PHIPA DECISION 217

Complaint HA22-00026

Ottawa Fertility Clinic

July 28, 2023

Summary: The complainant made a request to the Ottawa Fertility Clinic (the clinic) under PHIPA  for the clinic’s complete paperwork regarding vials of donor sperm she had provided to the clinic for the purpose of fertility treatment. After examining the records released by the clinic, the complainant made a complaint to the IPC on the basis the clinic had not provided her with the records she seeks. Through the IPC review process, the issues were narrowed to the reasonableness of the clinic’s search for responsive records in its custody or control.

In this interim decision, the adjudicator finds that the complainant has established a reasonable basis to believe there exist responsive records in the clinic’s custody or control that it has not identified or located. In particular, the complainant referred to federal health legislation that requires the clinic to create and maintain documentation around donor sperm handling, which the clinic failed to adequately address during the review. The adjudicator orders the clinic to conduct another search for responsive records, and to provide her with a written explanation regarding the results of its search. She remains seized of the complaint to address issues that may arise from the clinic’s further search.

Statutes Considered: Personal Health Information Protection Act, 2004,  SO 2004, c 3, Sch A  (as amended), sections 2 (definitions), 3(1), 4, 52, 53, and 54; Safety of Sperm and Ova Regulations, SOR/2019-19, under the Assisted Human Reproduction Act , SC 2004, c 2 .

Decisions and Orders Considered: PHIPA Decision 17; Order MO-3531.

OVERVIEW:

[1] The complainant is a client of the Ottawa Fertility Clinic (the clinic). The complainant provided the clinic with five vials of donor sperm for the purpose of intrauterine insemination (IUI) using the donor sperm. The clinic used one vial of donor sperm during an IUI cycle for the complainant.

[2] The complainant later made several requests to the clinic for the release of her medical records. At issue in this complaint is the complainant’s request under the Personal Health Information Protection Act, 2004  (PHIPA ) for her medical records covering a specified time period in 2021.[1] In this request, the complainant identified certain records that ought to be part of the release, including:

… complete paperwork regarding my donor sperm, in total 5 vials; such as delivery records, handling upon delivery, inspection reports, storage, preparation etc. for each of them. One has been used and I assume there is a record of it as well + IUI cycle documentation.

[3] (Further below is a more detailed breakdown of the complainant’s request for records relating to the delivery, handling, storage, and preparation of the donor sperm she provided to the clinic.)

[4] The clinic responded by stating that it had already released all the complainant’s medical records in response to her previous requests. With respect to the specific request at issue in this complaint, the clinic added that it denies access to records regarding delivery, handling upon delivery, inspection, storage, and preparation of donor sperm. The clinic’s reason for denial was its view that the requested information is not “personal health information” within the meaning of PHIPA .

[5] The complainant was dissatisfied with the clinic’s decision and filed a complaint with the Office of the Information and Privacy Commissioner of Ontario (IPC). The parties could not resolve the matter through mediation, and the complaint moved to the adjudication stage, where I conducted a review under PHIPA .

[6] During my review, I shared with the parties some preliminary views concerning the nature of the records responsive to the complainant’s request and the issues raised by the complaint. After clarifying some initial matters, the issue remaining to be decided was the reasonableness of the clinic’s search for records responsive to the complainant’s access request. In the discussion that follows, I explain why I find the clinic has failed to demonstrate reasonable efforts to identify and locate records reasonably related to the request. I therefore order the clinic to conduct a further search, and to provide me with a written explanation of its search efforts and the results of its search.

RECORDS:

[7] At issue in this complaint are records responsive to the complainant’s request for “complete paperwork” regarding five vials of donor sperm she provided to the clinic. She has specified that the request encompasses records containing the following information about the donor sperm she provided:

1. Shipping documents accompanying the five vials sent by the sperm bank to the clinic, including: proof of delivery documents (indicating date, time, and person who received the package); labelling (including donation code, donor ID code, summary documents, and vial identification codes); documentation related to the contents of the vials; packaging; storage instructions; and handling instructions provided by the sperm bank.
2. Documentation produced by the clinic prior to storage of the five vials in its facilities, including: dates and times of inspection and handling; and reports on inspection of package and of each vial (identification code, specification, assessment of compliance with Health Canada regulations and guidelines, persons responsible for inspection and handling).
3. Details regarding the storage of the five vials at the clinic, including: dates and times the vials were placed in storage; type of storage tank; storage contract identifying the length of storage; identification of the place where the vials are stored; and persons responsible for storage and the storage contract.
4. Documentation related to the one vial that was used, including: date and time when the vial was removed from storage; records on thawing procedure (type of thawing); identification code, specification, safety, viability, and quality assurance; and persons responsible for quality assurance.

