Health Information and Privacy

Decision Information

Summary:

The complainant submitted a request under the Personal Health Information Protection Act (PHIPA or the Act) to the Ottawa Physiotherapy & Sport Clinic (the custodian) for access to his records of personal health information. The custodian issued a decision granting access to paper copies of the records upon payment of a fee of $150 for the processing of the request. The complainant filed a complaint with the Information and Privacy Commissioner of Ontario (the IPC) regarding the custodian’s fee and its refusal to provide the records in electronic format.

In this decision, the adjudicator finds that, by virtue of section 52(1.1), the complainant’s right of access to his records of personal health information includes the right to access them in electronic format. She orders the custodian to provide the complainant with the records in electronic format.

The adjudicator also considers the amount of fee which would be in keeping with the principle of “reasonable cost recovery” under section 54(11) to provide the records in electronic format. She finds that, if the records are provided on a physical storage device such as CD or USB, reasonable cost recovery is $153.75. She finds that if the records are instead transmitted electronically (for example, via secure email or as a password protected PDF sent by regular email), reasonable cost recovery is $143.75.

Finally, the adjudicator finds that the fees for providing the records in electronic format are instead of and not in addition to the fee for paper copies that has been already paid by the complainant. She also finds that the difference between the $150 fee already paid by the complainant and the fees that she has found to be in keeping with reasonable cost recovery for providing the records in electronic format is sufficiently negligible that the custodian is not permitted to charge the complainant for the difference if it is providing the records on a physical storage device nor is it required to provide a refund if the records are to be transmitted electronically.

Decision Content

Logo of the Information and Privacy Commissioner of Ontario, Canada / Logo du Commissaire à l'information et à la protection de la vie privée de l'Ontario, Canada

PHIPA DECISION 185

Complaint HA20-00090

Ottawa Physiotherapy & Sport Clinic

August 15, 2022

Summary: The complainant submitted a request under the Personal Health Information Protection Act (PHIPA or the Act) to the Ottawa Physiotherapy & Sport Clinic (the custodian) for access to his records of personal health information. The custodian issued a decision granting access to paper copies of the records upon payment of a fee of $150 for the processing of the request. The complainant filed a complaint with the Information and Privacy Commissioner of Ontario (the IPC) regarding the custodian’s fee and its refusal to provide the records in electronic format.

In this decision, the adjudicator finds that, by virtue of section 52(1.1), the complainant’s right of access to his records of personal health information includes the right to access them in electronic format. She orders the custodian to provide the complainant with the records in electronic format.

The adjudicator also considers the amount of fee which would be in keeping with the principle of “reasonable cost recovery” under section 54(11) to provide the records in electronic format. She finds that, if the records are provided on a physical storage device such as CD or USB, reasonable cost recovery is $153.75. She finds that if the records are instead transmitted electronically (for example, via secure email or as a password protected PDF sent by regular email), reasonable cost recovery is $143.75.

Finally, the adjudicator finds that the fees for providing the records in electronic format are instead of and not in addition to the fee for paper copies that has been already paid by the complainant. She also finds that the difference between the $150 fee already paid by the complainant and the fees that she has found to be in keeping with reasonable cost recovery for providing the records in electronic format is sufficiently negligible that the custodian is not permitted to charge the complainant for the difference if it is providing the records on a physical storage device nor is it required to provide a refund if the records are to be transmitted electronically.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3, Sched. A, sections 52(1.1) , and 54(10)  and (11) .

Decisions Considered: Orders HO-009, HO-014, PHIPA Decisions 17, 111, 132, 133 and 137.

OVERVIEW:

[1] This complaint addresses whether a fee charged by the Ottawa Physiotherapy & Sport Clinic (the custodian) for access to records of personal health information complies with the Personal Health Information Protection Act (PHIPA or the Act). It also addresses whether the custodian is required to provide access to the records in electronic format, as requested by the complainant, rather than paper format.

[2] As background, under PHIPA, the complainant sought access to his own records of personal health information held by the custodian. [1] The request stated:

I write to request copies of all [named individual’s] medical records related to the treatment of his neck and related issues…

[3] The complainant requested that the records be provided by fax or by email.

