Health Information and Privacy

Decision Information

Summary:

The complainant requested access to an electronic file containing his personal health information. The custodian granted the complainant partial access to responsive records claiming that disclosure of the names of certain individuals withheld would give rise to the harm contemplated in the exemption at section 52(1)(e)(i) (harm to patient or others) of the Personal Health Information Protection Act. The complainant filed a complaint with the Information Privacy Commissioner of Ontario seeking access to the withheld names. The complainant also argued that further responsive records should exist.
In this interim decision, the adjudicator upholds the custodian’s search for records. However, she defers consideration of the possible application of the exemption at section 52(1)(e)(i) pending the complainant’s written confirmation that he continues to seek access to the withheld names and the subsequent notification of these individuals.

Decision Content

Logo of the Information and Privacy Commissioner of Ontario, Canada / Logo du Commissaire à l'information et à la protection de la vie privée de l'Ontario, Canada

PHIPA DECISION 189

Complaint HA19-00109

Canadian Mental Health Association - Waterloo Wellington

October 21, 2022

Summary: The complainant requested access to an electronic file containing his personal health information. The custodian granted the complainant partial access to responsive records claiming that disclosure of the names of certain individuals withheld would give rise to the harm contemplated in the exemption at section 52(1)(e)(i) (harm to patient or others) of the Personal Health Information Protection Act. The complainant filed a complaint with the Information Privacy Commissioner of Ontario seeking access to the withheld names. The complainant also argued that further responsive records should exist.

In this interim decision, the adjudicator upholds the custodian’s search for records. However, she defers consideration of the possible application of the exemption at section 52(1)(e)(i) pending the complainant’s written confirmation that he continues to seek access to the withheld names and the subsequent notification of these individuals.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, sections 2 , 3(1) , 4(1) , 52(1) (e)(i).

Decisions, Orders and Investigation Reports Considered: PHIPA Decision 34.

BACKGROUND AND OVERVIEW:

[1] This interim decision partially resolves a complaint regarding an access decision under the Personal Health Information Protection Act (PHIPA) by the Canadian Mental Health Association – Waterloo Wellington (the custodian or CMHA WW).

[2] The complainant received various services from the custodian. The complainant accessed support from the custodian’s crisis line, staffed by the custodian’s emplo yees. The custodian also provides employment services to individuals by partnering with community agencies staffed by job counsellors and other individuals, such as consultants paid by the community agencies. The agencies work with individuals by providing employment support services such as, but not limited to, pre-employment, job search, and interview skills along with job coaching services. The complainant received such services from the custodian. For the remainder of this decision, I will refer to the individuals providing employment support services as job counsellors.

[3] The complainant accessed services from the custodian until it communicated its decision to the complainant that it would be terminating services. Before the complainant’s services were terminated, the custodian called the police, which resulted in the creation of records authored by the police that were placed in the complainant’s file.

[4] The complainant also worked with a private psychotherapist from approximately October 2014 to October 2016, when there was a breakdown in their professional relationship. The complainant refers to this individual, using her full name, and describes her as his “original mental illness caregiver.” For the remainder of this decision, I will refer to this individual as the complainant’s former psychotherapist. [1] Most of the references in the records to the complainant’s psychotherapist appear in the context of the complainant sharing information about his mental health history with crisis staff.

[5] On April 1, 2019, the custodian received an emailed access request from the complaint seeking “a copy of [his] files in electronic format.”

[6] On April 26, 2019, the custodian issued an access decision under PHIPA granting the complainant partial access to responsive records, citing section 52 (harm to patient or others) to withhold portions of the records.

[7] The complainant filed a complaint with the Information and Privacy Commissioner of Ontario (IPC) and a mediator was assigned to explore settlement with the parties.

