PHIPA DECISION 259

Complaint HA22-00125

Brightshores Health System

October 15, 2024

Summary: A person asked a hospital for access to records of their personal health information. The hospital issued a fee estimate charging the person $702.01 for the records. The person disputes the amount of the fee.

In this decision, the adjudicator does not uphold the hospital’s fee estimate and instead finds that the Personal Health Information Protection Act, 2004  permits the hospital to charge $40 for the records.

Statutes Considered: Personal Health Information Protection Act, 2004,  S.O. 2004, c.3, Sched. A, sections 54 (2) , (10)  and (11) .

Decisions Considered: PHIPA Decision 111.

BACKGROUND:

[1] This decision determines whether a fee estimate of Brightshores Health System[1] (the hospital[2]) is consistent with the principle of “reasonable cost recovery” under sections 54(10)  and (11)  of the Personal Health Information Protection Act, 2004  (the Act ).

[2] The complainant made a written request to the hospital for access to records of their personal health information. The request listed specific records that the complainant sought and identified a period of time that the records covered. The request also asked that, prior to processing the request, the hospital provide a fee estimate which ought to include a total number of pages in the records. The hospital issued a fee estimate of $702.01 for 2345 pages of the records.

[3] The complainant made a complaint to the Information and Privacy Commissioner of Ontario (the IPC) about the hospital’s fee estimate.

[4] The IPC attempted to resolve the matter at mediation. However, the complaint was not resolved, and it was moved to the adjudication stage of the complaint process, where an adjudicator decided to conduct a review.

[5] An IPC adjudicator sought and received representations from the hospital and the complainant in accordance with the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004 . The complaint was then transferred to me to continue the review. Having reviewed the materials, I sought clarification from the hospital about some of its representations. Aside from the clarification, I did not need further representations before making my decision.

[6] For the reasons that follow, I find that the hospital’s fee estimate for providing the complainant with access to the records of their personal health information exceeds the amount of “reasonable cost recovery” under the Act . I reduce the fee to $40.

DISCUSSION:

[7] There is no dispute between the parties that the hospital is a “health information custodian” as that term is defined in section 3(1)  of the Act , or that the records at issue are records of “personal health information” as that term is defined in section 4(1)  of the Act .

[8] The sole issue in this appeal is whether the hospital’s fee estimate exceeds the amount of “reasonable cost recovery” under the Act .

[9] Sections 54(10)  and (11)  of the Act  allow health information custodians to charge a fee for providing an individual with access to their own personal health information. These sections state:

54 (10) A health information custodian that makes a record of personal health information or a part of it available to an individual under [Part V of the Act ] or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

Amount of fee

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[10] As of the date of the decision, there is no regulation that prescribes fees for access under the Act . However, the IPC has authority under the Act  to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery.”

[11] The expression “amount of reasonable cost recovery” is not defined in the Act . Applying the modern rule of statutory interpretation, the IPC has previously concluded that the phrase “reasonable cost recovery” does not mean “actual cost recovery” or full recovery of all the costs borne by a health information custodian in fulfilling a request for access to an individual’s own personal health information.[3] Further, the IPC has concluded that the use of the word “reasonable” to describe cost recovery suggests that costs should not be excessive, and that, as a whole, section 54(11) must be interpreted in a manner that avoids creating a financial barrier to the important purpose of the Act , which is to grant a right of access to one’s own personal health information.[4]

[12] Past orders have held that a fee scheme set out in a proposed regulation to the Act , published by the Minister of Health and Long-Term Care in 2006 (the “2006 framework”),[5] though never adopted, provides the best framework for determining “the amount of reasonable cost recovery” under the Act .[6] I agree with this reasoning and will apply the 2006 framework in this decision. However, I am also mindful that while the 2006 framework provides a helpful guideline for calculating permissible fees under the Act , the only principle that health information custodians are legislatively required to comply with is the requirement that a fee does not exceed the amount of “reasonable cost recovery.”[7]

[13] The 2006 framework establishes a set fee that health information custodians may charge to complete specifically defined work required to respond to a request. It also prescribes the fees that health information custodians may charge over and above that set fee.