[4] The custodian granted full access to the records (475 pages) and advised that it was charging a fee of $150 to provide photocopies of the requested records. It provided an invoice for the total amount of $150; no breakdown of the fee was set out in the invoice.

[5] The complainant took the position that the fee charged by the custodian for access to paper copies of the records is too high. He advised the custodian that he would prefer to receive the records in electronic format, which he argued would result in a lower fee. The complainant also asked whether his records could be reviewed on-site for the purpose of scanning them by portable scanner. The custodian denied that request.

[6] The complainant paid the fee and received paper copies of the requested records.

[7] Subsequently, the complainant made a complaint to the Information and Privacy Commissioner of Ontario (the IPC) with respect to the fee charged by the custodian for access to paper copies of the records, which he views as too high. A mediator was assigned to attempt to facilitate a mediated resolution between the parties.

[8] During mediation, the custodian provided the following breakdown of the fee:

  • Admin Fee: (including the first 20 pages) = $30
  • Postage: $22.66
  • Photocopies (455 pages @ $.25 after the first 20 pages): $113.75
  • Total Cost not including tax: $166.41

[9] The custodian did not explain why the breakdown of the fee he provided at mediation totalled $166.41 rather than the $150 set out in the invoice sent previously to the complainant. This discrepancy was not clarified at mediation.

[10] Also, during mediation, the complainant confirmed that he had received paper copies of the requested records but reiterated that he wished to receive them in electronic format. He communicated his view that for records provided in electronic format, the custodian should not be permitted to charge for photocopies and submits that, in this case, the custodian’s fee should be reduced to $50.

[11] In response to the complainant’s position, the custodian stated that it believes that its fee of $150 is in accordance with the IPC’s previous decisions relating to fees under PHIPA. In addition, the custodian explained that it provided paper records to the complainant, in a secure manner, because it does not have the technological or financial capability to securely provide the requested records in electronic format.

[12] As the parties did not reach a mediated resolution, the file was transferred to the adjudication stage of the complaint process where an adjudicator may conduct a review.

[13] During my review into this complaint, I sought and received representations from both the custodian and the complainant on the issues. Representations were shared between them in accordance with the IPC’s confidentiality criteria which are set out in the document entitled PHIPA Complaint Procedure at the Adjudication Stage that was provided to the parties.

[14] For the reasons that follow, I find that, in accordance with section 52(1.1) of the Act, the complainant’s right of access to his records of personal health information includes the right to access them in electronic format. I order the custodian to provide the complainant with the records in electronic format.

[15] With respect to the amount of fee for providing access to the records in electronic format that would be in keeping with the principle of “reasonable cost recovery” set out in section 54(11) of the Act, I find that if the records are provided on a physical storage device such as CD or USB, reasonable cost recovery is $153.75. I find that if the records are instead transmitted electronically (for example, via secure email or as a password protected PDF sent by regular email), reasonable cost recovery is $143.75.

[16] Finally, I find that the fees for providing the records in electronic format are instead of and not in addition to the fee for paper copies that has already been paid by the complainant. This is because, at the time that the complaint paid the fee and the custodian provided him with paper copies, the custodian was already aware of the complainant’s request that he be provided with the records in electronic format and had refused to provide them in that format. I also find that the difference between the $150 fee already paid by the complainant for paper copies of the records and the fees that I find are in keeping with reasonable cost recovery for providing the records in electronic format is sufficiently negligible that the custodian is not permitted to charge the complainant for the difference if it is providing the records on a physical storage device, nor is it required to provide a refund if the records are to be transmitted electronically.

DISCUSSION:

[17] There is no dispute between the parties that the Ottawa Physiotherapy & Sport Clinic is a “health information custodian” as that term is defined in section 3(1) of the Act, or that the records at issue are records of “personal health information” as that term is defined in section 4(1) of the Act.

Is the custodian required to provide the complainant with the records in electronic format?

[18] The complainant has made it clear, and made it clear before the custodian prepared paper copies, that he prefers to receive the records in electronic format rather than the paper copies that the custodian provided. For the reasons below, I find that PHIPA requires the custodian to provide the records in electronic format because the complainant specifically requested that they be provided in that format.