[8] During mediation, the custodian issued a revised decision on August 29, 2019 clarifying its position that the withheld portions of the records qualified for exemption under section 52(1)(e)(i). The custodian’s revised access decision also indicated that the complainant was granted access to his full file, but for the names of certain “CHMA WW staff.” However, the complainant was granted access to the names of CHMA WW staff members in leadership positions and of a staff member who consented to their name being released to the complainant. The name of the complainant’s current psychotherapist was also released.

[9] After reviewing the severed records provided to him, the complainant informed the mediator that the custodian had withheld the names of individuals who were not employed by the custodian (non-CHMA WW staff) despite previously agreeing to grant him access to this information. The complainant also took the position that the custodian’s search for responsive records should have identified at least two further client risk assessment reports.

[10] The complainant sent an email directly to the custodian about the client risk assessment reports he believed the custodian’s search should have located. The email stated:

. . . [P]lease provide (from my count) the two outstanding client risk assessments including the Doctors or qualified individuals names whom conducted the client risk assessment to support CMHAWW decisions to ban me and ensure my safety and well being.

[11] In response, the custodian issued a revised access decision, dated October 4, 2019 to the complainant addressing both of his concerns and stated:

[I]t was a non-intended oversight on my part that I did not expressly state in the decision letter, that we were redacting not only CMHA WW staff names but also the names of non-CMHA WW individuals who contributed to your CMHA WW client record.”

[12] The custodian indicated in its October 4, 2019 access decision that the names of individuals not in its employ, such as the complainant’s former psychotherapist and job counsellors, were redacted under section 52(1)(e)(i) along with the names of staff members employed by the custodian. With respect to the complainant’s request for his client risk assessments, the custodian’s letter informed the complainant that the custodian was satisfied that the complainant had received a copy of his complete file and that no further records exist.

[13] At the end of mediation, the complainant confirmed that he continues to pursue access to the withheld names contained in the records. [2] The complainant also indicated that he was not satisfied with the custodian’s explanation regarding the requested client risk assessments.

[14] As the complaint was not resolved during mediation, it was transferred to the adjudication stage of the complaints process in which an adjudicator may conduct a review. A review proceeded and the parties were invited to provide written representations in support of their positions, which they did. The non-confidential portions of the custodian’s representations were shared with the complainant in accordance with the confidentiality criteria set out in the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act ,  2004 . The complainant requested that his representations not be shared with the custodian. After sending his representations, the complainant sent two emails to the IPC. The complainant’s representations and emails are summarized below and will be referred to as the complainant’s submissions.

[15] The file was transferred to me to continue the adjudication of the complaint. In this decision, I dismiss the complainant’s arguments that the custodian should not be allowed to revise its original access decision by clarifying that all staff names are at issue (not just staff in the employ of the custodian), and I conclude that the custodian conducted a reasonable search for responsive records. However, I defer consideration of the exemption at section 52(1)(e)(i) pending the complainant’s written confirmation that he continues to seek access to the withheld names, which will necessitate the notification of these individuals as affected parties. In the interim, I direct the custodian to turn its mind to some potential issues with the manner in which it has severed records.

RECORDS:

[16] The records consist of 455 pages.

[17] Many of the records consist of medical assessments, reports, correspondence and call contacts from individuals, such as crisis line workers, providing health care services to the complainant. Other records appear to relate to hospital or emergency services the complainant accessed in another jurisdiction. These records appear to have been sent to the custodian, with the complainant’s consent, to provide his medical history. For the remainder of this order, I will refer to the types of records described in this paragraph as the “category 1 records.”

[18] As noted in the background section of this decision, some of the records located were created as the result of the complainant’s accessing employment services through a community agency that partnered with the custodian. Also located are police records that were apparently provided to the custodian which identify the name and badge number of officers responding to calls related to the complainant. For the remainder of this order, I will refer to the types of records described in this paragraph as the “category 2 records.”

