Health Information and Privacy

Decision Information

Summary:

The complainant made a request under the Personal Health Information Protection Act to the custodian seeking copies of records containing her personal health information. In her complaint to the IPC, the complainant takes the position that the custodian deleted emails that would have been responsive to her request and asks the IPC to conduct an audit of the custodian’s computer so that the emails may be recovered and provided to her. The complainant raised the same allegation in a complaint to the College of Psychologists (the college), of which the custodian is a member.

In this decision, the adjudicator finds that no review of the complaint is warranted given that the college proceedings appropriately dealt with the subject matter of the complaint before the IPC. The adjudicator exercises her discretion under section 57(4)(b) of PHIPA not to review the complaint.

Decision Content

Logo of the Information and Privacy Commissioner of Ontario, Canada / Logo du Commissaire à l'information et à la protection de la vie privée de l'Ontario, Canada

PHIPA DECISION 203

Complaint HA20-00110

A Psychologist

March 1, 2023

Summary: The complainant made a request under the Personal Health Information Protection Act to the custodian seeking copies of records containing her personal health information. In her complaint to the IPC, the complainant takes the position that the custodian deleted emails that would have been responsive to her request and asks the IPC to conduct an audit of the custodian’s computer so that the emails may be recovered and provided to her. The complainant raised the same allegation in a complaint to the College of Psychologists (the college), of which the custodian is a member.

In this decision, the adjudicator finds that no review of the complaint is warranted given that the college proceedings appropriately dealt with the subject matter of the complaint before the IPC. The adjudicator exercises her discretion under section 57(4)(b) of PHIPA not to review the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sched A , 3(1), 4(1), 57(3) and 57(4); Regulated Health Professions Act, 1991 , SO 1991, c 18, section 36(3) .

Decisions Considered: PHIPA Decision 80.

Cases Considered: British Columbia (Workers’ Compensation Board) v. Figliola, 2011 SCC 52 (CanLII); Penner v. Niagara (Regional Police Services Board), 2013 SCC 19 (CanLII).

BACKGROUND:

[1] The complainant submitted an access request under the Personal Health Information Protection Act (PHIPA or the Act), to a psychologist (the custodian) for her “entire file.” [1] The complainant had also filed a complaint against the custodian with the College of Psychologists of Ontario (the college), which I explain in further detail below.

[2] The custodian conducted a search for responsive records and granted the complainant access under PHIPA to the located records. In response, the complainant took the position that additional email records should exist and filed a complaint with the Information and Privacy Commissioner (IPC).

[3] A mediator was assigned to the complaint file to explore settlement with the parties. During mediation, the custodian located and granted the complainant access to additional records. Also during mediation, the custodian sent a letter [2] to the complainant in which she indicates that while she initially believed that she had maintained hard copies of all emails exchanged with the complainant, she did not. The custodian explained that “some of her emails were deleted in order to create more space within her email account. These deleted emails were not backed up electronically or physically and are not retrievable.” The custodian stated in the letter that “the missing emails cannot be found and this cannot be provided.”

[4] At the end of mediation, the complainant took the position that the custodian had not conducted a reasonable search to locate the additional email records referenced in her complaint. The complainant argued that a reasonable search would require the custodian to complete a forensic audit to retrieve any deleted emails which would respond to her request.

[5] No further mediation was possible and the file was transferred to the adjudication stage of the complaint process in which an adjudicator may conduct a review. I sent a Notice of Review to each of the parties and invited their written representations. The parties made representatinons.

[6] I then invited supplemental representations from the custodian regarding her position that the complainant’s complaint to the college raised the same issues which are the subject of the complaint before me. This argument raises the potential application of the “no review” process contemplated by section 57(4)(b) of PHIPA. The non-confidential portions of the custodian’s supplemental representations were provided to the complainant who had an opportunity to provide representations in response, which she did. [3]

[7] I have considered all of the information that has been put before me. However, for the sake of succinctness, I only summarize the points that I find to be most directly related to my determination of whether I should exercise my discretion to discontinue my review under section 57(4)(b). [4]

[8] For the reasons explained below, I find that the subject-matter of the complaint has been appropriately dealt with by the college. Accordingly, I exercise my discretion and decline to continue my review of this matter under section 57(4)(b).

