PHIPA DECISION 234

Complaint HA20-00118

David Guth

December 13, 2023

Summary: The complainant is a joint custodial parent of two minor children who received counselling services from the custodian, a doctor. Under PHIPA, the complainant made a request to the doctor for all communications between the doctor, the complainant, and the other joint custodial parent (the children’s father) regarding the children’s counselling services. The doctor denied the complainant’s request, including on the basis the responsive emails are not records of the children’s personal health information, and that the children’s father did not consent to release of the emails to the complainant.

In this decision, the adjudicator finds that the emails at issue are records of the children’s personal health information, and that any access to or disclosure of the emails is governed by PHIPA . Regarding access, the adjudicator finds that as a joint custodial parent, the complainant does not have an independent right of access to the emails, on the children’s behalf, in view of evidence of the objection of the other joint custodial parent.

However, the adjudicator finds that the complainant has raised the potential application of section 41(1)(d)(i) (order or similar requirement), which permits a custodian to disclose personal health information in some circumstances. The adjudicator finds that the doctor had a duty to consider the complainant’s request under this section of PHIPA , and that he failed to do so. She orders the doctor to consider the request for disclosure of the emails, and to issue a decision to the complainant with reasons demonstrating a proper exercise of the discretion conferred on him by this permissive section of PHIPA .

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sch A  (as amended), sections 2 (definitions), 3(1), 4, 5(1), 6(3), 23, 29, 41(1)(d)(i), 52, and 71(4)(b).

Decisions Considered: PHIPA Decisions 19, 22, 96, 107, and 160.

INTRODUCTION:

[1] This decision concerns a request made by the complainant, a joint custodial[1] parent of two minor children, for records relating to the health care provided to the children by a regulated health professional (the doctor). The doctor denied the request, including on the basis the emails the complainant seeks are not records of the children’s “personal health information” within the meaning of the Personal Health Information Protection Act, 2004  (PHIPA ). As I explain below, PHIPA  governs access to and disclosure of personal health information in the custody or under the control of health information custodians such as regulated health professionals.

[2] In this decision, I find that the emails at issue are records of the children’s personal health information, with the result that the complainant’s request is governed by PHIPA . As one of two joint custodial parents, the complainant does not have an independent right of access under PHIPA  to the children’s records, on their behalf, given evidence of the objection of the other joint custodial parent. I find, however, that the complainant has raised the potential application of a section of PHIPA  that permits the disclosure of personal health information in some circumstances, and that the doctor failed to consider this section in responding to her request. I order the doctor to consider the request for disclosure under this permissive section of PHIPA , taking into account relevant factors to guide his discretion, and to issue a decision to the complainant explaining how he has done so.

BACKGROUND:

[3] The complainant is the mother of two children under the age of 16 who received counselling services from the doctor, a psychological associate registered with the College of Psychologists of Ontario. There is no dispute in this complaint that the doctor is a “health information custodian” within the meaning of PHIPA , with the result that PHIPA  applies to personal health information in his custody or control.[2]

[4] This complaint arises from the complainant’s request to the doctor that he provide her with “any and all communications,” over a specified five-month period, to and from the doctor, the complainant, and the children’s father regarding the children’s counselling sessions. The complainant is separated from the children’s father, with whom she shares joint custody of the children.

[5] The doctor responded to the complainant’s request by stating that the complainant should already have the emails on which she was included, and that she would have to ask the father for any emails between only the doctor and the father that did not include the complainant.

[6] The complainant clarified that she is specifically looking for communications between the doctor and the children’s father on which she was not copied. She also said that if doctor requires consent from the father to provide her with the emails at issue, the doctor should seek that consent and inform her of the result.

[7] The complainant filed a complaint with the Office of the Information and Privacy Commissioner of Ontario (IPC) about the doctor’s failure to respond to her clarified request.