[19] Based on my review of the records, it appears that most of the records which identify the former psychotherapist are contained in notations made by crisis or job counselling staff who recorded information the complainant provided them. For example, the complainant shared information with crisis staff about his mental health history, including his recollection of the services he received from his former psychotherapist. Accordingly, the records in this complaint do not appear to overlap with the records the complainant was denied access to in PHIPA Decisions 100 and 113. At issue in those decisions were the former psychotherapist’s own records relating to the complainant.

[20] The complainant, in accessing services from the custodian, signed various consent forms which allowed the custodian and employment agency to exchange information about him with his former and present therapists. Accordingly, there are instances in which the employment agency contacted the complainant’s therapists directly. The therapists, at times, sent letters or other correspondence in response which became part of the complainant’s file. In addition, in some instances these types of records themselves reveal that the writer shared the content of the correspondence with the complainant before it was sent to the custodian.

[21] For instance, on August 30, 2016 the complainant’s former psychotherapist sent a letter to crisis staff providing background information with the aim of the complainant receiving better supports. The letter indicates that the content of the letter was shared with the complainant before it was sent to the custodian. However, the custodian, in processing the complainant’s access request under PHIPA, withheld the complainant’s former psychotherapist’s name while releasing the remaining parts of the letter.

[22] In other instances, I note that the custodian withheld the full name of individuals acting in their professional capacity but released business addresses, telephone numbers or email addresses that could identify these same individuals. The portions of the records released to the complainant indicate that the complainant was referred to these individuals to pursue job leads or set up informational interviews. In addition, the name of a consultant the job agency proposed to hire to provide additional job coaching services to the complainant is withheld, though the name of the consultant’s firm was released in other instances and the records themselves indicate that the complainant met with this individual and was blind copied on emails the job agency sent this individual. Finally, the custodian withheld the names of individuals, such as the complainant’s lawyer and accountant, where it appears that the complainant himself provided their names to a job counsellor.

[23] At issue in the records are the names, or parts of names, that the custodian has withheld from the records.

PRELIMINARY ISSUE:

Should the custodian be allowed to revise its April 27, 2019 access decision?

[24] Throughout his submissions, the complainant asks the IPC to enforce the “original agreement” between him and the custodian. The “agreement” the complainant refers to consists of the following paragraphs in the custodian’s decision letter, dated April 27, 2019 which states:

Please see the updated “Index of Records” relating to your request. It includes a general description of service you received at CMHA WW and indicates that we are providing you with your full CMHA WW file apart from all staff names.

We have made the decision to provide you access to your CMHA client file but will keep the identity of staff confidential.

[25] The complainant argues that the reference to “staff” in the access decision demonstrates the custodian’s decision to only withhold the names of certain individuals in its employ, but release the names of other individuals identified in the records. The complainant submits that the custodian should not be allowed to retract its original position of releasing the names of individuals whose names appear in the records, but do not work for the custodian. These individuals include, but are not limited to, the complainant’s former psychotherapist, police officers, job counsellors, and health care providers or other individuals whose names appear in the record in their professional capacity, but who are not employed by the custodian.

[26] During mediation, the custodian submitted that it was never its intention to release the names of these latter individuals as it takes the position that the exemption at section 52(1)(e)(i) applies. As mentioned above, the custodian issued a revised decision letter, dated October 4, 2019 clarifying that “it was a non-intended oversight on [its] part that [it] did not expressly state in the decision letter, that [it was] redacting not only CMHA WW staff names, but also the names of non-CMHA WW individuals who contributed to [the complainant’s file].” [3]

[27] The complainant does not accept the custodian’s explanation and demands that the IPC enforce the “original agreement.” The complainant says that he should not be punished for the custodian’s “incompetence.” The complainant also argues that the IPC’s failure to enforce the agreement violates his human rights, is an example of discrimination and is an abuse of process.