DISCUSSION:

[9] The custodian says that on March 2, 2020 the complainant submitted a complaint to the college regarding “concerns regarding records (i.e. the same missing email records which are the subject of the complainant’s IPC complaint).” The complainant says that she made her access request to the custodian under PHIPA after the college told her that there were “limits to their investigation.” The complainant says that the college told her that it does not have the authority to order the custodian to provide her copies of her medical records. Both parties, in their representations acknowledge that the college commissioned a forensic audit of the custodian’s computer and hard drive during its investigation. The complainant indicates that she has been informed about the results of the college’s investigation but was not provided a copy of the report.

[10] In my invitation to the parties for supplemental representations, I asked them:

  • Has the subject-matter of this aspect of the complaint before me been appropriately dealt with in other proceedings?
  • Should I exercise my discretion not to review the matter under section 57(4)(b) of PHIPA?

[11] I told the parties that the IPC had previously found in PHIPA Decision 80 that merely taking notice of the existence of the prior proceedings, in order to make a determination under section 57(4)(b) of the Act, does not engage section 36(3) of the RHPA. [5] I shared my preliminary assessment with the parties that section 36(3) of the RHPA did not preclude me from taking notice of the college proceedings.

[12] In response, the parties provided representations explaining their positions with regard to the above-referenced questions. The parties did not object to my preliminary assessment regarding the IPC’s previous ruling regarding section 36(3) of RHPA. I agree with and adopt the reasoning in PHIPA Decision 80 and find that in the circumstances of this complaint that it is appropriate for me to take notice of the existence of the college proceedings for the limited purpose of making a determination under section 57(4)(b) of PHIPA.

[13] I confirm that in taking notice of the college proceedings for the purpose of making a determination under section 57(4)(b) of the Act, I have not otherwise relied on any report, document, order or decision or any other materials that are subject to the prohibition in section 36(3) of the RHPA.

Has the subject-matter of the complaint before me been appropriately dealt with in the college proceedings?

[14] In her representations, the complainant states:

[My college] complaint was related to [the custodian’s] failure to provide me with a copy of my personal health records, despite my written request for my medical records and clinical file, a mere 5 months following my last session with [her].

It has been 8 years and I have yet to receive the substantive emails that were sent and received exclusively between myself and [the custodian] from her computer. You, as adjudicator, can order a forensic audit of [the custodian’s] computer to retrieve the clinical emails (and provide to me) that [the custodian] admitted to intentionally deleting. I believe I have a right of access to my medical records from the health care custodian.

[15] In PHIPA Decision 80, Adjudicator Jenny Ryu stated:

Section 57(4)(b) of the Act permits this office not to review the subject- matter of a complaint where the complaint has been or could be more appropriately dealt with by means of another procedure. The thrust of section 57(4)(b) is to confer a discretion on this office not to proceed with a complaint where doing so would amount to a re-litigation of issues appropriately addressed in another forum, or where the complaint could be more appropriately dealt with by another procedure.

[16] The adjudicator reviewed two Supreme Court cases [6] which looked at factors to be considered by decision-makers in determining whether the substance of a complaint has been appropriately dealt with. [7]

[17] Together these decisions, British Columbia (Workers’ Compensation Board) v. Figliola (Figliola) and Penner v. Niagara (Regional Police Services Board) (Penner), set out some factors for consideration by a decision-maker in exercising her discretion to proceed or not to proceed with a matter on the basis of a prior proceeding. These include: whether there was concurrent jurisdiction in the prior proceeding to decide the issues at hand; whether the previously decided legal issue was essentially the same as what is now being complained of; and whether there was an opportunity in the prior proceeding for the complainants or their privies to know the case to be met and have the chance to meet it, regardless of how closely the previous process procedurally mirrored the one the decision-maker prefers or uses.

[18] In addition, the Supreme Court in Penner observed that other considerations of fairness to the parties are relevant to the exercise of discretion.

[19] I asked the parties to explain whether section 57(4)(b) applies to this complaint in light of the considerations identified above. The parties were also invited to address whether it would be unfair or unjust not to proceed with a review in the circumstances of this complaint.

