant, but rather that it is their practice not to release staff names. PHO also stated its concern that:

. . . if front-line staff are contacted directly, or are targeted for any communication or legal action, staffing this area may be at risk. Like other public health laboratories, PHO has experienced repeated communications and complaints from disgruntled patients of health care practitioners regarding Lyme and other testing methodology, process, and results. PHO has a formal process to address these concerns and does not want front-line laboratory staff to be contacted. PHO has indicated that they are committed to continue to provide high quality Lyme testing, and supporting their employees is an important part of ensuring the ongoing delivery.

[8] The complainant was not satisfied with PHO’s response and continues to seek access to the names of staff who accessed her and her children’s electronic health records. The complainant also believes further responsive records exist, namely emails and all other communications between, to, from or among staff at PHO about her and her children. As a result, the reasonableness of PHO’s search for records was added as an issue in the complaint.

[9] The complaints then moved to the adjudication stage of the complaints process, where an adjudicator may conduct a review. I decided to conduct a review and sought, and received representations from PHO and the complainant, as well as reply representations from PHO. I then sought sur-reply representations from the complainant but did not receive any. Representations were shared amongst the parties. In its representations, PHO raised the application of the discretionary exemptions in sections 18(1)(c) and (d) of FIPPA, through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA .

[10] In her representations, the complainant had a number of questions for PHO that were not included in her request or referred to in mediation. In its reply representations, PHO provided answers to the questions. Those questions and answers are the following:

• The length of time each time a staff member accessed her records. PHO advised that it does not maintain records regarding the length of time of individual access; and
• The operating hours of the relevant laboratories. PHO provided the hours of operation of its laboratories.

[11] Also in its reply representations, PHO advised that it had located further records, which consisted of emails and more detailed audit records. According to PHO, it located some emails that were not responsive to the request, but that it is willing to provide to the complainant, and was not claiming any exemptions with regards to these emails. In addition, PHO advised that it had upgraded its electronic database, had expanded the time period of the search for responsive records and, as a result, was willing to provide updated versions of the records that PHO previously provided to the complainant. With respect to all of these records, PHO should provide them to the complainant, if it has not done so already.

[12] During the review of these complaints, IPC staff contacted PHO to seek the names and contact information of the staff members who accessed the complainant’s and her children’s electronic health records. PHO provided the contact information for the staff members’ union representative. I then notified the union of the review and provided them with the opportunity to provide representations on the possible application of section 20 of FIPPA through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA . I did not receive representations from the union.

[13] For the reasons that follow, I find that PHO is a health information custodian, and that the records at issue qualify as the personal health information of the complainant and her children. I also find that each of the three records is “dedicated primarily” to the personal health information of the individual to whom the audit report relates, within the meaning of section 52(3). I also find that the information at issue is not exempt from the right of access under sections 18(1)(c), 18(1)(d) and 20 of FIPPA through the flow-through provision in sections 52(1)(f)(i) and (ii)(A) of PHIPA . Finally, I uphold PHO’s search for records.

RECORDS:

[14] By way of background, I think it is helpful to describe the records that were released to the complainant, including the updated versions. These records are audit reports that were generated by PHO in response to the complainant’s access request. In its reply representations, PHO advised that it had updated the system from which these audit reports were generated, and that PHO is willing to provide these updated records to the complainant. There are four headings of these records as follows:

• Label ID (ID number);
• Audit Timestamp (which includes the date);
• Operations Role of the applicable staff member (but not their name); and
• Reason for Accessing the Record.

[15] None of these audit reports include the names of the staff members who accessed the electronic health records; the staff are only referred to by their role. The complainant’s access request included the names of the PHO staff who accessed the complainant’s and her children’s electronic records at PHO, which is the information at issue in these complaints.

[16] As seen below under Issue C, PHO appears to takes the position that the “record” here is its LIMS database. I disagree. In my view, the records at issue here are the audit reports, with staff names, that the PHO can generate from LIMS. Those are the records that the complainant asked for, and so they are the records at issue here.

[17] In addition, the complainant believes that further records exist, namely emails and all other communications between, to, from or among staff at PHO about her and her children.

ISSUES:

1. Is PHO a “health information custodian” within the meaning of PHIPA ?
2. Are the audit reports “records of “peronal health information” as defined in section 4  of PHIPA ?
3. Are the audit reports “dedicated primarily” to personal health information of the patient within the meaning of section 52(3)  of PHIPA ?
4. Do any of the exemptions at section 52(1)  of PHIPA  apply to the staff members’ names?
5. Did PHO conduct a reasonable search for records?

DISCUSSION:

Background

[18] PHO provided background information about its mandate and functions. PHO, otherwise known as The Ontario Agency for Health Protection and Promotion, was created under the Ontario Agency for Health Protection and Promotion Act, 2007 (OAHPPA). The purpose of the OAHPPA is to enhance the protection and promotion of the health of Ontarians, as well as to contribute to efforts to reduce health inequities through the establishment of an agency. This agency provides scientific and technical advice and support to those working across sectors and also carries out and supports activities such as population health assessments, public health research, surveillance, epidemiology, planning and evaluation.

[19] Under section 6(g) of the OAHPPA, one of the objects of PHO is to establish, operate and maintain laboratory centres and to provide laboratory services. The PHO laboratory receives specimens and accompanying test requisitions from external laboratories. Once Lyme disease tests are completed, the test results are stored in its Laboratory Information Management System (LIMS), which is an electronic database, and automatically sent to the health care provider who requested the tests.