[19] Section 52(1.1)  stipulates that an individual’s right of access to a record of personal health information includes the right of access to the record in an electronic format. [2] It reads:

The right to access a record of personal health information includes the right to access the record in an electronic format that meets that prescribed requirements, subject to any restrictions, additional requirements or exceptions that may be prescribed.

[20] Ontario Regulation 329/04 made under the Act does not contain any restrictions, additional requirements or exceptions that are relevant to section 52(1.1) .

Representations on the format of the records

Custodian’s representations

[21] The custodian submits that its physiotherapy clinic was established after purchasing another physiotherapy business and adds that all of the medical records were transferred from the physiotherapist who formerly operated the business.

[22] The custodian submits that because the complainant was a patient of the former physiotherapy business, all 475 pages of his records are in long-term storage in paper. The custodian submits that it noted the complainant’s request to receive the records electronically but decided that it was more secure to provide paper copies.

[23] In support of its decision to provide paper copies of the records rather than in electronic format, the custodian refers to its obligation to ensure the security of personal health information as set out in sections 12(1) and 13(1) of the Act. [3]

[24] The custodian notes that the IPC has stated that email systems should not be used for the purpose of collecting, using and disclosing personal information without adequate safeguards to protect privacy. [4]

[25] The custodian also observes that the IPC has stated that the determination of the method of secure transfer depends on the circumstances and those circumstances might include: [5]

  • the characteristics of the person or organization transferring records, meaning the size, sophistication and resources of the health information custodian,
  • the characteristics of the person or organization receiving the record, meaning whether the recipient has the ability to access the records through the method of transfer,
  • the number of individuals whose information is contained in the records,
  • the volume and frequency of the transfer, since transfers with a large volume of records of personal health information increase risks to privacy, and
  • availability of alternative methods of transfer and their associated risks.

[26] The custodian also notes that the College of Physiotherapists of Ontario (the college) has recommended to its licensees that, to protect personal health information when transferring physical files, the transfers should occur in a sealed envelope marked private and confidential, sent by Canada Post or a reputable courier with a strong privacy policy. The custodian also notes that, as per the terms set out in a document entitled The Personal Health Information Protection Act, 2004 , A Guide for Regulated Health Professionals, the college recommends that electronic information be either anonymized or encrypted before being transmitted. The custodian attached copy of this document to its representations. [6]

[27] The custodian submits that, in order to ensure that its records of personal health information are kept confidential and secure when transferred, its policy, as recommended by the college, is to transfer personal health information in paper format. It submits that it does not send health information by email or other electronic formats as its email is not a secure and encrypted service.

[28] The custodian submits that although the complainant suggested that the records be transferred by email or in CD or USB format, “these options were unavailable to [the custodian] considering the circumstances of the request.”

[29] The custodian submits that it does not have the financial means to license software to send medical records by encrypted and secured digital forms, including USB drive or CD for a single request. It submits that it determined that the most secure option available in the circumstances was to provide copies of the complainant’s medical records in paper format and send them by mail to the complainant.

Complainant’s representations

[30] In his representations, the complainant reiterates that it is his preference to receive the records in electronic format. He submits that he should be permitted to attend the custodian’s office and scan the records. Specifically, he states that the right to access records “includes a right to scan them with appropriate equipment at the custodian’s premises.” He submits that this “promotes the purpose of the Act to provide access to [records of personal health information] without unnecessary and arbitrary financial barriers.” He submits that “[t]here is effectively no difference between viewing records and taking scans of them while viewing them.”

[31] The complainant disagrees with the custodian’s argument that providing records in paper format is the most secure means of providing records. He submits:

While the complainant acknowledges that Health Information Custodians retain discretion to determine how to disclose records securely, that discretion must be exercised reasonably. [The custodian] offers no reasonable explanation or justification for not providing records on a CD or USB. It defies comprehension to suggest, as does [the custodian], that it would be required to encrypt records on a CD or USB if sending them by courier or post. Paper records sent by post are not encrypted. If intercepted, paper records are equally as vulnerable to unauthorized disclosure as an unencrypted USB or CD. Sending paper records by courier is no more secure than sending them digitized on an unencrypted USB or CD.

