PHIPA DECISION 221

Complaint HI23-00019

Syed Nasir Ahmed (also known as Nash Ahmed), Woburn Medical Dental Centre Inc., 2699064 Ontario Inc., Apex Properties Inc. (carrying on business as Apex Property Management), Apex Financial Corp. (carrying on business as Apex Property Management), Houselink And Mainstay Community Housing (Houselink), 1583728 Ontario Inc. (carrying on business as XYZ Storage), 1255894 Ontario Limited (carrying on business as All Canadian Self-Storage), Kevin Lee, Anthony L. Forgione, John Parchenko

August 22, 2023

Summary: The IPC issues an interim order directing a number of the respondents to ensure the security and preservation of records of personal health information transferred from a medical clinic to a storage facility for a three month period, pending the IPC’s review.

Statutes Considered: Personal Health Information Protection Act, 2004, S.O. 2004, c. 3,  sections 2 , 12(1) , 13(1) , 17 , 49 , and 61 .

Decisions Considered: PHIPA Decision 23.

Cases Considered: RJR-MacDonald Inc. v. Canada (A.G.), [1994] 1 SCR 311, 1994 CanLII 117 (SCC).

BACKGROUND:

[1] On July 21, 2023, the IPC issued a Notice of Review notifying Syed Nasir Ahmed and Woburn Medical Dental Centre Inc. (Woburn) that a review has been commenced by the Office of the Information and Privacy Commissioner of Ontario (the IPC) under section  58(1)  of the Personal Health Information Protection Act, 2004  (the Act ).[1]

[2] The review was commenced because the IPC received a report about abandoned records of personal health information at a specified property (the property) where Woburn previously operated a medical clinic.

[3] At the time the review was commenced the IPC understood that the records, consisting of approximately 300 boxes, had been abandoned by Mr. Ahmed and/or Woburn.

[4] Mr. Ahmed provided a response to the initial Notice of Review and has engaged in discussions with IPC staff geared at resolving this matter. The IPC has urged Mr. Ahmed and/or Woburn to retrieve and secure the records of personal health information. Mr. Ahmed and/or Woburn has been unwilling or unable to retrieve and secure the records of personal health information.

[5] Based on representations received and other information obtained, and for the reasons set out below, I issued an Amended Notice of Review dated August 22, 2023, and this interim order on an urgent basis requiring some of the respondents to take steps below to secure and preserve the records of personal health information pending the completion of this review.

[6] As set out in the Amended Notice of Review, the IPC has become aware of the following:

• Apex Properties Inc. (carrying on business as Apex Property Management), and Apex Financial Corp. (carrying on business as Apex Property Management) (together, APM), a property management company, contacted the IPC to report that it had possession of several boxes containing records of personal health information in a storage locker at XYZ Storage. APM stated that it understands the importance of preserving the records of personal health information and that the records originated from 4129 Lawrence Avenue East, Toronto, Ontario (the property). APM further advised the IPC that one of its clients owned and had recently sold the property.
• Mr. Ahmed advised the IPC he is the owner and director of Woburn.
• Woburn operated a medical clinic at the property (or may be continuing to operate a medical clinic). Woburn had stored records of personal health information at the property.
• 2699064 Ontario Inc. is a corporation owned by Ahmed. Woburn leased the property from 2699064 Ontario Inc.
• Anthony L. Forgione is a director of Apex Properties Inc.
• John Parchenko is a director of Apex Financial Corp.
• Due to creditor action, the property was sold from 2699064 Ontario Inc. to an unknown buyer (the first buyer) pursuant to a power of sale. The first buyer evicted Woburn from the property.
• According to Ahmed, Kevin Lee was involved with or caused the sale of the property from 2699064 Ontario Inc. to the first buyer.
• Approximately 300 boxes containing records of personal health information were left at the property when Woburn was evicted.
• Ahmed initially took the position that neither Woburn nor him are the health information custodian with custody or control of the records of personal health information contained within the approximately 300 boxes that were left at the property.
• On August 17, 2023, Ahmed admitted that he and/or Woburn is/are the health information custodian with custody or control of the personal health information contained within the approximately 300 boxes that were left at the property.
• Ahmed advised that at the time of eviction, he was making efforts to retrieve and deal with the records of personal health information and other equipment. Ahmed is aware that there are obligations under the Act  regarding security, use and disclosure of records of personal health information.
• A large number of the boxes containing records of personal health information were moved by APM to XYZ Storage for storage. 1583728 Ontario Inc. carries on business as XYZ Storage. XYZ Storage’s website[2] provides that XYZ Storage, is “Formerly All Canadian Self-Storage”. 1255894 Ontario Limited carries on business as All Canadian Self-Storage.
• XYZ Storage has not received proper payment from APM and has threatened to vacate the storage locker by holding a contents auction, initially on August 21, 2023. After discussions with IPC staff, XYZ Storage agreed not to auction the contents on August 21, 2023.
• The property was purchased from the first buyer by Houselink and Mainstay Community Housing (Houselink). Houselink advises that there are approximately 10 boxes containing records of personal health information remaining at the property. Houselink has agreed to secure these records of personal health information.
• Ahmed advises that while he has contacted XYZ Storage, he is unable to pay the amounts requested by XYZ Storage to release to him the contents of the storage locker.
• On August 22, 2023, the IPC demanded that APM identify its client, the entity responsible for directing APM to transfer the records of personal health information to XYZ Storage. The IPC made this demand pursuant to sections 60(2) (b) and 60(2) (c) of the Act .
• On August 22, 2023, a representative named Anthony Forgione of APM refused to provide the information. This representative further stated that APM will be directing XYZ Storage to destroy the records and falsely stated that the IPC instructed him to destroy the records at issue. The IPC immediately advised APM that APM is not to provide any such instructions to XYZ Storage.
• On August 22, 2023, the IPC issued a cease and desist to APM, John Parchenko and Anthony L. Forgione[3] that in part provided:
• Apex Properties Inc. (carrying on business as Apex Property Management), Apex Financial Corp. (carrying on business as Apex Property Management), Anthony L. Fiorgione [sic], John Parchenko and any other person acting on behalf of or on the instructions of “Apex Management” are to cease and desist from attempting to contact 1583728 ONTARIO INC. (carrying on business as XYZ Storage) for the purposes of giving any direction to destroy, transfer, use or disclose the records of personal health information at issue in this matter.
• On August 22, 2023, APM responded by email under the name “Anthony Forgione Apex Property Management”, to the IPC stating in part, that:
• I have provided you with sufficient time to resolve this, your inability to do so is not our issue. If you would like to meet and take carriage of the locker we can be there tomorrow, otherwise we will have a mobile destruction unit onsite tomorrow at 3pm to shred the documents.
• On August 22, 2023, XYZ Storage advised that while it will not sell/auction or destroy the records, there is nothing stopping APM from paying the outstanding balance and retrieving the storage unit contents/the records of personal health information, for the purpose of destroying them.