Preliminary Issues

[20] There is no dispute in this complaint that the complainant is entitled to request access to her children’s personal health information under section 23  of PHIPA . In addition, I note that although PHO raised the application of the exclusion in section 24 of O.Reg. 329/04 to certain records at the request stage, it did not raise it for the remaining records at issue.

Issue A: Is PHO a “health information custodian” within the meaning of PHIPA?

[21] A preliminary issue in this complaint is whether PHO is a “health information custodian” in relation to the records at issue.

[22] Section 3(1)  of PHIPA  defines “health information custodian.” It states, in part:

“health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any:

8. Any other person prescribed as a health information custodian if the person has custody or control of personal health information as a result of or in connection with performing prescribed powers, duties or work or any prescribed class of such persons.

[23] Section 3(3) of Regulation 329/04 under PHIPA  states:

The Ontario Agency for Health Protection and Promotion,

(a) is prescribed as a health information custodian;

(b) is prescribed as a single health information custodian with respect to all of its functions; and

(c) shall be deemed to be included in the list of types of custodians referred to in subsections 20(2) and (3) and clause 38(1)(a) of the Act.

Representations

[24] PHO submits that it is a health information custodian, relying on section 3(3) of Regulation 329/04 under PHIPA .

[25] The complainant’s representations do not explicitly address this issue, although she implies that she believes PHO is a health information custodian in that she makes representations on other sections of PHIPA , which apply only to health information custodians.

Analysis and findings

[26] Based on the definition of a “health information custodian” in section 3(1)  of PHIPA , as well as the specific reference in section 3(3) of Regulation 329/04 under PHIPA  defining PHO as a health information custodian, I find that PHO qualifies as a health information custodian within the meaning of PHIPA .

Issue B: Are the audit reports containing staff names “records of personal health information” as defined in section 4 of PHIPA?

[27] Section 52  of PHIPA  provides that an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian, subject to certain exemptions.

[28] Therefore, it is necessary to decide whether the audit reports containing the names of staff are records of personal health information of the patient. If they are, then the requester has a right of access to the records in their entirety under section 52(1) (subject to a finding that the records are not dedicated primarily to personal health information, or to the application of any exemptions, both concepts that I address below).

[29] “Personal health information” is defined in section 4  of PHIPA  , in part, as follows:

(1) In [PHIPA ],

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(2) In this section,

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

(3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[30] In PHIPA Decision 17, this office adopted a broad interpretation of the phrase “personal health information” (see particularly paragraphs 65-68). This office has applied this broad interpretation in subsequent decisions and orders (among others, see PHIPA Decisions 52 and 82, and Order MO-3531).

Representations

[31] PHO submits that information about all laboratory tests performed by the PHO laboratory is managed and stored in the LIMS electronic database. For each specimen received for testing, PHO will generate a unique ID, and this specimen ID is associated with the information contained on the test requisition, and may vary depending on the information included in the requisition by the ordering health care provider. Information stored in the LIMS is organized by specimen ID and not by any unique patient identifier. However, custom queries may be run to extract information from the LIMS in response to a specific request.

[32] In response to the complainant’s access request, PHO submits that it developed a custom query to extract information from the LIMS. The responsive information was converted into a pdf audit report and provided to the complainant, with the names of the staff members who accessed the specimen information withheld. It is these staff names that are at issue. In its reply representations, PHO indicated that it has been preparing upgrades to the LIMS database and has identified additional functionality in the system viewing logs. Information from the new log has been added to the information previously provided and will be provided to the complainant. These updated audit logs include the unique ID number, the audit timestamp, the operations roles of the applicable staff member (not their name) and the reason for accessing the record.

[33] PHO further submits that it does not interact directly with patients in communicating test results and that the names of the relevant PHO staff are not reported to the ordering health care provider, as this information is not relevant for the interpretation of any laboratory tests and is not recorded for the provision of health care.

[34] In addition, PHO submits that the names of its relevant staff members are included in the LIMS for two process-related purposes, namely, quality assurance and to comply with PHO’s obligations for laboratory accreditation. [2] It goes on to argue that because the names of PHO staff are recorded for quality assurance and laboratory accreditation purposes only, they are not recorded for the provision of health care and do not identify a person as a provider of health care to the complainant.

[35] For all these reasons, PHO argues, the names of PHO staff who accessed the electronic medical records of the complainant and her children are not personal health information within the meaning of section 4  of PHIPA .

[36] The complainant submits that if the unique ID number is associated with the information contained on the test requisition, this information would include the patient’s name, health card number and other information on the requisition. She further submits that the names of the PHO staff members qualifies as her personal health information because they form part of the electronic records that include the unique ID number associated with blood samples, and the test results of these blood samples.

Analysis and findings

[37] The issue to be determined is whether the records at PHO qualify as “records of personal health information” of the complainant and her children. As previously stated, this office has broadly interpreted the meaning of what qualifies as “personal health information.”

[38] In considering the records at issue, I apply the “record-by-record” method of analysis adopted by this office. [3] Under this method, the unit of analysis is the whole record, rather than individual paragraphs, sentences or words contained in a record. In addition, where the information at issue is the withheld portion of a record that has been partially released, the whole of the record (including released portions) is analyzed in determining a requester’s right to access the withheld information. As noted in PHIPA Decision 17, the presence of any personal health information in a record makes it a record of personal health information under PHIPA .

