PHIPA DECISION 183

Complaint HA18-49

Dr. Paola Leon

June 30, 2022

Summary: A father, a non-custodial parent with only access rights to his child, requested his child’s personal health information (PHI) from Dr. Paola Leon (the custodian). In support of his request, the father provided a court order and a consent to disclosure from the child’s mother, who has sole custody of the child.

The custodian denied the request on the basis that the father, as a non-custodial parent, does not have a right of access to the child’s PHI because he is not a lawfully authorized substitute decision-maker for the child under the Personal Health Information Protection Act, 2004 (PHIPA). The custodian subsequently gave the father a summary of the child’s PHI and treatment, but she decided not to disclose entire records containing the child’s PHI under PHIPA’s discretionary disclosure provisions at sections 29(a) (consent), 41(1)(d)(i) (compliance with summons or order) and 43(1)(h) (permitted or required by law). The custodian’s exercise of discretion was informed by her concerns about the child’s best interests and about the potential harm that disclosure could cause the child.

In this decision, the adjudicator finds that the father does not have a right of access to the child’s PHI under Part V of PHIPA. She also upholds the custodian’s exercise of discretion not to disclose the child’s PHI to the father under Part IV of PHIPA. She upholds the custodian’s decision and issues no order.

Statutes Considered: Personal Health Information Protection Act, 2004, sections 3(1)1, 4(1)(a), 6(3), 23(2), 29(a), 29(b), 41(1)(d)(i), 43(1)(h) and 52(1).

Decisions Considered: PHIPA Decisions 96 and 128.

BACKGROUND:

[1] This decision addresses a non-custodial parent’s request for access to or disclosure of his child’s personal health information under the Personal Health Information Protection Act (PHIPA) where that parent has a court order stating that he shall have “direct access” to his child’s “medical” information, and also has the consent of the custodial parent to disclosure of the child’s personal health information to him.

[2] The complainant is the father of a child who is less than 16 years of age and who was a patient of Dr. Paola Leon (the custodian). He is divorced from the child’s mother, who has sole custody of the child, and he has only access rights to the child. His complaint arises from his request to the custodian for “production” under PHIPA of all of the custodian’s clinical notes and records relating to his child. Along with his request, the complainant provided the custodian with a copy of an order of the Superior Court of Justice from July 2016 (the 2016 court order) arising from litigation between himself and the child’s mother regarding custody of and access to the child. The 2016 court order states that the complainant shall have “direct access to all professional information relating to” his child and specifies that all “professional information” includes “medical and educational information.” The 2016 court order also confirms that the mother has “sole custody” of the child.

[3] In response to the complainant’s request, the custodian issued a decision denying him access to the records. In her letter, the custodian stated:

…Pursuant to the Personal Health Information and Protection Act (PHIPA), [the complainant], as the non-custodial parent, is not entitled to consent to the release of [the child]’s personal health information (PHI), see s. 23(2). Furthermore, even if [the complainant] were entitled to consent to the release, as a capable child under the age of 16, [the child] would be entitled to ‘override’ that consent and refuse the disclosure, see s. 23(3).

Another important consideration is the fact that PHIPA provides that an individual (or their substitute decision maker (SDM) or parent) does not have a right of access to their PHI, regardless of consent if the custodian is of the view that:

…granting access could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person. S. 52(1)(e)(i).

[4] In her decision letter, the custodian added that she could not provide the child’s personal health information to him because she did not have clinical notes and records that relate exclusively to the child. She explained that all of the care she provided to the child was in the context of family counselling and all of her documentation was included in her office chart for the child’s mother, and the father has no right of access to the mother’s personal health information.

[5] The complainant was dissatisfied with the custodian’s decision and filed a complaint about it with the Information and Privacy Commissioner of Ontario (the IPC). Attached to the Access Complaint Form the complainant filed with the IPC was a copy of a form titled “Consent to Disclosure” signed by the child’s mother confirming that the custodian may disclose the child’s personal health information to the complainant, but not any personal health information relating to the mother.

