PHIPA DECISION 192

Complaint HC18-7

Sinai Health System

November 16, 2022

Summary: An affected person in an IPC complaint file made a procedural request that the IPC disclose to him a number of documents, including records of the complainant’s personal health information, in order to participate in the IPC’s review of the complaint under the Personal Health Information Protection Act, 2004  (PHIPA ). The complaint concerns allegations that the respondent Sinai Health System (the hospital) contravened PHIPA  by, among other things, failing to implement and enforce the complainant’s withdrawal of consent in respect of her personal health information after the complainant reported to the hospital that the affected person had sexually assaulted her during a medical examination. At the relevant time, the affected person was a doctor with privileges at the hospital. Although the complainant initially objected to the doctor’s disclosure request, she ultimately did not take issue with the request.

This interim decision sets out the adjudicator’s decision on the doctor’s disclosure request. After considering the requirements of procedural fairness in this case, based on relevant factors including the nature of the decision to be made, the role of the doctor as an affected person in the complaint, and the statutory context governing the IPC, among other factors, the adjudicator grants the doctor’s disclosure request in part. She decides to disclose most, but not all, of the documents the doctor requested.

With respect to the doctor’s request for the complaint documentation (i.e., the documents originating the complaint to the IPC) and the mediator’s report (which an IPC mediator issued to the complainant and the respondent hospital at an earlier stage of the complaint), the adjudicator decides to disclose these documents in part. She discloses to the doctor only those portions of the documents that relate to the issues to be decided in the review. She severs from the documents information that relates to other issues that were fully and finally resolved at earlier stages of the complaint. The severed information does not relate to the doctor, or to the issues remaining to be decided in the review, and its disclosure is not required for the purposes of procedural fairness to the doctor.

The adjudicator also denies the doctor’s request for disclosure of the complainant’s complete patient chart “up to the end of the time period at issue.” Instead, she decides to disclose to the doctor only those discrete records of personal health information from the complainant’s patient chart that are relevant, and proportionate, in the circumstances, in view of the specific allegations of unauthorized use and disclosure by the doctor that are at issue in the review. In addition, to protect the privacy of the complainant and the integrity of the IPC’s processes, the adjudicator orders that certain express conditions and restrictions attach to the handling of these records from the complainant’s patient chart. The conditions and restrictions, which are consistent with obligations imposed in comparable proceedings, are set out in undertakings enclosed with the parties’ copies of this interim decision.

These undertakings restrict the use and disclosure of these records of the complainant’s personal health information by the doctor and his legal counsel except for the purposes of the review (and any court proceedings arising from the review), and ensure the security of the records. If they wish to receive these records, the doctor and his legal counsel must first agree to these conditions and restrictions, by signing and returning the undertakings to the adjudicator.

After the adjudicator makes the disclosure described in this decision, she will continue the review to address the substantive issues raised by the complaint, including the issue of whether the hospital implemented the complainant’s withdrawal of consent (including by notifying its agents of the withdrawal of consent), in accordance with PHIPA .

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sch A  (as amended), sections 9(2) (a) and (b), 37(1) (h), 37(2) , 41(1) (a), 41(1) (d)(ii), 41(2) , and 68(1) , (2)  and (3) ; Freedom of Information and Protection of Privacy Act,  RSO 1990, c F.31 ; Municipal Freedom of Information and Protection of Privacy Act , RSO 1990, c M.56 ; Rules of Civil Procedure, RRO 1990, Reg 194, r. 30.1.01.

Cases Considered: Baker v. Canada (Minister of Citizenship and Immigration), 1999 CanLII 699 (SCC); Bongard v. Health Professions Board, 1997 CanLII 17794 (ON SCDC); Wilson v. Bourbeau, 2009 CanLII 22559 (ON SCDC).

OVERVIEW:

[1] This interim decision addresses a procedural request made by an affected person in a review conducted by the Information and Privacy Commissioner of Ontario (IPC) under the Personal Health Information Protection Act, 2004  (PHIPA ). As described in more detail below, the review concerns allegations that Sinai Health System (the hospital) contravened PHIPA  by, among other things, failing to implement and enforce a complainant’s withdrawal of consent in respect of her personal health information. Some of the allegations involve actions by the affected person, who at the time of the events at issue was a doctor with privileges at the hospital.

[2] As part of the IPC’s review of the complaint against the hospital, the IPC sought representations from the doctor, as an affected person in the review. The doctor, through his legal counsel, asked the IPC to disclose to him certain documents, including records of the complainant’s personal health information, in order to respond to the IPC’s request for representations in the review. As I explain further below, the other parties to the complaint ultimately took no position on the doctor’s disclosure request.

[3] This interim decision sets out my decision on the doctor’s disclosure request. In the discussion that follows, I explain why I have decided to disclose to the doctor most, but not all, of the documents he requested. I find that some of these documents contain information that is not relevant, or proportionate, in the circumstances of the review, and that its disclosure is not required for the purposes of procedural fairness. I also explain why I have decided to explicitly order that conditions and restrictions attach to the handling of certain records of the complainant’s personal health information that I have decided to disclose. If the doctor and his legal counsel wish to obtain these records of personal health information, they must sign undertakings agreeing to the conditions and restrictions before I will make this disclosure.

[4] For clarity, this interim decision does not contain findings of fact with respect to the allegations raised by the complaint. After the doctor receives the disclosure described in this interim decision (which includes some records subject to certain conditions and restrictions, as described in more detail below), I will continue this review to address the substantive issues raised by the complaint, including by re-establishing a deadline for the doctor’s representations in the review.

BACKGROUND:

[5] The complainant was a patient of the hospital’s pain management centre, where she was treated by the doctor. The complainant alleges that she was sexually assaulted by the doctor during an examination in 2016.

[6] In January 2017, the complainant reported the sexual assault, as well as other concerns about her care, to the hospital’s privacy and risk coordinator. The complainant says that at that time, she withdrew her consent for the doctor to be involved in her care at the hospital. The complainant later received an email from the privacy and risk coordinator, confirming their meeting in January and advising her that the complaint was under investigation.

[7] In February 2017, the complainant also contacted the hospital’s human rights and health equity specialist with her concerns about the doctor. In an email to the equity specialist, the complainant asked that the results of certain tests be forwarded to her family doctor, and that the hospital do the same with future tests, because the complainant no longer felt comfortable under the doctor’s care. The complainant says that in additional emails she sent to the equity specialist, and at a meeting with the equity specialist later that same month, she reiterated her request not to be treated by the doctor or to have him involved in the coordination of her care.

[8] The complainant alleges that despite these requests, the hospital inappropriately continued to share her personal health information with the doctor. In the complainant’s view, she explicitly revoked her consent to the doctor’s involvement in her health care and with her personal health information when she first reported the sexual assault to the hospital’s privacy and risk coordinator in January 2017. She alleges that any use and disclosure of her personal health information contrary to her request after that date occurred without authority and in violation of PHIPA . As will be seen further below, PHIPA  is a statute that sets out rules to protect an individual’s privacy in respect of the individual’s personal health information that is collected, used, and disclosed by bodies such as the hospital and its agents.

[9] The complainant raised these concerns with the IPC in January and February 2018, resulting in the IPC’s opening the present complaint file against the hospital. (At that time, the complainant also raised other concerns, which were resolved at the mediation stage of the complaint process. Those resolved matters are not the subject of this review, as I explain in more detail below.) Relevant to this review, the complainant identified the following events (occurring after her January 2017 report to the hospital of sexual assault by the doctor) as instances in which the hospital failed to comply with and enforce her withdrawal of consent in respect of her personal health information:

• The doctor’s accesses to the complainant’s electronic health record on three specified dates in January, March, and July 2017 (as identified by the hospital’s audit of the complainant’s health record);
• Three specialist and diagnostic referrals made by the doctor in January and February 2017;
• The hospital’s providing the doctor’s lawyer with the complainant’s records of personal health information in February 2017;
• The doctor’s March 2017 fax to his legal counsel containing a consultation note (dated February 2017) prepared by the complainant’s new physician;
• The doctor’s sending the complainant’s family doctor a consultation note in March 2017 regarding the status of the complainant’s care;
• The hospital’s continuing to copy the doctor on emails in March and April 2017 regarding the complainant’s specialist and diagnostic referrals;
• The doctor’s sending the complainant a letter in July 2017 communicating the cancellation of an upcoming appointment; and
• The hospital’s sending the complainant’s records of personal health information to the College of Physicians and Surgeons of Ontario in September 2017.