[8] During the IPC complaint process, the complainant explained that she seeks the emails at issue to better understand why the doctor ended treatment of her children. She says there is a consent order that provides that the complainant and the father may make inquiries and be given information by health care providers and others involved with the children, and that requires both parties to give consent as necessary. She also says that before the doctor began providing services to the children, the father was required to consent to the doctor’s release of information about the children.

[9] The doctor describes the records at issue as emails between him and the children’s father only, containing the father’s conjectures about the complainant and the children. The doctor takes the position that the emails are not records of personal health information of the complainant, or of the children. He also says that he asked the father for consent to provide the emails to the complainant, and that the father did not respond to the doctor’s request. The doctor maintains that in these circumstances, he will not release the emails to the complainant.

[10] As the matter could not be resolved through mediation, the file was moved to the adjudication stage of the complaint process, where the IPC may conduct a review under PHIPA .

[11] During the review, I shared with the parties some preliminary views based on the information before me. In particular, it was my view that the emails at issue are records of the children’s personal health information, and that in the circumstances, the complainant’s request for the emails is both a request for “access” to and for “disclosure” of the emails, within the meaning of those terms in PHIPA . As will be seen below, different parts of PHIPA  govern the different types of requests, and place different obligations on a custodian who receives the request.

[12] The parties provided representations, including on my preliminary views, which I shared in accordance with the IPC’s Code of Procedure for matters under the Personal Health Information Protection Act, 2004. I have considered the parties’ representations in arriving at my decision.

[13] For the reasons that follow, I find that the emails are records of the children’s personal health information, in respect of which only the children, or a lawfully authorized substitute decision-maker for them, have a right of access under PHIPA . I find the complainant cannot exercise the children’s right of access under PHIPA , on their behalf, because there is evidence of an objection by the children’s father, who is equally ranked with the complainant as a substitute decision-maker for the children under PHIPA . As a result, the complainant has no right of access to the emails under PHIPA .

[14] However, I find that the complainant’s evidence raises the potential application of section 41(1) (d)(i) of PHIPA , which permits a custodian to disclose personal health information in some circumstances. Because the doctor failed to address this section of PHIPA  in responding to the complainant’s request, I order that he do so now, by considering whether he can and should disclose the requested emails under this section of PHIPA . The doctor is to provide the complainant with his decision on whether to disclose or not to disclose the emails, with reasons demonstrating a proper exercise of his discretion under PHIPA .

RECORDS:

[15] The responsive information is contained in two email chains.

[16] While the custodian identified five email chains as responsive records, some of these emails, or portions, are not responsive to the complainant’s request for communications between the doctor and the father only, occurring over a specified five-month period, regarding the children’s counselling sessions.

[17] With the doctor’s copy of this decision, I will provide him with a highlighted copy of the records indicating the responsive portions. In accordance with this decision, the doctor is to exercise his discretion under PHIPA  with respect to these highlighted portions only.

DISCUSSION:

[18] Before addressing the main issues arising in this complaint, I will address a preliminary issue raised by the doctor in his initial response to the complainant. This is the question of whether the emails at issue are records of “personal health information” within the meaning of PHIPA . If the emails do not contain personal health information, then PHIPA  does not govern the complainant’s request to the doctor for them.

[19] “Personal health information” is defined at section 4  of PHIPA  to mean identifying information about an individual that relates to certain enumerated subjects, including the individual’s physical or mental health (paragraph (a) of the definition at section 4(1)  of PHIPA ) and to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual [paragraph (b) of section 4(1)].

[20] The IPC has adopted a broad interpretation of the term “personal health information” in PHIPA .[3] For example, in PHIPA Decision 96, the IPC found that information identifying whether or not a person was a provider of health care to a requester’s children qualified as the personal health information of the children. In that decision, the IPC also found that such information did not qualify as the personal health information of the parents of the children, who were not themselves recipients of health care.[4]

[21] In this case, the emails at issue reveal (among other things) that the children received health care from the doctor. This information qualifies as the children’s personal health information within the meaning of paragraph (b) of the definition at section 4(1). In addition, the emails reveal other personal information about the children that, in the context in which this information appears, also qualifies as their personal health information under section 4(3)  of PHIPA .[5]

[22] In making this finding, I note that even if the emails contain the father’s conjectures about the children and their mother, as the doctor asserts, the information about the children in this context still qualifies as their personal health information within the meaning of PHIPA . I also find that none of the information in the emails qualifies as the personal health information of the complainant or of the children’s father. There is no claim that either parent received health care from the doctor, and there is no evidence to indicate that the information about them appearing in the records otherwise qualifies as their personal health information.