[6] The IPC attempted mediation of the complaint. [1] During the mediation stage of the complaint process, the custodian provided a summary of the child’s personal health information and treatment to the complainant in lieu of the requested records. The complainant reviewed the summary and raised a number of concerns with it. The custodian responded to the complainant’s comments and concerns in writing. However, the complainant was not satisfied with the summary and additional clarification provided by the custodian.

[7] A mediated resolution of the complaint was not possible and the complaint progressed to the adjudication stage of the complaint process. An adjudicator commenced a review of the complaint, inviting and receiving representations from the custodian and the complainant on a number of issues. The adjudicator shared the non- confidential representations with the parties. [2] The complaint was then transferred to me to complete the review. I decided to seek additional representations from the parties on two recent and relevant IPC decisions. I invited the parties to consider the impact of PHIPA Decision 96, which addresses discretionary disclosure under PHIPA, and PHIPA Decision 107, which addresses joint custodial parents’ ability to act as substitute decision- maker for the child, on this complaint. The custodian provided representations and I shared the non-confidential representations with the complainant. The complainant did not reply.

[8] In this decision, I determine that the complainant is not a lawfully authorized substitute decision-maker for the child under PHIPA, and therefore cannot exercise the child’s right of access to the records under PHIPA. I also uphold the custodian’s exercise of discretion in deciding not to disclose the records under PHIPA’s discretionary disclosure provisions at sections 29(a) (consent), 41(1)(d)(i) (compliance with summons or order) and 43(1)(h) (permitted or required by law). As a result, I dismiss the complaint without issuing any order.

[9] I refer below only to the representations from the parties that are most relevant to the issues I have deemed necessary to decide. The parties provided extensive representations and made a number of arguments, some of which I will not address or repeat here because there is no need for me to do so.

RECORDS:

[10] All of the child’s personal health information at issue in this complaint is contained in the custodian’s patient chart for the mother. I do not have a copy of the records at issue. The custodian did not provide a copy of the records to the IPC, and I determined that I did not require a copy of the records at issue in order to make my decision.

Preliminary Findings

[11] There is no dispute and I am satisfied, based on the description provided by the custodian, that the records at issue qualify as records of “personal health information” of the child within the meaning of section 4 of PHIPA. [3] There is also no dispute that the records also contain the personal health information of the child’s mother.

[12] There is also no dispute and I find that Dr. Leon is a health information custodian under paragraph 1 of section 3(1) of PHIPA by virtue of being a health care practitioner who has custody or control of personal health information as a result of performing her work.

DISCUSSION:

[13] The right of “access” to records of personal health information, which is addressed in Part V of PHIPA, is distinct from the rules found in Part IV of PHIPA governing the “disclosure” of personal health information by health information custodians. In this complaint, I consider the complainant’s request to be both a request for “access” and a request for “disclosure,” and I address both in this decision.

Access under PHIPA

[14] The only right of access in PHIPA is the right of individuals, under Part V of PHIPA, to obtain their own personal health information in the custody or under the control of health information custodians, subject to limited and specific exclusions and exemptions. The right of access must be exercised by the individual to whom the personal health information relates, or, if applicable, that individual’s lawfully authorized substitute decision-maker (sections 5(1), 25, 52 and 53). [4]

The complainant does not have a right of access under PHIPA

[15] Section 52(1) of PHIPA sets out the right of access to a record of personal health information, in part, as follows:

Subject to this Part [Part V of PHIPA], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless[…]

[16] The complainant, the father of the child whose personal health information is at issue, is not the individual to whom the personal health information at issue relates. As a result, the complainant can exercise a right of access to the child’s personal health information under PHIPA only if he is the child’s lawfully authorized “substitute decision- maker” within the meaning of PHIPA (sections 5(1), 25, 52 and 53).

[17] Section 23(1) lists the persons who may act as substitute decision-makers for individuals in different situations described in paragraphs 1 to 5 of that section. Paragraph 2 of section 23(1), relied on by the complainant, lists a parent of a capable child who is less than 16 years of age as a substitute decision-maker for that child. However, section 23(2), relied on by the custodian, confirms that only a parent with custody of a child is considered a “parent” under section 23(1). These sections state:

23(1) If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent:

. . .