[10] During the IPC complaint process, the respondent hospital and the complainant engaged in an attempt at mediation of the issues. [1] During this process, the hospital provided explanations for some of the above incidents.

[11] Because this interim decision addresses a procedural request made by an affected person in the review, rather than the substantive issues raised by the complaint (such as whether the above incidents contravened PHIPA ), it is not necessary for me to set out the hospital’s position on the substantive issues in detail here. In general, the hospital states that it did not understand the complainant’s January 2017 report of sexual assault and request to be treated by another doctor as a withdrawal of consent in respect of her personal health information. As a result, the hospital did not initially restrict the doctor’s access to the complainant’s personal health information. (Later, during the processing of the complaint before the IPC, the hospital confirmed that it has since placed a consent directive in the complainant’s electronic health record to implement her withdrawal of consent. The hospital advised that its investigation of the doctor’s conduct ultimately led to its suspending (at the end of July 2017), and then permanently revoking (in January 2018) the doctor’s hospital privileges.)

[12] The complaint could not be resolved through the mediation process. As a result, in accordance with the IPC’s procedures under PHIPA  (which I discuss in more detail, further below), the IPC mediator prepared a mediator’s report outlining the facts gathered at mediation and the issues remaining in dispute, and provided the report to the hospital and the complainant. The complaint was then transferred to the adjudication stage of the IPC process, where an IPC adjudicator may conduct a review under section 57(3)  of PHIPA .

Adjudication stage of the complaint process

[13] At the adjudication stage, an IPC adjudicator was assigned to this file. That adjudicator decided there were reasonable grounds to conduct a review of the complaint. She began her review by sending a Notice of Review to the respondent hospital on December 2, 2020, setting out the facts of the complaint and seeking the hospital’s representations on the issues raised by the complaint—including, namely, whether, in each incident described above, the hospital’s actions contravened PHIPA . The hospital provided representations in response.

[14] On the same date in December 2020, the previous adjudicator notified the doctor of the complaint. She provided the doctor with the same Notice of Review, and invited his representations on the issues raised by the complaint.

[15] On January 27, 2021, counsel for the doctor responded on the doctor’s behalf. The doctor’s position is that in order to respond to the issues raised in the Notice of Review, he requires the following documents:

1. a copy of the complaint and all attached documentation;
2. a copy of the relevant documentation from the hospital, including the audit trail, and details of the accesses by the doctor;
3. the patient chart up to the end of the time period at issue, or alternatively confirmation that the doctor can disclose the information previously provided to him for the purposes of other proceedings in responding to the complaint;
4. a copy of any representations already received from the hospital and all attachments in this matter;
5. details of the notice that the hospital has advised was placed on the complainant’s EHR [electronic health record];
6. a copy of the mediator’s report referred to in the Notice of Review.

[16] On February 24, 2021, the previous adjudicator wrote to the doctor’s counsel to request a further explanation of why the doctor requires any or all of the patient chart (item (c) of the doctor’s request) in order to respond to the Notice of Review. Also, to address the second part of item (c) of the doctor’s request (namely, the request for “confirmation that the doctor can disclose the information previously provided to him for the purposes of other proceedings in responding to the complaint”), the adjudicator specified that the IPC is not authorizing the doctor, in responding to this complaint, to use or disclose information previously provided to him for the purposes of other proceedings. In this letter, the adjudicator also clarified that the doctor is an affected person, not a respondent, in the review. [2]

[17] The previous adjudicator advised the doctor that after receiving his response to her letter, she would provide the response, along with the doctor’s January 27, 2021 letter, to the complainant and the hospital in seeking their views on the doctor’s disclosure request. In the meanwhile, the adjudicator suspended the doctor’s deadline to respond to the substantive issues set out in the Notice of Review.

[18] On March 8, 2021, the doctor provided a response through his counsel. The doctor maintains that he needs the requested documents to make a full and meaningful response to the issues set out in the Notice of Review. He makes more specific submissions about why certain documents he identified are relevant to his ability to respond, which I will describe further below in setting out my decision on his disclosure request. In general, he argues that he cannot respond to, explain, or even know the factual circumstances giving rise to the complaint or the request for representations without being able to confirm the dates and times of the actions alleged to have taken by him, and to use and disclose relevant portions of the complainant’s personal health information to explain his conduct in the transactions described in the Notice of Review.

[19] On March 26, 2021, the previous adjudicator informed the complainant of the doctor’s disclosure request, and invited her to provide her views to inform the IPC’s decision on the request. The adjudicator provided the complainant with copies of the doctor’s January 27 and March 8, 2021 letters for this purpose. The adjudicator also asked the complainant to address any conditions or restrictions that should apply to any disclosure the IPC may make to the doctor for the purpose of responding to the complaint. Finally, the adjudicator noted that the IPC had not obtained a copy of the complainant’s patient chart from the hospital, and she asked the complainant for her view on whether the IPC should obtain any or all of the complainant’s chart for the purpose of addressing the complaint.

[20] The complaint file was then reassigned to me as the new adjudicator. Through IPC staff, I followed up with the complainant to seek her response to the previous adjudicator’s letter to her.

[21] At this point, the complainant advised me that she objected to the doctor’s disclosure request. She took the position that the doctor is asking for information that he was denied as part of criminal proceedings against him, and that his request for additional documents in this review is a breach of her privacy. (As I explain further below, the complainant later changed her position, and ultimately did not object to the disclosure request.)

[22] The complainant consented to the IPC’s obtaining records of her personal health information from the hospital for the purposes of the complaint.

[23] On July 29, 2021, I wrote to the hospital to seek its views on the doctor’s disclosure request. I enclosed copies of the doctor’s January 27 and March 8 letters containing the disclosure request and reasons for the request, and provided the above summary of the complainant’s position on the doctor’s request. [3] I also invited the hospital to address any conditions or restrictions that should apply in the event I decide to disclose some or all of the requested documents to the doctor for the purpose of responding to the complaint.

[24] I also asked the hospital to provide me with certain records of the complainant’s personal health information for my consideration in making my decisions in this complaint, including my decision on the doctor’s disclosure request. Specifically, I asked the hospital to provide me with the following records of personal health information:

• The records accessed by the doctor on specific dates in January, March, and July 2017, according to the hospital’s audit, and an explanation of how the hospital’s audit shows the doctor accessed these records on those dates; [4]
• The three referrals made by the doctor in January and February 2017;
• The consultation note (prepared by another physician) that the doctor sent to his legal counsel by fax in March 2017;
• The consultation note that the doctor sent to the complainant’s family physician in March 2017;
• The emails on which the hospital copied the doctor in March and April 2017; and
• The letter that the doctor sent to the complainant in July 2017.

[25] To be clear, my request to the hospital for records of the complainant’s personal health information was limited to the discrete records identified above. I did not ask the hospital to provide me with the complainant’s complete patient chart. I explain my reasons for requesting only these records in the discussion section, further below.

[26] On August 19, 2021, the hospital advised me that it takes no position on the doctor’s disclosure request.