[23] Having found that the emails are records of personal health information of the children only, I will now address the main issues in this complaint, which have to do with whether the doctor acted in accordance with PHIPA  in refusing the complainant’s request.

Did the doctor act in accordance with PHIPA in refusing the complainant’s request for her children’s personal health information?

[24] Under Part V of PHIPA , individuals have a right of access to records of their own personal health information in the custody or under the control of a health information custodian. The health information custodian must respond to the request for access, and, if no exceptions to access apply, must provide access (section 54).

[25] PHIPA  also contains rules governing the disclosure of personal health information (Part IV of PHIPA ). Under PHIPA, a health information custodian may disclose an individual’s personal health information with the consent of the individual. PHIPA  also permits (and, in some cases, requires) a health information custodian to disclose personal health information without consent in specific circumstances.

[26] The distinction in PHIPA  between access and disclosure means that requests for personal health information can yield different outcomes, depending on the nature and circumstances of each request. A health information custodian who receives a request for personal health information may have to consider which type of request is being made. In either case, the custodian must respond to the request in accordance with its statutory obligations under the relevant parts of PHIPA .[6]

[27] As will be seen below, the complainant’s request for records of her children’s personal health information is both a request for access to and a request for disclosure of that information to her. I will consider the relevant parts of PHIPA  in turn.

Access under PHIPA

[28] There is no general right of access in PHIPA  to records of another individual’s personal health information. Under PHIPA, the right of access belongs only to the individual to whom the personal health information relates (section 52). The right of access may also be exercised by that individual’s lawfully authorized “substitute decision-maker” under PHIPA . A substitute decision-maker under PHIPA  is a person who may act on behalf of an individual in respect of the individual’s personal health information. For example, a substitute decision-maker may make a request for access to records of an individual’s personal health information on that individual’s behalf (sections 5(1), 25, 52, and 53).

[29] The emails at issue in this complaint are records of personal health information of the complainant’s children, both of whom are under 16 years of age. Since the complainant is not the individual to whom the personal health information relates, she has a right to access the records, on the children’s behalf, only if she is the lawfully authorized substitute decision-maker for them under PHIPA .

[30] PHIPA  identifies persons who may act as a substitute decision-maker for an individual under various circumstances. The following portions of section 23  of PHIPA  address substitute decision-making authority for a mentally capable child:[7]

23 (1) If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent:

(2) If the individual is a child who is less than 16 years of age, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to,

i. treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or

ii. counselling in which the child has participated on his or her own under the Child, Youth and Family Services Act, 2017.

(2) In subsection (1),

“parent” does not include a parent who has only a right of access to the child.

(3) If the individual is a child who is less than 16 years of age and who is capable of consenting to the collection, use or disclosure of the information and if there is a person who is entitled to act as the substitute decision-maker of the child under paragraph 2 of subsection (1), a decision of the child to give, withhold or withdraw the consent or to provide the information prevails over a conflicting decision of that person.

[31] Thus, in the case of a mentally capable child under the age of 16, PHIPA  provides that a custodial parent may act as a substitute decision-maker for the child, except in certain circumstances that are not relevant here.[8]

The complainant does not have a right of access to the emails under PHIPA

[32] The complainant in this case shares joint custody of the children with the children’s father. At the complainant’s request, the doctor emailed the children’s father to ask whether he consented to the doctor’s releasing the requested emails to the complainant. The father did not respond to the email, which the doctor interpreted as a lack of consent. The complainant takes the position that the doctor ought to have made additional efforts to follow up with the children’s father, “in case the email was missed by the father.”