Custodian’s reply representations

[32] In reply, the custodian reiterates that its decision to provide paper copies was justified because it provides the most secure means to protect the complainant’s records. It also submits that the right to access records of personal health information does not include the right to attend the custodian’s premises to make copies of the records, which could compromise the security of other health information stored by the custodian.

The custodian must provide the complainant with records in electronic format

[33] The complainant states, and the custodian does not dispute, that he requested to receive the records in electronic format. However, despite the complainant’s request, the custodian provided the paper copies of the records. The complainant submits that in order to ensure that its records of personal health information are kept confidential and secure when transferred, its policy, as recommended by the college, is to transfer personal health information in paper format. It submits that it does not send health information by email or other electronic format as its email is not a secure and encrypted service. It further submits that it does not have the financial means to transmit records in electronic format, securely.

[34] I acknowledge the custodian’s position that it does not have the financial or technological means to maintain the security of the complainant’s records of personal health information if it were to provide them in an electronic format. However, as section 52(1.1)  explicitly provides for an individual’s right to receive records in electronic format, in my view the custodian has a duty to explore and implement appropriate measures while ensuring compliance with the Act, including with sections 12(1) and 13(1), which the custodian referenced in its representations.

[35] Although the custodian submits that its email is not a secure and encrypted service, the IPC accepts that mailing an encrypted or password protected USB containing the records or emailing a password protected PDF version of the records is a reasonably secure manner of providing access to them.

[36] With respect to the complainant’s request to scan the records at the custodian’s premises, I disagree that it forms part of the right to access under PHIPA. There is nothing in the Act that stipulates either explicitly or implicitly that the right of access includes the right for a requester to scan the records himself (or through his lawyer). I accept the custodian’s decision to decline this request on the basis that it might compromise the security of personal health information of other individuals, particularly in light of the custodian’s duty under the Act to maintain the security of records. [7] As a result, I find that the custodian is not required to permit the complainant to attend its premises for the purposes of scanning the records.

What is the amount of reasonable cost recovery allowable under section 54(11) of the Act, for the custodian to provide the records in electronic format?

[37] I have found that, in the circumstances, the custodian must provide the complainant with the records in electronic format, rather than in paper format. I will now consider what amount of fee is in keeping with the principle reasonable cost recovery under section 54(11) of the Act for the custodian to provide the records in electronic format. As the complainant has always been clear that it is his preference to receive the records in electronic format, I will not review the custodian’s fee to provide the records in paper format.

[38] Sections 54(10) and (11) of the Act provide custodians with the discretion to charge a fee for providing an individual with access to their own personal health information. These sections state:

54 (10) A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[39] Section 54(11) of the Act prohibits a health information custodian from charging a fee that exceeds “the prescribed amount” or the “amount of reasonable cost recovery.” As of the date of this decision, there is no regulation that prescribes fees for access under PHIPA. The IPC has the authority, pursuant to Part VI of the Act, to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery” within the meaning of the Act.

[40] The expression “amount of reasonable cost recovery” is not defined in the Act. However, the IPC has previously considered the meaning of this phrase for the purposes of the fee provisions in PHIPA. [8] Applying the modern rule of statutory interpretation, the IPC has concluded that the phrase “reasonable cost recovery” does not mean “actual cost recovery,” or full recovery of all the costs borne by a health information custodian in fulfilling a request for access to an individual’s own personal health information. [9] The IPC has also concluded that the use of the word “reasonable” to describe cost recovery suggests that costs should not be excessive, and that, as a whole, section 54(11)  must be interpreted in a manner that avoids creating a financial barrier to the important purpose of the Act, which is to provide a right of access to one’s own personal health information. [10]

[41] These past orders and decisions concluded that a fee scheme set out in a proposed regulation to the Act, published by the Minister of Health and Long-Term Care in 2006 (the “2006 framework”), [11] though never adopted, provides the best framework for determining the amount of “reasonable cost recovery” under the Act. I agree with this reasoning, and will apply the 2006 framework in this decision.