DISCUSSION:

[8] In this complaint, there is no dispute that the clinic is a “health information custodian” within the meaning of that term at section 3(1)  of PHIPA .[2] The parties also agree that the complainant has a right of access under PHIPA  to records of her “personal health information” within the clinic’s custody or control. These preliminary findings are relevant because an individual’s right of access in PHIPA  applies only in respect of records of that individual’s personal health information in the custody or control of a custodian (section 52). There is no right of access in PHIPA  to general records of the custodian.

[9] This matter came to adjudication on the issue of whether the responsive records identified by the clinic are records of the complainant’s personal health information within the meaning of PHIPA  (and thus records to which the complainant has a right of access under PHIPA ). The records identified by the clinic included standard clinic forms that had been filled out with information relating to the complainant or to the donor sperm samples she had provided to the clinic, and a donor sperm tracking log containing information about the samples. They also included documents the clinic described as standard operating procedures relating to the preparation, receipt, and verification of donor sperm samples and donor sperm banking.

[10] After examining the records, I shared with the parties my preliminary view that most of the records identified by the clinic are records of personal health information of the complainant. This includes standard forms filled out with information relating to the samples provided by the complainant. I agreed with the clinic, however, that the clinic’s standard operating procedures are not records of the complainant’s personal health information. Unlike the first category of records, these are records of general application, setting out various clinic processes, that are not specifically referable to the complainant or to the particular health care the clinic provided to her. (Below I discuss in more detail the relevant sections of PHIPA  addressing the definition of personal health information.)

[11] The clinic agreed with these preliminary views. With respect to the first category of records (records of the complainant’s personal health information), the clinic stated that it had either already given or was now prepared to give to the complainant these records in full.

[12] In response, the complainant clarified that none of the records identified by the clinic are of interest to her. She confirmed that she has already received or does not require copies of the records in the first category. She also confirmed that she does not seek access to any records in the second category (the clinic’s standard operating procedures relating to donor sperm handling in general).

[13] Instead, the complainant explained, she seeks all clinic paperwork relating to the handling of the specific donor sperm samples she had provided to the clinic (emphases mine). The records she seeks are described more particularly above under the heading “Records.” For example, the complainant says, one of the records she received from the clinic is a form on which is attached a label filled out with details such as the date of the clinic’s receipt of and the number of units received of donor sperm provided by the complainant. The complainant explains that what she seeks are the “primary/original source records” from which the information on the label was derived.[3]

[14] I shared with the clinic the complainant’s representations, as well as my view that the only remaining issue in the complaint is the reasonableness of the clinic’s search for the records described by the complainant. I noted that the complainant has confirmed that the scope of her request is accurately described in my correspondence to the parties (which description is reproduced above), and that the complainant does not seek access to any of the records the clinic had identified to that point, including its standard operating procedures.

[15] In my view, records responsive to the complainant’s access request, if they exist, are records of the complainant’s personal health information within the meaning of PHIPA . PHIPA  defines personal health information to include identifying information about an individual that relates to the individual’s physical or mental health [paragraph (a) of the definition at section 4(1)], and to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual [paragraph (b) of section 4(1)]. Personal health information also includes other identifying information about an individual that is not specifically listed in section 4(1)  of PHIPA , but that is contained in a record that includes personal health information of the type listed in section 4(1).[4]

[16] In PHIPA Decision 17, the IPC adopted a broad interpretation of the term “personal health information” in PHIPA . In that decision, the IPC found that the phrase “relates to,” as it appears in a number of paragraphs of the definition, should be interpreted broadly to include any information that is “connected in some way” to the subjects described in those paragraphs. The IPC concluded that this broad and liberal interpretation accords with the grammatical and ordinary sense of the phrase, and best gives effect to one of the purposes of PHIPA , which is to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions. The IPC noted that a broad interpretation is also supported by PHIPA ’s inclusion, at section 4(3), of non–health-related information about an individual in the definition of personal health information.

[17] In PHIPA Decision 17, the IPC applied this broad interpretation to find that “personal health information” can encompass records going beyond medical charts and other documents typically found in a patient’s file. For example, in that case, the IPC found that records such as correspondence between a hospital and its lawyers, and minutes of hospital board meetings (all of which included discussion about some matters relating to a patient) qualified as records of the patient’s personal health information, because they contained information that arose from, and were referable to, the provision of health care to the patient at the hospital.