The IPC has initiated this review because there are reasonable grounds to believe that:

• One or more of the Respondents is a “health information custodian” with custody or control of personal health information within the meaning of sections 3(1)  and 4(1)  of the Act .
• One or more of the Respondents is a recipient(s) or an agent(s) of a recipient of personal health information within the meaning of section 49(1)  of the Act .
• One or more of the Respondents have contravened or are about to contravene section 49  of the Act  by using or disclosing the personal health information in contravention of section 49  of the Act .
• One or more of the Respondents is an agent(s) of a health information custodian within the meaning of section 2 and 17 of the Act and have contravened or are about to contravene section 17  of the Act .
• One or more of the Respondents as a health information custodian, an agent of a health information custodian or a recipient of personal health information have contravened or are about to contravene:
• section 13(1)  of the Act , by failing to ensure that the records of personal health information are, or were, retained, transferred or disposed of in a secure manner, and,
• section 12(1)  of the Act , by failing to take steps that are reasonable in the circumstances to ensure that the personal health information is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.

DECISION:

[7] At this early stage of the review process, APM has expressly stated that it intends to retrieve the records of personal health information from XYZ Storage and to destroy the records at issue, I am of the view that an order requiring the records of personal health information at XYZ Storage be secured on an interim basis is required. The following reasons explain why.

[8] As indicated above, the IPC initiated this review because it had received information providing reasonable grounds to believe that records containing personal health information had been abandoned. The review raises issues about whether one or more of the respondents are health information custodians, an agent of a health information custodian(s) or a recipient(s) of personal health information with obligations under the Act  that have been contravened or are about to be contravened.

[9] At the outset of the review, the IPC sought submissions from Mr. Ahmed and Woburn with a view to ensuring the security of the records pending completion of my review. Mr. Ahmed disputes that the medical records were abandoned; however, he alleges that he is being restrained from accessing the records by some of the respondents. The IPC has also engaged with various respondents in an effort to reach a resolution. A resolution has not been possible and APM has now stated that it will retrieve the records of personal health information by 3:00 p.m. tomorrow and destroy most of the records at issue.

[10] The IPC has previously issued an interim order to preserve records on an urgent basis. In PHIPA Decision 23, former Assistant Commissioner, Sherry Liang was guided by the principles set out in RJR-MacDonald Inc. v. Canada (A.G.).[4] I agree with the former Assistant Commissioner that although RJR-MacDonald is not directly applicable to this type of order under the Act , the principles assist in analyzing the considerations to be taken into account in deciding whether to issue an interim order preserving the status quo. In setting out the test for interlocutory injunctive relief, the court stated as follows:

First, a preliminary assessment must be made of the merits of the case to ensure that there is a serious question to be tried. Secondly, it must be determined whether the applicant would suffer irreparable harm if the application were refused. Finally, an assessment must be made as to which of the parties would suffer greater harm from the granting or refusal of the remedy pending a decision on the merits.