[42] The 2006 framework establishes a set fee that custodians may charge to complete specifically defined work required to respond to a request. It also prescribes the fees that custodians may charge over and above that set fee. The 2006 framework reads, in part, as follows:

Fees for access to records

25.1(1) For the purposes of subsection 54(11) of PHIPA, the amount of the fee that may be charged to an individual shall not exceed $30 for any or all of the following:

1. Receipt and clarification, if necessary, of a request for a record.

2. Providing an estimate of the fee that will be payable under subsection 54(10) of the Act in connection with the request.

3. Locating and retrieving the record.

4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access or disclosure may or shall be refused.

5. Preparation of a response letter.

6. Preparation of the record for photocopying, printing or electronic transmission.

7. Photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages, excluding the printing of photographs from photographs stored in electronic form.

8. Packaging of the photocopied or printed copy of the record for shipping or faxing.

9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping or faxing the printed copy.

10. The cost of faxing a copy of the record to a fax number in Ontario or mailing a copy of the record by ordinary mail to an address in Canada.

11. Supervising examination of the original record for not more than 15 minutes.

(2) In addition to the fee charged under subsection (1), fees for the services set out in Column 1 of Table 1 shall not, for the purposes of subsection 54(11)  of [the Act], exceed the amounts set out opposite the service in Column 2 of the Table.

[43] Section 25.1(2) of the 2006 framework indicates that a custodian may charge fees over and above the set $30 fee in amounts that are set out in the following table:

ITEM

COLUMN 1

COLUMN 2

1

For making and providing photocopies or computer printouts of a record

25 cents for each page after the first 20 pages

2

For making and providing a paper copy of a record from microfilm or microfiche

50 cents per page

3

For making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form

$10

4

For making and providing a microfiche copy of a record stored on microfiche

50 cents per sheet

5

For making and providing a copy of a microfilm of a record stored on microfilm that is,

 

 

16 mm

$25 per reel

 

35 mm

$32 per reel

6

For printing a photograph from a negative or from a photograph stored in electronic form, per print,

 

 

measuring 4” ´ 5”

$10

 

measuring 5” ´ 7”

$13

 

measuring 8” ´ 10”

$19

 

measuring 11” ´ 14”

$26

 

measuring 18” ´ 20”

$32

7

For making and providing a copy of a 35 mm slide

$2

8

For making and providing a copy of an audio cassette

$5

9

For making and providing a copy of a ¼”, ½” or 8mm video cassette,

 

 

that is one hour or less in length

$20

 

that is more than one hour but not more than two hours in length

$25

10

For making and providing a copy of a ¾” video cassette,

 

 

that is not more than 30 minutes in length

$18

 

that is more than 30 minutes but not more than one hour in length

$23

11

For producing a record stored on medical film, including x-ray, CT and MRI films

$5 per film

12

For the review by a health information custodian or an agent of the custodian of the contents of a record to determine if the record contains personal health information to which access or disclosure may or shall be refused

$45 for every 15 minutes after the first 15 minutes

13

For supervising examination of original records

$6.75 for every 15 minutes

Representations

Custodian’s representations on the breakdown of the fee

[44] The custodian submits that its fee of $150, which it set out in its original invoice, is within the range of reasonable cost recovery and in compliance with the Act.

[45] Although the original invoice that the custodian provided to the complainant set the fee at $150 without any further breakdown, in its representations, the custodian submitted a breakdown of a fee totalling $150.16. [12] The breakdown of the $150.16 set out in the custodian’s representations is as follows:

  •  

Search Time (30 minutes):

$ 15.00

  •  

Preparation Time (35 minutes):

$ 17.50

  •  

Postage:

$ 22.66

  •  

Photocopying 475 pages:

$ 95.00

[46] The custodian submits that all 475 pages of the complainant’s records are in long-term storage in paper format only. As it determined that it was more secure to provided the records in paper copy, it submits that the records needed to be photocopied in order to be provided to complainant. The custodian also submits that it took “several hours” of staff time to “photocopy and produce” the records.