[33] Section 71(4) (b) of PHIPA  entitles a custodian to rely on a person’s assertion that she is the substitute decision-maker for an individual, unless it is not reasonable to do so in the circumstances.[9] In PHIPA Decision 107, the IPC interpreted sections 23  and 71(4) (b) of PHIPA  harmoniously with provisions of PHIPA  addressing substitute decision-making authority in other circumstances[10] to conclude that a custodian faced with a request from a substitute decision-maker will not be obliged to canvass the views of all other equally ranked substitute decision-makers to satisfy himself that all agree to the request. However, where there is reason to believe that an equally ranked substitute decision-maker disagrees with the request, it would not be reasonable for the custodian to treat any one substitute decision-maker as having independent authority in respect of the request.[11]

[34] In this case, the custodian contacted the father about the complainant’s request. The custodian says he had reason to believe the father would not consent to the complainant’s request. When the father did not respond to the custodian’s email asking about the father’s consent, the custodian interpreted the father’s silence as a lack of consent, based both on the custodian’s experience with the parents, and because it was a departure from the father’s usual practice of responding promptly to the custodian’s emails.

[35] In the circumstances, I find reasonable the custodian’s conclusion that the father did not consent to the complainant’s access request. While the complainant asserts that the custodian ought to have made additional efforts to contact the father, I see no basis in PHIPA  for imposing such an obligation on the custodian. If the complainant believes that the father would have consented or would now consent to her request for access to the emails, she is free to seek that consent herself, and to provide it to the custodian to support her access request. It is my understanding that the complainant has not provided such a consent to date.

[36] The situation before me is similar to those addressed in PHIPA Decision 107 and later decisions that followed the approach set out there.[12] In view of the evidence of an objection by the other joint custodial parent, who is equally ranked with the complainant as a substitute decision-maker for the children, I uphold the custodian’s refusal of the complainant’s request for access to the children’s personal health information. In the circumstances, the complainant cannot act as an independent substitute decision-maker for the children under PHIPA  to exercise a right of access on their behalf.

[37] Apart from her assertion that the doctor ought to have made more efforts to obtain the father’s consent to release the specific emails at issue to her, the complainant says that she and the children’s father provided a “consent at the beginning of the children’s care” that ought to apply to the current request. I have no evidence before me about the nature and scope of this prior consent, which was apparently provided in connection with the children’s care, and thus no basis to conclude the prior consent would cover the complainant’s access request for the specific records at issue here. It is an open question, for instance, whether this prior consent contemplates a request made by one parent, after the termination of the health care relationship, for release of the children’s personal health information contained in communications between the doctor and the other parent only.

[38] In addition, based on the evidence I have accepted about the father’s more recent refusal to give a specific consent to the release of the emails at issue in this complaint, I see no basis to consider the claim about a prior consent under section 29 (a) of PHIPA , which permits disclosure with consent in some circumstances.

[39] Finally, the complainant refers to a court order that she says contains a clear direction that information can be requested from any individual working with the children. She asserts that this court order confers a legal right for her to obtain the information she seeks.

[40] I will discuss the court order under the next heading, in considering whether it is a basis for the custodian to consider disclosing the requested emails to the complainant. With regard to access, the court order does not confer any substitute decision-making authority on the complainant for the purposes of PHIPA . It does not have an impact on my finding, above, that the complainant may not exercise an independent right of access, on the children’s behalf, to records of their personal health information in view of evidence of the father’s objection.

[41] For all these reasons, I find the complainant has no right of access to the emails under PHIPA .

Disclosure under PHIPA

[42] Aside from the right of access in Part V of PHIPA , several sections in Part IV of PHIPA  address the disclosure of personal health information.[13]

[43] Under PHIPA, a disclosure of personal health information can occur only with the consent of the individual to whom the information belongs (or the consent of that individual’s lawfully authorized substitute decision-maker), or without consent in specified circumstances. Section 29  of PHIPA  states:

A health information custodian shall not collect, use or disclose personal health information about an individual unless,

(a) it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or

(b) the collection, use or disclosure, as the case may be, is permitted or required by this Act.

