PHIPA DECISION 208

Complaint HA21-00218

Kristus Darzs Latvian Home

May 8, 2023

Summary: This complaint deals with an access decision made by the Kristus Darzs Latvian Home (the custodian) in response to a request made by an Estate Trustee for all records relating to her deceased father who had been a resident at the custodian’s facility. The custodian granted access to all records, with the exception of a number of emails for which it claimed the application of the exemption in section 52(1)(e)(iii) of the Personal Health Information Protection Act (the Act). In this decision, the adjudicator finds that the emails are “dedicated primarily” to the deceased’s personal health information within the meaning of section 52(3) of the Act. She also finds that these emails are exempt from disclosure under section 52(1)(e)(iii) of the Act Consequently, under section 61(1) of the Act, the adjudicator makes no order. The complaint is dismissed.

Statutes Considered: Personal Health Information Protection Act, 2004, S.O. 2004 , c. 3, sections 52(1) (e)(iii), 52(3) and 61(1).

Decisions Considered: PHIPA Decisions 24 and 200.

BACKGROUND:

[1] This decision disposes of the issues raised as a result of an access decision made by the Kristus Darzs Latvian Home (the custodian) under the Personal Health Information Protection Act (the Act). The requester is the Estate Trustee of her deceased father, who was a resident at the custodian’s facility. The access request was for all records relating to the deceased from the time of admission to the time of discharge from the custodian.

[2] In response to the request, the custodian issued a decision to the requester, granting full access to her father’s electronic health record. The custodian also advised the requester that it was withholding certain email communications (the emails) in full, that referred to her father because these emails were sent with either a direct or implied expectation of confidentiality on the part of the author(s) of the emails.

[3] The requester, now the complainant, made a complaint to the Information and Privacy Commissioner of Ontario (the IPC) of the custodian’s decision relating to the emails.

[4] During the mediation of the complaint, the complainant advised the mediator that she continued to seek access to the emails. The mediator informed the custodian of the complainant’s position. In response, the custodian clarified that it was withholding the emails under section 52(1)(e)(iii) (provider of information in confidence) of the Act.

[5] The complaint then moved to the adjudication stage of the complaints process, where an adjudicator may conduct a review. I decided to conduct a review and sought, and received, representations from the custodian and the complainant. The representations were shared between the custodian and the complainant. Portions of the custodian’s representations were withheld from the complainant, as they met the confidentiality criteria set out in the IPC’s Code of Procedure for Matters under PHIPA (the Code). While I will not be referring to the confidential representations in this decision, I have taken them into consideration in making my findings. The complainant objects to the withholding of portions of the custodian’s representations, which I address below as a preliminary issue.

[6] During the review of the complaint, there was no dispute between the complainant and the custodian that:

• the custodian is a health information custodian as defined in section 3(1)4 of the Act,
• the complainant is the Estate Trustee of the deceased and as such may exercise a right of access to the deceased’s personal health information,[1] and
• the emails contain the personal health information of the deceased as defined in section 4(1) of the Act.

[7] For the reasons that follow, I find that the emails are “dedicated primarily” to the deceased’s personal health information within the meaning of section 52(3) of the Act. I also find that these emails are exempt from disclosure under section 52(1)(e)(iii) of the Act Consequently, under section 61(1) of the Act, I make no order. The complaint is dismissed.

RECORDS:

[8] The records consist of email communications to the custodian. In this decision, I refer to the records as “emails.” The parties refer to them as both “records” and “emails.”

ISSUES:

1. Are the emails “dedicated primarily” to the personal health information of the deceased within the meaning of section 52(3) of the Act?
2. Does the exemption in section 52(1)(e)(iii) of the Act apply to the emails? If so, can the exempt information be severed under section 52(2)?

DISCUSSION:

Preliminary issue: the withholding of portions of the custodian’s representations

[9] The complainant has raised a concern about parts of the custodian’s representations that were submitted in this complaint but that I did not share with her. In particular, the complainant takes issue with the fact that I withheld portions V.B.1 and V.D.1 of the custodian’s representations from her. The complainant’s position is that the principles of procedural fairness, both at common law and in the IPC’s Code[2] and jurisprudence require that she be able to review the withheld portions of the custodian’s representations in order to “know the case she has to meet.”

