Health Information and Privacy

Decision Information

Summary:

This decision relates to a request made under PHIPA to Midland Gardens Care Community (the custodian) for access to video surveillance footage of an incident involving the complainant. The custodian refused access to the video, in its entirety.

In this decision, the adjudicator does not uphold the custodian’s decision and she orders it to disclose to the complainant the portions of the video that contain their personal health information that can reasonably be severed from the video. To reach this conclusion, the adjudicator determined that the personal health information of the complainant is not subject to either of the exemptions claimed by the custodian [sections 52(1)(b) (another act prohibits disclosure) and 52(1)(e)(i) (risk of serious harm)].

Decision Content

Logo of the Information and Privacy Commissioner of Ontario, Canada / Logo du Commissaire à l'information et à la protection de la vie privée de l'Ontario, Canada

PHIPA DECISION 212

Complaint HA21-00100

Midland Gardens Care Community

June 27, 2023

Summary: This decision relates to a request made under PHIPA to Midland Gardens Care Community (the custodian) for access to video surveillance footage of an incident involving the complainant. The custodian refused access to the video, in its entirety.

In this decision, the adjudicator does not uphold the custodian’s decision and she orders it to disclose to the complainant the portions of the video that contain their personal health information that can reasonably be severed from the video. To reach this conclusion, the adjudicator determined that the personal health information of the complainant is not subject to either of the exemptions claimed by the custodian [sections 52(1)(b) (another act prohibits disclosure) and 52(1)(e)(i) (risk of serious harm)].

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3, Sched. A, sections 3(1) , 4 , 52(1) (b), 52(1) (e)(i), 52(3) ; Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31, section 20 .

Decisions and Orders Considered: PHIPA Decisions 17, 52, 82, 90, 117, 120, 123, 142, 164 and Orders PO-1940 and PO-4212.

BACKGROUND:

[1] This decision addresses Midland Gardens Care Community’s (the custodian or the care facility) denial of access to video surveillance footage of an incident that occurred at the care facility.

[2] A resident of the care facility who was involved in the incident submitted a request under the Personal Health Information Protection Act, 2004  (PHIPA  or the Act ) to the custodian for the video surveillance footage (the video) of the incident.

[3] The custodian issued a decision in response to the request advising that it was refusing to provide access to the video on the basis that the record is not dedicated primarily to the requester’s own personal health information under section 52(3) of the Act and, therefore, they have a right of access to only the portion of the video that contains their own personal health information that can reasonably be severed from the video. The custodian further advised that the images of the requester could not reasonably be severed from the video without also disclosing images of staff members at the care facility, identifiable to the requester, and who explicitly do not consent to their images captured in the video being released to the requester.

[4] Through their representative, the requester, now the complainant, made a complaint to the Office of the Information and Privacy Commissioner of Ontario (the IPC) about the custodian’s decision. A mediator was assigned to attempt to reach a mediated resolution between the parties.

[5] During mediation, the custodian confirmed its position that the requested video is not a record dedicated primarily to the complainant’s personal health information and that it is not possible for the video to reasonably be severed to show the complainant’s image without also disclosing images of the custodian’s staff members. As a result, the custodian maintained that, pursuant to section 52(3)  of the Act , the complainant does not have a right of access to any part of the video recording.

[6] The complainant advised that they continue to seek access to the video.

[7] As a mediated resolution could not be reached, the complaint was moved to the adjudication stage of the complaint process where, as the adjudicator assigned to the complaint, I decided to conduct a review.

[8] I sought and received representations from both the custodian and the complainant, which were shared between them in accordance with practices set out in the IPC’s Code of Procedure for Matters Under the Personal Health Information Protection Act, 2004.

[9] In this decision, I find that the complainant has a right of access under the Act  to the portions of the video that contain their reasonably severable personal health information and none of the exemptions from disclosure apply. I order the custodian to disclose those portions of the video to the complainant.

RECORD:

[10] The record at issue is video surveillance footage (the video or the record) of an incident involving the complainant. It is approximately nine minutes in length.