[20] I have considered the representations of the parties and find that the subject- matter of the complaint before me has been already appropriately dealt with by the college. The custodian asserts, and I agree, that the college’s mandate includes enforcing standards and regulations relating to record-keeping. [8] I also accept the custodian’s evidence that the college conducted an investigation into the concerns raised by the complainant, which included a summons being served on the custodian’s internet provider and a report being prepared by a forensic investigator who conducted an examination of the custodian’s computer and hard drive. Furthermore, based on the representations of the parties, I am satisfied that the complainant was granted multiple opportunities to participate and make submissions during the college proceedings. In addition, there is no suggestion in the complainant’s submissions that the college’s proceedings were procedurally unfair.

[21] Having regard to the above, I find that the college proceedings appropriately dealt with the subject-matter of the IPC complaint before me.

Should I exercise my discretion not to review the matter under section 57(4)(b) of PHIPA?

[22] The Court in Penner instructs that even where the preconditions for applying the common law finality doctrine of issue estoppel have been met, other fairness factors ought to be considered. [9] The Court identified factors such as significant differences in the purpose and scope of the different proceedings, and the reasonable expectations of the parties about the impact of the prior proceedings. [10]

[23] The complainant states:

The [college] proceeding did not provide me an opportunity to get a copy of my medical records from [the custodian’s] computer… The [college] investigation concluded [that the custodian] breached standards of care, and the outcome was to help protect the public in the future; it does not provide me as victim, access to my records that [the custodian] failed to provide.

It would be unfair and unjust not to review the facts that I have not been given a copy of my personal health records from [the custodian], and not to order a forensic audit to obtain them.

If it is not possible to get all my substantive email records from [the custodian’s] computer in a forensic audit, it would still be helpful for me to have it ordered by the IPC. To obtain a copy of a forensic audit that the IPC can order, I can then use it as proof in the civil proceedings to show that [the custodian] breached standards of care, and that I have been truthful all along.

[24] Adjudicator Ryu considered fairness factors in PHIPA Decision 80 and compared the differences in the proceedings between a different regulatory college [11] and the IPC and found that the differences between the proceedings were not significant enough to warrant a re-litigation of the complaint before her. In making her decision, Adjudicator Ryu stated:

The IPC’s mandate to receive and respond to health privacy complaints under the Act may overlap with the College’s role to regulate its members in the public interest. This may occur, as here, in the case of a complaint about a member’s actions or conduct in respect of patient personal health information. This type of complaint may raise issues of professional misconduct, [12] the member’s compliance with the Act’s rules governing the collection, use and disclosure of personal health information, and other issues.

The College is empowered to address this type of complaint through the Committee’s investigation and decision-making process, which may result in remedial action against the College member. [13] The IPC may decide to review a complaint alleging a breach of the Act and, following its review, may make orders and recommendations to remedy contraventions of the Act. [14] The IPC has recognized that orders and recommendations made by this office are different from the outcome of College proceedings, and serve a different purpose. [15] In particular, dispositions issued by the Committee are generally directed at improving a member’s conduct or future practice, or disciplining the member where appropriate, while the IPC’s focus is on addressing systemic issues arising from complaints. [16] In this case, however, I am satisfied that these differences do not warrant a re-litigation of this matter before this office.

[25] I find that Adjudicator’s Ryu’s reasoning is relevant in the circumstances of this complaint. The IPC’s mandate to receive and respond to complaints under PHIPA may overlap with the college’s role to regulate the custodian in the public interest. In this case, the complainant’s complaint to the college raised issues relating to the custodian’s compliance with the college’s record-keeping standards. There is no dispute that the college investigated the complaint. PHIPA provides that the IPC has the authority to review the same type of allegation related to the custodian’s record-keeping practices. [17] However, following a review, the IPC may make orders and recommendations only provided for in PHIPA.

[26] Having regard to the above, I find that the differences between the college and IPC’s proceedings, in the circumstances of this complaint, do not give rise to a fairness issue warranting the re-ligation of this matter. In making my decision, I took into account the complainant’s argument that a marked difference between the college and IPC is that the IPC can order the custodian to grant her access to records of her PHI. However, the issue raised in this complaint is search, not access. Any additional records located as a result of an audit would have to be the subject of another access decision.