[47] As it did in mediation, the custodian submits that had it applied the 2006 framework to the request, it would be entitled to charge a total fee of $166.41. [13] It explains that the fee that it is entitled to charge can be broken down as follows:

  •  

Search, preparation and photocopying of first 20 pages:

$ 30.00

  •  

Photocopying remaining 455 pages at $0.25 per page:

$113.75

  •  

Postage:

$ 22.66

[48] Addressing the fee it charged for photocopying, the custodian submits that had it calculated the fee in accordance with the 2006 framework and PHIPA Decision 111, it would be entitled to charge the $30 flat fee to photocopy the first 20 pages, and then $0.25 for each of the remaining 455 pages for a total of $143.75, rather than the $95 that it charged.

[49] Regarding the postage fee, the custodian submits that because it decided to provide the complainant with paper copies of the records and they needed to be sent by mail, it was reasonable for it to recover the cost of postage in the amount of $22.66.

[50] The custodian submits that the fee that it was entitled to charge under the 2006 came to a total of $166.41, which is $16.41 more than the fee of $150 that it quoted to the complainant for the processing of the request. The custodian suggests that because the fee that it charged was less than the amount it was entitled to charged, it should be considered to be “reasonable cost recovery” within the meaning of section 54(11)  and in compliance with the Act.

[51] The custodian notes that the complainant did not request a fee waiver under section 52(12) of the Act or provide any evidence to support a conclusion that the complainant is entitled to one in the circumstances of this case.

Complainant’s representations

[52] The complainant submits that access to records of personal health information under PHIPA is intended to be based on the principle of reasonable cost recovery as contemplated by section 54(11) . He submits that decisions issued by the IPC, including Order HO-009 and PHIPA Decision 111, have made it clear that “reasonable cost recovery” does not mean complete cost recovery.

[53] The complainant submits that under PHIPA, custodians are entitled to recover costs associated with producing copies of health records. He submits, however, that the principles of cost recovery in PHIPA are not to provide a custodian with a new revenue stream but to provide affordable access to one’s own records of personal health information.

[54] The complainant notes that PHIPA Decisions 111 and 132 determined that reasonable cost recovery for scanning paper records to be provided in digital format was the same rate as for photocopying, which is $.20 per page. He submits that $.20 per page is not reasonable cost recovery for scanning and the precedent set in PHIPA Decision 111 should be abandoned. [14]

[55] The complainant submits that there is no relationship between the cost of scanning and cost of printing and photocopying. He submits that as opposed to printing and photocopying, when scanning, “custodians incur no out-of-pocket expenses” other than the cost of staff labour. The complainant submits that although the custodian did not provide an estimate of the cost of labour for scanning the documents, using a “typical office scanner with a modest capacity of 50 pages per minute, a reasonable time estimate for scanning the records is approximately 10 minutes or less.” The complainant submits that “reasonable cost recovery for scanning the records would amount to 10 minutes of staff time plus $10 for the cost of a CD or USB” and therefore, “[t]he $30 flat fee more than covers the [custodian’s] reasonable out-of-pocket expenses for scanning 455 pages.”

Custodian’s reply representations

[56] In reply, the custodian disagrees with the complainant’s submission that cost recovery under PHIPA is a business opportunity for the custodian. It also disagrees with the complainant’s suggestion that the cost of scanning records is less than photocopying records. It submits that the costs of scanning and printing records, to make them available electronically, includes various equipment costs and staff time, neither of which are fully recoverable.

Reasonable cost recovery to providing access to the records in electronic format

[57] While section 52(1.1) requires the custodian to provide the complainant with access to his medical records in an electronic format, the custodian is still entitled to reasonable cost recovery for the provision of those records. For the reasons set out below, I find that in the circumstances here, reasonable cost recovery for providing records in electronic format is either $153.75 or $143.75, depending on the means of transmission of those records. I find that both options can be achieved securely and the complainant is entitled to choose between the options.

[58] In this case, the custodian submits, and I accept, that all of the responsive records exist only in paper format and for them to be made available in electronic format they must be scanned. Neither the Act nor the 2006 framework address fees for the scanning of paper records to make them available to a requester in electronic format. Section 25.1 (1) of the 2006 framework includes in the $30 set fee, the electronic transmission of a copy of the electronic record (instead of printing a copy of the record and shipping or faxing the printed copy), but indicates that the record must exist in electronic form. Table 1, which outlines fees that a custodian can charge over and above the $30 set fee, includes fees “[f]or making and providing photocopies or computer printouts of a record” [15] as well as a flat fee of $10 “[f]or making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form.” [16] Therefore, the 2006 framework only considers the provision of records in electronic format if the records already exist in electronic form.