[11] I am satisfied that this review, and the issue of the preservation and security of the records of personal health information pending the completion of this review, raises a serious question to be tried. There are reasonable grounds to believe that the records that are located at XYZ Storage are records of personal health information that are not properly secured, are abandoned, are being wrongfully withheld from the custodian, or – much worse – about to be destroyed by one or more of the Respondents.

[12] The second and third criterion requires an examination of the harms at issue, and whether the harms cannot be quantified in monetary terms or cannot be cured. I find that the irreparable harms requirement is satisfied. APM has stated its intention to destroy the records of personal health information by 3:00 p.m. tomorrow and has refused to keep them secure pending the completion of this review. Although XYZ Storage has indicated a greater degree of willingness to preserve the records of personal health information, XYZ Storage is under contract with APM and has stated that that there is nothing stopping APM from retrieving the records and destroying them.

[13] I understand that APM may be frustrated with the obligations set out in the Act and that its continued storage of these records will cause it to continue to incur fees with XYZ Storage. Certainly, I also understand that any order that requires XYZ Storage to preserve the records will impact its ability to adhere to its contract with APM or to earn some revenue. However, wilful destruction of records, as threatened by APM, gives rise to a greater harm than no order at all. The harm that would be caused by inaction would be suffered by an innumerable number of individuals whose personal health information is contained in the records with such information becoming unrecoverable if the records are destroyed. These individuals’ personal health information rights are protected by the Act and action is required to preserve their records in the face of threatened unlawful action.

[14] Some of the potential harms at issue in this decision involve the theft, loss, destruction, and disposal of the records. Should these harms occur, the individuals about whom the records relate would, among other things, lose the ability to request access to the missing records or to have these records used in their health care. Such a theft, loss, destruction, or disposal would practically restrict the orders available in this review, as a respondent(s) who is found to be responsible for these records would be unable to exercise its statutory functions with respect to records that have been stolen, lost, disposed of, or destroyed. I conclude that the irreparable harms criterion is met.

[15] It is necessary to preserve the status quo until the review can be completed. The terms of my order are not unduly onerous and are time limited, subject to further extension. Should the parties resolve the issue, the order can also be revisited.

[16] Due to Mr. Lee’s affiliation with APM based on the information provided to the IPC, and APM’s refusal to identify its client, I have decided to issuer an order against him as well.

ORDER

For the reasons set out above, I order as follows:

1. 1583728 Ontario Inc. (operating as XYZ Storage) and 1255894 Ontario Limited (operating as All Canadian Self-Storage), including their employees and agents, shall not dispose of, destroy or transfer to another person the records and/or the personal health information in such records, that were provided by Apex Properties Inc. (operating as Apex Property Management) or Apex Financial Corp. (operating as Apex Property Management), without the prior written approval of the IPC.
2. 1583728 Ontario Inc. (operating as XYZ Storage) and 1255894 Ontario Limited (operating as All Canadian Self-Storage), including their employees and agents, shall take steps that are reasonable in the circumstances to ensure that personal health information in the records stored with 1583728 Ontario Inc. (operating as XYZ Storage) or 1255894 Ontario Limited (operating as All Canadian Self-Storage) and/or the personal health information in such records, that were provided by Apex Properties Inc. (operating as Apex Property Management) or Apex Financial Corp. (operating as Apex Property Management), is protected against theft, loss and unauthorized use or disclosure.
3. Kevin Lee, Anthony L. Forgione, Apex Properties Inc. (operating as Apex Property Management) and Apex Financial Corp. (operating as Apex Property Management) including their employees and agents, shall not retrieve, dispose of, destroy or transfer to another person the records and/or the personal health information in such records currently stored with 1583728 Ontario Inc. (operating as XYZ Storage) or 1255894 Ontario Limited (operating as All Canadian Self-Storage), without the prior written approval of the IPC.
4. Kevin Lee, Anthony L. Forgione, Apex Properties Inc. (operating as Apex Property Management) and Apex Financial Corp. (operating as Apex Property Management) including their employees and agents, shall not instruct 1583728 Ontario Inc. (operating as XYZ Storage) or 1255894 Ontario Limited (operating as All Canadian Self-Storage) to return, dispose or destroy the records and/or the personal health information in such records currently stored with 1583728 Ontario Inc. (operating as XYZ Storage) or 1255894 Ontario Limited (operating as All Canadian Self-Storage), without the prior written approval of the IPC.
5. This Order shall remain in effect for a period of three months following which, if the Review has not been completed, I may seek submissions on whether its terms should be extended.
6. For greater clarity, nothing in this Order shall be interpreted to interfere with the regulatory activities of a College under the Regulated Heath Professions Act, 1991.