2. If the individual is a child who is less than 16 years of age, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to,

i. treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or

ii. counselling in which the child has participated on his or her own under the Child, Youth and Family Services Act, 2017.

. . .

23(2) In subsection (1),

“parent” does not include a parent who has only a right of access to the child.

[18] The complainant argues that the 2016 court order lawfully entitles him to have access to the child’s personal health information, and, accordingly, the complainant “is a person lawfully entitled to give consent to the release of” the child’s personal health information within the meaning of section 23(1)2 of PHIPA. He also submits that he is not precluded under section 23(2) from exercising his child’s right of access to the records. The complainant adds that the mother’s signed consent to disclosure strengthens his position that he should be entitled to access the records as a lawfully authorized substitute decision-maker for the child under PHIPA. I disagree.

[19] While the 2016 court order states that the complainant shall have “direct access” to the child’s “medical” information, it does not confer any substitute decision-making authority on the complainant for the purposes of PHIPA.

[20] First, the 2016 court order does not establish that the complainant is a “person who is is lawfully entitled to give or refuse consent in the place” of the custodial parent, within the meaning of paragraph 2 of section 23(1).

[21] Second, the 2016 court order confirms that the mother maintains “sole custody” of the child, while the complainant retains access to the child. The complainant therefore does not qualify as a “parent” of the child with substitute decision-making authority for the purposes of PHIPA because of section 23(2) of PHIPA.

[22] Finally, the consent to disclosure signed by the mother does not confer substitute decision-making authority on the complainant. The consent to disclosure contains the mother’s consent for the custodian to disclose the child’s personal health information to the complainant. Assuming, without deciding, that the mother is the lawfully authorized substitute decision-maker of the child under PHIPA, she could be entitled to provide this consent, and the custodian may have to consider the impact of this consent in deciding whether to disclose personal health information under Part IV of PHIPA. (I address discretionary disclosure under the next heading.) The mother would be also entitled to request access to the child’s personal health information on the child’s behalf; in that case, the right of access would belong to the mother, and not to the complainant. [5] By itself, however, the mother’s consent to disclosure is not evidence to support the complainant’s claim that he is entitled to exercise his own right of access to the child’s personal heath information under PHIPA.

[23] In these circumstances, I find that the complainant has no right of access to the child’s personal health information under PHIPA. [6]

[24] The parties provided representations on the exemption at section 52(1)(e)(i), relied on by the custodian. Given my finding that the complainant cannot exercise a right of access on behalf of the child, I need not consider the parties’ arguments about this exemption from a right of access in PHIPA.

Disclosure under PHIPA

[25] In addition to the provisions governing access in Part V, PHIPA contains provisions in Part IV (sections 38 through 50) addressing the “disclosure” of personal health information. [7] PHIPA requires that any disclosure of personal health information occur with consent, except in specified circumstances. While PHIPA requires disclosure in some situations, none of the mandatory disclosure provisions applies in this complaint. [8] Only discretionary disclosure is relevant in this complaint.

[26] The IPC has found that where a requester provides a custodian with evidence that conditions for disclosure under specific sections of PHIPA may have been met, the custodian has a duty to consider the request under those potentially applicable sections of PHIPA. [9] In this complaint, the complainant provided evidence that the discretionary disclosure provisions in sections 29(a), 41(1)(d)(i) and 43(1)(h) may apply. As a result, the custodian had a duty to consider the request under each of these sections. Section 29(a) relates to disclosure with consent, and sections 41(1)(d)(i) and 43(1)(h) address circumstances in which disclosure may occur without consent. In addition, section 6(3) provides clarification about permissive disclosure, as explained further, below. I address the complainant’s evidence and the potentially applicable discretionary disclosure provisions, below.