[14] Section 25.1(1) of the 2006 framework reads as follows:

Fees for access to records

25.1(1) For the purposes of subsection 54(11)  of the Act , the amount of the fee that may be charged to an individual shall not exceed $30 for any or all of the following:

1. Receipt and clarification, if necessary, of a request for a record.

2. Providing an estimate of the fee that will be payable under subsection 54(1) of [the Act ] in connection with the request.

3. Locating and retrieving the record.

4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access may be refused.

5. Preparation of a response letter to the individual.

6. Preparation of the record for photocopying, printing or electronic transfer.

7. Photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages, excluding the printing of photographs from photographs stored in electronic form.

8. Packaging of the photocopied or printed copy of the record for shipping or faxing.

9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping of faxing the printed copy.

10. The cost of faxing a copy of the record to a fax number in Ontario or mailing a copy of the record by ordinary mail to an address in Canada.

11. Supervising the individual’s examination of the original record for not more than 15 minutes.

[15] Section 25.1(2) of the 2006 framework indicates that a health information custodian may charge fees over and above the set $30 fee as set out in Table 1. The following excerpt from Table 1 is relevant to this review:

TABLE 1

Table 1

ITEM	COLUMN 1	COLUMN 2
1.	For making and providing photocopies or computer printouts of a record	25 cents for each page after the first 20 pages
3.	For making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form	$10

Representations

Hospital’s representations

[16] The hospital submits that its fee estimate is consistent with the “IPC’s guidance on reasonable cost recovery.” The hospital says that the fee is charged for making a copy of the records and saving them on a digital storage device based on the number of pages in the records. The hospital further says that, in calculating the fee, it did not include fees for the effort and time that it took its staff to prepare the records, the time that it would take its staff to burn the records on a digital storage device,[8] or the review time.

[17] The hospital provides the following breakdown of its fee:

Hospital Fee Breakdown

First 20 pages, preparing the package for mailing and cost of mailing	$30.00
25 cents for each page after the first 20 pages (2,325)	$581.25
Providing results on a digital storage device	$10.00
HST	$80.76
Total	$702.01

[18] While the hospital says that the time and effort its staff spent on responding to the complainant’s request for records of personal health information was not a factor that formed the basis of the fee estimate, the hospital describes its file management system and how it responds to requests for records of personal health information in order to address the complainant’s assertion that a response to the request simply entails copying to a digital storage device the complainant’s records (which the hospital says the complainant assumes are contained in one digital file).

[19] The hospital explains that for requests that span a large number of years, a patient’s electronic record is split into encounters. Each encounter contains documents from a separate episode of care. Within each encounter, different types of documents and notes are separated into electronic folders depending on the type of documentation.

[20] In order to respond to a request for records of personal health information, hospital staff go into each folder within each encounter and save each document separately by clicking “print to PDF.” Staff then combine all PDF documents in the right sequence into one PDF. The hospital notes that saving each document in PDF format by clicking “print to PDF” or printing a hard copy of each document by sending the document to a printer requires the same time and effort.

[21] The hospital says that there were 82 separate encounters for the complainant. This means that its staff needed to go into each of the 82 encounters and then each folder within each encounter to locate and retrieve the documents that the complainant requested. Therefore, the hospital says that the work that is required to prepare a response to the complainant’s request for records of personal health information entails more steps than assumed by the complainant.

[22] The hospital acknowledges that patients can access their records using an online platform. However, it says that records are not stored in one document within this platform either. Patients need to undergo the same search and compilation process as hospital staff to gain access to their records.

Complainant’s representations

[23] The complainant submits that printing electronic records before saving them on a digital storage device is the most inefficient and costly manner of processing the request and therefore the fee estimate that contains a charge for printing is not consistent with “reasonable cost recovery” under the Act .

[24] The complainant submits that the request clearly informed the hospital of the nature of the complainant’s condition and that the request was urgent. The complainant highlights that the request identified a list of records to which access was sought, specific complainant’s condition related to which the records were sought, and the purpose of the request (which was litigation). In addition, the request noted that no professional review was required and asked that, prior to processing the request, the hospital provide an estimate indicating a total number of pages in the records.