[44] The IPC has found that where a requester provides a custodian with evidence that conditions for disclosure under specific sections of PHIPA  may have been met, the custodian has a duty to consider the request under those potentially applicable sections of PHIPA .[14]

[45] The complainant has referred to a court order issued in proceedings between the complainant and the children’s father, which she says entitles her to the requested emails. This claim may raise the potential application of section 29 (a) of PHIPA , which permits a custodian to disclose personal health information with consent in some circumstances; and section 41(1)(d)(i), which permits a custodian to disclose personal health information without consent pursuant to an order or other similar requirement.

[46] If I find the custodian had a duty to consider the request under a discretionary section of PHIPA , I have the authority to review the custodian’s exercise of discretion under this section. The IPC has found that in deciding whether or not to disclose personal health information under a permissive section of PHIPA , a custodian must make the decision in a proper manner, based on proper considerations, in good faith and for a proper purpose. If the IPC finds the custodian has failed to do so, the IPC may order the custodian to consider the matter again, and may provide comments and recommendations to guide the custodian’s consideration.[15] However, the IPC cannot order release of the information.[16]

[47] In the discussion that follows, I will explain why I find the custodian had a duty to consider the complainant’s request for disclosure under section 41(1) (d)(i) of PHIPA . Because I find the custodian failed to do so, I accordingly order him to fulfil his duty by properly exercising his discretion under this permissive section of PHIPA , and by issuing a decision to the complainant demonstrating how he has done so.

The doctor had a duty to consider the complainant’s request for disclosure under relevant sections of PHIPA

Disclosure with consent – section 29(a)

[48] Under section 29(a) of PHIPA  (reproduced above), a health information custodian may disclose personal health information with consent where the disclosure, “to the best of the custodian’s knowledge, is necessary for a lawful purpose.”

[49] Under this heading, I will consider the complainant’s claim that a consent order made in a proceeding between the complainant and the children’s father requires the father to consent to release of the children’s information to her. She relies on the following provision in the order:

The parties [the complainant and the children’s father] may make inquiries and be given information by the children’s teachers, school officials, doctors, dentists, health care providers, summer camp counsellors or other[s] involved with the children. The parties will execute any required authorization or direction necessary to enforce this clause.

[50] In PHIPA Decision 96, the IPC observed that in deciding whether the conditions for disclosure under section 29(a) are met, a custodian will have to determine who (if anyone) may provide consent on behalf of the individual whose personal health information is the subject of the request. The custodian must then decide whether any consent was in fact given by such a person. The custodian also must consider whether that consent meets the other requirements of a valid consent under PHIPA  (section 18 )— including, for example, whether the consent relates to the particular personal health information being requested [section 18(1)(c)].

[51] In addition, the custodian must consider whether, to the best of its knowledge, the disclosure is “necessary for a lawful purpose” within the meaning of section 29(a). In PHIPA Decision 96, the IPC noted that while that phrase is not defined in PHIPA , a plain reading indicates that, at a minimum, the custodian must not be aware that the requested disclosure is for a purpose contrary to law.

[52] The complainant has referred to the court order as a basis for inferring the consent of the children’s father to the custodian’s release of the specific emails at issue in this complaint. However, there is no evidence before me that the father has executed any authorization or direction pursuant to the court order that would qualify as a valid consent for the purposes of section 29(a). I note that any issues arising from enforcement of the court order are outside the IPC’s mandate under PHIPA .

[53] In addition, as I noted above, I accept the evidence that when asked more recently, the father did not provide a specific consent to the release of the particular emails at issue in this complaint.

[54] In these circumstances, to the extent the custodian had any duty to consider the complainant’ s request under section 29(a), I am satisfied he has fulfilled this duty, and, in view of the lack of a valid consent from the father, properly exercised his discretion not to disclose the requested emails to the complainant.