[59] In PHIPA Decision 111, I found that a custodian can charge a fee for scanning records in order to provide them to the complainant on CD if the records are not already available in electronic format and do not require severing. In that decision, I considered the activity of scanning records that exist only in paper format to be a necessary component of making them available on CD. I found that a custodian may charge fees for scanning and determined that such fees should be calculated at the same rate as the photocopying charges set out in the 2006 framework.

[60] In my view, the reasoning set out in PHIPA Decision 111 regarding scanning paper records in order to provide them to an individual on CD is also applicable here, where existing paper records need to be photocopied and/or scanned in order to be provided to the complainant in electronic format.

[61] The 475 pages of the complainant’s medical records exist only in paper format. As a result, providing these records to the complainant in electronic format would require them to be scanned. The custodian is therefore entitled to charge scanning fees at the same rate as for photocopying under the 2006 framework ($0.25 per page for each page beyond the initial 20 pages).

[62] I acknowledge the complainant’s argument that in the process of scanning documents as opposed to printing and photocopying, “custodians incur no out-of-pocket expenses” other than the cost of staff labour to scan records. I disagree. While, in scanning, there may not be costs incurred for ink or for paper, there are other costs involved, including, but not limited to, costs related the purchase and maintenance of not only the equipment that performs the task of scanning but also the computers required to collect and store the digital data that results from scanning and the software that enables them to do so. Nevertheless, in my view, the difference in costs related to photocopying or scanning of records is not the only factor relevant to the determination of the fees that can be charged for either of these two activities.

[63] While scanning paper records to make them available to a requester in electronic format and photocopying paper records are different activities, neither the Act nor the 2006 framework list fees for activities that could be considered to be analogous to scanning or present another logical means of calculating fees for scanning records. No regulations setting legislated amounts that health information custodians can charge under the Act have been enacted. There being no persuasive evidence to support an alternative method of calculating fees for the scanning of paper records to make them available to the complainant in electronic format, I agree with the reasoning applied in PHIPA Decision 111 and find that a charge of $0.25 per page for scanning after the first 20 pages is in keeping with the principle of reasonable cost recovery at section 54(11) of the Act.

[64] Item 3 of Table 1 of section 25(2.1) of the 2006 framework includes a $10 fee “[f]or making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form.” As the records at issue in this appeal exist in paper format, the act of scanning them turns them into records stored in electronic format. In keeping with Item 3, once the records are available in electronic format, the custodian is permitted to charge a $10 fee for storing (making) and providing those records that now exist in electronic format by CD. Although not specifically mentioned in Item 3, I find that the same charge is reasonable for the provision of records any other similar device used for storing electronic records, such as on USB, which is now more commonly used. This finding is in keeping with PHIPA Decision 143, in which the adjudicator allowed a fee of $10 for records to be provided on USB.

[65] Accordingly, where the custodian provides the requested records, in electronic format, to the complainant on a storage device such as CD or USB as the chosen electronic format, as set out in Item 3 of Table 1 it is permitted to charge $10 for that storage device and I find that this amounts to reasonable cost recovery in keeping with section 54(11) of the Act.

[66] However, where the custodian provides the requested records, in electronic format, to the complainant through electronic means such as via secure email, or as a password protected PDF via regular email, rather than a on a storage device, the custodian is not permitted to charge the $10 fee in Item 3 of Table 1, because a storage device is not being used.

Conclusion

[67] Above I have found that under section 52(1.1) of the Act the complainant is entitled to receive access to his client’s records of personal health information in electronic format and the custodian must provide them in that format.

[68] I have considered the fee that the custodian may charge for providing the records in electronic format in light of the 2006 framework and the principle of reasonable cost recovery in section 54(11) of the Act. I find that if the custodian provides the records in electronic format on a storage device such as a CD or USB, a total fee of $153.75 is in accordance with the principle of reasonable cost recovery. However, if the custodian transmits the records in electronic format to the complainant electronically (for example, by secure email or as a password protected PDF via regular email), the custodian is not permitted to charge $10 for a storage device as contemplated in Item 3 of Table 1. Where records in electronic format are transmitted electronically, I find that the amount of reasonable cost recovery and the amount that the custodian is permitted to charge, is $143.75. The complainant is entitled to choose which option to use.