[25] The complainant says that despite the request clearly noting the complainant’s condition and that the request was urgent, to date, the complainant has not received access to the records due to a dispute about the fee. The complainant submits that the dispute about the fee is unreasonable for the following reasons.

[26] First, the complainant argues that they have a right to access their personal health information within 30 to 60 days of making the request regardless of whether the fee is in dispute.

[27] Second, the complainant says that despite the request asking that a fee estimate be provided prior to the hospital processing the request and this being a requirement under the Act , the fee estimate was provided after the request was processed. In addition, the complainant says that the fee estimate did not include details about the fee structure, including the fact that the records would be printed. The complainant acknowledges, however, that the fee estimate indicated the total fee to be charged and the total number of pages in the records. The complainant also confirms that, following their response to the hospital about the fee estimate, the hospital provided a second fee estimate which included details about the fee structure.

[28] Third, the complainant submits that the fee does not reflect “reasonable cost recovery” because it contains charges for services that were not requested. The complainant says that they did not ask the hospital to print the records before saving them on a digital storage device. The complainant further adds that the hospital is able to save the records on a digital storage device without printing them because the hospital stores records electronically.

[29] Given that the records are stored electronically and the request is for records to be provided to the complainant on a digital storage device, the complainant submits that no fee for printing ought to be charged.[9] In addition, the complainant says that it is easy to save electronic records on a digital storage device: the hospital only needs to highlight the records, click copy and then save them on a device.

[30] Finally, the complainant submits that the fee does not reflect “reasonable cost recovery” because sections 54(10)  and (11)  of the Act  require that requests for records of personal health information be processed in the most economical manner.

Hospital’s reply representations

[31] In response to the complainant’s description of their request for records of personal health information, the hospital submits that it considered the entirety of the request when responding to it.

[32] The hospital disputes the complainant’s claim that an estimate was not provided as asked in the request. The hospital says that it provided an estimate of the fee to be charged and a breakdown of the fee.

[33] The hospital also disputes the complainant’s assertion that it did not use the most efficient method of providing the records. The hospital says that the fact that records might be stored electronically does not mean that all records are in one document and can be simply copied to a digital storage device. Further, the hospital says that the estimate clearly stated that the records would be provided on a digital storage device. However, in its response to my clarification, the hospital says that it originally believed that the complainant requested a hard copy of the records.

Analysis and findings

The per page fee estimate for making electronic copies when the hospital is providing electronic records on a digital storage device does not reflect “reasonable cost recovery”

[34] As noted above, previous IPC decisions have held that the 2006 framework provides the best method for determining the amount of “reasonable cost recovery” under the Act .[10] The 2006 framework allows health information custodians to charge a set fee of $30 for a number of administrative tasks involved in processing requests, including “photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages”. If the record is larger than 20 pages, the 2006 framework permits health information custodians to charge 25 cents per page for “making and providing photocopies or computer printouts of a record.”

[35] The hospital is charging the complainant $30 for the first 20 pages of the records and $581.25 for the remaining 2325 pages of the records. The amount of $581.25 is calculated based on a charge of 25 cents per page. The hospital says that to prepare the records to be transferred onto a digital storage device, its staff save a copy of each electronic record in PDF format. I understand, therefore, that the hospital is charging per page fees for creating electronic copies of the records. While the fees that the hospital is charging are found in the 2006 framework, I find that the hospital incorrectly applies them.

[36] As a preliminary issue, I need to determine in which format the hospital stores the records and in which format the complainant requested to receive the records. Based on the hospital’s description of its file management system and its process of responding to requests for records of personal health information, I find that the hospital stores records of personal health information in electronic format. While the hospital says that it initially assumed that the complainant requested a hard copy of the records, I find that the hospital was aware at the time when it issued the fee estimate that the records were to be provided on a digital storage device. I make this finding based on the fee estimate, which indicates that the hospital was charging the complainant $10 for a digital storage device.