ISSUES:

Preliminary matter: Is the care facility a health information custodian subject to the Act ?

  1. Is the video a record of “personal health information” of the complainant, as that term is defined in section 4  of the Act ?
  2. Is the video “dedicated primarily” to the complainant’s personal health information within the meaning of section 52(3)  of the Act ? If not, can the complainant’s personal health information reasonably be severed?
  3. Does either of the exemptions at section 52(1)(b) and/or section 52(1) (e)(i) of the Act  apply to the reasonably severable personal health information of the complainant in the video? If so, can the exempt information reasonably be severed under section 52(2)?

DISCUSSION:

Preliminary matter: Is the care facility a health information custodian subject to PHIPA?

[11] As a preliminary matter, for PHIPA  to apply, the custodian must be a health information custodian as that term is defined in section 3(1)  the Act . The custodian submits that, as a long-term care home within the meaning of the Long-Term Care Homes Act, 2007 ,[1] it is a “health information custodian” pursuant to the definition in section 3(1)  of the Act . The complainant does not dispute the custodian’s position in this respect. I agree with the custodian and find that it is a health information custodian as defined by PHIPA and, therefore, subject to PHIPA .

Issue A: Is the video a record of “personal health information” of the complainant, as that term is defined in section 4 of the Act?

[12] Section 52  of the Act  grants an individual a right of access to a record of their own personal health information that is in the custody or under the control of a health information custodian, subject to limited and specific exemptions and exclusions.

[13] A requester’s right of access to records under PHIPA  is limited to records of the requester’s own personal health information.[2] Section 4(1) defines the term “personal health information.” Paragraphs (a) and (b) of section 4(1) are relevant here. They state:

In [PHIPA ],

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual[.]

[14] Section 4(2) defines “identifying information” referred to in section 4(1):

In this section,

“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

[15] Section 4(3) addresses identifying information that is not considered personal health information:

Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.

[16] Section 4(4)  of PHIPA  sets out an exception to the definition of “personal health information,” which is not reproduced here as it is of no relevance in this appeal.

[17] In PHIPA Decision 17, and subsequent orders and decisions, the IPC has adopted and applied a broad interpretation of the phrase “personal health information.”[3]

Representations

[18] The custodian acknowledges that the images of the complainant captured in the video constitute the complainant’s personal health information within the meaning of PHIPA  because they reveal that the complainant is a resident of a long-term care home, which amounts to identifying information about the complainant relating to the complainant’s physical and mental health.

[19] The custodian also does not dispute that images of three of its staff members seen assisting or interacting with the complainant in the video constitute the complainant’s personal health information as they relate to the providing of health care to the complainant.

[20] The custodian, however, disputes that the images of three other staff members who appear in the video constitute the complainant’s personal health information because they do not relate to the providing of health care to the complainant. The custodian submits that in the video these staff members are not assisting the complainant; they do not interact or have any physical contact with the complainant. Therefore, they are not observing, monitoring or providing services to the complainant for a health-related purpose. The custodian states that it appreciates that section 4(3) provides that personal health information includes identifying information that is not personal health information but that is contained in a record that contains personal health information. However, it submits that the images of the staff members who do not interact with the complainant during the incident are not “identifying information.”

[21] In support its position, the custodian points to PHIPA Decision 120 where it was found that images of hospital staff who did not interact with the complainant in that complaint, did not qualify as the complainant’s personal health information. The custodian submits that, applying the reasoning of PHIPA Decision 120 in this complaint, the complainant does not have a right of access to the images of the staff members who had no interaction with them during the incident because these images do not consist of the complainant’s personal health information.

[22] The custodian also submits that the approximately five minutes of the video that does not capture the complainant’s image also does not qualify as the complainant’s personal health information. In support of its position, it cites PHIPA Decision 123 which found that the portions of a video where a complainant’s own image was not captured did not qualify as the complainant’s personal health information.

[23] The custodian submits that, other than the complainant, no other individuals - including residents of the care facility - are captured in the video.