[27] The hospital also provided the IPC with copies of the records of personal health information that I had requested, with one exception. With respect to the first item (i.e., records accessed by the doctor on specific dates in January, March, and July 2017), the hospital advised that its audit specifies only the dates on which the doctor accessed the complainant’s EHR, and not the particular records he accessed on those dates. The hospital reported that it is unable to otherwise identify the records that were accessed. As a result, the hospital was unable to provide those records to the IPC.

[28] The hospital had already provided to the IPC (at an earlier stage of the complaint process) a copy of the flag it had placed on the complainant’s EHR (item (e) of the doctor’s disclosure request). This flag does not contain any personal health information.

[29] On September 14, 2021, I wrote to the doctor’s counsel to advise him of the positions taken by the complainant and the hospital on the doctor’s disclosure request, [5] and to invite any additional representations he wished to make in support of the request.

[30] In this letter, I advised that I may impose express conditions or restrictions in respect of any documents I decide to disclose to the doctor in the interests of procedural fairness. I set out my preliminary views on the terms of an undertaking that I may decide to seek from the doctor, his counsel, or from other parties (such as experts retained by the doctor). I invited the doctor’s counsel to comment on these draft terms.

[31] By separate correspondence, I also invited the complainant and the hospital to comment on my preliminary views on the terms of an undertaking I may decide to seek from the doctor and any other parties as a condition of any disclosure.

[32] In response, the hospital advised that it takes no position on this issue, and will defer to the IPC’s decisions on the doctor’s disclosure request and on the imposition of any conditions in respect of any disclosure.

[33] The doctor’s counsel objected to the proposed undertakings. He takes the position that the draft terms impermissibly circumscribe the conduct of the doctor and his legal counsel, and impermissibly infringe and circumscribe certain sections of PHIPA  that generally concern the use and disclosure, by health information custodians, of personal health information in the context of proceedings. I will describe these arguments, and the others set out in counsel’s October 8, 2021 response to my September letter, in more detail further below.

[34] After receiving these responses from the hospital and the doctor’s counsel, the IPC followed up with the complainant on her response to my September 2021 letter. The complainant requested several extensions of time in order to obtain legal advice, which I granted.

[35] On March 2, 2022, the complainant advised that she “no longer take[s] issue” with the doctor’s disclosure request. On March 30, the complainant advised that she “do[es] not take a position” on my preliminary view on the terms of an undertaking that I may decide to seek before making any disclosure to the doctor.

[36] This interim decision sets out my decision to disclose to the doctor (through his counsel) most, but not all, of the documents he has requested, and to impose express conditions and restrictions in respect of some of these documents. My reasons follow.

DISCUSSION:

Should the IPC disclose any of the requested documents to the doctor in the interests of procedural fairness? If so, should the IPC impose conditions or restrictions on the handling of any disclosed documents?

[37] In Baker v. Canada (Minister of Citizenship and Immigration), [6] the Supreme Court of Canada considered the duty of procedural fairness in the context of administrative proceedings (like this proceeding before the IPC). The Court explained that the purpose of the participatory rights contained within the duty of procedural fairness is “to ensure that administrative decisions are made using a fair and open procedure, appropriate to the decision being made and its statutory, institutional, and social context, with an opportunity for those affected by the decision to put forward their views and evidence fully and have them considered by the decision-maker. [7] ”

[38] In grounding the duty of procedural fairness in the broader context of the decision being made, the Court recognized that the content of the duty of fairness is “flexible and variable,” [8] and will depend on the circumstances. In Baker, the Court set out some factors relevant to determining what procedural rights the duty of fairness requires in a given set of circumstances. They are: (1) the nature of the decision being made and the process followed in making it; (2) the nature of the statutory scheme and the terms of the statute pursuant to which the decision-making body operates; (3) the importance of the decision to the individual or individuals affected; (4) the legitimate expectations of the person challenging the decision; and (5) the choices of procedure made by the decision-making body itself. [9] This list is not exhaustive. [10]

[39] In making my decision on the doctor’s disclosure request, I have considered the factors outlined in Baker to determine the requirements of procedural fairness in this case.

[40] First, I have considered that the complaint before me concerns allegations of unauthorized use and disclosure of the complainant’s personal health information in the custody or control of the hospital. The respondent in this review is the hospital, which is alleged to have contravened PHIPA  by, among other things, failing to implement and enforce the complainant’s withdrawal of consent with respect to her personal health information in its custody or control. In several of the incidents under review, the hospital is alleged to have permitted the doctor to use and disclose the complainant’s personal health information even after her withdrawal of consent. The issues for the IPC to decide in this complaint include whether, in each instance, the hospital’s actions contravened PHIPA . The nature of the issues to be decided in the review is a significant factor that has informed my decision about the degree of procedural protections the doctor requires in this case.

[41] I have also taken into account the related factor of the doctor’s role as an affected person in this matter, and his legitimate expectations as a party to the review in this capacity. While the IPC must give the affected person an opportunity to make representations during a review, [11] the interests of the affected person in a privacy complaint are not the same as those of the complainant, whose personal health information is at issue, or of the respondent, who is the primary focus of the review. While the actions of the doctor are central to several of the incidents under review, the respondent hospital, as the health information custodian, remains responsible under PHIPA  for its agents’ handling of personal health information in its custody or control. [12] In this case, as noted above, one of the issues to be determined in the review is whether, and when, the hospital implemented the complainant’s withdrawal of consent in respect of her personal health information, including by notifying its agents of the withdrawal of consent.

[42] Another factor to be considered under Baker is the nature of the statutory scheme governing the IPC. The IPC’s governing statutes, including PHIPA , establish its mandate to administer and enforce rules concerning access to information, and the protection of privacy in respect of an individual’s own information. This statutory context raises some unique procedural fairness considerations when the IPC acts as a tribunal addressing privacy and access-to-information matters. For example, there may be a tension between, on the one hand, the interests in maintaining the confidentiality of records at issue and certain representations made by parties in a matter before the IPC and, on the other, the need for some degree of mutual disclosure to ensure procedural fairness for all parties. This tension may be heightened in a privacy complaint where the records asked to be shared for procedural fairness purposes are the very records alleged to have been the subject of a privacy breach.

[43] The Legislature and the courts have recognized the need for flexibility in the IPC's procedures to address these considerations. To begin, PHIPA  provides that the Statutory Powers Procedure Act does not apply to reviews conducted by the IPC under PHIPA . [13] Analogous provisions are contained in the Freedom of Information and Protection of Privacy Act  (FIPPA ) and the Municipal Freedom of Information and Protection of Privacy Act  (MFIPPA ) in respect of inquiries conducted by the IPC under those statutes. [14] As a result, the only applicable statutory procedural guidelines are those appearing in the IPC’s governing statutes. Among other things, these statutes confer discretion on the IPC with respect to the sharing of representations made by parties to matters before the IPC. [15] However, in the context of PHIPA , the IPC is generally prohibited from sharing representations that contain or that would reveal personal health information that would not be subject to the right of access under PHIPA . [16] In addition, an overarching confidentiality provision prohibits the IPC from disclosing any information that comes to its knowledge in the course of exercising its functions under PHIPA , except in specified circumstances. [17]

[44] Of course, the IPC must read these statutory provisions in light of the common law right to procedural fairness. [18] And the IPC’s governing statutes do not address all of the circumstances that arise in the conduct of proceedings under its statutes. For matters under FIPPA and MFIPPA , the IPC has recognized by necessary implication the need to develop its own procedures, as well as the Legislature’s intention that it do so. [19] The Legislature made this explicit in PHIPA , by expressly providing that the IPC may make its own rules of procedure for the conduct of a review. [20] In the context of PHIPA , these rules are set out in the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004  (the Code ). The last of the Baker factors noted above involves an examination of these procedural rules.