[39] Applying the “record-by-record” method of analysis to the records at issue in this review, I find that they contain the personal health information of the complainant and her children. Each of the audit reports, therefore, is a record of personal health information relating to the patient in question.

[40] I find that the records qualify as their personal health information under section 4(1) (b) of PHIPA , which relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual. In my view, the testing and analysis of their blood specimens was an assessment or procedure carried out by PHO staff for the purpose of assisting in the resulting diagnosis of whether or not they had Lyme disease. In making this finding, I am guided by the definition of “health care” in PHIPA , which is a broadly defined term in section 2 that includes any observation, examination, assessment, care, service or procedure that is done for a health related purpose and that:

1. is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,
2. is carried out or provided to prevent disease or injury or to promote health[.]

[41] Since each record contains personal health information, they are records of personal health information under PHIPA .

Issue C: Are the audit records containing staff members’ names “dedicated primarily” to the personal health information of the patient within the meaning of section 52(3) of PHIPA?

[42] The extent of an individual’s right of access under PHIPA  depends on whether the record of his or her personal health information is “dedicated primarily” to that information.

[43] This is because, subject to any applicable exemptions, the right of access in PHIPA  applies either to the whole record, or only to certain portions of it. Specifically, while section 52(1)  of PHIPA  grants a right of access to the entire record, section 52(3) limits access where the record is not “dedicated primarily” to the individual’s personal health information. Section 52(3)  of PHIPA  states:

Despite subsection (1) [setting out exemptions from the right of access in PHIPA ], if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[44] PHIPA Decision 17 set out the IPC’s approach to the interpretation of section 52(3) (see paragraphs 85-115). In order to determine whether a record is “dedicated primarily” to the personal health information of the individual within the meaning of section 52(3), this office takes into consideration various factors, including:

• the quantity of personal health information of the requester in the record,
• whether there is personal health information of individuals other than the requester and/or her children in the record,
• the purpose of the personal health information in the record,
• the reason for creation of the record,
• whether the personal health information of the requester and/or her children is central to the purpose for which the record exists, and
• whether the record would exist “but for” the personal health information of the requester and/or her children in it.

[45] This list is not exhaustive.

Representations

[46] PHO submits that its LIMS is not a record that is dedicated primarily to the personal health information of the complainant and her children. It goes on to argue that the LIMS pools the complainant’s laboratory test results and analyses with the results of every other patient and that, consequently, the complainant’s information is not central to the purpose for which the LIMS exists.

[47] PHO further notes that under section 52(3)  of PHIPA , in the case where a record is not primarily dedicated to the personal information about the complainant, the complainant has a right of access to the personal health information that can be reasonably severed from the LIMS. PHO goes on to state:

While it is possible to extract the names of staff who accessed the specimen information of the complainant and her children from the LIMS using a custom query, such information is maintained for process-related purposes and is not of a nature or quality that requires PHO to sever such information from the LIMS in response to a request for personal health information.

[48] Lastly, PHO submits that the staff names are not reported to the ordering health care provider, as this information is not relevant for the interpretation of any laboratory tests, and reiterates that the staff names are included in the LIMS for the purposes of quality assurance and to comply with its obligations for laboratory accreditation.

[49] The complainant’s representations do not address this issue.

Analysis and findings

[50] As I noted above, there are three records at issue, consisting of an audit report, with staff names, relating to each of the complainant and her two children. I find that each of the records is “dedicated primarily” to the personal health information of the patient in question. As previously stated, in PHIPA Decision 17, former Assistant Commissioner Sherry Liang considered the difference between records that are and are not primarily dedicated to personal heath information about an individual. She explained the importance of this distinction as follows:

The distinction is important because if a record is dedicated primarily to the personal health information of the individual, the individual has a right of access to the entire record, even if it incidentally contains information about other matters or other parties. If a record is not dedicated primarily to the personal health information of the individual, the right of access only applies to the information about the individual that can reasonably be severed from the record. [4] [emphasis added]

[51] With respect to determining the limit on an individual’s right of access, former Assistant Commissioner Liang stated:

The determination of whether a record is or is not dedicated primarily to personal health information about an individual is therefore an important first step in defining the individual’s right of access in PHIPA . [5]

[52] In my view, the records are dedicated primarily to the personal health information of the complainant and her children. In particular, I find that there is a substantial amount of their personal health information in each of the records, and the records do not contain the personal health information of other individuals. The purpose of the information in the records is to capture the bloodwork and testing that was conducted on the specimen samples and the reason for the creation of the audits was in response to specific requests made by the complainant. I further find that the personal health information of the complainant and her children is central to the purpose for which these records exist. For these reasons, therefore, I find that the records are “dedicated primarily” to the personal health information of the complainant and her children.

[53] PHIPA Decision 152 is instructive in this regard. In PHIPA Decision 152, Investigator John Gayle conducted an investigation of a hospital’s response to an access request for an audit report. He noted that the hospital that was the subject matter of his investigation did not dispute that a patient has a right of access to audit records containing their personal health information, subject to any limits on this right under section 52(3), as well as any applicable exceptions and exclusions set out in the Act. In addition, the hospital advised that, in its view, audit records are generally dedicated primarily to personal health information about the patient. In the circumstances of that case, the audit was generated at the request of the complainant, and was specifically directed at his son’s medical record.