[10] I examined the custodian’s representations and decided under sections 18.01 and 18.03(a) of the Code to withhold the portions referred to above from the complainant. I find that the disclosure of these portions of the custodian’s representations to the complainant would reveal the substance of the records at issue, in addition to the actual content of some of the records. The records are the subject matter of this complaint in which the custodian has claimed that they are exempt from a right of access. As a result, I find that I properly withheld these portions of the custodian’s representations from the complainant, in accordance with the Code.

[11] I considered and am satisfied that the complainant has been provided the opportunity to know the case to be met. She was provided with a Notice of Review that explained the basis of the custodian’s claims, as well as the relevant principles to address. Further, the complainant was provided with general information about the basis of the custodian’s arguments in this complaint.

Issue A: Are the emails “dedicated primarily” to the personal health information of the deceased within the meaning of section 52(3) of the Act?

[12] The extent of an individual’s right of access under the Act depends on whether the record of his or her personal health information is “dedicated primarily” to that information.

[13] This is because, subject to any applicable exemptions, the right of access in PHIPA applies either to the whole record, or only to certain portions of it. Specifically, while section 52(1) of PHIPA grants a right of access to the entire record, section 52(3) limits access where the record is not “dedicated primarily” to the individual’s personal health information. Section 52(3) of PHIPA states:

Despite subsection (1) [setting out exemptions from the right of access in PHIPA], if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[14] PHIPA Decision 17 set out this office’s approach to the interpretation of section 52(3).[3] In order to determine whether a record is “dedicated primarily” to the personal health information of the individual within the meaning of section 52(3), the IPC takes into consideration various factors, including:

• the quantity of personal health information of the requester in the record,
• the purpose of the personal health information in the record,
• the reason for the creation of the record,
• whether the personal health information of the requester is central to the purpose for which the record exists, and
• whether the record would exist “but for” the personal health information of the requester in it.

Representations

[15] The parties agree that the emails are dedicated primarily to the deceased’s personal health information and, as a result, the complainant has a right to access the emails in their entirety, subject to section 52(1)(e)(iii).

Analysis and findings

[16] Having examined the emails and taking into account the positions of the complainant and the custodian, I find that they are dedicated primarily to the personal health information of the deceased within the meaning of section 52(3) of the Act. In making this finding, I have taken into consideration the purpose of the personal health information of the deceased in the emails and the reason for the creation of these emails, whether the personal health information of the deceased is central to the purpose for which the emails exist, and whether the emails would exist “but for” the personal health information of the deceased in them.

[17] As a result, I find that the complainant as Estate Trustee of her father’s estate has a right of access under the Act to the entirety of the emails, subject to my findings regarding whether the exemption in section 52(1)(e)(iii) applies to them.

Issue B: Does the exemption in section 52(1)(e)(iii) of the Act apply to the emails? If so, can the exempt information be severed under section 52(2)?

[18] The custodian is claiming the application of the exemption in section 52(1)(e)(iii) to the emails. A record may be exempt, either in whole or in part, from the right of access in PHIPA.

[19] Section 52(1)(e)(iii) of PHIPA states:

Subject to this Part [Part V of PHIPA, setting out the rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(e) granting the access could reasonably be expected to,

(iii) lead to the identification of a person who provided information in the record to the custodian explicitly or implicitly in confidence if the custodian considers it appropriate in the circumstances that the identity of the person be kept confidential;

[20] Even where a record contains information exempted under section 52(1) of PHIPA, section 52(2) may apply to give the individual a right of access to part of the record. Section 52(2) states:

Despite subsection (1), an individual has a right of access to that part of a record of personal health information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of clauses (1) (a) to (f).

Representations

[21] The authors of the emails are named in the emails. The custodian submits that there is sufficient evidence in the emails that the information provided to it was done so either explicitly or implicitly with an expectation of confidentiality. The custodian further argues that the emails cannot be severed, as they fall within section 52(1)(e)(iii) in their entirety.

[22] The complainant advises that she wishes to receive the emails in order to determine why her father died prematurely. With respect to the exemption claimed by the custodian, the complainant submits that in order for a party to rely on “this type” of exemption, it must be established that the supplier of the information had an objectively reasonable expectation of confidentiality at the time the information was provided. The complainant relies on Order PO-2274.