[45] The Code  requires a complainant to provide the IPC with a written notice of the complaint that includes, among other things, a statement of whether the complainant consents to the IPC’s inspecting a record of, requiring evidence of, or inquiring into the complainant’s personal health information for the purpose of processing the complaint. [21] This is necessary because under PHIPA , the IPC is not authorized to inspect a record of, require evidence of, or inquire into personal health information without the consent of the individual to whom it relates, unless specific conditions apply to do so without this consent. [22]

[46] The Code  further limits the IPC’s handling of personal health information, even where it has this consent, to that which is “reasonably necessary” for the purposes of the complaint. [23] This reflects the limitations imposed by PHIPA  on the IPC’s collection, use, and retention of personal health information in the course of carrying out the IPC’s functions under PHIPA . [24] This mirrors the limitation principle imposed by PHIPA  on health information custodians governed by PHIPA  not to handle more personal health information than is reasonably necessary for a given purpose. [25] These limiting principles, contained in PHIPA and reflected in the Code , align the IPC’s own procedures with PHIPA ’s broader purposes to protect the confidentiality of personal health information and the privacy of individuals with respect to that information. [26]

[47] The Code  also sets out the IPC’s procedures with respect to the sharing of representations received in the course of an IPC proceeding under PHIPA . [27] It reflects the discretion conferred to the IPC under PHIPA  to withhold representations in appropriate circumstances, including where, in the IPC’s judgment, the harm of sharing information communicated to the IPC in confidence would outweigh the benefits of that sharing for the correct disposal of the file. [28] The Code  also permits the IPC, at any stage of its process, to issue interim decisions (like this one) to determine procedural or other interlocutory matters. [29]

[48] In this context, I have considered the doctor’s request for the disclosure of various documents obtained by the IPC from the complainant or from the hospital in the course of this complaint, as well his request for the complainant’s complete patient chart “up to the end of the time period at issue,” which the IPC has not to date requested or obtained from the hospital. For ease of reference, I list again here the documents requested by the doctor:

1. a copy of the complaint and all attached documentation;
2. a copy of the relevant documentation from the hospital, including the audit trail, and details of the accesses by the doctor;
3. the patient chart up to the end of the time period at issue, or alternatively confirmation that the doctor can disclose the information previously provided to him for the purposes of other proceedings in responding to the complaint; [30]
4. a copy of any representations already received from the hospital and all attachments in this matter;
5. details of the notice that the hospital has advised was placed on the complainant’s EHR;
6. a copy of the mediator’s report referred to in the Notice of Review.

[49] With the exception of item (e) (the EHR flag), all the requested documents contain identifying information about the complainant relating to her physical and mental health and to the providing of health care to her. This information is the complainant’s personal health information within the meaning of PHIPA . [31]

[50] After considering the doctor’s request in light of the requirements of procedural fairness in this case, I have decided to disclose to the doctor (through his counsel) most of the requested documents, with two exceptions.

[51] Items (a) and (f) set out the doctor’s request for the complaint and attached documentation, and the mediator’s report that was provided to the complainant and the hospital at the close of the mediation stage. I have decided to disclose these documents in part. I will disclose only those portions of the documents that concern the issues currently under review, which issues the doctor (and the other parties) have been asked to address in the review. As I explain in more detail below, other portions of these documents concern unrelated matters that are no longer at issue in the review, and their disclosure is not necessary for procedural fairness purposes.

[52] The other exception concerns item (c), which contains the doctor’s request for the “patient chart up to the end of the time period at issue.” I understand this to be a request for the complainant’s complete patient chart up to a particular date in September 2017 (specifically, to the date of the most recent incident under review in this complaint). (I address the doctor’s alternative proposition in item (c) further below in my discussion.)

[53] I have decided that the complete patient chart “up to the end of the time period at issue” is not reasonably necessary for the IPC’s purposes in addressing this complaint, and for this reason I have not requested the complete chart covering this time period from the hospital. Instead, I have decided to obtain from the hospital only those records of the complainant’s personal health information from her patient chart that are directly relevant, and proportionate, for this purpose. I will disclose these same records to the doctor in the interests of procedural fairness. I identify those records below.

[54] I have also decided to impose express conditions and restrictions in respect of these discrete records of the complainant’s personal health information. If the doctor and his counsel wish to obtain these particular records, they must agree to the express conditions and restrictions, and demonstrate their agreement by signing the undertakings that I have provided to them with this interim decision.

[55] I address each component of my decision, below.

In the interests of procedural fairness, I will disclose items (b), (d), and (e) in full, and items (a), (c), and (f) in part

[56] Having considered the issues raised by the complaint, the role of the doctor as an affected person, the statutory scheme (including the limiting principles discussed above) governing this review, and other factors (discussed in more detail below), I have decided to disclose to the doctor only those documents and portions of documents that are relevant, and proportionate, in the circumstances of the complaint. The documents that I will disclose to the doctor in the interests of procedural fairness are the following:

• relevant portions of the complaint and all attached documentation (fulfilling item (a) of the request, in part);
• a copy of the relevant documentation from the hospital, including the audit trail (fulfilling item (b) of the request);
• discrete records of the complainant’s personal health information from the complainant’s patient chart (fulfilling item (c) of the request, in part);
• a copy of the representations already received from the hospital and all attachments (fulfilling item (d) of the request);
• a copy of the notice placed in the complainant’s EHR (fulfilling item (e) of the request); and
• relevant portions of the mediator’s report referred to in the Notice of Review (fulfilling item (f) of the request, in part).

[57] Below I explain my disclosure decisions for the different categories of documents.

Disclosure of the hospital’s representations and related documents in full (items (d), (b), and (e) of the request)

[58] I will disclose in full the hospital’s representations and related documentation, including the EHR notice. [32] These documents correspond to items (d), (b) and (e) of the doctor’s request.

[59] I observe that as a matter of procedural fairness to the affected person and in accordance with the Code , I would have provided the doctor with these documents in the course of my review in any event, without the need for a specific disclosure request. Along with the Notice of Review (which the doctor received at the outset of the review), these documents set out the facts, evidence and arguments at issue in the review so that the doctor, as a party to the review, is able to make meaningful representations in response to the issues he is being asked to address. I agree that these documents are relevant, and proportionate, to satisfy the procedural fairness rights of the doctor as an affected person in this complaint.

[60] Although these documents typically include personal health information, they are generally shared with the other parties to the review (either with consent, or based on a sharing decision of the IPC in the absence of consent), to the extent these documents are relevant and proportionate for the purposes of addressing the complaint. For this same reason, I may share with the doctor relevant portions of representations that I receive at later stages of the review from the complainant, the hospital, or any other party that I may decide to notify in the course of the review. [33]

Disclosure of the complaint documentation and mediator’s report in part (items (a) and (f)of the request)

[61] I have decided to disclose in part the complaint documentation that originated the complaint [item (a)], and the mediator’s report that was issued to the hospital and the complainant at the conclusion of the mediation stage of the complaint [item (f)].

[62] Unlike the documents described above, these types of documents are not routinely shared with affected persons during an IPC proceeding. These documents generally set out the background and nature of the original complaint, which may be amended or narrowed through the IPC’s intake, early resolution, and mediation stages. The mediator’s report may also describe events that occurred at the mediation stage relating to the settlement of issues that are no longer necessary to address at the review stage of the complaint.

[63] In this case, the complaint documentation (including attachments) and the mediator’s report contain details of the original complaint, which encompassed a number of issues. They include the complainant’s concerns about certain uses and disclosures of her personal health information, as I have outlined above, which were not resolved at earlier stages of the complaint. These incidents are at issue in this review. I grant the doctor’s request to receive the portions of the complaint documentation (and attachments) and mediator’s report that concern the issues under review, which he has been asked to address as a party to the review.

[64] I have severed from these documents references to other issues that were raised in the original complaint, which do not relate to the doctor and instead relate to another hospital agent. [34] These other matters were fully and finally resolved at the mediation stage: They are not before me in this review, and they do not relate to the issues currently under review. Because this information is not relevant, or proportionate, in the circumstances of the review, its disclosure is not required for procedural fairness purposes. I have accordingly severed the unrelated information from the documents before disclosing them to the doctor.

