PHIPA DECISION 198

Complaint HC19-00051

Dr. Jaswinder Dhillon

January 17, 2023

Summary: The complainant alleged that the physician disclosed more of his personal health information than necessary to the Workplace Safety and Insurance Board, in contravention of the Personal Health Information Protection Act (PHIPA). In this decision, the adjudicator finds that the discretionary disclosure provision at section 43(1)(h) (disclosure permitted or required by law) authorized the physician to disclose the complainant’s personal health information to the WSIB pursuant to the requirement at section 37(1)  of the Workplace Safety and Insurance Act ,  1997 . She also finds that the data minimization principle at section 30 of PHIPA does not apply, by virtue of section 30(3) of PHIPA, and she dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3, Sch. A ., sections 2  (definitions of “records” and “disclose”), 3(1)1, 4, 29(b), 30(3) and 43(1)(h); Workplace Safety and Insurance Act, 1997 , S.O. 1997, c. 16, Sch. A, section 37(1) .

BACKGROUND:

[1] This complaint considers a physician’s disclosure of his patient’s personal health information to the Workplace Safety and Insurance Board (the WSIB) under section 43(1) (h) of the Personal Health Information Protection Act, 2004 (PHIPA) and finds that it was authorized under that section of PHIPA because it was required by law, namely, section 37(1)  of the Workplace Safety and Insurance Act, 1997  (WSIA ).

[2] The complainant filed a privacy complaint with the Information and Privacy Commissioner of Ontario (the IPC) against Dr. Jaswinder Dhillon and the Ontario Health Clinic – Brantford FHO (the clinic), alleging that Dr. Dhillon inappropriately disclosed his personal health information to the WSIB.

[3] In his complaint, the complainant asserted that, in response to a request from the WSIB for medical information about his left knee from 2014 to 2018, the clinic inappropriately disclosed his personal health information when it disclosed information about another medical issue, thereby disclosing more than what was requested, contrary to PHIPA .

[4] As background, the complainant explained that he had suffered a workplace injury to his left knee, which was treated at the clinic, and he had made a WSIB claim regarding his injury. The complainant stated that, in processing his claim, the WSIB sent the clinic a Request for Health Information Form (the WSIB form). The WSIB form contained a section titled Health Information Requested, with ten enumerated categories, all of which had been checked off. This section of the WSIB form read as follows:

1. Subjective and objective clinical findings.
2. Diagnostics test and their reports (e.g. X-ray, MRI).
3. Specialist report (include operative reports).
4. Treatment and outcomes.
5. Proposed treatment and prognosis.
6. Detailed functional precautions for timely return to work, for this work-related injury.
7. History and treatment of related pre-existing conditions, along with most recent visit prior to date of accident.
8. Range of motion for: LEFT KNEE
9. Current mediations and prescribed dosage.
10. Other: Any medical history re: left knee issues from 2014-date.

[5] The WSIB form also contained a “Comments” section that read, “Please submit all medical information (chart notes, consult reports, imaging) re: left knee from 2014-date.”

[6] The complainant provided a copy of the WSIB form and the clinic’s faxed nine- page response (the disclosed information), which included:

• four pages of notes from the complainant’s chart, with entries from September 2014 to July 2018, that included information about a pre- existing condition with his lower limb
• two, one-page radiology reports from February 2015 and June 2018, respectively, and
• a two-page MRI report from June 2018.

[7] The complainant was concerned about the disclosed information because, in his view, it included information that was not directly related to his knee injury. The complainant stated that he had contacted the WSIB about his concern and it had agreed to delete the disclosed information from his WSIB claim file. The complainant provided the IPC with a letter on WSIB letterhead from a WSIB service delivery manager (the WSIB letter), which stated as follows:

Further to our telephone conversation today, I am enclosing the medical reports you requested. These reports will be permanently deleted from your file.

[8] The IPC attempted to mediate the complaint, but a mediated resolution was not possible. Accordingly, the complaint was moved to the adjudication stage of the IPC’s complaint process. Another IPC adjudicator commenced a review under PHIPA , sending the parties a Notice of Review setting out the issues in the complaint. Dr. Dhillon provided written representations in response to the Notice of Review. Dr. Dhillon’s representations were shared with the complainant, who was invited to respond to them and to the issues set out in the Notice of Review. For his written representations, the complainant provided the documents he had submitted when he filed his IPC complaint and stated that he had nothing to add. These documents were: the complainant’s IPC complaint form (eight pages), the WSIB letter, and the nine pages of disclosed information. The complaint was then transferred to me to continue the adjudication process. After assessing the file, I decided I did not require further representations in order to issue a decision.

[9] In this decision, I dismiss the complaint and issue no order.

DISCUSSION:

A. Preliminary findings

[10] I begin with the facts that are undisputed. There is no dispute and I find that, as a health care practitioner, Dr. Dhillon is a health information custodian under section 3(1)1 of PHIPA . There is also no dispute and I find that, the disclosed information at issue constitutes “records” of the complainant’s “personal health information,” as those terms are defined in sections 2 and 4(1) of PHIPA , respectively. Finally, there is no dispute and I find that, in faxing the disclosed information to the WSIB, Dr. Dhillon disclosed (within the meaning of the term “disclose” in section 2 of PHIPA ) the complainant’s personal health information.