[27] If I decide the custodian had a duty to consider disclosure under sections 29(a), 41(1)(d)(i) and/or 43(1)(h), I will proceed to assess whether she properly exercised her discretion under each section. In deciding whether to disclose personal health information under a permissive section of PHIPA, a custodian must make the decision in a proper manner, based on proper considerations, in good faith and for a proper purpose. If the custodian does not, the IPC may order the custodian to consider the matter again, and may provide comments and recommendations to guide the custodian’s consideration. [10] However, while the IPC can order a custodian to properly consider a request for disclosure of personal health information, the IPC cannot order release of the information. [11]

Disclosure with consent

Section 29(a) of PHIPA

[28] Under section 29(a) of PHIPA, a health information custodian may disclose personal health information with consent where the custodian is satisfied that the disclosure is “necessary for a lawful purpose.” This section states:

A health information custodian shall not collect, use or disclose personal health information about an individual unless,

(a) it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose[.]

The custodian had a duty to consider discretionary disclosure under section 29(a)

[29] The complainant submits that the form titled “Consent to Disclosure” signed by the custodial parent and the 2016 court order provide the necessary consent for the custodian to disclose the child’s personal health information to him under section 29(a) of PHIPA. He asserts that his request for discosure of his child’s personal health information is for a lawful purpose, in accordance with section 29(a), since it is based on his role as a father and his desire that his child receive the best possible health care. He submits that he is entitled to question the custodian’s care of his child by seeking a further medical opinion and that the records at issue will be essential to the continuity of the child’s care with another health care provider.

[30] Because the complainant provided the custodian with evidence that the conditions for disclosure under section 29(a) may have been met, the custodian had a duty to consider discretionary disclosure under section 29(a) of PHIPA.

The custodian exercised her discretion under section 29(a) properly

[31] In her representations, the custodian denies that the conditions for disclosure under section 29(a) are met. She submits that in order to disclose the child’s personal health information, she must: (1) have the consent of the custodial parent or the child, and (2) be satisfied that the disclosure is necessary for a lawful purpose. She argues that, although the mother has signed the consent to disclosure, consent alone is not sufficient to permit disclosure. She asserts that there is no indication in this complaint that disclosure directly to the complainant is necessary for a lawful purpose.

[32] The custodian states that, to the extent that disclosure of the child’s personal health information was necessary for the lawful purpose of conducting a court-ordered assessment in the course of a Family Court proceeding, she consented to a court order in February 2019, after the filing of this complaint. The custodian states that she abided by the February 2019 consent order and continues to abide by it. The February 2019 consent order, provided by the custodian, orders her to provide the child’s personal health information to a specified health information custodian in connection with the court- ordered custody and access assessment. It also notes Dr. Leon’s objection to producing the child’s personal health information directly to the complainant on the basis of her belief that disclosure may lead to harm to the child and risk of harm to the child’s treatment and/or recovery. In his representations, the complainant acknowledges that the custodian has cooperated with the lawful purpose of conducting a court-ordered custody and access assessment in the context of a Family Court proceeding.

[33] The custodian also provides confidential representations that explain the basis for her concerns about the child’s well-being. I cannot repeat them here since they would reveal the content of the records at issue; however, I have considered them.

[34] The discretionary nature of section 29(a) means that the custodian may disclose records if she is satisfied that the conditions for disclosure are met. Since the custodian exercised her discretion under section 29(a) not to disclose the records, my authority is limited to deciding whether to uphold her exercise of discretion.

[35] The custodian took a number of factors into account in exercising her discretion not to disclose under section 29(a). She considered the complainant’s arguments, the signed consent to disclosure, and the 2016 court order and the wording of section 29(a), and she did not think there was a lawful purpose for the disclosure as required for the application of section 29(a). She also considered the February 2019 consent order and her compliance with it, and distinguished it from the 2016 court order in concluding that disclosure is not necessary for a lawful purpose. Finally, she considered the best interests of the child and the harm to the child that could result from disclosure. I find that all of the above considerations were proper and were taken in good faith and for a proper purpose. As a result, I uphold the custodian’s exercise of discretion under section 29(a) of PHIPA.