Disclosure of certain records only (12 pages) from complainant’s patient chart (item (c) of the request)

[65] As indicated above, I reach a different conclusion with respect to item (c), being the doctor’s request for “the patient chart up to the end of the time period at issue.” [35] I have decided to grant this request in part only. Specifically, I decline to disclose to the doctor the complainant’s complete patient chart for the requested time period. Instead, I have decided to disclose only the following records of the complainant’s personal health information from her patient chart:

• The three referrals made by the doctor in January and February 2017;
• The consultation note (prepared by another physician) that the doctor sent to his legal counsel by fax in March 2017;
• The consultation note that the doctor sent to the complainant’s family physician in March 2017;
• The emails on which the hospital copied the doctor in March and April 2017; and
• The letter that the doctor sent to the complainant in July 2017.

[66] In all, these records total 12 pages.

[67] As noted above, these are the only records of personal health information from the complainant’s patient chart that I obtained from the hospital for the purposes of making my decisions in this complaint. With one exception (which I will describe in the next paragraph), these are the only records from the complainant’s patient chart that I requested from the hospital, based on my assessment of which records of personal health information I reasonably require for the purposes of adjudicating this complaint.

[68] In addition to the above records, I had asked the hospital to provide me with the records accessed by the doctor on specific dates in January, March, and July 2017, as indicated by the hospital’s audit. As noted above, the hospital advised me that its audit does not specify which particular records were accessed on those dates (only that the doctor accessed the complainant’s EHR on those dates), and that it is unable to otherwise identify those records. As a result, the hospital was not able to provide those records to the IPC, and I am in turn unable to disclose them to the doctor.

[69] I have considered whether the hospital’s inability to identify the specific records the doctor is alleged to have accessed on these particular dates means that I should obtain from the hospital (and consider disclosing to the doctor) the complainant’s complete patient chart “up to the end of the time period at issue.” For the reasons set out below, I have decided that it is not reasonably necessary for me to obtain the complete patient chart for this period to fairly adjudicate the complaint. For related reasons, I find that in the circumstances, procedural fairness does not require disclosure of the complete patient chart for the requested time period to the doctor.

[70] To begin, I recognize the possibility that two of the incidents at issue in this complaint may involve the complainant’s complete patient chart up to particular dates in 2017. However, it is my view that I do not require the complete chart covering this time period in order to decide the issues raised by these incidents under PHIPA . They are the following:

• The hospital’s providing the doctor’s lawyer with the complainant’s records of personal health information in February 2017; and
• The hospital’s sending the complainant’s records of personal health information to the College of Physicians and Surgeons of Ontario in September 2017.

[71] The issue for me to decide with respect to these two incidents is whether these disclosures of personal health information by the hospital contravened PHIPA . The hospital has cited authority in PHIPA  for each of these disclosures (specifically, sections 41(1) (a), 41(1) (d) and 43(1)  of PHIPA , which permit health information custodians to disclose personal health information in relation to proceedings in certain circumstances). The complainant challenges the application of these sections of PHIPA  in the circumstances of the disclosures. I note that the complaint is not about the amount of personal health information that the hospital disclosed, but is rather based on the allegation that these disclosures were not authorized to be made under PHIPA .

[72] At this stage, it is my view that I can fairly adjudicate the issue of whether these disclosures complied with PHIPA  based on the evidence of the parties, without the need for the complete patient chart over the relevant time period. On this basis, I have not asked the hospital for, and I have not been provided with, the complete patient chart for this time period. If, at a later time, I decide that I require the complainant’s complete patient chart in order to decide this issue (or any other issue in the review), I will revisit the question of which records of personal health information are reasonably necessary for the purposes of the complaint, and whether procedural fairness requires any further disclosure to the doctor. However, in the present circumstances, I am not satisfied that the doctor, an affected person in the complaint, requires the complete patient chart for the requested time period for procedural fairness purposes in relation to my review of these disclosures by the hospital that may have involved the complete patient chart (up to particular dates).

[73] Next, I have considered whether procedural fairness requires disclosure of the complete patient chart for the requested time period to enable the doctor to address the specific incidents in which he is alleged to have been involved. In his March 8, 2021 letter elaborating on the reasons for his disclosure request, the doctor argues that given the passage of time since the events under review, he cannot recall specific details without relying on or referring to the complainant’s chart for the relevant time period—and in particular, using and disclosing relevant portions of the chart to explain his conduct.

[74] The doctor’s submissions support my decision to disclose to the doctor certain discrete records of personal health information in the interests of procedural fairness to the doctor. Specifically, I find that the 12 pages of records I identified above are directly relevant to the issues the doctor is being asked to address in this review. These records correspond to the specific uses and disclosures that the complainant alleges the hospital allowed the doctor to make after her withdrawal of consent. I agree that the doctor requires these records to meaningfully address the specific uses and disclosures that he is alleged to have made without authority, in contravention of PHIPA .

[75] By contrast, I am not satisfied that disclosure of the complete patient chart for the requested time period (as opposed to these discrete records from the chart) is necessary to address these issues. In my view, this level of disclosure would be disproportionate to satisfy the procedural fairness rights of the doctor in his role as an affected person and in light of the specific uses and disclosures by the doctor that are under review in this complaint.

[76] I have also considered whether the doctor requires the complete chart for the requested time period to account for the fact the hospital is unable to conclusively identify the specific records that he is alleged to have accessed in January, March, and July 2017. I recognize that the doctor’s ability to address these particular accesses may be hampered as a result. The ability of the other parties to address these accesses may be hampered for the same reason. This is a circumstance that I will take into account in making my decisions, at a later stage of this review, on the substantive issues raised by the complaint (namely, whether these incidents contravened PHIPA ).

[77] I acknowledge the possibility that examination of the whole chart for the requested time period might enable the doctor to recall which particular records he accessed on specific dates in January, March, and July 2017, and thus to make better representations on those accesses. I note, however, that I received no representations from the doctor on the likelihood that (or how) examination of the whole chart for the requested time period would assist in this way. I have also taken into account the complainant’s lack of objection to the doctor’s disclosure request. While her lack of objection is a factor in my decision-making, it is not determinative. The complainant’s lack of objection does not diminish the importance of considerations of relevance and proportionality in making my decisions on the doctor’s disclosure request. (I discuss these considerations again, below, in response to specific arguments made by the doctor.)

[78] I conclude that procedural fairness requires that I disclose to the doctor only that personal health information from the complainant’s patient chart that is relevant, and proportionate, in the circumstances of this case. Disclosure of the complete chart for the requested time period would go well beyond this level of disclosure. The patient chart was not created for the purposes of this complaint, or included in the complaint documentation filed by the complainant. It originates in the health care provided by the hospital to the complainant, and exists independently of this complaint. Disclosing the complete patient chart for the requested time period would almost certainly result in the disclosure of personal health information that is not relevant to the issues the doctor is being asked to address in this review. The doctor has not provided a clear or persuasive explanation to support the claim that this broad disclosure of sensitive personal health information is necessary for him to meaningfully respond to the issues under review.

[79] By contrast, the more limited disclosure that I have decided to make from the complainant’s patient chart respects the procedural fairness rights of the doctor as an affected person in this review, while at the same time protecting the complainant’s privacy against unnecessary disclosure of her complete health care record for the requested time period. This more limited disclosure also ensures the integrity of the IPC’s complaint process through adherence to the IPC’s rules of procedure, including the limitation principles set out in PHIPA and in the Code . [36] As noted above, if, in the course of the review, I determine that I need additional portions of the complainant’s patient chart to decide the issues in the review, I will revisit the question of which records of personal health information are reasonably necessary for the purposes of the complaint, and whether procedural fairness requires any further disclosure to the doctor.