[69] For the sake of clarity, the breakdown of each of these fees is as follows:

 

Fee if electronic records are provided on a storage device

Fees if electronic records are transmitted electronically

Flat rate fee for the tasks set out in section 25.1(1) of the 2006 framework including:

15 minutes of review

Photocopying (or scanning the first 20 pages)

packing and mailing the records

postage

administrative tasks

$30.00

$30.00

Fee for scanning the remaining pages of paper records to make them available in electronic format ($0.25 per page for 455 pages of records).

$113.75

$113.75

Fee for making and providing the records in electronic format available on CD or USB (only to be charged it the records are to be provided in one of these manners)

$10.00

N/A

Total Cost

= $153.75

= $143.75

[70] As I stated above, the fees for providing the records in electronic format are instead of and not in addition to the $150 fee for paper copies that has already been paid by the complainant. I also find that the difference between the $150 fee already paid by the complainant for paper copies of the records and the fees that I find are in keeping with reasonable cost recovery for providing the records in electronic format is sufficiently negligible that the custodian is not permitted to charge the complainant for the difference if it is providing the records on a physical storage device, nor is it required to provide a refund if the records are to be transmitted electronically. Accordingly, I uphold the custodian’s fee of $150 on the basis that it is in keeping with the principle of reasonable cost recovery under section 54(11)  to provide the records to the complainant in electronic format.

ORDER:

  1. I order the custodian to provide complainant with the records in an electronic format.
  2. I uphold the complainant’s fee of $150.

Original Signed by:

 

August 15, 2022

Catherine Corban

 

 

Adjudicator

 

 

 



[1] In this case, the request and subsequent complaint were made by a lawyer, on behalf of his client, the individual whose records of personal health information were requested. In this decision, despite having been represented by a lawyer throughout the complaint process, I will refer to the individual, who seeks access to his own personal health information, as the complainant.

[2] Personal Health Information Protection Act,  2004 , as amended by An Act to Amend Various Statutes, 2020, c. 5, Sched 6, s. 9. This amendment pre-dates the complainant’s request for access under PHIPA.

[3] Sections 12(1) and 13(1) of the Act read:

12(1) A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.

13(1) A health information custodian shall ensure that the records of personal health information that it has in its custody or under its control are retained, transferred and disposed of in a secure manner in accordance with the prescribed requirements, if any.

[4] Information and Privacy Commissioner of Ontario, Privacy Protection Principles for Electronic Mail Systems, February 1994; Information and Privacy Commissioner of Ontario, Fact Sheet Communicating Personal Health Information by Email, September 2016.

[5] Information and Privacy Commissioner of Ontario, Fact Sheet #18 on the Secure Transfer of Personal Health Information.

[6] The College of Physiotherapists of Ontario, The Personal Health Information Protection Act, 2004 , A Guide for Regulated Health Professionals.

[7] See sections 12(1) and 13(1) of the Act, for example.

[8] See, for example, Orders HO-009 and HO-014.

[9] Orders HO-009, HO-014, and PHIPA Decision 17.

[10] Orders HO-009, HO-014, and PHIPA Decision 17.

[11] Notice of Proposed Regulation under PHIPA, published in Ontario Gazette Vol 139-10 (11 March 2006). Available online here: http://files.onatriogovernment.ca/gazettedocs/139-10.pdf.

[12] The custodian did not provide any explanation as to the $0.16 discrepancy between the fee set out in the original invoice and the fee broken down in its representations.

[13] This is the same breakdown of the fee that it provided at mediation.

[14] Although in his submission, the complainant states that the rate for photocopying applied in PHIPA Decisions 111 and 132 was $.20 per page, this is incorrect. The rate set out in section 25.1(2) of the 2006 framework and applied in those decisions is $.25.

[15] See Item 1 of Table 1 to the 2006 framework.

[16] See Item 3 of Table 1 to the 2006 framework.

 You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.