Disclosure without consent

[36] Section 29(b) prohibits disclosure of personal health information without the individual’s consent unless specific provisions set out in PHIPA apply. Section 6(3) of PHIPA provides clarification regarding provisions that permit health information custodians to disclose personal health information without the consent of the individuals to whom the personal health information relates. [12] Section 6(3) states, in part:

A provision of this Act that permits a health information custodian to disclose personal health information about an individual without the consent of the individual,

(a) does not require the custodian to disclose it unless required to do so by law;

(b) does not relieve the custodian from the legal requirement to disclose the information[.]

[37] Section 6(3) clarifies that a health information custodian considering sections of PHIPA that permit disclosure without consent is not required to disclose. Rather, the disclosure provisions set out exceptions for when health information custodians may disclose personal health information without violating their obligations under PHIPA. At the same time, PHIPA explicitly recognizes that health information custodians may be subject to mandatory legal requirements to disclose outside of PHIPA. [13] And while a health information custodian cannot relieve itself of other mandatory legal requirements by relying on PHIPA, PHIPA itself does not require disclosure – that requirement comes from other sources of law. [14]

[38] The complainant relies on two sections of PHIPA that permit custodians to disclose personal health information in specified circumstances without consent: sections 41(1)(d)(i) and 43(1)(h).

Section 41(1)(d)(i)

[39] Section 41(1)(d)(i) states:

A health information custodian may disclose personal health information about an individual,

(d) for the purpose of complying with,

(i) a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information [.]

The custodian had a duty to consider discretionary disclosure under section 41(1)(d)(i)

[40] In arguing that the custodian may disclose the records to him under the authority of section 41(1)(d)(i), the complainant relies on the 2016 court order, which contains the following provision:

The [complainant] shall have direct access to all professional information relating to [his son], such as medical and educational information.

[41] He argues that the 2016 court order continues to remain in place, and it is not mentioned in or restricted by the February 2019 consent order.

[42] Because the complainant provided the custodian with evidence – the 2016 court order – that the conditions for disclosure under section 41(1)(d)(i) may have been met, the custodian had a duty to consider discretionary disclosure under that section of PHIPA.

The custodian exercised her discretion under section 41(1)(d)(i) properly

[43] The custodian denies that section 41(1)(d)(i) applies. She argues that the 2016 court order was made before she was involved in the child’s care and well before she became aware of information giving rise to her grounds to suspect that the child was in need of protection. She argues that the subsequent order, the February 2019 consent order, which deals exclusively with records in her custody or control, is the applicable court order in this complaint. The custodian also notes her compliance with the February 2019 consent order. She submits that, if the 2016 court order applies to the complainant’s request for disclosure such that section 41(1)(d)(i) is applicable, section 41(1)(d)(i) is discretionary. She asserts that she has exercised her discretion and disclosed only the information that she does not feel would be harmful to the child (in the summary she prepared and disclosed to the complainant).

[44] I am satisfied that the custodian properly exercised her discretion not to disclose under section 41(1)(d)(i) of PHIPA. She considered proper factors, including the complainant’s arguments, the wording, significance and timing of the 2016 court order and the February 2019 consent order, and, importantly, the best interests of the child. The custodian also noted her compliance with the February 2019 consent order to provide the personal health information of the child to another custodian, appointed by the court, and her disclosure of a summary of the child’s personal health information and treatment to the complainant. I find that all of the above considerations were proper and were taken in good faith and for a proper purpose. I uphold the custodian’s exercise of discretion under section 41(1)(d)(i) of PHIPA.

Section 43(1)(h)

[45] Section 43(1)(h) states:

A health information custodian may disclose personal health information about an individual,

(h) subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada.