[80] Before leaving this topic, I acknowledge a potential third option, falling short of disclosure of the complete patient chart for the requested time period, that could help to address the problem of the hospital’s inability to identify the specific records accessed on specific dates in January, March, and July 2017. That is the disclosure of records dating from around these dates (based on an assumption about the doctor’s potential health care purposes for accessing the complainant’s EHR on those particular dates). The hospital acts on this assumption when, its representations, it identifies records that “coincide” with each of these dates of access. For example, the hospital notes that the doctor’s access on a specific date in January 2017 coincides with referrals he made in January and February 2017. I observe that all of these “coinciding” records for the dates of access in January, March, and July 2017 (i.e., records dating from around the specific dates of access in each of those months) are already among the 12 records from the complainant’s patient chart that I have decided to disclose to the doctor.

[81] Lastly, I have considered the doctor’s reliance, in his October 8, 2021 letter, on decisions of the Ontario Divisional Court in Bongard v. Health Professions Board [37] and Wilson v. Bourbeau. [38] He cites these decisions for the proposition that a complainant is deemed to have impliedly waived confidentiality over documents relevant to proceedings that the complainant has voluntarily initiated.

[82] First, I note that these decisions were made in the context of applications for judicial review of disclosure decisions made by a review body in accordance with its duties under the Regulated Health Professions Act, 1991 , [39] which is a different statutory context than the one that governs this complaint. Among other things, that statute contains a procedural code establishing duties on the part of the review body with respect to disclosure in its proceedings. [40] I have outlined above some important elements of the different statutory scheme governing the IPC, including that IPC proceedings are not subject to the Statutory Powers Procedure Act (unlike the proceedings of the review body considered in these court decisions). I do not find the cited decisions to be directly relevant to the question before me, being the extent of any disclosure I ought to make for procedural fairness purposes to a party in a proceeding before the IPC.

[83] Second, these decisions in any event address the disclosure of documents that are “relevant” to the proceedings at issue. I do not understand these decisions to stand for the proposition that any implied waiver of confidentiality by a complainant disposes of the need to take into account considerations such as relevance and proportionality in deciding the degree of disclosure required for procedural fairness purposes. The doctor has advanced no arguments in support of such a proposition. I have explained above why I am not satisfied that the complete patient chart “up to the end of the time period at issue” is relevant, or proportionate, in the circumstances of this complaint, and accordingly why I have decided that its disclosure is not required for the purposes of procedural fairness to the doctor.

[84] For all these reasons, I grant the doctor’s request for the “patient chart up to the end of the time period at issue” in part. I decline to disclose to the doctor the complainant’s complete chart for the requested time period, and instead have decided to disclose only discrete records of the complainant’s personal health information, as described above at paragraph 65. This disclosure totals 12 pages.

[85] I will also order that certain conditions and restrictions expressly attach to the handling of these 12 pages of personal health information from the complainant’s patient chart. I address this next.

I will impose express conditions and restrictions on the handling of records from the complainant’s patient chart

[86] In my September 14, 2021 letter to the doctor’s counsel, I advised that if I decide to provide the doctor with any of the requested documents in the interests of procedural fairness, I may also impose express conditions or restrictions in respect of those documents. I set out my preliminary views on the terms of an undertaking that I may decide to seek in that event from the doctor’s counsel, the doctor, or from other parties, such as experts retained by the doctor’s counsel.

[87] The draft terms proposed in my letter were the following: The undersigned law firm undertakes that:

1. it may use the Disclosed Materials solely for the purpose of responding to the Review and any appeals or judicial reviews arising therefrom;
2. it shall keep the Disclosed Materials secure and not disclose, publish or otherwise distribute them or their contents without the prior written permission of the IPC;
3. it may permit access to the Disclosed Materials for the use of persons acting under the law firm’s supervision (for example, articling students and retained experts) and shall inform such persons of this undertaking and their obligation to comply with it;
4. it may only permit [the doctor] to access the Disclosed Materials at the undersigned law firm’s office, and shall not permit [the doctor] to retain or make any copies of theDisclosed Materials;
5. if there is a change in [the doctor]’s counsel, it shall either deliver all of the Disclosed Materials to [the doctor]’s new counsel with these conditions attached to them or return the Disclosed Materials to the IPC forthwith at the end of the retainer;
6. as the Disclosed Materials contain sensitive personal health information, it shall either return all of the Disclosed Materials (and any copies made thereof) to the IPC, or certify to the IPC that the Disclosed Materials and all copies made thereof have been securely destroyed, within 30 days after the date the Review and any appeals or judicial reviews arising therefrom are concluded (which, in the case of a potential judicial review that has not been commenced, is deemed to occur 30 days after receiving a copy of the decision concluding the Review);
7. it shall promptly notify the IPC of any breach of this undertaking; and
8. it shall promptly return to the IPC any documents (and all copies thereof) upon request of the IPC.

[88] As seen above, the draft terms generally restrict the use and disclosure of documents subject to the undertaking except for the purposes of this review (and any appeals or judicial reviews arising from the review), and ensure the security of the documents.

[89] In my letter, I invited the doctor’s counsel to comment on any conditions or restrictions that should apply in connection with any disclosure I may decide to make, including by commenting on my preliminary views on the terms of an undertaking, as reproduced above.

[90] In his October 8, 2021 response, the doctor’s counsel objects to the proposed draft terms set out in my letter. He asserts that the draft terms impermissibly infringe and circumscribe sections 9(2)(b) and (c); [41] 37(1)(h) and 37(2); and 41(1)(a), 41(1)(d)(ii) and 41(2) of PHIPA  (sections of PHIPA  that I discuss below.) He also asserts that the draft terms impermissibly circumscribe both the conduct of the doctor’s counsel and the doctor’s own ability to seek legal advice from counsel of the doctor’s choosing, and in this way infringe the doctor’s right to seek legal advice.

[91] However, the doctor’s counsel states that in an effort to resolve the issue, and in the interests of allowing this matter to proceed in an expeditious fashion, the doctor and his counsel will agree to the following (emphasis in original):

[W]e and [the doctor] will agree that the documents, records and/or information we have requested in these proceedings will be used and relied on for the purpose of responding to the Notice of Review and any appeals or judicial reviews arising therefrom (the “Proposed Agreement”).

For absolute clarity, nothing in the Proposed Agreement affects, implicitly or explicitly, in any way, [the doctor’s] ability to seek legal advice and representation from Counsel of his choosing or his right to provide Counsel of his choosing with any documents, records and/or information obtained in any other proceeding, including this proceeding before the IPC.

Whether or not [the doctor], or his Counsel, can use those documents, records, and/or information in any other proceeding is a matter for the parties and the Court in those proceedings. The IPC has no jurisdiction to make orders binding the parties in any other proceedings.

[92] I have considered counsel’s submissions. However, for the reasons given below, I have decided to impose conditions and restrictions (that have been slightly modified from the draft terms, as I will discuss further below) in respect of the 12 pages of records from the complainant’s patient chart described above at paragraph 65. The doctor and his counsel must agree to these terms and conditions, which I have set out in undertakings enclosed with the parties’ copies of this interim decision, if they wish to receive these particular records from the complainant’s patient chart. To be clear, only these records of personal health information from the complainant’s patient chart are subject to the express undertakings. [42]

[93] The other documents that the doctor requested, and that I have decided to disclose, are not subject to the express undertakings.

[94] Specifically, I will not require express undertakings before disclosing the hospital’s representations and related documentation (items (d), (b) and (e) of the doctor’s request). These are documents that are generally shared between the parties to a complaint, without the imposition of express conditions or restrictions at the review stage.