[54] Having found that the records are dedicated primarily to the personal information of the patient for the purposes of section 52(3), the complainant has a right of access to the entirety of each record, subject to any exemptions from that right of access.

[55] I will now determine whether the exemptions relied on by PHO apply to exempt the records from the complainant’s right of access.

Issue D: Do any of the exemptions at section 52(1) of PHIPA apply to the staff members’ names?

[56] PHO has claimed the application of the exemption in section 52(1) (f) of PHIPA , which is available to the PHO as an institution under the Freedom of Information and Protection of Privacy Act  (FIPPA ). [6]

[57] As previously stated, section 52(1) provides a record of personal health information (or a part thereof) may be exempt from the right of access.

[58] Section 52(1)  of PHIPA  lists exemptions from the right of access. It states, in part:

Subject to this Part [Part V of PHIPA , setting out the rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(f) the following conditions are met:

(i) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act  or the Municipal Freedom of Information and Protection of Privacy Act or is acting as part of such an institution, and

(ii) the custodian would refuse to grant access to the part of the record,

(A) under clause 49  (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act , if the request were made under that Act and that Act applied to the record,

. . .

[59] PHO is claiming that the flow through provision in sections 52(1) (f)(i) and (ii) of PHIPA  apply, and is relying on section 49(a) of FIPPA, in conjunction with sections 18(1)(c), 18(1)(d) and 20 of FIPPA.

[60] Section 49(a) of FIPPA reads:

A head may refuse to disclose to the individual to whom the information relates personal information,

where section 12, 13, 14, 14.1, 14.2, 15, 16, 17, 18, 19, 20 or 22 would apply to the disclosure of that personal information.

Section 18(1) of FIPPA

[61] Section 18(1) of FIPPA states, in part:

A head may refuse to disclose a record that contains,

(c) information where the disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution;

(d) information where the disclosure could reasonably be expected to be injurious to the financial interests of the Government of Ontario or the ability of the Government of Ontario to manage the economy of Ontario;

[62] The purpose of section 18(1) is to protect certain economic interests of institutions. Generally, it is intended to exempt commercially valuable information of institutions to the same extent that similar information of non-governmental organizations is protected under FIPPA. [7]

[63] For sections 18(1)(c) or (d) to apply, the institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that releasing the information will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [8]

[64] The failure to provide detailed evidence will not necessarily defeat the institution’s claim for exemption where harm can be inferred from the surrounding circumstances. However, parties should not assume that the harms under section 18 are self-evident or can be proven simply by repeating the description of harms in FIPPA. [9]

[65] The purpose of section 18(1)(c) is to protect the ability of institutions to earn money in the marketplace. This exemption recognizes that institutions sometimes have economic interests and compete for business with other public or private sector entities, and it provides discretion to withhold information on the basis of a reasonable expectation of prejudice to these economic interests or competitive positions. [10] The exemption requires that releasing the information could reasonably be expected to prejudice the institution’s economic interests or competitive position. [11]

[66] Section 18(1)(d) is intended to protect the broader economic interests of Ontarians. [12]

Representations

[67] PHO’s representations address sections 18(1)(c) and (d) collectively. PHO submits that it performs approximately 5.5 million laboratory tests each year. Of these tests, PHO performed 39,406 Lyme disease tests from April 2018 to March 2019. These tests, PHO submits, are performed by medical laboratory technologists (MLTs) who are regulated healthcare professionals and who are qualified to perform Lyme disease tests as well as tests for other infectious diseases. PHO goes on to argue that while it is the only public laboratory in the province that tests for Lyme disease, it must compete with commercial laboratories for the limited numbers of MLTs. PHO further submits that due to the controversial nature and significant public profile of Lyme disease, releasing staff names would undermine PHO’s ability to hire and retain MLTs who are willing to perform Lyme disease testing.

[68] PHO also submits that staffing issues would significantly undermine its ability to perform Lyme disease testing, which would significantly challenge the province’s ability to deliver these tests in a timely manner and to manage the costs of healthcare related to Lyme disease.

[69] PHO goes on to state:

Should PHO staff names be released, it would be open to members of Lyme advocacy groups to launch lawsuits against these staff members for the work that they are doing in the context of the employment at PHO. These costs would be borne by PHO acting as the employer of these staff members.

Should PHO staff names be released without their express consent, it will be open to these staff members, represented by their respective unions, to take action against PHO resulting in costs and damage to PHO’s reputation and economic interests.

[70] PHO also provided evidence by way of an affidavit sworn by its Chief of Medical Microbiology. She submits that she is responsible for the quality and value of clinical and public health testing at the PHO laboratory, which is the only publicly funded testing laboratory for Lyme disease in the province. She further submits that releasing the staff names will risk the ability to ensure that PHO can retain and hire staff to test for Lyme disease if there is a threat or instance of harassment. The affiant argues that this is an important threat given the controversial nature of Lyme disease that goes well beyond PHO’s commitment to transparency of methods and the ability to enter into medical debate consistent with free speech.