Disclosure without consent - section 41(1)(d)(i)

[55] The complainant’s reliance on the court order might also raise the potential application of section 41(1) (d)(i) of PHIPA . This section states:

A health information custodian may disclose personal health information about an individual for the purpose of complying with a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information.

[56] Also relevant is section 6(3)  of PHIPA , which states, in part:

A provision of this Act that permits a health information custodian to disclose personal health information about an individual without the consent of the individual,

(a) does not require the custodian to disclose it unless required to do so by law;

(b) does not relieve the custodian from a legal requirement to disclose the information[.]

[57] Through section 6(3), PHIPA  clarifies that custodians considering disclosure under sections of PHIPA  that permit disclosure without consent are not required to disclose. Rather, these sections provide exceptions under which custodians may disclose personal health information without violating their obligations under PHIPA . At the same time, PHIPA  explicitly recognizes that custodians may be subject to mandatory legal requirements outside PHIPA .[17]

[58] In PHIPA Decision 96, the IPC considered a requester’s claim that a court order issued in family court proceedings between him and the children’s mother gave him a right to receive information about their children. The IPC concluded that the custodian in that case failed to show that it had properly considered the request under section 41(1) (d)(i) of PHIPA , which could have applied in the circumstances. The IPC stated that in deciding whether or not to disclose the requested information under section 41(1)(d)(i) based on a court order, a custodian must consider, among other things, whether it is satisfied that the court order is valid, and whether and how the order addresses the particular information that a requester is seeking.[18]

[59] In this case, as in PHIPA Decision 96, there is no indication that the custodian considered the relevance of the court order provided by the complainant when refusing her request for the children’s personal health information. In these circumstances, I find the custodian failed to discharge his duty to consider the potential application of section 41(1) (d)(i) of PHIPA .

[60] To remedy this failure, I will return the matter to the custodian to properly consider the complainant’s request for disclosure under section 41(1)(d)(i). This means the custodian must show that he exercised his discretion under this permissive section of PHIPA a proper manner, based on proper considerations, in good faith, and for a proper purpose—in legal terms, to properly exercise the discretion conferred to him under PHIPA .[19] One way for the custodian to do this is by providing reasons for his decision.[20]

[61] If the custodian decides that the conditions for disclosure under section 41(1)(d)(i) are not met, he should make this clear in his decision. However, if the custodian decides that the court order requires disclosure of the information sought by the complainant, then PHIPA  is not a barrier to disclosure [section 6(3)(b)].

[62] Ultimately, if a requester believes that a custodian has failed to comply with a valid court order that requires disclosure, the requester may wish to seek enforcement of the order through the courts. While a custodian cannot relieve itself of other mandatory legal requirements by relying on PHIPA , PHIPA  itself does not require disclosure—that requirement comes from other sources of law.[21] While in a case like this, the IPC can order a custodian to properly consider a request for disclosure of personal health information, the IPC cannot order release of the information.[22]

Conclusion and summary

[63] For all the reasons given above, I find the complainant has no right of access to records of the children’s personal health information.

[64] However, I find that the complainant has provided evidence to the custodian giving rise to a duty on the part of the custodian to consider the potential application of section 41(1)(d)(i), which permits disclosure of personal health information in some circumstances. As the custodian has not shown that he has properly considered this section of PHIPA , I will remedy this breach of duty by ordering the custodian to consider the complainant’s request under this permissive section of PHIPA , and to provide reasons demonstrating a proper exercise of the discretion conferred on him by this section.

ORDER:

1. For the foregoing reasons, pursuant to section 61(1)  of PHIPA , I order the custodian to consider the complainant’s request for disclosure of her children’s personal health information under section 41(1) (d)(i) of PHIPA , and to provide a response explaining his decision to disclose or not to disclose the requested information under this section.
2. I order the custodian to provide the complainant with his decision and reasons by January 5, 2024.
3. I reserve the right to require the custodian to provide me with a copy of his decision to the complainant in compliance with order provisions 1 and 2.

Original Signed by:		December 13, 2023
Jenny Ryu
Adjudicator