The custodian had a duty to consider discretionary disclosure under section 43(1)(h)

[46] In arguing that the custodian may disclose the records to him under the authority of section 41(3)(1)(h), the complainant asserts that section 16(5)  of the Divorce Act  and section 20(5) of the Children’s Law Reform Act are relevant. When the complainant submitted his representations, these sections read as follows:

Section 16(5)  of the Divorce Act :

Unless the court orders otherwise, a spouse who is granted access to a child of the marriage has the right to make inquiries, and to be given information, as to the health, education and welfare of the child. [15]

Section 20(5) of the Children’s Law Reform Act:

The entitlement to access to a child includes the right to visit with and be visited by the child and the same right as a parent to make inquiries and to be given information as to the health, education and welfare of the child.” [16]

[47] He argues that neither section 16(5)  of the Divorce Act  nor section 20(5) of the Children’s Law Reform Act limits his request for his child’s personal health information. He asserts that his request cannot be restricted by the custodian unless “any of the exceptions” set out in PHIPA applies. He notes the custodian’s claim that section 52(1)(e)(i) applies and he disputes that disclosure could be expected to result in a risk of serious harm to his child’s treatment or recovery. In support of his position, the complainant states that the custodian is no longer treating his child and, therefore, disclosure of the child’s personal health information is needed for continuity of care purposes. He adds that disclosure will also assist in the child’s recovery.

[48] Given the family’s circumstances, and because the complainant drew the Divorce Act  and the Children’s Law Reform Act provisions to the custodian’s attention, I accept that she had a duty to consider them and to consider whether the conditions for discretionary disclosure under section 43(1)(h) were met.

The custodian exercised her discretion under section 43(1)(h) properly

[49] The custodian denies that section 43(1)(h) applies. She argues that the statutory provisions relied on by the complainant – section 16(5)  of the Divorce Act  and section 20(5) of the Children’s Law Reform Act – provide for the right of the non-custodial parent to make inquiries and receive information. She submits that these provisions do not require her to disclose her office chart to the complainant. The custodian takes the position that the complainant has made inquiries, which he was entitled to do, and he has been provided with information as contemplated by these statutory provisions. Furthermore, she confirms that when she prepared the summary she provided to the complainant of his child’s personal health information, she removed any information she believes could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the child.

[50] I find that the custodian exercised her discretion not to disclose under section 43(1)(h) of PHIPA properly. She based her exercise of discretion, primarily, on her belief that disclosure would likely result in a serious risk of harm to the child.

[51] The custodian also took into account her disclosure of a summary of the child’s personal health information and treatment, in respect of the complainant’s right to make inquiries and receive information about his child’s health. This release of some personal health information by the custodian forms part of her exercise of discretion. While this release falls short of the complete disclosure of the records that the complainant seeks, it has provided the complainant with personal health information about his child and the treatment that the child received from the custodian. By providing the summary of the child’s personal health information to the complainant, the custodian has ensured that none of the personal health information of the mother was released to him, thereby satisfying her obligations under PHIPA as the custodian of the mother’s personal health information. I uphold the custodian’s exercise of discretion under section 43(1)(h) of PHIPA.

Conclusion and summary

[52] In respect of the complainant’s access request, I have found above that the complainant – a non-custodial parent who has only access rights to the child – is not a lawfully authorized substitute decision-maker for the child under PHIPA because he is not a “parent” of the child within the meaning of section 23(1). He therefore has no right of access to the child’s personal health information, on the child’s behalf, under PHIPA. I have also found that the 2016 court order granting “direct access” to “medical” information and the mother’s consent to disclosure do not give the complainant a right of access to the records under PHIPA.

[53] Regarding the complainant’s request for disclosure, the custodian had a duty to consider the request under the discretionary disclosure provisions at sections 29(a), 41(1)(d)(i) and 43(1)(h) of PHIPA that permit, but that do not require, the custodian to disclose the records to the complainant. I have found that the custodian considered the application of these provisions and properly exercised her discretion under them.

[54] I therefore uphold the custodian’s refusal of the complainant’s request and I dismiss this complaint.

[55] Finally, if the complainant believes that the custodian failed to comply with a legal requirement to disclose, he may wish to seek enforcement through the courts, including seeking enforcement of the 2016 court order. The IPC cannot order release of the personal health information at issue. [17]

NO ORDER:

1. For the foregoing reasons, I dismiss the complaint and issue no order.

Original Signed by:		June 30, 2022
Stella Ball
Adjudicator