[18] The IPC has applied this broad interpretation in many subsequent decisions and orders. For example, “personal health information” has been found to include:

• raw data about identifiable patients contained in a hospital’s electronic databases (PHIPA Decision 52);
• video images of a patient at a custodian’s facility, whether or not the images depict the patient actively receiving health care from the custodian (PHIPA Decision 117);
• the mere fact that an individual received or did not receive health care services from a particular health care provider (PHIPA Decision 96); and
• an anonymized “run number” corresponding to a particular attendance by a municipality’s ambulance service to provide health care to a patient (Order MO-3531).

[19] These examples also illustrate the application of the “record-by-record” method of analysis adopted by the IPC in addressing requests for records of personal health information under PHIPA . Under this method, the unit of analysis is the whole record, rather than individual paragraphs, sentences or words contained in a record. In addition, where the information at issue is the withheld portion of a record that has been partially released, the whole of the record (including released portions) is analyzed in determining a requester’s right to access the withheld information.[5]

[20] In my view, the records described by the complainant, if they exist, would be records of her personal health information with the meaning of PHIPA . Responsive records would include those containing numerical or other data that are referable in some way to the specific donor samples provided by the complainant and/or to the health care provided to her by the clinic. At a minimum, records relating to the clinic’s handling of the donor sperm provided by the complainant to the clinic would identify the clinic as a provider of health care to her, and thus contain the complainant’s personal health information within the meaning of paragraph (b) of the definition at section 4(1).

[21] I thus asked the clinic to provide representations on its search for responsive records in its custody or control. The clinic provided representations, which I shared with the complainant. I then gave each party a further opportunity to address the other party’s representations on this topic. Both parties raised issues that are not relevant to my determinations in this decision, and that are unnecessary to set out here.[6]

[22] In this decision, I find the clinic has not demonstrated reasonable efforts to identify and locate records reasonably related to the complainant’s access request. I thus order the clinic to conduct a further search for responsive records. My reasons follow.

Did the custodian conduct a reasonable search for records responsive to the complainant’s request?

[23] When a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53  and 54  of PHIPA . These sections address the written request that an individual may make to a custodian to exercise a right of access to records, and the obligations on the custodian in responding to the access request. These sections of PHIPA  require the custodian to make reasonable efforts to identify and to locate requested records. If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the custodian’s decision. If I am not satisfied, I may order further searches.

[24] In PHIPA Decisions 17, 18, and later decisions,[7] the IPC found applicable to PHIPA the principles outlined in IPC orders that address the issue of reasonable search under the Freedom of Information and Protection of Privacy Act and its municipal counterpart. These decisions establish that PHIPA  does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records.[8] To be responsive, a record must be “reasonably related” to the request.

[25] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester still must provide a reasonable basis for concluding that such records exist.[9]

[26] In my correspondence to the clinic, I noted that the complainant had set out reasons for her belief that there ought to exist additional records that had not been identified by the clinic. I noted, for example, that the complainant asserts that the clinic is mandated by Health Canada to keep and maintain for a period of 10 years certain records concerning the handling and storage of sperm and ova,[10] and that she refers to a Health Canada guidance document that she enclosed with her representations.[11] For instance, the complainant states that the clinic is mandated to inspect any delivered vials and their accompanying packing slips and labels, in order to ensure that delivered vials are not compromised, damaged, tampered with, or contaminated in any way. In addition, the complainant asserts that certain information in records already provided to her by the clinic must have been derived from “original, primary source records” (and it is these source records that she seeks). I asked the clinic to address these aspects of the complainant’s submissions in particular in providing its own representations outlining its search efforts in response to the complainant’s access request.

[27] In response, the clinic provided representations maintaining its previous position that no further records exist. These representations are supported by affidavits from the clinic’s GMP [Good Manufacturing Practices] quality control and research program manager, who also acts as its privacy officer, and from the clinic’s assisted reproductive technologies lab director.

[28] In these representations, the clinic provides details of its efforts to respond to the complainant’s previous requests (which requests precede the one at issue in this complaint), and about the records identified as a result of its previous searches (which records are no longer at issue in this complaint, as explained above). The clinic states that in the course of responding to the complaint, it searched its lab records as well as its electronic medical record database. The clinic maintains that no additional records exist, and that it has no reason to believe that any records related to the complainant have been destroyed. The clinic also says it is not aware of any responsive records that would exist outside its custody or control.

[29] In response to the particular evidence provided by the complainant, the clinic says that it maintains all records related to donor sperm activities for 10 years, in accordance with federal regulations. This includes, for example, its lab donor sperm tracking log, which the clinic says contains personal health information. The clinic states that all personal health information belonging to the complainant in its lab donor sperm tracking log has already been released to the complainant.