[28] I disagree with the complainant’s position and find that the custodian was entitled to clarify its position set out in its April 26, 2019 access decision. The custodian’s initial decision was not an “agreement”, but a decision. In any event, the original decision did not limit the exemption claim to certain staff and the later clarification the custodian provided was not necessary given the circumstances of the complaint. I find that there was no need for the custodian to differentiate between individuals employed by the custodian and those not employed by the custodian in its original access decision. Accordingly, the use of the term “staff” was appropriate in the circumstances.

[29] Accordingly, I accept that all the names withheld by the custodian must be considered under the custodian’s claim that section 52(1)(e)(i) applies.

[30] First, however, I will address the complainant’s claim that the custodian’s search for responsive records was not reasonable.

ISSUES:

  1. Did the custodian conduct a reasonable search for client risk assessment reports?
  2. Do the records contain “personal health information” of the complainant as defined in section 4(1) of PHIPA?
  3. Does the exemption to the right of access to the complainant’s own personal health information in section 52(1)(e)(i) of PHIPA apply?

DISCUSSION:

A. Did the custodian conduct a reasonable search for client risk assessment reports?

Representations of the parties

[31] The complainant takes the position that the custodian’s search should have located at least two additional client risk assessment reports. Based on the information provided by the complainant, it appears that for several years, he has been seeking answers from the custodian regarding its decision to initially limit and subsequently cancel its services to him. The complainant has done this by making direct inquiries to the custodian in addition to filing the present access request under PHIPA.

[32] After his review of the records provided to him under PHIPA, the complainant filed a complaint with the IPC and told the mediator that he thought that additional records should exist. The complainant subsequently sent an email to the custodian directly (copied to the mediator) on October 9, 2019. The email stated:

May I please request the client risk assessment the CMHAWW conducted before my first and last banning from all services in the CMHAWW jurisdiction. So far [what] I have seen by the documentation and recent actions presented [is CMHAWW’s concern] with societal safety precautions; however, where is the supporting documentation that my own safety and well being was even a consideration in the process of being banned?

… please provide (from my count) the two outstanding client risk assessments including the Doctors or qualified individuals names [sic] whom conducted the client risk assessment to support CMHAWW decisions to ban me and ensure my safety and well being.

[33] The custodian provided a response on October 22, 2019 stating that the complainant had been provided with his complete file and thus no further records relating to a client risk assessment exist. The custodian’s response says that its letter sent to the complainant the year [4] before explained that no client risk assessment reports were created related to its decision to stop providing services to the complainant. The custodian’s October 19, 2018 letter responded to the complainant’s email dated October 5, 2018 requesting an explanation regarding the custodian’s decision to terminate services. [5] In its representations, the custodian states:

CMHA WW at that time, did not compile one consolidated Risk Assessment report to make this determination. The complainant was looking for a formal risk assessment document compiled at that time, and one does not exist. If such a formal, consolidated Risk Assessment at that time was made, we would have no reason not to provide it. CMHA WW has provided the [complainant] all documents that speak to risk assessments which include the email communications and letters that provide the rationale as to why CMHA WW services were discontinued and alternative services provided, paid for by CMHA WW…

[34] The custodian provided the IPC with copies of emails it exchanged with the complainant in 2018 which it says “clearly explains the rationale as to why the decision to terminate [services with the complainant] was made.” The custodian also says in its representations that it has provided the complainant with a Psychiatric Assessment, dated February 14 to March 18, 2018, a Psychology Consultation and file review, dated August 17, 2019 which also “speak to risk assessments.”

[35] The custodian’s representations also provided details of its searches upon its receipt of the complainant’s request under PHIPA for “a copy of his file in electronic format”. The custodian says that four individuals participated in the searches, with the searches being coordinated by the custodian’s Chief Privacy Officer. This individual was assisted by two Health Information Management (HIM) Specialists and the Director of the crisis call centre. The custodian says that searches were conducted in its electronic client record system (CaseWORKS), its incident reporting software (RL6) and email system. The custodian provided copies of various record management policies and procedures and submits that its policies require records containing PHI to be stored in CaseWORKS and that any emails containing PHI are incorporated in the patient’s electronic record. The custodian says that all paper records created must be scanned into CaseWORKS and are subsequently shredded. Finally, the custodian explains that any records created to report an incident are subject to the Incident Reporting Policy which requires incidents to be documented in the RL6 software system. The custodian takes the position that it conducted a reasonable search for responsive records and states:

In summary, all records in respect to the complainant’s PHI request, except for redacted names of internal/external staff have been searched, located and provided to the complainant. [We] are confident that no other records in relation to this complaint exist within the CMHA WW HIM system.