[71] The affiant cites one of the Canada’s leading experts on Lyme disease and submits that she had email communication with this expert, who advised that he has been the subject of hate mail and threats of harm to him and his family by groups who promote Lyme disease awareness, research, education and treatment. He was also the subject of complaints to his regulatory college and to the Dean of Medicine. (These complaints were dismissed). The expert also advised the affiant that as a result of being the public face of Lyme disease, there has been a reduction in the number of individuals who see him, who he has the potential to assist.

[72] The affiant submits that one of the Lyme disease experts from the United States has received multiple death threats, as did one of his colleagues.

[73] The complainant submits that PHO has not met its evidentiary burden in claiming the application of section 18, and that past IPC orders have held that the names of staff who appear in the various types of information should “typically not be withheld.” [13] With respect to the specific claims made by PHO, the complainant submits that PHO’s arguments are based on numerous assumptions, none of which have a factual basis, and are frivolous, groundless, exaggerated and speculative. The complainant goes on to state:

. . . The proof put forward by PHO for all of these assertions rests on the affidavit of [the affiant]. [The affiant’s] affidavit actually contains no statement that any PHO staff have expressed any concerns. She states that “she is concerned that releasing these names will risk the ability to retain and hire staff for Lyme if there is a threat or instance of harassment.”

. . .

. . . PHO refers to IPC Order PO-3970 which states that “the purpose of s. 18(1)(c) of FIPPA is to protect the ability of institutions to earn money in the marketplace.” This doesn’t seem to be at all relevant in this case, which is about a private citizen seeking information regarding the personal information of herself and my two minor daughters.

Analysis and findings

[74] PHO’s position is that releasing the names of staff at issue could reasonably be expected to lead to the harassment of staff, the exit of staff, legal action against PHO by unions, lawsuits against staff by Lyme disease advocacy groups, difficulty in recruiting and retaining staff, and difficulty providing Lyme disease testing in a timely manner, all to the detriment of PHO’s economic interests and to managing the healthcare costs related to Lyme disease.

[75] As previously stated, the purpose of section 18(1) is to protect certain economic interests of institutions. Generally, it is intended to exempt commercially valuable information of institutions. The purpose of section 18(1)(c) is to protect the ability of institutions to earn money in the marketplace. This exemption recognizes that institutions sometimes have economic interests and compete for business with other public or private sector entities, and it provides discretion to refuse disclosure of information on the basis of a reasonable expectation of prejudice to these economic interests or competitive positions. [14] Section 18(1)(d) is intended to protect the broader economic interests of Ontarians. [15]

[76] I find that PHO has not provided sufficient evidence to demonstrate a risk of harm that is well beyond the merely possible or speculative. In my view, releasing the names of staff at issue could not be reasonably be expected to result in the overly broad and, frankly, catastrophic harms described by PHO in its representations. The PHO describes a sequence of events that in my view, is based on pure speculation. As a result, I am not persuaded that releasing the staff names could reasonably be expected to result in prejudice to PHO’s economic interests or its competitive position. Similarly, I am not persuaded that the broader economic interests of Ontarians could reasonably be expected to be affected by releasing the staff names. As a result, I find that neither of sections 18(1)(c) or (d) applies, and this information is not exempt from the complainant’s right of accesson that basis.

Section 20 of FIPPA

[77] Section 20 of FIPPA states:

A head may refuse to disclose a record where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual.

[78] For this exemption to apply, the institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [16]

[79] An individual’s subjective fear, while relevant, may not be enough to justify the exemption. [17] The term “individual” is not necessarily confined to a particular identified individual, and may include any member of an identifiable group or organization. [18]

Representations

[80] PHO refers to IPC Order PO-3972, where the record at issue was a video aimed at providing education on vaccines. In that case, it was argued that the disclosure of the video could result in altercations and misinformation by anti-vaccine lobbying groups. The adjudicator stated “the section 20 exemption can still apply even if the disclosure of the records triggers intervening events that then subsequently lead to a reasonable expectation that those harms will occur.” [19] PHO goes on to argue that Lyme disease has a controversial and political nature and a significant public profile.

[81] PHO further references excerpts from articles concerning the controversial nature of Lyme disease and more notably, for example, an article published in the New York Times in 2009 regarding Dr. Allen Steere, the medical researcher and rheumatologist who first identified Lyme disease. The article details how Dr. Steere was subject to harassment and threats to the extent that The New England Medical Center, where Dr. Steere worked, had to hire security for his public appearances and spent hours each week monitoring threats against him.

[82] PHO goes on to state:

While PHO does not have any specific safety or health concerns with the complainant, PHO is concerned that the release of the information would trigger intervening events that then subsequently leads to a reasonable expectation that those harms will occur. These harms would concern both the safety and health of PHO employees and of Ontarians.

[83] With respect to the danger to the safety or health of PHO employees, PHO submits that:

• PHO staff work in a laboratory setting and do not directly provide a service to the public;
• Danger to PHO staff is reasonably expected to occur if their names are disclosed both at the workplace and outside of work;
• PHO staff who have their names disclosed will be at serious risk of harassment, unfounded complaints to their professional bodies, lawsuits, investigations and death threats; and
• Releasing the information to the complainant will be a disclosure to the world and the information will be disseminated to the Lyme disease advocacy community.

