PHIPA DECISION 242

Complaint HA23-00213

May 15, 2024

Summary: The complainant sought access to her records of personal health information from Dr. Eric Ireland (the custodian). This decision determines that the custodian is deemed to have refused the complainant’s request for access. The custodian is ordered to provide a response to the complainant in response to her request for access to records of her personal health information in accordance with the Personal Health Information Protection Act.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c. 3 ; sections 2, 3(1), 4(1) and (2), 52, 53 and 54(2), (3), (4) and (7); and Regulated Health Professions Act, 1991 , S.O. 1991, c. 18, section 1(1) .

BACKGROUND:

[1] This is a complaint under the Personal Health Information Protection Act, 2004 (the Act).

[2] On June 29, 2023, by email, the complainant made a request to Dr. Eric Ireland (the custodian) for access to her records of personal health information. The request states:

Good day dr Ireland, im requesting my recent health records from you as i need them to get a doctor, thank you.

Between August 10, 2023, and August 22, 2023, the complainant sent two follow up emails asking for her records.

[3] On August 29, 2023, the Information and Privacy Commissioner/Ontario (IPC or this office) received a deemed refusal complaint from the complainant indicating it had been more than 30 days since she had submitted her access request to the custodian, and she had not received a response. As a result, file HA23-00213 was opened and assigned to me as the Acting Adjudicator.

[4] On September 14, 2023, the complainant wrote another email to the custodian about her concerns and the various attempts made to obtain her records.

Good Day im requesting my medical records from you dr Ireland, i have the flash drive, prepaid envelope as you ask for. but dont know were to send it. i understand my emails and calls to you are going un answered as iv sent you at lest 6 this will be 7 emails. i was told today that you have been answering other peoples text messages /emails but ignore mine and by law you are to hand over our records its past the 30 day mark as you are no longer a dr. this is wrong what you are doing to us. if i dont hear from you i will be taking legal actions as you have a duty to your patents and you are not following your dutys to send out our records. Thank you.

[5] On October 24, 2023, I sent a Notice of Review (the notice) to the complainant and to the custodian by email. The notice indicated that the complainant had filed a deemed refusal complaint against the doctor on the basis that he had not responded to her access request within the time period set out in section 54 of the Act.

[6] The notice directed the custodian to immediately issue a response letter to the complainant and to forward a copy to me, the Acting Adjudicator, assigned to this complaint. The notice also indicated that if the doctor failed to do so and the complaint was not settled by November 7, 2023, an order requiring him to issue a response letter to the complainant may be issued.

[7] On October 25, 2023, I received a voicemail message from the custodian requesting a call back, however he did not leave a phone number. On this same date, I wrote to the custodian via email acknowledging receipt of his voicemail message and requested his phone number along with his availability for a phone call. In response, the custodian wrote me an email stating the following:

I have received your emails. I tried to call you today, but unsuccessfully. Could you please advise what a "deemed refusal" is, and what steps should I make to rectify this?

[8] I responded to the custodian’s email requesting his phone number and availability so I could provide details over a telephone discussion. When I did not hear back, on October 30, 2023, I contacted the custodian via email again and provided a detailed written summary of the “deemed refusal” complaints process. I encouraged the custodian to issue a final letter of response to the complainant and to contact me with any questions.

[9] On November 15, 2023, the complainant provided a phone number for the custodian.

[10] On November 24, 2023, I called the phone number provided by the complainant. The call went straight to voicemail. I left a message and requested the custodian call me back. That same day, I also wrote an email to the custodian and provided additional information regarding the complaint process and attached a guidance document titled “Responding to a Request for Access to Personal Health Information”.

[11] On December 12, 2023, I contacted the custodian again via phone and email regarding this complaint. To date, the custodian has not responded to my communications.

DISCUSSION:

Issue A: Are the records at issue “records” of “personal health information” as defined in sections 2 and 4 of the Act?

[12] Section 2 of the Act defines a “record” as follows:

“record” means a record of information in any form or in any medium, whether in written, printed, photographic or electronic form or otherwise, but does not include a computer program or other mechanism that can produce a record;

[13] The term “personal health information” is defined in section 4(1) of the Act as follows:

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,

(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,

(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,

(f) is the individual’s health number, or

(g) identifies an individual’s substitute decision-maker.

[14] Further, the term “identifying information” is defined in section 4(2) of the Act as “information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.”

[15] During the processing of this complaint, the complainant advised that she was a patient of the custodian from 1984 until 2023. The complainant submitted that she has some copies of her older records from this custodian.

[16] Based on the information before me, I am satisfied that the information contained in the records relates to the provisions of health care to the complainant by the custodian. I am also satisfied that the requested records contain identifying information within the meaning of section 4(2) that relates to the information described in one or more of the paragraphs under section 4(1).