[36] As mentioned above, the complainant requested that a copy of his written representations not be shared with the custodian. Accordingly, while I have taken his representations into account, I summarize below his position and argument only at a high level.

[37] The complainant appears to take the position that the custodian has a pattern of providing unsatisfactory documentation to support its decisions. A considerable portion of his submissions share his frustration with what he sees as the lack of accountability and responsibility of institutions and professionals providing mental health services. The complainant makes a passionate plea that individuals, such as himself, who access mental health services in Ontario deserve to be treated with respect and dignity and should have a voice in improving services.

[38] The complainant appears to take the position that the custodian’s record holdings contain many inconsistencies and fail to support its decisions that affected the quality of mental health services he received, including the custodian’s decision to terminate services. The complainant did not specifically address the custodian’s argument that it conducted a reasonable search for a client risk assessment report. However, the complainant appears to take the position that the records the custodian located that “speak to risk assessments” fall short of the type of documentation he thinks the custodian should have prepared to support its decision to terminate services.

Decision and analysis

[39] Where a complainant claims that additional records exist beyond those identified by the custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53 and 54 of the Act. If the IPC is satisfied that the search carried out was reasonable in the circumstances, the custodian’s decision will be upheld. If the IPC is not satisfied, it may order further searches.

[40] PHIPA does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [6] To be responsive, a record must be "reasonably related" to the request. [7]

[41] The IPC has extensively canvassed the issue of what constitutes a reasonable search for responsive records in orders issued under the Freedom of Information and Protection of Privacy Act (FIPPA) and its municipal counterpart, the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). It has also addressed the issue of reasonable search under PHIPA. [8] In addition to what is set out in PHIPA Decision 18, principles outlined in IPC orders addressing reasonable search under FIPPA and MFIPPA are instructive to the review of this issue under PHIPA.

[42] As previously stated, PHIPA does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [9] To be responsive, a record must be "reasonably related" to the request. [10]

[43] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [11]

[44] A further search will be ordered if the custodian does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [12]

[45] I have considered the evidence of the parties and am satisfied that the custodian’s searches were coordinated and completed by an experienced individual, who was knowledgeable in the subject matter of the request and the custodian’s electronic management systems. In addition, I note that this individual was assisted by three other individuals knowledgeable in the subject matter of the request or having technical expertise.

[46] Although a complainant will rarely be in a position to indicate precisely which records the custodian has not identified, the complainant still must provide a reasonable basis for concluding that such records exist. [13] In this case, the complainant suggests that at least two risk assessment reports should have been created given the seriousness of the custodian’s decision to terminate services. However, the custodian says that no such reports were created in the circumstances as it relied on other documentation to support its decision. Though it is clear that the complainant has concerns regarding the manner in which the custodian chose to document its decision to terminate services to him, I am not satisfied that the complainant’s concerns provide a reasonable basis for concluding that such records exist. In fact, it seems that the point the complainant seeks to make is that the custodian, in the future, should prepare better documentation when making decisions of this nature.

[47] Having regard to the above, I find that the custodian’s evidence concerning the steps it took in response to the complainant’s request to locate responsive records demonstrates that it expended a reasonable effort to identify and locate responsive records, which were provided to the complainant. I also find that the custodian provided a satisfactory explanation as to why its search efforts did not locate the specific type of record requested by the complainant.