[24] The complainant disagrees that the images of the staff members who do not interact with them is not their personal health information. The complainant submits that the term “health care” has been defined and interpreted broadly under PHIPA . In support of their position, they cite PHIPA Decision 123 in which the adjudicator stated: “[t]he definition of “health care” is broad and includes any observation, examination, assessment, care, service or procedure that is done for a health-related purpose.”

[25] The complainant submits that the staff members who are not seen interacting with the complainant during the incident captured on the video are nevertheless part of the incident. They submit that there is no requirement for the complainant and a staff member to be in the same video frame and interacting with each other to qualify as the complainant’s personal health information. They submit that the images of staff members who are not interacting with the patient in the video is analogous to specialists or other health care professionals who may not actually “see” a patient but whose information is still included in their health record as having participated in their care and is therefore the personal health information of the complainant.

Analysis and finding

[26] For the reasons set out below, I find that the video is a record of the complainant’s personal health information and, therefore, the complainant has a right of access to it under section 52  of PHIPA . In reaching this finding, I applied the “record-by-record” method of analysis adopted by the IPC.[4] This method of analysis requires me to consider the video as a whole rather than as stand-alone segments.

The video is a record of personal health information of the complainant

[27] The video depicts an incident involving the complainant, a resident of the care facility, and records and reveals actions taken by care facility staff as they observed or provided services to the complainant in responding to the incident. Among other things, the video reveals that the complainant was a resident of the care facility, which, in my view, qualifies as identifying information about the complainant that relates to their physical or mental health, and also relates to the provision of health care to them within the meaning of paragraphs (a) and (b) of section 4(1)  of PHIPA . This finding is consistent with the approach taken by the IPC in PHIPA Decision 17,[5] and in my view, is also consistent with the broad interpretation of the term “health care” applied by the IPC, in particular in PHIPA Decision 123, referenced by the complainant.

[28] As a video surveillance recording, the video also includes identifying information that may not be considered to be the complainant’s personal health information described in section 4(1). However, as a result of the application of section 4(3), reproduced above, because the record is a record of personal health information of the appellant, that identifying information is also the complainant’s personal health.

[29] Accordingly, applying the record-by-record approach, I find that the video is a record of personal health information of the complainant, to which they have a right of access under section of PHIPA .

[30] Having found that the video as a whole is a record of personal health information of the complainant, I acknowledge that not all of the information contained within the video qualifies as the complainant’s personal health information. Because this is relevant when determining the extent of the complainant’s right of access to a record of their own personal information,[6] which I will determine below, I will identify what information in the video is not the complainant’s personal health information.

Images of care facility staff who do not interact with the complainant are not the complainant’s personal health information

[31] The custodian submits that the images of the staff members who are not interacting with the complainant in the video does not consist of the complainant’s personal health information. The complainant disagrees and submits that under a broad interpretation of the definition of “health care” it qualifies as their personal health information.

[32] The question of whether images of hospital staff and security personnel interacting with a patient on hospital surveillance videos are a patient’s personal health information was considered in PHIPA Decisions 117, 120, 123 and 142. In each of these decisions, the adjudicator found that the images of health care professional hospital staff, hospital security staff and other professionals interacting with a patient qualify as the patient’s personal health information under section 4(1) (b) of PHIPA  because the images are identifying information relating to the providing of care.

[33] However, some of those decisions also considered images of hospital staff and other individuals who did not interact with the complainant in the videos. In particular, PHIPA Decision 120 found that such images are not the complainant’s personal health information. I agree with this finding and, applying it in the context of the video before me in this complaint, I find that the images of the care facility staff who do not interact with the complainant in the video do not qualify as the complainant’s personal health information because these images do not relate to the providing of care within the meaning of section 4(1)(b).

The portions of the video that do not contain the image of the complainant are not their personal health information

[34] Additionally, I agree with the custodian and find, as was found in PHIPA Decisions 120 and 123, that the portion of the video that does not contain the image of the complainant, does not qualify as their personal health information.