[84] Concerning the danger to the safety or health of Ontarians, PHO submits that the increased risk of harassment, lawsuits, investigations and death threats will lead to PHO employees finding other employment and/or choose to perform other infectious disease tests rather than Lyme disease. This will result in PHO not being able to offer Lyme disease tests to Ontarians. Lastly, PHO argues that it is the only public laboratory in the province to offer Lyme disease testing, and that if it cannot hire and retain sufficient staff to perform these tests, this will endanger the safety and health of Ontarians.

[85] The PHO’s Chief of Medical Microbiology states in her affidavit:

If we were ordered to release employee names of those who saw or handled the samples in question, we would be obliged to inform both the unions and the employees affected, to ensure that they can protect themselves given the history of harassment that we are familiar with.

In conclusion, with great respect for Ontario’s commitment to access to information, in this instance I am greatly concerned that release of the names of employees, including those that only transferred the specimen from the loading dock to the testing lab, will endangers Ontario’s ability to offer high quality testing for Lyme Disease and therefore threaten the health [of] the people of our province.

[86] The complainant submits that PHO has not met its burden of proof. In particular, she argues the articles referred to by PHO are not relevant to the issue of whether providing the staff names to her is a risk to anyone, and that PHO has not provided evidence that danger to staff members is reasonably expected, including harassment, unfounded complaints to professional bodies, lawsuits, investigations and death threats. The complainant further submits that PHO has not provided evidence that PHO staff have a reasonable expectation of not being required to share their identity with the public, given that they are government employees acting in a professional capacity. Further, the complainant submits that the PHO’s affidavit setting out the health and safety threats experienced by individuals working in Lyme disease testing refers to individuals working in a different country, who are not working in a public health setting, and there is no evidence that these threats arose from the release of information to individuals seeking their own personal information.

[87] The complainant also clarified that she is only seeking the names of staff who accessed the electronic health records at issue, and that she is not seeking the names of any staff who only transferred the specimens from the loading dock to the testing lab, including those who only saw or handled the specimens.

Analysis and findings

[88] In Order PO-2917, a parent who was involved with the Family Responsibility Office (FRO) made a request for information for records, including staff names. Adjudicator Steven Faughnan found that the names of employees that were contained in the records at issue were not exempt under section 49(a) in conjunction with sections 14(1)(e) (endanger life or safety) or 20 of FIPPA. As a result, he ordered those names to be disclosed to the appellant, finding that the institution had not provided sufficient evidence to substantiate its claim that disclosure of the employees’ names could reasonably be expected to seriously threaten the safety or health of an individual.

[89] Similarly, in PHIPA Decision 90, the Canadian Red Cross Society (the Red Cross) had received a request under PHIPA  for access to a full copy of the requester’s file, including the dates of all visits by the Red Cross to his home and the full names of the Red Cross staff who provided services to him. In response, the Red Cross issued a decision granting partial access to the responsive records, but withholding the names of the staff. The Red Cross claimed the exemption in section 52(1) (e)(i) of PHIPA , which states:

52(1) Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(e) granting the access could reasonably be expected to,

(i) result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person.

[90] In that Decision, Adjudicator Jaime Cardy adopted the approach taken by former Adjudicator John Higgins in PHIPA Decision 34, where he found that the purpose of section 52(1)(e)(i) is to protect the treatment, recovery, and physical security of a patient and others, also finding that it was similar to section 20 of FIPPA, which applies “where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual.” [20]

[91] While both PHIPA Decisions 34 and 90 deal with section 52(1)(e)(i) of PHIPA and not section 20 of FIPPA, Adjudicator Higgins also found that the standard of proof required under section 52(1) (e)(i) of PHIPA  is the same as the standard under section 20 of FIPPA, and other exemptions that contain the words “could reasonably be expected to”. [21] The health information custodian must demonstrate a risk of harm that is well beyond the merely possible or speculative, although it need not prove that granting access will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [22]

[92] In Order PO-1940, Adjudicator Laurel Cropley considered a similar fact situation to the one at hand: the institution withheld the names of staff members from records pursuant to the exemption at section 20 of FIPPA. The institution in that appeal submitted that it did “not see any justifiable need for the individual to have access to the names of those present at the meeting, other than to possibly harass those individuals.” The substantial evidence and history predating that appeal led Adjudicator Cropley to conclude that the information was properly withheld under section 49(a) in conjunction with section 20 of FIPPA; however, in a post-script to Order PO-1940, the adjudicator stated the following:

There are occasions where staff working in “public” offices […] will be required to deal with “difficult” clients. In these cases, individuals are often angry and frustrated, are perhaps inclined to using injudicious language, to raise their voices and even to use apparently aggressive body language and gestures. In my view, simply exhibiting inappropriate behaviour in his or her dealings with staff in these offices is not sufficient to engage a section 20 or 14(1)(e) claim [under FIPPA]. Rather, as was the case in this appeal, there must be clear and direct evidence that the behaviour in question is tied to the records at issue in a particular case such that a reasonable expectation of harm is established.