[48] Accordingly, I conclude that the custodian’s search for responsive records, including risk assessment reports was reasonable and dismiss this part of the complaint.

B. Do the records contain “personal health information” of the complainant as defined in section 4(1) of PHIPA?

[49] Section 52(1) of PHIPA provides a right of access to “a record of personal health information about the individual that is in the custody or under the control of a health information custodian.” Unlike FIPPA and its municipal equivalent (MFIPPA), PHIPA does not provide a general right of access to information held by the organizations to which it applies. The only right of access under PHIPA is the right of individuals to obtain access to their own personal health information under section 52(1). [14]

[50] In this matter, there is no dispute that the custodian is subject to PHIPA as a health information custodian under section 3(1) of PHIPA. [15] There is also no dispute that the records at issue are in the custodian’s custody or control.

[51] The parties also appear to agree that the records at issue are records of the complainant’s “personal health information.” The relevant parts of the definition of “personal health information” in section 4 of PHIPA state:

(1) In [PHIPA],

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information, -12-

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, [or]

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(2) In this section:

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

(3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[52] Section 4(4) sets out limited exceptions to this definition of personal health information. The custodian did not claim that any of the exceptions in section 4(4) apply in this matter, and I am satisfied that none apply.

[53] In determining whether the records are records of the complainant’s PHI, I am guided by the “record-by-record” approach that the IPC has adopted where the whole record, as opposed to individual paragraphs, sentences or words, are analyzed to determine if the record is a record of PHI of an individual. [16] Having reviewed the records, I am satisfied that the records contain the complainant’s PHI under section 4(1)(b) because they relate to the provision of health care to him, including the identification of a person as a provider of health care to him. Since each record contains the complainant’s PHI, it is a record of his personal health information.

[54] “Health care” is a broadly defined term in section 2 of PHIPA that includes any observation, examination, assessment, care, service or procedure that is done for a health related purpose and that:

  1. is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,
  2. is carried out or provided to prevent disease or injury or to promote health[.]

[55] I am also satisfied that the portions of the records relating to employment services provided to the complainant contain his PHI. As well, as the records relating to police contact, including the identification of police officers and their badge numbers, are records of PHI because these records, too, contain PHI.

[56] Having regard to the above, I am satisfied that the records are records of personal health information under PHIPA.

[57] Furthermore, I am satisfied that the information at issue is the complainant’s PHI. As I noted above, the only information at issue constitutes of the names of various individuals. I am satisfied that these names are the complainant’s PHI because, in the case of the category 1 records, the names generally relate to the provision of health care to the complainant (section 4(1)(b)). In any case, and in the case of the category 2 records, the names, taken in the context of where they appear in the records, consist of identifying information about the complainant and constitute his PHI under section 4(3).

[58] The right of access in PHIPA applies either to a whole record under section 52(1) [17] or only to certain portions of a record of personal health information under section 52(3).

[59] Section 52(3) of PHIPA states:

Despite subsection (1) [setting out exemptions from the right of access in PHIPA], if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[60] If a record is dedicated primarily to the personal health information of the individual, the individual has a right of access to the entire record (subject to any applicable exemptions), even if it incidentally contains information about other matters or other parties.

[61] If, on the other hand, a record is not dedicated primarily to the personal health information of the individual, the right of access only applies to any PHI of the individual that can reasonably be severed from the record (subject to the applicability of any exemptions).

[62] As I have found above that the withheld information is the complainant’s PHI, I do not need to address these provisions further. The complainant has a right of access to the names, unless an exemption from that right of access applies. I examine that question next.

C. Does the exemption to the right of access to the complainant’s own personal health information in section 52(1)(e)(i) of PHIPA apply?