The video does not contain images of other individuals, including other residents of the care facility

[35] The parties do not disagree, and it is clear from my review, that the video does not contain the images of other individuals, including other residents of the care facility.

[36] Despite my finding that some of the information contained in the video is not the personal health information of the complainant, because the record as a whole is a record of personal health information of the complainant, the complainant may have a right of access to the entire video if it is found to be “dedicated primarily” to the complainant’s personal health information. I will determine that next.

Issue B: Is the video “dedicated primarily” to the complainant’s personal health information within the meaning of section 52(3) of the Act?

If not, can the complainant’s personal health information reasonably be severed?

[37] As noted previously, the complainant has a right of access to a record of their own personal health information under section 52  of PHIPA , subject to certain limitations. One of those limitations is section 52(3), which is relied on by the custodian in this complaint.

[38] Section 52(3) requires that, to determine the extent of the complainant’s right of access to the video, I must determine whether it is “dedicated primarily” to the personal health information of the complainant. This is because, depending on the results of such a determination, the complainant’s right of access is to either the whole record or to certain portions of the record. More specifically, subject to any applicable exemptions, if a record is “dedicated primarily” to the personal information of the complainant, the right of access in PHIPA  applies to the entirety of the record under section 52(1).[7] On the other hand, if a record is not “dedicated primarily” to the personal health information of the complainant, the right of access applies only to certain portions of it under section 52(3).

[39] Section 52(3) states:

Despite subsection (1) [setting out exemptions from the right of access in PHIPA ], if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

[40] PHIPA Decision 17 set out the IPC’s approach to interpreting section 52(3) that has been consistently applied in subsequent decisions.[8] In order to determine whether a record is “dedicated primarily” to the personal health information of the individual within the meaning of section 52(3), the IPC takes into consideration various factors, including:

  • the quantity of personal health information of the requester in the record;
  • whether there is personal health information of individuals other than the requester in the record;
  • the purpose of the personal health information in the record;
  • the reason for creation of the record;
  • whether the personal health information of the requester is central to the purpose for which the record exists; and
  • whether the record would exist “but for” the personal health information of the requester in it.

[41] This list is not exhaustive.

Representations

[42] The custodian submits that as the video is not dedicated primarily to the complainant’s personal health information the complainant has a right of access to only their own personal health information that can reasonably be severed from the video.[9]

[43] The custodian submits that because the video was taken in a common area, rather than the complainant’s room, its main purpose was to ensure the safety and security of residents, staff and visitors of the care facility. The custodian submits that the video was not created for the purpose of recording the complainant’s personal health information and serves no health care purpose. It submits that it was created for security purposes.

[44] The custodian also submits that the complainant’s personal health information is not central to the video but is incidental to the security purpose for which the video was recorded.

[45] The custodian further submits that the video would exist regardless of whether or not the complainant entered the area that it captured on the night of the incident. The custodian submits that other decisions issued under PHIPA  have found that video recordings of analogous circumstances are not records dedicated primarily to a complainant’s personal health information.[10]

[46] The custodian submits that, given the video is not dedicated primarily to the complainant’s personal health information, the complainant’s right of access is only to the complainant’s personal health information that can reasonably be severed from the video, subject to any application exemptions. The custodian submits that in the video this consists of the complainant’s image and any images of staff interacting with them.

[47] The complainant does not specifically comment on whether the video is dedicated primarily to their personal health information.

[48] The complainant submits that the actions of these other staff members should be viewed in the context of the incident as a whole and the video should be released to the complainant, in its entirety.

Analysis and finding

[49] Applying the “qualitative approach” discussed above, in determining whether the video is “dedicated primarily” to the personal health information of the complainant, I find that it is not.

The video is not “dedicated primarily” to the complainant’s personal health information

[50] The “qualitative approach” takes into account considerations such as whether the personal health information at issue is central to the purpose for which the record exists, and whether the record would exist “but for” the personal health information of the individual in it.[11] Examining the video from a qualitative perspective, I agree with the custodian that the presence of the complainant’s personal health information in the video is “incidental” to the primary purpose of the video surveillance system that generated the video, which is to maintain the security of the care facility. The custodian also submits that, as a video from its video surveillance system, the video would exist “but for” the personal health information of the complainant.

