PHIPA DECISION 233

Appeal HA23-00110

2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic)

December 7, 2023

Summary: The complainant sought access to her records of personal health information from Pond Mills Medical Clinic (the custodian). This decision determines that the custodian is deemed to have refused the complainant’s request for access. The custodian is ordered to provide a response to the complainant regarding her request for access to records of her personal health information in accordance with the Personal Health Information Protection Act.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3 ; sections 2, 3(1), 4(1) and (2), 52, 53 and 54(2), (3), (4) and (7).

BACKGROUND:

[1] This is a complaint under the Personal Health Information Protection Act, 2004 (the Act).

[2] On March 21, 2023, the complainant sent a written request via registered mail to 2315771 Ontario Ltd., formerly operating as Pond Mills Medical Clinic (the custodian). The request for access was sent by the complainant to the attention of Weixiu Cui, the director of the custodian, for access to her records of personal health information. The request stated the following in part:

I am writing to you today in [sic] request access to my medical records from Pond Mills Medical Clinic from January 2017 to December 2019 from [named physicians]. My request is in accordance with the Personal Health Information Protection Act.

[3] The complainant advised that Weixiu Cui also goes by the name of Michelle Cui.

[4] On April 21, 2023, the Information and Privacy Commissioner/Ontario (IPC or this office) received a deemed refusal complaint from the complainant stating it had been more than 30 days since she had submitted her access request to the custodian and she had not received a response. As a result, file HA23-00110 was opened and assigned to me as the Acting Adjudicator.

[5] In her complaint, the complainant advised that she was a patient of the custodian from October 1, 2017, until March 31, 2019. During that time, she received health care from two physicians working for the custodian.

[6] The complainant also advised this office that she had unsuccessfully made previous attempts to obtain her records of personal health information from the custodian. She further explained that she had made two requests for access for her records of personal health information to the two physicians that she received health care from. Subsequent to the requests being made, she received letters from each of the two physicians, who advised that they were not the custodian of her records of personal health information. Both physicians also confirmed that they each attempted to request the complainant’s records of personal health information from the custodian but were unsuccessful.

[7] During the processing of this complaint, this office completed a corporate and name search of the custodian on May 17, 2023. The corporate profile report generated from the corporate search lists the numbered corporation, 2315771 Ontario Ltd., as previously operating under a number of names including “Pond Mills Medical Clinic” and “Oxbury Cannabis Clinic”. The corporate profile report lists Weixiu Cui as 2315771 Ontario Ltd.’s director and officer.

[8] According to the complainant, in an effort to ensure the custodian received her access request, she sent it to multiple addresses of the custodian via registered mail. She sent the access request to the address of the Oxbury Cannabis Clinic, Weixiu Cui’s address (as listed in the corporate profile report) and to the custodian’s registered office address. The complainant advised that the request addressed to the registered office address was undelivered and returned to her, but the others were not.

[9] On May 2, 2023, I sent a Notice of Review to the complainant’s representative and to the custodian. The Notice of Review was sent to all four addresses listed in the corporate profile report. Specifically, the Notice of Review was sent to the address of Pond Mills Medical Clinic (publicly available and the same address attended by the complainant), the address of the custodian’s registered office in Hamilton (as listed in the corporate profile report), the address of the custodian’s director in Hamilton (as listed in the corporate profile report) and the address of custodian’s director in Tillsonburg (as listed in the corporate profile report).

[10] The Notice of Review stated that the complainant had filed a deemed refusal complaint against the custodian on the basis that the custodian had not responded to her access request within the time period set out in section 54 of the Act.

[11] The Notice of Review directed the custodian to immediately issue a response letter to the complainant and to forward a copy to me, the Acting Adjudicator assigned to this complaint. The Notice of Review also indicated that if the custodian failed to do so and the complaint was not settled by May 16, 2023, an order requiring the custodian to issue a response to the complainant may be issued.

[12] On May 4, 2023, I sent a copy of the Notice of Review to the email address of Oxbury Cannabis Clinic.

[13] On May 4, 2023, I also contacted the Oxbury Cannabis Clinic using the telephone number publicly available and asked to speak with Weixiu Cui, (also known as Michelle Cui). The receptionist answered the phone stating that it was Oxbury Cannabis Clinic and asked how she could assist me. The receptionist also confirmed that Michelle Cui was the current owner of the Oxbury Cannabis Clinic but was not available to speak with me. I explained that my call was regarding a complaint. I also explained that a Notice of Review had been sent to Weixiu Cui and that I had not heard back from her. I advised that it was urgent that I speak with Michelle Cui about this complaint. The receptionist provided Michelle Cui’s personal email address where she may be contacted to discuss this matter further.

[14] On May 15, 2023, the Notice of Review that was sent to the address of custodian’s registered office in Hamilton was returned to this office as undeliverable. The Notice of Review sent to the address of Pond Mills Medical Clinic was also returned for this reason, as undeliverable.

[15] In an effort to ensure that the custodian responded to this complaint, on May 17, 2023, I sent another copy of the Notice of Review to Weixiu Cui’s personal email address as provided by the receptionist of Oxbury Cannabis Clinic.