[63] Section 52(1)(e)(i) states:

Subject to this Part [Part V of PHIPA], setting out the rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(e) granting the access could reasonably be expected to,

(i) result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person,

[64] The purpose of section 52(1)(e)(i) is to protect the treatment, recovery and physical security of a patient and others. [18]

[65] Section 52(1)(e)(i) of PHIPA is similar to the exemptions in sections 14(1)(e), 20, and 49(d) of FIPPA, which apply where disclosure of a record could reasonably be expected to endanger the health, life or safety of an individual. [19] In order to satisfy the burden of proof under sections 14(1), 20, or 49(d), it is not enough for the institution denying access to take the position that the harms are self-evident from the record. The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [20]

[66] In PHIPA Decision 34, Adjudicator John Higgins determined that the standard of proof required under section 52(1)(e)(i) of PHIPA is the same as the standard under sections 14(1), 20 and 49(d) of FIPPA. I agree.

The custodian’s representations

[67] The custodian takes the position that granting the complainant access to any of the withheld names in the records could reasonably be expected to result in a risk of bodily harm to the individuals that would be identified. In support of its position, the custodian provided a copy of a psychological consultation report. The report was prepared in 2019 by a psychologist who “conducted a thorough review” of the complainant’s file to determine whether releasing the file could reasonably be expected to give rise to the harms in section 52(1)(e)(i). A copy of the report was provided to the complainant with the custodian’s representations.

[68] The psychologist concluded that releasing the entire file contents to the complainant could reasonably be expected to result in placing the complainant at risk of harm. The examples of the risk of harm to the complainant provided were self-harm and/or emotional dysregulation. The psychologist also said that in considering the risk of harm to others, he considered “both physical harm, as well as psychological harm, which includes fear of physical injury and other emotional, mental, or cognitive consequence.”

[69] However, the psychologist recommended that only the last names of staff members be redacted from the records requested by the complainant. The psychologist identified the exception being staff members in leadership positions with whom the complainant has already corresponded with via email. In those cases, the psychologist recommended that the full names be disclosed. The psychologist also concluded that the potential risk for harm was higher for crisis line staff, given that the complainant may perceive these individuals as having abandoned him.

The complainant’s representations

[70] The complainant maintains that he is entitled to access an unredacted copy of his file. The complainant argues that denying him full access to his medical records poses a risk to his continued growth and success. The complainant questions the custodian’s reliance on a 2019 psychological consultation report that reviewed documentation that at the time of the review he says was several years old.

[71] The complainant says that he has grown significantly from past experiences and his current mental wellbeing has greatly improved. The complainant indicates that he has secured full-time professional employment and is a top performer in his work environment. The complainant also provided two letters of support from medical professionals. [21]

Analysis

[72] I have considered the submissions of the parties, along with the records themselves and have determined that, in the interests of procedural fairness, the affected individuals should be notified about the circumstances of this complaint. Once they have been notified, I will be able to decide whether or not to uphold the custodian’s claim that the withheld names qualify for exemption under section 52(1)(e)(i).

[73] I need to notify these parties for several reasons. First, it appears that some of the withheld names were supplied by the complainant himself to the custodian, in the context of his recounting his history to the custodian. Although I have not made my decision on the custodian’s exemption claim yet, it appears at least arguable that disclosure of these names could not reasonably be expected to result in the harms contemplated by section 52(1)(e)(i). However, I need to notify interested parties before contemplating ordering that these names be ordered disclosed.

[74] Furthermore, I note that the custodian takes the position that granting the complainant full access to the withheld names in the records could reasonably be expected to result in a risk of serious harm to the complainant’s treatment or recovery, or result in serious bodily harm to the individual or another person. I also note that the psychological consultation report that the custodian provided the IPC and the complainant during the review stage only recommended that the last names of staff members be redacted from the records to be released to the complainant, with some exception. There may be good reason why the custodian’s decision differed from its expert’s recommendation, but that has not been explained to me. Again, although I have not yet made a decision, it is possible that I will accept the expert’s opinion and will order the custodian to release the first names to the complainant. It is also possible that I will order the names to be released in full. In the interest of procedural fairness, I will need to notify these individuals.