[23] The complainant submits that the authors of the emails could not have had a reasonable expectation of privacy because a physician has a duty to grant access to the information they use in administering treatment.[4] In addition, the complainant argues, because the custodian has conceded that the emails are dedicated primarily to her father’s personal health information, they are relevant to the fiduciary relationship that existed between her father and his caregivers and that were, therefore, used in administering treatment to him. Furthermore, the complainant submits that because the authors of the emails knew or reasonably ought to have known that her father’s healthcare providers were obligated to share the information in the emails with him, there could be no reasonable expectation of confidentiality in the emails. The complainant also argues that there could be no reasonable expectation of confidentiality regarding the emails because it was reasonably foreseeable that there would be civil litigation involving the death of her father at the custodian’s facility.

[24] Lastly, the complainant submits that the exemption in section 52(1)(e)(iii) has rarely been invoked, stating:

It is submitted that this is because the potential for disclosure under the Rules of Civil Procedure and healthcare providers’ fiduciary duties means that there will rarely be a reasonable expectation of confidentiality when providing information about someone else to a healthcare provider as was done in this case.

Analysis and findings

[25] For ease of reference, section 52(1)(e)(iii) of PHIPA states:

Subject to this Part [Part V of PHIPA, setting out the rights of access and correction], an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(e) granting the access could reasonably be expected to,

(iii) lead to the identification of a person who provided information in the record to the custodian explicitly or implicitly in confidence if the custodian considers it appropriate in the circumstances that the identity of the person be kept confidential;

[emphasis added]

[26] PHIPA Decision 200 is instructive regarding the burden of proof of a health information custodian in claiming the exemption in section 52(1)(e)(iii). Adjudicator Valerie Jepson conducted an analysis, stating:

The hospital has the burden of proof[5] to demonstrate that granting access “could reasonably be expected to” lead to the harm in paragraph 52(1)(e)(iii). To establish that granting access “could reasonably be expected to” result in a specified harm, the hospital must provide detailed evidence about the potential for the harm, demonstrating that the risk of harm is beyond the merely possible or speculative.[6] Although it need not prove that granting access will in fact result in such harm, how much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences.[7]

[27] I have examined the contents of the emails in their entirety and I am satisfied that the conditions set out in the exemption in section 52(1)(e)(iii) have been met. In particular, I find that granting access to the emails could reasonably be expected to lead to the identification of individual(s) who provided the information to the custodian, even if the name of the individual(s) were severed from the emails. I also find based on both the custodian’s representations, but more so on my examination of the records, that the information in the emails was provided to the custodian explicitly in confidence by the individual(s) who provided the information. I also find that it is appropriate for the custodian to keep the information in these emails and the identity(ies) of the provider of the information confidential.

[28] The complainant’s position is that there is no objective basis for concluding that there was a reasonable expectation of confidentiality regarding the emails for two reasons; first, possible civil litigation between the complainant and the custodian, and second, that the information in the emails was used to provide healthcare to the complainant’s father because of the fiduciary relationship between the custodian and him. In my view, the fact that there may or may not be civil litigation at some point in the future between the complainant and the custodian, and whether or not the information in the emails was used to facilitate the deceased’s healthcare does not negate the meaning of the exemption in section 52(1)(e)(iii) of the Act. As I have stated above, I have found that the requirements of section 52(1)(e)(iii) have been met.

[29] I am also satisfied that the custodian has considered and decided that it is appropriate to keep these identities confidential. I have reached this conclusion because it is my view that the custodian has demonstrated in the course of this complaint, including its decision to provide full access to the rest of the deceased’s records to the complainant, that it worked to balance the complainant’s right of access with the interests protected by section 52(1)(e)(iii). For these reasons, I am satisfied that the custodian properly exercised its discretion in withholding the emails under section 52(1)(e)(iii), regardless of the purpose of the complainant’s access request.

[30] I now turn to section 52(2), which provides that despite section 52(1)(e)(iii), an individual has a right of access to that part of a record of personal health information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of section 52(1). I find in the circumstances of this case that if I sever the information in the emails that would lead to the identification of the individual(s) who provided the information explicitly in confidence to the custodian, the remaining information would consist solely of meaningless snippets.[8] As a result, I find that section 52(2) does not apply in these circumstances.

[31] For all of these reasons, I find that the emails are exempt from disclosure in their entirety under section 52(1)(e)(iii) of the Act.

ORDER:

1. For the foregoing reasons, pursuant to section 61(1) of the Act, no order is issued.

Original signed by:		May 8, 2023
Cathy Hamilton
Adjudicator