[16] On June 27, 2023, I again made attempts by telephone to reach Weixiu Cui (Michelle Cui) at the Oxbury Cannabis Clinic. However, the receptionist advised that Michelle Cui was not available. I left a message with the receptionist and requested a call back from Michelle Cui.

[17] On July 7, 2023, the Notice of Review to the address of the custodian’s director in Tillsonburg was also returned as undeliverable.

[18] It is important to note that the Notice of Review that was sent to the address of Oxbury Cannabis Clinic has not been returned. The Notice of Review that was sent to Weixiu Cui’s personal email address as well as the email address of Oxbury Cannabis Clinic was also not returned.

[19] On July 25, 2023, on behalf of the complainant, her representative wrote me an email, which stated the following in part:

It's a right for me to have my medical records. I believe files are forwarded from one place to another with a fee, which I paid for. In my files was blood work, ex[sic]-ray's, cat scan and MRI esting [sic] which I lost.

[20] On October 2, 2023, the complainant’s representative provided additional documentation via email in support of this complaint. The email included letters from the named physicians that stated that they were both employees of Pond Mills Medical Clinic, and that the complainant was a patient of Pond Mills Medical Clinic. The letters also confirmed that both physicians had provided health care to the complainant. Lastly, the letters stated that the physicians were not the custodian of the complainant’s records of personal health information and asked the complainant to submit her access request to Weixiu Cui, the owner of Pond Mills Medical Clinic.

[21] On October 3, 2023, I sent an email to Weixiu Cui (at her personal email address as well as email address for Oxbury Cannabis Clinic) attaching the two letters from the named physicians and requested a response to this complaint.

[22] On October 16, 2023, I called Oxbury Cannabis Clinic. The receptionist answered the phone confirming that I had reached Oxbury Cannabis Clinic. I asked to speak with Michelle Cui (Weixiu Cui) but was advised that she was not available to speak with me. I advised that I was calling to speak to Michelle Cui about the complaint and requested a call back at her earliest convenience. The receptionist advised that she would forward my message to Michelle Cui.

[23] On October 16, 2023, I also contacted Weixiu Cui by email (her personal email address as well as email address for Oxbury Cannabis Clinic) and asked her to give me a call to speak about this complaint.

[24] As of today, the custodian has not responded to my Notice of Review. A response to the complainant’s access request has also not been issued by the custodian.

DISCUSSION:

Issue A: Are the records at issue “records” of “personal health information” as defined in sections 2 and 4 of the Act?

[25] Section 2 of the Act defines a “record” as follows:

“record” means a record of information in any form or in any medium, whether in written, printed, photographic or electronic form or otherwise, but does not include a computer program or other mechanism that can produce a record;

[26] The term “personal health information” is defined in section 4(1) of the Act as follows:

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,

(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,

(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,

(f) is the individual’s health number, or

(g) identifies an individual’s substitute decision-maker.

[27] Further, the term “identifying information” is defined in section 4(2) of the Act as “information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.”

[28] Section 2 of the Act defines “health care” as follows:

“health care” means any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

(c) is carried out or provided as part of palliative care,

and includes,

(d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and

(e) Repealed: 2020, c. 13, Sched. 3, s. 8 (1).

(f) a home and community care service that is funded under section 21 of the Connecting Care Act, 2019,

[29] As previously indicated, the complainant advised this office that she was a patient of the Pond Mills Medical Clinic and received health care from two physicians that worked at there. The physicians also confirmed that they provided health care to the complainant, which is referenced in paragraph 20 of this decision.

[30] Based on the information before me, I am satisfied that the information contained in the records requested relate to the provision of health care to the complainant. I am also satisfied that the requested records contain identifying information within the meaning of section 4(2) that relates to the information described in one or more of the paragraphs under section 4(1) of the Act.

[31] Therefore, based on the aforementioned, I find that the records at issue are records of personal health information within the meaning of section 2 and 4 of the Act.

Issue B: Is 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) a “health information custodian” as defined in section 3(1) of the Act?

[32] Section 52 of the Act provides an individual with a right of access to a record of personal health information that is in the custody or under the control of a “health information custodian”. The term “health information custodian” is defined in section 3(1)1 of the Act as follows:

“health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties of the work described in the paragraph, if any:

1. A health care practitioner or a person who operates a group practice of health care practitioners.

[33] Further, the term “health care practitioner” is defined in section 2 of the Act, which reads in part as follows:

“health care practitioner” means,

(a) A person who is a member of a regulated profession within the meaning of the Regulated Health Professions Act, 1991 and who provides health care,

[34] Moreover, the term “health care” is also defined in section 2 of the Act, which reads in part as follows:

“health care” means any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, …

[35] Section 1(1) of the Regulated Health Professions Act, 1991 (RHPA), defines “‘member” to mean a member of a “College”. The RHPA further defines “College” under section 1(1) to mean “the College of a health profession or group of health professions established or continued under a health profession Act”.