[93] PHO has relied on Order PO-3972 in its discussion of the harms in section 20. In that Order, Adjudicator Colin Bhattacharjee stated the following:

The wording of section 20 makes it clear that for the exemption to apply, it is the disclosure of the requested records that must lead to a reasonable expectation of a serious threat to the safety or health of an individual. In my view, the section 20 exemption can still apply even if the disclosure of the records triggers intervening events that then subsequently lead to a reasonable expectation that those harms will occur. However, I find that the chain of events described in the ministry’s submissions that it claims could occur and then indirectly lead to a reasonable expectation of harm under section 20, amounts to speculation, which is not sufficient to satisfy the requirements of that exemption. [emphasis added]

[94] I agree with the approaches taken in Orders PO-1940, PO-3972 as well as PHIPA Decisions 34 and 90 with respect to the standard of proof required to establish the harms contemplated in section 20, and I find that PHO has not demonstrated that the disclosure of the names of staff who accessed the complainant’s (and her children’s) electronic health records would lead to a reasonable expectation of a serious threat to the safety or health of an individual or individuals.

[95] In particular, in my view, the harms that PHO submits are reasonably expected to result from providing access to the information at issue are speculative in nature. With respect to the complainant, there is no evidence in the records or the parties’ submissions to suggest that the complainant is likely to attempt to contact PHO staff, either in person, over the phone, or otherwise, if their names are released. I also note that PHO acknowledges that it does not have any specific safety or health concerns with the complainant. Its position is that it is concerned that the release of the staff names would trigger intervening events that would then subsequently lead to a reasonable expectation that those harms will occur to PHO employees and all of Ontarians. In particular, PHO submits that the disclosure of the staff names could lead to, among other things, harassment, threats, unfounded complaints to regulatory colleges, lawsuits, investigations, staff either refusing to conduct Lyme disease specimens, or leaving PHO altogether, with the possible result that PHO will no longer be able to conduct testing for Lyme disease to the detriment of Ontarians.

[96] While the subject of Lyme disease is controversial, I find that PHO’s arguments with respect to the wide ranging harms it has articulated are speculative, merely possible and not substantiated by sufficient evidence to establish the requirements of section 20.

[97] As there is insufficient evidence to establish the requirements of the exemption in section 20, I find that it does not apply. Having also found that section 18(1) does not apply, I find that section 52(1)(f)(i) and (ii)(A) of PHIPA , as claimed by PHO does not apply. Accordingly, I find that the complainant has a right of access to the withheld information and I will order PHO to grant access to it.

Issue E: Did PHO conduct a reasonable search for records?

[98] As the complainant claims that additional records exist beyond those identified by PHO, the reasonableness of PHO’s search is an issue in this review.

[99] Many PHIPA decisions have now found that it is appropriate to apply the same principles as those set out in FIPPA. [23] Given this, the principles outlined in orders of this office addressing reasonable search under those statutes are instructive to my review of this issue under PHIPA .

[100] Where a requester under PHIPA  claims that additional records exist beyond those identified by a health information custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53  and 54  of PHIPA . If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the custodian’s decision. If I am not satisfied, I may order further searches.

[101] PHIPA  does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [24] To be responsive, a record must be "reasonably related" to the request. [25]

[102] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [26] A further search will be ordered if the custodian does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [27]

[103] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [28]

[104] In this case, the complainant believes that emails and other communications about her and her children exist. At the conclusion of mediation, PHO took the position that these records were previously provided to the complainant, or that they do not exist.

[105] In order to determine whether PHO has conducted a reasonable search for records of personal health information as required by PHIPA , I asked that PHO provide a written summary of all steps taken in response to the request. In particular, I asked the following questions:

1. Did PHO contact the complainant for additional clarification of the request? If so, please provide details including a summary of any further information the complainant provided.
2. If PHO did not contact the complainant to clarify the request, did it:
1. choose to respond literally to the request?
2. choose to define the scope of the request unilaterally? If so, did PHO outline the limits of the scope of the request to the complainant? If yes, for what reasons was the scope of the request defined this way? When and how did PHO inform the complainant of this decision? Did PHO explain to the complainant why it was narrowing the scope of the request?
3. Please provide details of any searches carried out including: by whom were they conducted, what places were searched, who was contacted in the course of the search, what types of files were searched and finally, what were the results of the searches? Please include details of any searches carried out to respond to the request.
4. Is it possible that such records existed but no longer exist? If so please provide details of when such records were destroyed including information about record maintenance policies and practices such as evidence of retention schedules.
5. Do responsive records exist which are not in PHO’s possession? Did PHO search for those records? Please explain.

Representations

[106] PHO provided the affidavits of three staff members regarding its search for records responsive to the complainant’s access request. PHO submits that, upon receipt of the complainant’s clarified access request, the Privacy Officer contacted laboratory personnel knowledgeable in the subject matter of the request for direction and assistance in determining where responsive records might reasonably be located. Laboratory personnel referred the Privacy Officer to the Director of Laboratory Information and Research Operations (the Director) with respect to the electronic health record, and to the Clinical Microbiologist (the Microbiologist) with respect to other records.

[107] PHO further submits that the Privacy Officer worked with the Director to develop search parameters in response to the request. As previously stated, electronic health records are held in the LIMS, which is organized by specimen ID. The LIMS contains other information which is provided on the test requisition by the health care provider who ordered the test, including, for example, the patient’s name, date of birth, health card number and other information about the test(s) ordered in connection with the specimen ID and the test results.

[108] The Director then conducted a search of the LIMS using the following search terms: health card number, first name plus date of birth, first name plus last name, first name plus alternative last name, last name plus date of birth, and alternative last name plus date of birth. The information for the complainant and her children was found and compiled into a report, which was provided to the complainant.