[30] The clinic also says, however, that individual donor sperm vials held by the clinic “do not contain personal health information and are labelled in accordance with the Safety Regulations.” Assuming that an individual donor sperm vial supplied by a particular patient is labelled with a unique code or other identifier (to distinguish it from other donor sperm vials supplied by other patients), that unique code or identifier would, in my view, qualify as that patient’s personal health information, even if it does not identify the patient by name. In this scenario, a unique code or identifier referable to a particular patient (and to the health care to be provided to that patient) is, in my view, analogous to the anonymized ambulance run number that was found to qualify as personal health information in Order MO-3531, addressed above. If such labels exist for the vials that are the subject of this complaint, the clinic should identify them and issue a decision on access to them under the Act.

[31] The clinic goes on to say that “appropriate and complete documentation was performed in the receipt and storage of the complainant’s donor sperm vials.” The clinic provides no further details, except to note that Health Canada inspects the clinic for compliance with applicable laws in respect of its donor sperm activities, and that it is not aware of any complaints about or investigations related to its compliance with safety regulations. When invited to provide further representations on its search, the clinic observed that while the complainant makes submissions on records that she believes the clinic failed to identify and create, PHIPA  does not prescribe what records a health information custodian must create or keep in response to an access request.

[32] I agree that PHIPA  does not impose on the clinic an obligation to create records responsive to the complainant’s access request for paperwork regarding the handling of donor sperm she provided to the clinic. It may be that the records the complainant seeks simply do not exist, because they are not in fact records the clinic is required to create under federal safety regulations, or because the clinic did not create or maintain them for some other reason. Whether the clinic has complied with federal regulations is not a matter for determination under PHIPA .

[33] However, the complainant’s evidence establishes a reasonable basis to believe there may exist additional records relating to the handling of the specific donor sperm she provided, to satisfy regulatory requirements around the documentation of these processes, and the clinic has failed to sufficiently address this evidence. The clinic’s statement that it has complied with rules around appropriate and complete documentation does not identify what documentation is required by the rules, and whether this documentation is responsive to the complainant’s access request.

[34] If the records the complainant seeks do not exist (and could not reasonably be expected to exist), the clinic should provide an explanation of why this is the case. If, instead, the documentation to which the clinic refers consists of records it has already provided to the complainant, then the clinic should make this clear so the complainant will be in a better position to understand how the clinic complied with the applicable regulations. And if the documentation to which the clinic refers consists of records it has not provided to the complainant, then the clinic should provide a clear explanation of why these records are not “reasonably related” to the complainant’s detailed access request, or other basis on which it has withheld them from the complainant.

[35] In summary, I find that the clinic has failed to respond adequately to the complainant’s access request, because it has failed to demonstrate reasonable efforts to identify and search for records reasonably related to the request. To remedy this defect, I will order the clinic to conduct another search, and to provide me with the results of its search.

ORDER:

For the foregoing reasons, pursuant to section 61(1) (c) of PHIPA :

1. I order the clinic to conduct, within 30 days of the date of this decision, a further search for records responsive to the complainant’s access request. For greater certainty, responsive records are those reasonably related to the complainant’s access request, as reproduced at paragraph 7 of this order.
2. Following the search described in order provision 1, the clinic must provide me with a detailed explanation of its search efforts. This explanation should be in the form of an affidavit sworn by the individual(s) who conduct the search, and must identify, at a minimum:

• The names and positions of the individuals who conducted the search and those who are contacted in the course of the search;

• The nature and location of the search, including each of the places and the types of files searched, and the key words or other search terms used in the search;

• The results of the search; and

• If there is a possibility that responsive records existed but no longer exist, details of any relevant record maintenance policies and practices, such as retention schedules.

This explanation should address the complainant’s evidence that there exist regulatory requirements around documentation of the clinic’s handling of donor sperm, and clarify the clinic’s statement that “appropriate and complete documentation was performed in the receipt and storage of the complainant’s donor sperm vials.” At a minimum, the clinic must identify the records to which it refers (i.e., those records that make up the “appropriate and complete documentation” relating to the receipt and storage of the complainant’s donor sperm), and the clinic’s decision on access to each of these records.

I will share the clinic’s explanation with the complainant, subject to the IPC’s confidentiality criteria as described in guidance provided to the clinic at earlier stages of the review. The clinic should state its position on sharing.

3. I order the clinic to issue a decision to the complainant under PHIPA  on access to any additional records it locates as a result of the search. The clinic must issue any such decision within 30 days of the date of this decision.
4. I remain seized of this matter to address issues that may arise from order provisions 1 and 2.
5. I reserve the right to require the clinic to provide me with a copy of the access decision referred to in order provision 3.

Original Signed By:		July 28, 2023
Jenny Ryu
Adjudicator