[95] I have also decided against requiring express undertakings in respect of the portions of the complaint documentation and the mediator’s report that I will be disclosing to the doctor (items (a) and (f) of the doctor’s request). These documents are generally shared between the complainant and the respondent in a complaint without the imposition of express conditions or restrictions. In this case, in view of the lack of objection from of the complainant to sharing these documents with the doctor, I will not impose express conditions and restrictions on the doctor or his counsel that do not apply to the other parties in respect of their use and disclosure of these documents.

[96] I reach a different conclusion with respect to the 12 pages from the complainant’s patient chart that I have decided to disclose to the doctor in the interests of procedural fairness. These are copies of records of the complainant’s personal health information that are in the custody or control of the hospital in its role as a provider of health care to the complainant. Unlike most of the other documents that I will be disclosing to the doctor as a result of this interim decision, these records of personal health information originated in the health care provided by the hospital to the complainant. [43] These records were not created for the purposes of this complaint, nor were they part of the complaint documentation filed to the IPC. The IPC obtained these records from the hospital during the review stage solely for the purposes of this complaint.

[97] It is important to note that in the normal course, the IPC does not itself disclose records at issue (or their substance) in a complaint to any party to the complaint. In the context of an access complaint, for example, the IPC would not generally share representations that contain or that would reveal the very personal health information at issue in the complaint. [44] And where the IPC finds, after its review, that a custodian improperly denied access to records of an individual’s personal health information under PHIPA , the IPC will generally order the custodian to grant the individual access to those records, pursuant to the IPC’s powers under section 61  of PHIPA . The IPC would not itself provide those records to the individual. [45]

[98] In this case, the doctor is asking the IPC to disclose to him documents beyond those the IPC routinely discloses to parties to a privacy complaint—including records of the complainant’s personal health information that the IPC obtained from the hospital for the purposes of addressing this complaint. I explained above why I have decided to disclose to the doctor certain records from the complainant’s patient chart in the interests of procedural fairness to the doctor.

[99] However, to mitigate the risks of this disclosure to the complainant’s privacy, and to ensure the security of the records and the integrity of the IPC’s processes, I have also decided to order that certain express conditions and restrictions attach to the doctor and his legal counsel in connection with this disclosure. I have therefore prepared and enclosed with the parties’ copies of this interim decision undertakings that I have prepared for the doctor and his legal counsel, which set out these conditions and restrictions. The doctor and his counsel must agree to these conditions and restrictions, by signing these undertakings, if they wish to obtain these records of personal health information.

[100] The enclosed undertakings contain terms that are largely identical to the draft terms I set out in my September 14, 2021 letter to the doctor (as reproduced above), with the exception of draft clause #4. This term would have prohibited the doctor’s counsel from allowing the doctor to access the records except at counsel’s office. Given the doctor’s counsel’s objections to the draft terms, and in view of the complainant’s decision (after consulting with her own legal counsel) not to take a position on the draft terms, I have decided to streamline the undertakings to align more closely with the terms of undertakings recognized in other similar contexts. The enclosed undertakings do not contain draft clause #4. Instead, I have prepared separate undertakings to be signed by the doctor and his counsel, to govern the handling of the records by each of them. The undertakings I have prepared will permit the doctor and his counsel to use the records subject to the undertakings solely for the purpose of responding to the review (and any appeals or judicial reviews arising from the review). They also include the other terms described, above, to protect the privacy of the complainant and the security of the records subject to the undertaking.

[101] In preparing these undertakings, I considered counsel’s arguments that the terms I originally proposed would impermissibly circumscribe sections 9(2)(b) and (c); 37(1)(h) and 37(2); and 41(1)(a), 41(1)(d)(ii) and 41(2) of PHIPA ; and would impermissibly circumscribe both the conduct of the doctor’s counsel and the doctor’s ability to seek legal advice from counsel of his choosing. For the reasons set out below, I do not agree that the imposition of the express terms I have ultimately decided upon would have these effects.

[102] Sections 9(2) (b) and (c) of PHIPA  state:

Nothing in [PHIPA ] shall be construed to interfere with,

(b) any legal privilege, including solicitor-client privilege;

(c) the law of evidence or information otherwise available by law to a party or a witness in a proceeding[.]

[103] The doctor’s counsel also raises the following sections of PHIPA :

• Sections 37(1)(h) and 37(2), which permit a health information custodian, and its agents, to use personal health information without consent for the purpose of a proceeding where certain conditions are met;
• Sections 41(1)(a) and 41(1)(d)(ii), which permit a health information custodian to disclose personal health information without consent in some circumstances in relation to a proceeding; and
• Section 41(2), which permits an agent or former agent of a custodian who receives personal health information under section 37(2) or 41(1) for the purposes of a proceeding to disclose that information to his professional advisor where certain conditions are met.

[104] As I explain below, the arguments made by the doctor’s counsel appear to conflate uses and disclosures that the hospital may make under sections 37  and 41(1)  of PHIPA  with disclosures the IPC could make for the purposes of its own proceedings, which latter disclosures are not governed by these sections of PHIPA . These arguments also appear to conflate the issue of what uses and disclosures the doctor may make of personal health information already in his possession (for example, as a result of other proceedings) with the IPC’s powers to impose express conditions and restrictions in respect of the use and disclosure of personal health information that the IPC discloses to a party in its own proceedings.

[105] To begin, sections 37  and 41  of PHIPA  confer discretion on health information custodians (such as the hospital) to use and disclose personal health information without consent in some circumstances, and (in particular circumstances) for a custodian’s agents to use and disclose that information. These sections of PHIPA  do not apply to the doctor’s request that the IPC disclose certain documents to him. I do not understand counsel to be suggesting that the IPC is a health information custodian (or an agent of a health information custodian) subject to PHIPA , and it is clear the IPC is not subject to these provisions of PHIPA  in this way.

[106] There is also no explicit claim by the doctor that he obtained (or should be able to obtain) for the purposes of this complaint the complainant’s personal health information directly from the hospital pursuant to section 37(2)  or section 41(1) (a) or 41(1) (d)(ii) of PHIPA , and that he should be permitted to use or further disclose that information under the authority of sections 37(2)  and 41(2)  of PHIPA . (I address further below the doctor’s arguments concerning uses and disclosures of any personal health information he may have obtained for purposes other than this complaint.) I do not understand the doctor’s disclosure request to be a request that the hospital disclose the complainant’s personal health information to him. To the extent this is the doctor’s argument, I note that the hospital’s powers to use and disclose personal health information under these sections of PHIPA  are discretionary, and are to be exercised by the hospital based on the particular facts before it. These sections of PHIPA  conferring discretion on the hospital do not address the question of whether the IPC should require disclosure of personal health information in this case as a matter of procedural fairness to the doctor.

[107] If the doctor’s argument is that he is authorized, under section 41(2)  of PHIPA , to disclose to his legal counsel personal health information that he has already received from the hospital under section 37(2)  or 41(1)  PHIPA , I do not see how the terms I have proposed would interfere with his ability to do so. The conditions and restrictions I have proposed apply in respect of records of personal health information that the IPC (not the hospital) is prepared to disclose to the doctor as part of this complaint process. Even assuming that sections 37  and 41  of PHIPA  were applicable to the complaint, they would not override the IPC’s ability to control its own processes in deciding the extent, and terms, of any disclosure of personal health information that the IPC makes to a party to a complaint on procedural fairness grounds. As I discuss further below, I am also not persuaded that the terms I have proposed will interfere with any legal privilege, or with the law of evidence or information otherwise available by law to a party or witness in a proceeding, in contravention of sections 9(2) (b) and (c) of PHIPA .

[108] In his October 8, 2021 response, the doctor’s counsel says that the doctor and his counsel are prepared to agree that documents I disclose in this IPC proceeding “will be used and relied on for the purpose of responding to the Notice of Review and any appeals or judicial reviews arising therefrom.” However, counsel then asserts that any such agreement would not affect the doctor’s right to seek legal advice and representation from counsel of the doctor’s choosing, or the doctor’s right to provide his counsel with any documents, records and/or information obtained in “any other proceeding, including this IPC proceeding,” and to use such documents, records and/or information “in any other proceeding.” He states that the IPC has no jurisdiction to make orders binding the parties in any other proceedings.