[51] The video captures images of the complainant seated near a nurses’ station at the care facility before, during and after an incident in which they were involved. The video also captures images of staff at the care facility observing and responding to the incident.

[52] From my review, I am satisfied that the video footage, taken from a surveillance camera located in a common area of the care facility, is not dedicated primarily to the complainant’s personal health information. In my view, the video footage was collected for security purposes relating to the health and safety of patients and staff. This reasoning is consistent with previous IPC decisions which have found that personal health information of a patient captured on a hospital’s video surveillance system is incidental to the security purpose of the video footage and is not dedicated primarily to that patient’s personal health information.[12]

The video can reasonably be severed to give the complainant access to the portions of video that contain their personal health information

[53] Having found that the video contains, but is not dedicated primarily to, the complainant’s personal health information, subject to the application of any exemptions, the complainant’s right of access to it is limited to the portions of the video that contain their personal health information that can reasonably be severed from it. This is as a result of the application of section 52(3)  of PHIPA .

[54] Earlier in this decision, I found that all the portions of the video that captured the images of the complainant, including images of staff members interacting with the complainant, qualify as the complainant’s personal health information. Subject to my consideration below of the exemptions claimed by the custodian, the complainant is entitled to be provided with this information, as long as it is reasonably severable. However, I also found that the images of the staff members not interacting with the complainant and the portions of the video in which the complainant’s image does not appear do not qualify as the complainant’s personal health information. As this information is not the personal health information of the complainant, they are not entitled to it and I must now consider whether the complainant’s personal health information can reasonably be severed from these portions of the video that do not contain their personal health information.

[55] From my review of the video, I find that all of the complainant’s personal health information can reasonably be severed from the video for the purpose of providing them with access. This includes images of the complainant and all care facility staff who interact with the complainant in the video. This is in accordance with my finding above that these images form part of the complainant’s personal health information within the meaning of section 4(1) (b) of PHIPA .

[56] In my view, the video can reasonably be severed to remove the segments of the video in which the complainant’s image does not appear by removing those portions. I also find that the best way to isolate the complainant’s reasonably severable personal health information from the remainder of the record is to obscure all images of staff members who do not interact with the complainant in the video. I note that previous IPC orders and decisions have ordered institutions to use video editing software with obscuring technology to sever exempt information from the portions of videos that contain identifiable images of the requester.[13]

Issue C: Does either of the exemptions at section 52(1)(b) or section 52(1)(e)(i) of the Act apply to the reasonably severable personal health information in the video?

If so, can the exempt information be severed under section 52(2)?

[57] Although I have found that the video can reasonably be severed to remove the portions of the video that do not contain the complainant’s personal health information, an individual’s right of access to their reasonably severable personal health information under section 52(3) is subject to the application of any exemptions found in section 52(1)  of PHIPA . The custodian submits that the whole record, including the personal health information of the complainant, is exempt from disclosure under sections 52(1) (b) and 52(1) (e)(i) of PHIPA .[14] Those exemptions state:

Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(b) another Act , an Act of Canada or a court order prohibits disclosure to the individual of the record or the information in the record in the circumstances;

(e) granting the access could reasonably be expected to,

(i) result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person,

….

Section 52(1)(b) – another act prohibits disclosure

[58] Although the custodian claims that the exemption at section 52(1)(b) is relevant in the circumstances of this complaint, it does not specifically identify another act as prohibiting disclosure to the individual (the complainant) of the record or the information in the record.

[59] In its representations, the custodian cites provisions of the Ontario Health and Safety Act (OHSA),[15] submitting that it has an obligation under the OHSA to take every precaution reasonable in the circumstances to protect its staff against workplace harassment by anyone, including residents of the care facility. It notes that workplace harassment is defined in the OHSA[16] and in materials published by the Ministry of Labour, as including personal harassment such as circulating offensive materials in print or electronic form.[17]

[60] The custodian also notes that section 423.2(1)  of the Criminal Code [18] states that it is an offence for a person to engage in any conduct with the intent to provoke the state of fear in a health professional, or a person who assists a health professional, in order to impede them in the performance of their duties.