[109] With respect to the search for other records, PHO submits that it worked with the Clinical Microbiologist, who indicated that if he were to have any responsive records, they would be in his email. The Microbiologist subsequently searched his using the following search terms: health card numbers for the complainant and her children, the names of the complainant’s children, the alternative names of the complainant and various specimen ID’s.

[110] PHO submits (in paragraph 89 of its representations) that it found one email chain, which was a collection of media clips. In the email, the complainant was mentioned while acting in an official capacity related to an organization. PHO’s position is that this information did not consist of either personal information or personal health information and was, therefore, not responsive to the request.

[111] In paragraph 90 of its representations, PHO further submits that the search using the LIMS specimen ID’s found three spreadsheets, each attached to an email message. These spreadsheets and emails, PHO argues, were related to the laboratory’s evaluation of test kits, which is a broader laboratory operational purpose that used all specimens submitted for Lyme disease testing during a specific period. PHO’s position is that the information in the spreadsheets was not personal information or personal health information and was, therefore, not responsive to the request.

[112] PHO goes on to submit that the email search did not find any communications about the complainant and her children, and there is no reason to believe that responsive records existed but no longer exist and there is no reason to believe that responsive records exist which are not in PHO’s possession.

[113] The complainant submits that she accepts that the process following by PHO with respect to the electronic health records was reasonable.

[114] However, she seeks access to the email referred to in paragraph 89 of PHO’s representations. In reply, PHO indicated that this email is not responsive to the request, but will informally disclose the record to her, as it is not claiming any exemptions with respect to it. The complainant also seeks access to the emails referred to in paragraph 90 of PHO’s representations. In reply, PHO identified that these emails are not responsive to the request, but it will informally disclose a severed version to the complainant, as it is not claiming any exemptions with respect to them and the severed information relates to individuals other than the complainant and her children.

[115] The complainant also requested that PHO conduct another search in LIMS for records over a longer time period. In reply, PHO advised that it subsequently expanded the time period of the search, using the same search terms as described above. In addition, PHO submits that it has been preparing upgrades to the LIMS database and, as a result, has identified additional functionality to create system viewing logs. Information from the new log has been added to the audit reports previously disclosed and will be informally disclosed to the appellant.

[116] The complainant further submits that she is of the view that the Microbiologist was not the most appropriate person to have been charged with the search for emails and other records outside of the electronic health records as he would not be an experienced employee knowledgeable in the subject matter of the request. She goes on to suggest that an independent person with specific expertise in emails, technology and record-keeping be tasked with a further search.

Analysis and finding

[117] As previously stated, PHIPA  does not require health information custodians to prove with absolute certainty that further records do not exist; rather, it requires custodians to provide sufficient evidence to demonstrate that they have made a reasonable effort to identify and locate responsive records. [29] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records that are reasonably related to the request. [30] In the circumstances of this complaint, I find that PHO has provided sufficient evidence to demonstrate that it made a reasonable effort to identify all records responsive to the complainant’s access request for all records and communications relating to her and her children. [31]

[118] I am satisfied, based on the representations and the affidavit evidence before me, that the PHO employees who conducted and oversaw the searches, namely the Privacy Officer, Director and Microbiologist are experienced employees knowledgeable in the subject matter of the request.

[119] I also note that there were discussions between the complainant and PHO in order to clarify the scope of her request.

[120] I am satisfied that in order to locate the responsive records, PHO searched its LIMS electronic database using a number of search terms relating to the complainant and her children. Moreover, PHO provided the complainant with access to all of the records identified by these searches, subject to the severance of the staff members who accessed the complainant’s and her children’s records of personal health information. All records identified as responsive to the request were provided to the complainant and, in fact, a second search was conducted in which more fulsome information was identified and will be provided to the complainant, in addition to the emails PHO identified in its representations. Based on the evidence before me, I am satisfied that PHO’s search parameters were aligned with the scope of the request and were reasonable in the circumstances. I am also satisfied that PHO expended a reasonable effort to locate records that are reasonably related to the complainant’s request.

[121] As previously stated, although a complainant will rarely be in a position to indicate precisely which responsive records a custodian has not identified, the complainant must, nevertheless, provide a reasonable basis for concluding that such records exist. [32] In this case, the complainant’s representations do not provide evidence that additional records should exist that have not yet been identified and released, or will be released. Therefore, I am not persuaded by the complainant’s position that there is a reasonable basis for believing that PHO has not conducted a reasonable search for responsive records. Accordingly, having considered both parties’ positions, I find that PHO has expended a reasonable effort to locate records that are reasonably related to the complainant’s request.

[122] Finally, I am satisfied that there is no reasonable basis for concluding that responsive records might have existed, but no longer exist because they have been deleted or destroyed or that they are no longer in PHO’s possession. For all of these reasons, I find that PHO conducted a reasonable search for records responsive to the complainant’s request in compliance with its obligations under PHIPA .

ORDER:

For the foregoing reasons, pursuant to section 61(1)  of PHIPA :

1. I order PHO to provide the audit reports including staff names to the complainant in their entirety by October 25, 2021 but not before October 18, 2021. To be clear, the records are to include the names of the staff members who accessed the personal health information of the complainant and her two children.
2. I uphold PHO’s search for records responsive to the complainant’s access request.

Original signed by:		September 17, 2021
Cathy Hamilton
Adjudicator