[17] Therefore, based on the aforementioned, I find that the records at issue are records of personal health information within the meanings of sections 2 and 4 of the Act.

Issue B: Is Dr. Eric Ireland a “health information custodian” as defined in section 3(1) of the Act?

[18] Section 52 of the Act, generally, provides an individual with a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian, unless any of the exceptions set out under this section applies.

[19] The term “health information custodian” is defined in section 3(1)1 of the Act as follows:

“health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties of the work described in the paragraph, if any:

1. A health care practitioner or a person who operates a group practice of health care practitioners.

[20] Further, the term “health care practitioner” is defined in section 2 of the Act, in part, as follows:

“health care practitioner” means,

(a) A person who is a member of a regulated profession within the meaning of the Regulated Health Professions Act, 1991  and who provides health care,

[21] Moreover, the term “health care” is also defined in section 2 of the Act, in part, as follows:

“health care” means any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, …

[22] Under section 1(1) of the Regulated Health Professions Act, 1991 , “‘member’ means a member of a College” and “‘College’ means the College of a health profession or group of health professions established or continued under a health profession Act.”

[23] Accordingly, based on the aforementioned, I find that the custodian is a “health care practitioner” within the meaning of section 2 of the Act and, therefore, a “health information custodian” within the meaning of section 3(1)1 of the Act.

Issue C: Is Dr. Eric Ireland in a deemed refusal situation pursuant to section 54(7) of the Act?

[24] Section 53(1) of the Act states:

An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has the custody or control of the personal health information.

[25] Where a custodian receives a written access request, section 54(1) of the Act requires that the custodian issue a response that is in accordance with one of the paragraphs (a) to (d) under this section.

[26] Further, section 54(2) of the Act requires that a custodian “give the response required by clause [54] (1) (a), (b), (c) or (d) as soon as possible in the circumstances but no later than 30 days after receiving the request.”

[27] However, this 30-day time limit may be extended under section 54(3) of the Act. This section states:

Within 30 days after receiving the request for access, the health information custodian may extend the time limit set out in subsection (2) for a further period of time of not more than 30 days if,

(a) meeting the time limit would unreasonably interfere with the operations of the custodian because the information consists of numerous pieces of information or locating the information would necessitate a lengthy search; or

(b) the time required to undertake the consultations necessary to reply to the request within 30 days after receiving it would make it not reasonably practical to reply within that time.

[28] Section 54(4) of the Act requires that the requester be notified of such a time extension as follows:

Upon extending the time limit under subsection (3), the health information custodian shall give the individual written notice of the extension setting out the length of the extension and the reason for the extension.

[29] Under section 54(7), where a “health information custodian does not respond to a request within the [30-day] time limit or before the extension, if any, expires, the custodian shall be deemed to have refused the individual’s request for access.”

[30] Above, I found that the complainant’s medical records are records of “personal health information” under the Act. I also found that the custodian is a “health information custodian” under the Act.

[31] On June 29, 2023, the complainant made a written access request to the custodian for her medical records. The complainant has complained to this office that, to date, she has not received a response from him to this request. Further, following my multiple attempts to contact the custodian about this matter, I too have not received a response from him.

[32] In the circumstances of this complaint, there is no evidence before me indicating that the custodian has issued a response to the complainant’s access request in accordance with section 54(1) within the 30-day time limit required by section 54(2). There is also no evidence that the custodian gave the complainant notice of an extension of the 30-day time limit to respond in accordance with section 54(4). However, I note that, even if such notice was given, the additional time of up to 30 days would have expired long ago.

[33] For these reasons, I find that the custodian has not responded to the complainant’s access request within 30 days or before any extension of this time limit and, therefore, pursuant to section 54(7), I find that he is deemed to have refused the complainant’s request for access to her medical records.

[34] Accordingly, I will order the custodian to issue a response, in accordance with the Act, to the complainant’s request for access within ten (10) days of this decision and to provide a copy to my attention to verify compliance.

ORDER:

For the foregoing reasons, pursuant to section 61(1) of the Act, I order that:

1. The custodian shall provide a response to the complainant regarding her June 29, 2023 request for access to her medical records in accordance with the Act and without recourse to a time extension no later than May 29, 2024.
2. In order to verify compliance, the custodian shall provide me with a copy of the response referred to in provision 1 by May 29, 2024. This should be forwarded to my attention c/o Information and Privacy Commissioner/Ontario, 2 Bloor Street East, Suite 1400, Toronto, Ontario, M4W 1A8.

Original Signed By:		May 15, 2024
Soha Khan
Acting Adjudicator