B. Was Dr. Dhillon authorized under PHIPA to “disclose” the complainant’s personal health information at issue to the WSIB?

[11] The sole issue in this complaint is whether Dr. Dhillon was authorized under PHIPA  to disclose the complainant’s personal health information at issue to the WSIB. For the reasons that follow, I find that disclosure was authorized by section 43(1)(h) of PHIPA , because section 37(1)  of the WSIA  required the disclosure.

[12] The complainant’s representations do not directly address the issues or the provisions of PHIPA  or the WSIA  cited in the Notice of Review. The complainant generally takes issue with the amount of his personal health information that Dr. Dhillon disclosed in response to the WSIB’s request for health information. He believes that Dr. Dhillon disclosed information that was not directly related to his knee injury, which was the condition for which the WSIB was requesting information. The complainant’s position is that Dr. Dhillon was not authorized to disclose his personal health information about his other medical issue to the WSIB. In support of his position, the complainant notes that the WSIB deleted the disclosed information from his WSIB file, as confirmed by the WSIB letter.

[13] Section 29 of PHIPA  prohibits disclosure of an individual’s personal health information unless the individual has consented, or PHIPA  permits or requires the disclosure. The parties’ representations do not address whether Dr. Dhillon had the complainant’s consent under section 29(a) of PHIPA . Dr. Dhillon argues that he disclosed the complainant’s personal health information to the WSIB in accordance with his statutory obligation to do so. He submits that he was permitted, by section 43(1)(h) of PHIPA , and required by section 37(1)  of the WSIA , to disclose the complainant’s personal health information to the WSIB. For the following reasons, I am satisfied that section 29(b) is engaged in this complaint and that Dr. Dhillon’s disclosure of the complainant’s personal health information without consent was permitted by the discretionary disclosure provision at section 43(1)(h) of PHIPA .

[14] Section 43(1)(h) of PHIPA  confers discretion on health information custodians to disclose personal health information without consent if required by another law. It states:

A health information custodian may disclose personal health information about an individual,

(h) subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada.

[15] I agree with Dr. Dhillon that section 43(1)(h) permits him to disclose the complainant’s personal heath information to the WSIB because the disclosure is required by law, namely, section 37(1)  of the WSIA , which states:

Every health care practitioner who provides health care to a worker claiming benefits under the insurance plan or who is consulted with respect to his or her health care shall promptly give the Board such information relating to the worker as the Board may require. [1]

[16] Under this provision of the WSIA , Dr. Dhillon, as a “health care practitioner who provides health care to a worker claiming [WSIB] benefits” was required to “promptly give the [WSIB] such information relating to the worker as the [WSIB] may require.”

[17] I am satisfied that the conditions for disclosure under section 43(1)(h) of PHIPA  are met in the circumstances of this complaint. I find that Dr. Dhillon was authorized, by section 43(1)(h) of PHIPA , to disclose the complainant’s personal health information to the WSIB without the complainant’s consent.

[18] Dr. Dhillon asserts that he was not limited to disclosing only information that was “directly related to the knee injury” as suggested by the complainant. Dr. Dhillon argues that because he was required by section 37(1)  of the WSIA  to provide “history and treatment of related pre-existing conditions” he disclosed all information that, in his clinical opinion, was reasonably necessary to meet the requirement; this included information regarding a pre-existing musculoskeletal condition of the complainant’s lower limb. I agree that Dr. Dhillon’s disclosure was in accordance with section 37(1)  of the WSIA , which reads quite broadly and says that the health care practitioner must give such information relating to the worker as the WSIB may require. In my view, Dr. Dhillon reasonably concluded that the WSIB required information about the pre-existing condition of the lower limb.

C. Is section 30 of PHIPA relevant in the circumstances of this complaint?

[19] The complainant’s arguments that Dr. Dhillon breached PHIPA  by disclosing information to the WSIB that was not directly related to the knee injury – the condition for which the WSIB requested information – allude to the data minimization principle in section 30 of PHIPA . [2] However, for the following reasons, I find that section 30 is not relevant.

[20] Section 30 of PHIPA  sets out the general limiting principles that apply to the collection, use, and disclosure of personal health information by health information custodians and reads:

1. A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.
2. A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be.
3. This section does not apply to personal health information that a health information custodian is required by law to collect, use or disclose.

[21] I have found above that Dr. Dhillon was required by section 37(1)  of the WSIA , and thereby permitted by section 43(1)(h) of PHIPA , to disclose the complainant’s personal health information at issue. Section 30(3) of PHIPA  provides that section 30 does not apply when the disclosure is required by law. The WSIA  itself contains parameters for the disclosure: the information must be information relating to the worker that the WSIB required. I have explained above that that requirement was met. Section 30 of PHIPA  is inapplicable in the circumstances.

[22] Having found that Dr. Dhillon was authorized under section 43(1)(h) of PHIPA  to disclose the complainant’s personal health information at issue to the WSIB and that section 30 of PHIPA  does not apply, I make no order in this complaint. I provide this decision in satisfaction of the requirement at section 61(4) of PHIPA  to provide my reasons for not making an order.

NO ORDER:

For the foregoing reasons, I dismiss the complaint.

Original signed by:		January 17, 2022
Stella Ball
Adjudicator