[27] Furthermore, I reject the complainant’s argument that the fairness considerations in Penner are engaged because the college proceedings did not result in her obtaining the type of evidence she says would be helpful in a civil suit. I am not satisfied that the fairness considerations contemplated in Penner require a duplicate proceeding in the circumstances.

[28] Pursuant to section 57(4)(b), I have decided not to continue with my review of this complaint. I issue this decision in satisfaction of the notice requirement in section 57(5) of PHIPA.

NO REVIEW:

For the foregoing reasons, no further review of this matter will be conducted under Part VI of the Act.

Original Signed by:

 

March 1, 2023

Jennifer James

 

 

Adjudicator

 

 

 



[1] There is no dispute and I find that the psychologist in question is a “health information custodian” within the meaning of section 3(1) of PHIPA (paragraph 8). In addition, there is no dispute and I find that the complainant’s request for her “entire file” constitutes a request for her personal health information (PHI) as defined in section 4(1) of PHIPA.

[2] Letter, dated March 24, 2021.

[3] The parties’ representations were shared in accordance with the confidentiality criteria set out in IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act ,  2004 .

[4] The Supreme Court of Canada found in Canada (Minister of Citizenship and Immigration) v. Vavilov, 2019 SCC 65, at paragraphs 128 and 301 Newfoundland and Labrador Nurses' Union v. Newfoundland and Labrador (Treasury Board) , 2011 SCC 62, [2011] 3 S.C.R. 708 that an administrative decision maker is not required to explicitly address every argument raised by the parties. Moreover, the fact that a decision maker’s reasons do not address all arguments will not, on its own, impugn the validity of those reasons or the result. (See Vavilov, at para 91; Newfoundland Nurses, at para 16).

[5] Section 36(3) of the RHPA states:

No record of a proceeding under this Act, a health profession Act or the Drug and Pharmacies Regulation Act, no report, document or thing prepared for or statement given at such a proceeding and no order or decision made in such a proceeding is admissible in a civil proceeding other than a proceeding under this Act, a health profession Act or the Drug and Pharmacies Regulation Act or a proceeding relating to an order under section 11.1 or 11.2 of the Ontario Drug Benefit Act.

[6] British Columbia (Workers’ Compensation Board) v. Figliola, 2011 SCC 52 (CanLII) (Figliola) and Penner v. Niagara (Regional Police Services Board), 2013 SCC 19 (CanLII) (Penner).

[7] See paragraphs 47, 48 and 49 of PHIPA 80.

[8] See for example clauses 2.1, 9.2 and 9.4 of the College of Psychologists of Ontario, Standards of Professional Conduct (2017) which were referenced in the custodian’s representations.

[9] See Penner, above, at paras 45-48. Also cited in PHIPA Decision 80 at para 49.

[10] Ibid.

[11] In PHIPA Decision 80, Adjudicator Ryu considered whether proceedings related to a complaint made against the doctor to the College of Physicians and Surgeons of Ontario (CPSO), which was decided by the CPSO’s Inquiries, Complaints and Reports Committee and later confirmed by the Health Professions Appeal and Review Board already appropriately dealt with the IPC complaint matter before her.

[12] Footnote 21 in PHIPA Decision 80 which references the Medicine Act, 1991, c 30 and the College of Physicians and Surgeons Policy Statement #8-05.

[13] Footnote 22 in PHIPA Decision 80 which references schedule 2 to the RHPA (Health Professions Procedural Code), section 26.

[14] Footnote 23 in PHIPA Decision 80 referencing section 61 of PHIPA which sets out the IPC’s powers after conducting a review.

[15] Footnote 24 in PHIPA Decision 80 referencing PHIPA Decision 16, at para 19.

[16] Footnote 25 in PHIPA Decision 80 which states: “The Court of Appeal recognized the IPC’s position regarding its own mandate in Hopkins v. Kay, cited above. See, for example, paras 38, 55-59 and 73.”

[17] Sections 10, 12, 13 and 14 of PHIPA contain provisions relating to information and security practices required by custodians having custody or control of personal health information.

 You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.