[109] As I stated above, it is important to distinguish between the doctor’s uses and disclosures of personal health information he may have received for other purposes, outside this IPC proceeding, and the doctor’s uses and disclosures of personal health information that the IPC discloses to him for the purposes of this review. The doctor’s handling of information that he obtained through other proceedings is not the subject of the undertakings I have prepared.

[110] The undertakings I have prepared apply only in respect of records of personal health information that the IPC is prepared to disclose to the doctor in the course of this IPC proceeding. The undertakings impose no conditions (nor grant any authority) with regard to the doctor’s ability to provide counsel with documents, records, or information obtained in proceedings other than this IPC proceeding, and to use such documents, records or information in other proceedings. I note that the doctor has not provided the IPC with any details of the information he may have received in the context of other proceedings—including, for instance, details about the nature of that information or any conditions and restrictions under which he may have received it. The IPC previously addressed the doctor’s request (contained in item (c) of his request, reproduced above) for “confirmation that [the doctor] can disclose the information previously provided to him for the purposes of other proceedings in responding to the complaint.” In response, the IPC has stated only that the IPC is not authorizing the doctor to use or disclose information obtained in other proceedings in responding to this complaint. I maintain this position. In these circumstances, I am not prepared to further comment on or to give direction on what can be done with information that may have been disclosed to the doctor through proceedings other than this IPC proceeding.

[111] More generally, the doctor’s objection to the undertakings appears to be based on a claim that the IPC lacks jurisdiction to impose conditions or restrictions on a party’s handling of documents that the IPC discloses to a party to its proceedings for procedural fairness purposes. The doctor has provided no support for this claim, and I find no basis for the proposition that the IPC is an administrative tribunal that lacks this jurisdiction. To the extent the doctor’s argument is based on a concern that the express conditions and restrictions I have proposed would interfere with other proceedings, I observe that the undertakings plainly contemplate exceptions based on court orders. They also preserve the IPC’s ability to consent to additional uses and disclosures of the records subject to the undertakings. Further, as I have stated above, the undertakings do not apply to records disclosed to the doctor in proceedings other than this IPC proceeding.

[112] I observe here that the terms of the undertakings I have prepared for the doctor and his counsel are generally similar to the terms of the implied undertaking used in the civil litigation context. As codified in Ontario in the Rules of Civil Procedure, [46] the deemed undertaking rule generally prevents parties and their lawyers from using evidence or information obtained through the civil discovery process for purposes outside the proceeding in which the evidence was obtained. While court proceedings are distinct from IPC proceedings, and civil discovery is distinct from the PHIPA  review process, this further undermines the doctor’s claim (as I understand it) that the imposition of the express conditions and restrictions I have proposed would impermissibly circumscribe his ability to obtain legal advice, or interfere with legal privileges, like those identified in section 9(2) (b) of PHIPA . For example, the undertakings explicitly permit the doctor and his counsel to use the records subject to the undertakings for the purpose of responding to the review (and court proceedings arising from the review), including by permitting access to other persons acting under the supervision of the doctor’s counsel. The undertaking to be executed by the doctor’s counsel also addresses the delivery of documents to new counsel in the event of a change in counsel.

[113] Section 9(2)(c), which the doctor also raises, provides that PHIPA  shall not be construed to interfere with the law of evidence or information otherwise available by law to a party or a witness in a proceeding. In the context of the powers granted to the IPC to conduct reviews under PHIPA , I do not interpret section 9(2) (c) to mean that the IPC cannot make determinations about the evidence in its own proceedings. Rather, in my view, decisions about what degree of disclosure must be made in the interests of procedural fairness to a party in an IPC proceeding fall squarely within the IPC’s powers. I am not persuaded that this power conflicts with section 9(2) (c) in this case.

[114] For all these reasons, I grant the doctor’s disclosure request in part. With respect to the 12 pages from the complainant’s patient chart that I have decided to disclose in the interests of procedural fairness, I will impose certain express conditions and restrictions on their use and disclosure to protect the complainant’s privacy and the integrity of the IPC’s processes. For greater clarity, the express restrictions and conditions are as follows:

The undersigned law firm undertakes that:

1. it may use the Subject Materials [being only those records from the complainant’s patient chart subject to the undertaking] solely for the purpose of responding to the Review and any appeals or judicial reviews arising therefrom;

2. it shall keep the Subject Materials secure and not disclose, publish or otherwise distribute them or their contents without the prior written permission of the IPC;

3. it may permit access to the Subject Materials for the use of persons acting under the law firm’s supervision (for example, articling students and retained experts) and shall inform such persons of this undertaking and their obligation to comply with it;

4. it may permit access to the Subject Materials by [the doctor] to be used in accordance with [the enclosed separate undertaking to be signed by the doctor];

5. if there is a change in [the doctor’s] counsel, it shall either deliver all of the Subject Materials to [the doctor’s] new counsel with these conditions attached to them, or return the Subject Materials to the IPC forthwith at the end of the retainer;

6. as the Subject Materials contain sensitive personal health information, it shall either return all of the Subject Materials (and any copies made thereof) to the IPC, or provide a sworn personal affidavit to the IPC confirming that the Subject Materials and all copies made thereof have been securely destroyed, within 30 days after the date the Review and any appeals or judicial reviews arising therefrom are concluded (which, in the case of a potential judicial review that has not been commenced, is deemed to occur 30 days after [the doctor] or his counsel receives a copy of the decision concluding the Review);

7. it shall promptly notify the IPC of any breach of this undertaking; and

8. it shall promptly return to the IPC any Subject Materials (and all copies thereof) upon request of the IPC.

[115] The separate undertaking to be signed by the doctor contains largely the same terms (modified to reflect that they apply to the doctor’s handling of the records), with the exception of clauses 4 and 5, which are omitted from the doctor’s undertaking.

[116] The undertakings also specify, for greater certainty, that they do not limit the use of the records subject to the undertakings for impeachment purposes. As noted above, they also contemplate exceptions based on court orders, or with the written agreement of the IPC.

[117] In conclusion, I order that express conditions and restrictions (as set out above, and reproduced in the undertakings enclosed with the parties’ copies of this interim decision) apply to the handling of these 12 pages from the complainant’s patient chart. If the doctor and his legal counsel wish to obtain these records, they must agree to these express conditions and restrictions, and demonstrate their agreement by providing me with executed undertakings. Only after I receive executed undertakings will I disclose these records of the complainant’s personal health information to the doctor (through his legal counsel).

[118] After I make the disclosure described in this interim decision (including of the records subject to the above undertakings, if applicable), I will write to all the parties to advise them of next steps in this complaint. This will include fixing a new date for receipt of the doctor’s representations in response to the Notice of Review sent to him on December 2, 2020.

ORDER:

For the reasons set out above, I make the following orders:

1. The express conditions and restrictions set out at paragraph 114 of this interim decision, subject to the exceptions noted in paragraph 116 (as contained in the template undertakings enclosed with the parties’ copies of this interim decision) attach to the handling of the 12 pages of personal health information that are more particularly described at paragraph 65 of this interim decision.
2. As a condition precedent of receiving these 12 pages of personal health information, the doctor and his legal counsel must agree to the conditions and restrictions referred to in order provision 1. In the event the doctor and his legal counsel wish to obtain these 12 pages of personal health information, the doctor and his legal counsel are to return executed undertakings to me by November 30, 2022.
3. After November 30, 2022, whether or not I receive executed undertakings from the doctor and his legal counsel, I will continue this review to address the issues arising from the complaint.

Original Signed by:		November 16, 2022
Jenny Ryu
Adjudicator