[61] In my view, the custodian’s representations fall short of demonstrating that the OHSA, the Criminal Code  or “another Act , an Act of Canada or a court order prohibits disclosure to the individual of the record or the information in the record in the circumstances.” Accordingly, I find that the exemption at section 52(1) (b) of PHIPA  does not apply to the personal health information of the complainant in the video.

Section 52(1)(e)(i) – risk of serious harm

[62] Previous IPC decisions have found that the standard of proof required under section 52(1) (e)(i) of PHIPA  is the same as the standard under sections 49 (b) and 20  of Freedom of Information and Protection of Privacy Act  (FIPPA ), and other exemptions that contain the words “could reasonably be expected to.”[19] The health information custodian must demonstrate a risk of harm that is well beyond the merely possible or speculative, although it need not prove that granting access will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences.[20]

[63] The custodian submits that there have been numerous incidents involving the complainant in which they have behaved in a manner which is harassing, threatening, intimidating and demeaning toward staff at the care facility. It submits that the complainant has thrown objects at staff members, shouted profanities at them, called them derogatory names, made unfounded accusations against them regarding their professional competence and capabilities, and video recorded them without their consent. The custodian submits that the complainant has also made disparaging remarks about staff on social media and in news media. The custodian submits that the incident captured in the video involved the complainant shouting at staff and using a racial slur towards one of them.

[64] The custodian submits that as a result of the complainant’s actions, staff members at the care facility have expressed fear for their safety. It states that staff are concerned that they will be injured when they provide care to the complainant and are troubled by the remarks made by the complainant towards them. It adds that some staff members have filed complaints citing workplace violence and harassment under the OHSA. The custodian submits that it has an obligation under the OHSA to take every reasonable precaution in the circumstances for the protection of its staff and that this obligation includes protecting staff against workplace harassment by anyone, including residents of the care facility.[21]

[65] The custodian submits that given the complainant’s prior conduct, it has real concerns that they are seeking access to the video so that they can intimidate and belittle staff by threatening to post, or actually post, the video on social media. The custodian submits that, in the past, the complainant has used social media in an effort to publicly shame identified staff at the care facility. The custodian provided an affidavit sworn by the Executive Director of the care facility to support its submissions regarding the complainant’s conduct towards its staff and the resulting concerns expressed by those staff members.

[66] The complainant submits that the video is their personal health information to which they are entitled and that the custodian’s submission, that staff members at the care facility are in fear for their personal safety if the video is released to the complaint, is without merit.

[67] The complainant submits that the custodian has not provided sufficient evidence to establish that granting access could reasonably be expected to result in a risk of serious bodily harm to any staff member, as is required by section 52(1)(e)(i). The complainant also submits that, as a party to the incident, they are already aware of the identity of the staff who were involved. They submit that disclosure of the video will in no way cause them to now suddenly cause serious bodily harm to these staff members, over two years after the incident.

[68] The complainant also submits that, although they have no intention of doing either, release of the video on social media or via traditional media does not constitute harm within the meaning of the exemption at section 52(1)(e)(i). They also note that in the two years that have passed since the incident they have not used social media to harm any of the staff involved.

[69] The complainant further submits that the custodian’s suggestion that disclosure of the video could result in the workplace harassment of some of the staff involved is also without merit. They submit that a video where they become upset due to staff negligence is not evidence of workplace harassment towards care facility staff.

Analysis and finding regarding the application of section 52(1)(e)(i)

[70] As noted above, previous PHIPA  decisions have determined that the standard of proof required under section 52(1) (e)(i) of PHIPA  is a demonstrable risk of harm that is well beyond the merely possible or speculative although the evidence need not prove that granting access will in fact result in such harm.