[75] Accordingly, if the custodian continues to take the position that section 52(1)(e)(i) applies to all of the information it has withheld (full names), it must advise me, in which case I will notify the affected individuals. I will require the custodian’s assistance in locating and notifying them. I urge the custodian to consider its position anew in light of my comments above, particularly in relation to names that the complainant would already be aware of.

[76] However, before proceeding to notify these individuals about the complaint, the complainant is to confirm in writing within 30 days of the issuance of this decision whether he continues to pursue access to all of the withheld names the records, including his former psychotherapist.

ORDER:

  1. The complainant is to confirm in writing within 30 days of issuance of this decision whether he continues to pursue access to all of the withheld information.
  2. I uphold the custodian’s search for records as reasonable and dismiss that aspect of the complaint.

Original Signed by:

 

October 21, 2022

Jennifer James

 

 

Adjudicator

 

 

 



[1] In PHIPA Decision 100, the IPC upheld the complainant’s former psychotherapist’s decision to deny the complainant access to his PHI under section 52(1)(e)(i). The complainant’s subsequent reconsideration request was denied in PHIPA Decision 113. The adjudicator in that matter described the records before her as “records for the time that [the complainant] was treated by the psychotherapist (approximately October 2014 – October 2016), as well as notations that were made in the complainant’s file following the termination of the therapeutic relationship as a result of the ongoing contact between the parties.”

[2] The mediator’s report indicates that the complainant is only seeking access to “non-CMHA WW staff members” which suggest that the complainant accepts the custodian’s decision to withhold the names of individuals it employs. However, throughout his submissions the complainant takes the position that he is entitled to an unredacted copy of his medical records. Accordingly, I am not satisfied that this issue was resolved at mediation.

[3] The parties also exchanged emails about this issue on October 1, 2019 in which the custodian told the complainant that the exemption applied to “not only internal but external authors to [his] CMHA WW record.”

[4] Dated October 19, 2018,

[5] The complainant’s October 5, 2018 email asked “…senior leadership to provide documentation over the last year to support your decision including dates, times and identities of individuals these so called infractions occurred. I would like to also request your risk assessment report for your latest decision …”

[6] Orders P-624 and PO-2559.

[7] Order PO-2554.

[8] PHIPA Decision 18, PHIPA Decision 43.

[9] Orders P-624 and PO-2559.

[10] Order PO-2554.

[11] Orders M-909, PO-2469 and PO-2592.

[12] Order MO-2185.

[13] Order MO-2246.

[14] PHIPA Decision 19.

[15] The term “health information custodian” is defined in section 2(1) of PHIPA as having the meaning set out in section 3. The term is defined in section 3(1)(4)(vii) as:

3 (1) In this Act,

“health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any:

vii. A centre, program or service for community health or mental health whose primary purpose is the provision of health care.

[16] The “record-by-record” approach for dealing with requests for records of personal information is set out in Order M-352. This approach has been adopted by this office in reviewing records that may contain PHI in PHIPA Decisions 17, 27 and 30.

[17] Section 52(1) provides that an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless certain exemptions or conditions listed in paragraphs (a) to (f) apply.

[18] PHIPA Decisions 34 and 100.

[19] Section 14(1)(e) states that a head may refuse to disclose a record where the disclosure could reasonably be expected to endanger the life or physical safety of a law enforcement officer or any other person. Section states that a head may refuse to disclose a record where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual. Section 49(d) states that a head may refuse to disclose to the individual to whom the information relates personal information that is medical information where the disclosure could reasonably be expected to prejudice the mental or physical health of the individual.

[20] Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31 (CanLII) at paras. 52-4.

[21] The first letter is addressed to the IPC from a psychotherapist, dated March 29, 2021. The second letter is from a physician addressed to “To whom it may concern” regarding a “Medical Update per Patient Request”, dated September 8, 2020.

 You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.