[36] “Health Profession Act” means an Act named in Schedule 1 of the RHPA. Schedule 1 lists a number of self-governing health professions under the RHPA. Schedule 1 of the RHPA lists Medicine Act as one of the “Health Profession Acts”. The College of Physicians and Surgeons of Ontario (CPSO) is the governing College as defined in section 1 under the Medicine Act.

[37] As indicated above, the complainant is a former patient of the custodian, who received health care from two regulated health care professionals at the Pond Mills Medical Clinic from October 1, 2017, until March 31, 2019.

[38] I note that the two physicians are members of the College of Physicians and Surgeons of Ontario. The complainant’s representative has provided to this office copies of correspondence from the physicians to the complainant stating that they were employees of Pond Mills Medical Clinic and they never had custody or control of the complainant’s records of personal health information. The physicians also confirmed that the complainant’s records of personal health information remained with Pond Mills Medical Clinic. The physicians also advised that they do not have copies of the complainant’s records of personal health information.

[39] Applying the definitions above, I find that 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) is a “person who operates a group practice of health care practitioners” within the meaning of the Act, and therefore a health information custodian. 2315771 Ontario Ltd. (formerly known as Pond Mills Medical Clinic) is a group practice consisting of members of the College of Physicians and Surgeons of Ontario who provide health care to patients. The complainant was a patient at Pond Mills Medical Clinic. The complainant therefore reasonably suspects that 2315771 Ontario Ltd. (formerly known as Pond Mills Medical Clinic) has custody or control of records of personal health information as a result of, or in connection with, the provision of health care to her.

[40] There is no information before me to suggest that 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) is not the custodian of the complainant’s records of personal health information. The custodian has not responded to the Notice of Review in this matter or to any attempts of contact made by this office.

[41] Accordingly, based on the information before me, I find that 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) is the health information custodian with custody or control of the complainant’s records of personal health information pursuant to section 3(1)1 of the Act.

Issue C: Is 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) in a deemed refusal situation pursuant to section 54(7) of the Act?

[42] Section 53(1) of the Act states:

An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has the custody or control of the personal health information.

[43] Where a custodian receives a written access request, section 54(1) of the Act requires that the custodian issue a response that is in accordance with one of the paragraphs (a) to (d) under this section.

[44] Further, section 54(2) of the Act requires that a custodian “give the response required by clause [54] (1) (a), (b), (c) or (d) as soon as possible in the circumstances but no later than 30 days after receiving the request.”

[45] However, this 30-day time limit may be extended under section 54(3) of the Act.

This section states:

Within 30 days after receiving the request for access, the health information custodian may extend the time limit set out in subsection (2) for a further period of time of not more than 30 days if,

(a) meeting the time limit would unreasonably interfere with the operations of the custodian because the information consists of numerous pieces of information or locating the information would necessitate a lengthy search; or

(b) the time required to undertake the consultations necessary to reply to the request within 30 days after receiving it would make it not reasonably practical to reply within that time.

[46] Section 54(4) of the Act requires that the requester be notified of such a time extension as follows:

Upon extending the time limit under subsection (3), the health information custodian shall give the individual written notice of the extension setting out the length of the extension and the reason for the extension.

[47] Under section 54(7), where a “health information custodian does not respond to a request within the [30-day] time limit or before the extension, if any, expires, the custodian shall be deemed to have refused the individual’s request for access.”

[48] On March 21, 2023, the complainant made a written access request to the custodian for her records of personal health information. The complainant has complained to this office that, to date, she has not received a response from the custodian. The custodian has also not responded to the Notice of Review or the IPC’s telephone calls or emails.

[49] In the circumstances of this complaint, there is no evidence before me indicating that the custodian has issued a response to the complainant’s access request in accordance with section 54(1) within the 30-day time limit required by section 54(2). There is also no evidence that the custodian gave the complainant notice of an extension of the 30-day time limit to respond in accordance with section 54(4). However, I note that, even if such notice was given, the additional time of up to 30 days would have expired long ago.

[50] In light of the custodian’s continued failure to respond to the complainant’s request for access in compliance with the Act and to adequately respond to the attempts made by this office to resolve this matter without recourse to a formal order, I find that the custodian has not responded to the complainant’s access request within 30 days or before any extension of this time limit and, therefore, pursuant to section 54(7), I find that the custodian is deemed to have refused the complainant’s request for access to her records of personal health information.

[51] Accordingly, I will order the custodian to issue a response, in accordance with the Act, to the complainant’s request for access within ten (10) days of this decision and to provide a copy to my attention to verify compliance.

ORDER:

For the foregoing reasons, pursuant to section 61(1) of the Act, I order that:

1. 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) shall provide a written response to the complainant regarding her March 21, 2023 request for access to her records of personal health information in accordance with the Act and without recourse to a time extension, no later than December 21, 2023.
2. In order to verify compliance, 2315771 Ontario Ltd. (formerly operating as Pond Mills Medical Clinic) shall provide me with a copy of the response referred to in provision 1 of this Order by December 29, 2023. The copy of the response shall be forwarded to my attention c/o Information and Privacy Commissioner/Ontario, 2 Bloor Street East, Suite 1400, Toronto, Ontario, M4W 1A8.

Original signed by:		December 7, 2023
Soha Khan
Acting Adjudicator