[71] In PHIPA Decision 90, the adjudicator considered, under section 52(1)(e)(i), a patient’s request for the name of employees of the Canadian Red Cross Society who provided care to him. The adjudicator found that, despite incidents of verbal abuse by the patient of Red Cross employees, she was not persuaded that providing the patient with access to the employees’ names could reasonably be expected to lead to any of the harms set out in section 52(1) (e)(i) of PHIPA . The adjudicator stated that while the incidents of verbal abuse were inappropriate, they were insufficient on their own to engage the exemption at section 52(1)(e)(i). She found that the harms the Red Cross submitted as “reasonably likely” to result from providing access to the information were speculative in nature. The adjudicator noted she was not persuaded that the evidence demonstrated that the complainant would use the names to contact Red Cross staff.

[72] In making her finding in PHIPA Decision 90, the adjudicator noted that in Order PO-1940 (decided under FIPPA), another adjudicator considered a similar fact situation where an institution withheld the names of staff members pursuant to the exemption at section 20 of FIPPA, which considers disclosure that could reasonably be expected to seriously threaten the safety or health of an individual.[22] Although in Order PO-1940, the substantial evidence and history presented by the parties led the adjudicator to conclude that section 20 of FIPPA had been established, the adjudicator noted:

There are occasions where staff working in “public” offices […] will be required to deal with “difficult” clients. In these cases, individuals are often angry and frustrated, are perhaps inclined to using injudicious language, to raise their voices and even to use apparently aggressive body language and gestures. In my view, simply exhibiting inappropriate behaviour in his or her dealings with staff in these offices in not sufficient to engage a section 20 … claim [under FIPPA]. Rather, as was the case in this appeal, there must be clear and direct evidence that the behaviour in question is tied to the record at issue in a particular case such that a reasonable expectation of harm is established.

[73] Most recently, in PHIPA Decision 164, the adjudicator considered whether granting a patient access to video surveillance footage involving their involuntary hospitalization under the Mental Health Act could reasonably be expected to result in serious bodily harm to the security and hospital staff depicted in the records. She found that although the patient, who continued to be involved with the hospital as an outpatient, would be able to identify staff involved in the depicted incident, the evidence provided to her fell short of demonstrating a risk of serious bodily harm because it did not establish a connection between granting access to the records and the reasonable expectation of such harm.

[74] Even more recently, in Order PO-4212, I considered whether the exemption at section 52(1)(e)(i) applied to the disclosure of the names of security guards who restrained an individual while that individual was an in-patient at a hospital. In that order, although the hospital provided evidence of a history of repeated abuse and violence towards staff by the requester, I found that such evidence was not sufficient, on its own, to demonstrate that disclosure of the names of the security guards would result in a reasonable expectation of a risk of serious bodily harm to the security guards, or any other individual.

[75] I agree with the findings of the adjudicators in PHIPA Decisions 90 and 164, and in Order PO-1940. In my view, the reasoning applied in those decisions and order, as well as that which I applied in Order PO-4212, is relevant to my consideration of the circumstances of this complaint.

[76] In this complaint, while I acknowledge that the custodian’s position is that the complainant, an in-patient at the care facility, has a history of being abusive to staff, I do not accept that there is sufficient evidence before me to establish that disclosure of the portions of the video containing their reasonably severable personal health information could reasonably be expected to give rise to a risk of serious bodily harm to the staff who were involved. As a result, I find that the exemption at section 52(1)(e)(i) does not apply.

[77] I have found that neither of the claimed exemptions applies.[23] Accordingly, it is not necessary for me to consider whether any information subject to an exemption must be severed from the record before access is provided to the complainant.

SEVERANCE OF THE VIDEO

[78] In this decision, I have found that the complainant is entitled to be provided access to the portions of the video that contain their own personal health information and that no exemptions to their right of access apply. I have also found that the portions of the video containing the complainant’s personal health information can reasonably be severed with the use of video editing software with obscuring capabilities.

[79] Previous IPC orders have considered situations where custodians advise that they cannot reasonably sever video surveillance footage because they do not own the required technology or software to facilitate the required severances including the obscuring of individuals. Although the custodian in this complaint has not raised this issue, I will pre- emptively address it here.

[80] In PHIPA Decision 123, the adjudicator stated that video redaction and obscuring technology is commonplace and is routinely used by police and other agencies throughout Ontario. The adjudicator noted that the custodian in that complaint had the option of retaining the services of a third party and charging the complainant a fee.

[81] PHIPA  contains provisions which allow health information custodians to charge a fee for the preparation of records containing personal health information for disclosure.[24] PHIPA  also provides that if a custodian decides to charge the complainant a fee for access, it must first give them an estimate of the fee.[25] Additionally, pursuant to Part VI of PHIPA, the IPC has the authority to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery” within the meaning of PHIPA .[26] The custodian may also waive its fee.[27]

[82] Therefore, if the custodian does not own the technology required to sever the video as ordered, the custodian may retain the services of a third party and charge the complainant a fee for its preparation for disclosure, in accordance with the fee provisions of PHIPA , including those mentioned above.

ORDER:

  1. For the foregoing reasons, pursuant to section 61(1)  of the Act , I order that the custodian provide the complainant with access to the portions of the video that contain their personal health information.
  2. If the custodian decides to charge a fee for access, it is to give the complainant an estimate of the fee in accordance with section 54(10).
  3. For the purposes of order provision 1 and 2, the date of this decision should be treated as the date of the access request.

Original signed by:

 

June 27, 2023

Catherine Corban

 

 

Adjudicator

 

 

 



[2] Or the personal health information of the individual on whose behalf the requester acts as a substitute decision maker.

[3] See PHIPA Decision 17, paragraphs 65-68, and also, PHIPA Decision 52, PHIPA Decision 82 and Order MO-3531.

[4] The IPC adopts a “record by record” approach when reviewing records to determine whether they contain personal health information. Under this method, the unit of analysis is the whole record, rather than individual paragraphs, sentences or words contained in a record. This has been applied in PHIPA Decisions 17, 27 and 30, among others.

[5] See PHIPA Decision 17, paragraph 69.

[6] As will be discussed below, under section 52(3), if a record is not “dedicated primarily” to a complainant’s personal health information, their right of access to it is limited to the portions of their own personal health information that can reasonably be severed from the record.

[7] Section 52(1) provides that an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless certain exemptions or conditions listed in paragraphs (a) to (f) apply.

[8] See, for example, PHIPA Decisions 52, 117, 120, 123 and 142 and Order MO-3531.

[9] The custodian note that this right is subject to the applicable exemptions set out in section 52(1) (a) to (f) of PHIPA .

[10] The custodian submits that these decisions include PHIPA Decisions 11, 120, 123 and 142.

[11] PHIPA Decision 17.

[12] PHIPA Decisions 117 and 120.

[13] See for example, Order PO-3905 and PHIPA Decisions 117, 120 and 123.

[14] The custodian does not claim that any of the other exemptions in section 52(1) applies; none of them is relevant to this complaint.

[16] OHSA, section 1(1).

[17] Health and Safety Guidelines, Workplace Violence and Harassment: Understanding the Law, Ministry of Labour, September 2016.

[19] PHIPA Decision 34.

[20] Ontario (Community Safety and Correctional Services) v. Ontario (Information and Privacy Commissioner), 2014 SCC 31 (Can LII) at paras. 52-4.

[21] OHSA, section 25(2)(h).

[22] Section 20 of FIPPA reads:

A head may refuse to disclose a record where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual.

[23] No other exemptions set out in section 52(1)  of PHIPA  were claimed nor are they relevant in this appeal.

[24] For a discussion of the fee provisions in PHIPA , see PHIPA Decisions 93, 111, 117 and 120.

[25] Section 54(10) states:

A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1)

(a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

[26] Section 54(11) states:

The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[27] Section 54(12) states:

A health information custodian mentioned in subsection (1) may waive the payment of all or any part of the fee that an individual is required to pay under that subsection if, in the custodian’s opinion, it is fair and equitable to do so.

 You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.