[37] Having found that the hospital stores the records electronically and the complainant requested the records be provided on a digital storage device, I will now determine whether the hospital is permitted to charge a per page fee for making electronic copies of electronic records when it is providing them on a digital storage device. I find that it cannot for two reasons.

[38] First, the 2006 framework does not contemplate a per page fee for making an electronic copy of an electronic record. The 2006 framework contemplates that a health information custodian will charge the fees of $30 and 25 cents per page only for making a photocopy of a paper record and for printing a hard copy of an electronic record. The 2006 framework also contemplates a fee for making and providing a record on a digital storage device, which I will discuss further below. While the 2006 framework was never adopted, I find that it is reasonable to differentiate between fees to be charged for photocopying a paper record or printing a hard copy of an electronic record and making an electronic copy of an electronic record. Unlike making an electronic copy of an electronic record, photocopying and printing requires the use of additional material, such as ink and paper.

[39] Second, prior IPC orders held that it is not reasonable for a health information custodian to charge photocopying fees[11] for a record that is available in electronic format that does not require severance and that can be transferred onto a digital storage device.[12] As reasoned by Adjudicator Corban in PHIPA Decision 111, while the fee scheme under provincial and municipal access legislation[13] is different from the fee scheme under the Act , it provides helpful guidance in determining the fees that a health information custodian can charge under the Act .[14] Provincial and municipal institutions are not permitted to charge photocopying fees for providing an electronic record on a digital storage device, unless the record requires severance or cannot be transferred to a digital storage device without being printed.[15] I agree with the reasoning in PHIPA Decision 111 and orders under provincial and municipal access legislation and apply it to this case. Further, there is no evidence before me that the hospital needed to print a hard copy of the records to be able to save them on a digital storage device.

The fees that the hospital is permitted to charge

[40] The 2006 framework permits a health information custodian to charge $30 for such tasks as receipt of the request, providing an estimate, locating and retrieving the records, preparing a response letter, and preparing records for electronic transmission. In my view, the steps taken by the hospital to make electronic copies of the records are those contemplated by preparing the records for electronic transmission. Hospital staff performed all these tasks in preparing the records of the complainant’s personal health information and therefore the hospital is able to charge the set fee of $30.

[41] In addition, since the hospital is providing the records of the complainant’s personal health information on a digital storage device, it can charge the complainant $10 for “making and providing” the records on a digital storage device.

Other issues raised by the complainant

[42] The complainant raised a number of other concerns in their representations that I will address below. While these concerns do not directly impact my decision on the fee, they deal with the access request.

[43] First, the complainant submits that the hospital ought to have provided the records within 30 to 60 days of the receipt of the request despite a dispute about the fee. Section 54(2)  of the Act  requires that a health information custodian provide a record of personal health information to an individual within 30 days of the request. Section 54(10) permits a health information custodian to charge a fee for providing the records after it provides a fee estimate. The Act  does not speak to health information custodian’s responsibilities when there is a dispute about the fee.[16]

[44] Second, the complainant submits that the hospital failed to provide a fee estimate prior to processing the request, as requested in the request for access to records of personal health information and as required by the Act . While I agree that the request asked that the hospital provide a fee estimate prior to processing the request, I find that there is no prejudice to the complainant in the fee estimate having been provided after the request was processed. The complainant had sufficient time to review the fee estimate and raise concerns with it, which they did. In addition, section 54(10)  of the Act  only requires the hospital to provide a fee estimate prior to charging a fee and does not specify whether the fee estimate ought to be provided before or after the processing of the request.

[45] Related to the concerns about when the fee estimate was provided are the complainant’s concerns about the content of the fee estimate. I do not accept the complainant’s submission that there were two fee estimates. While the hospital provided a fee estimate twice, it was the same fee estimate. I also do not agree with the complainant that the fee estimate did not contain a breakdown of the fee. I find that the fee estimate clearly identified the bases for the fee amount.

ORDER:

I do not uphold the hospital’s fee, and I order that it be reduced to $40.

Original Signed by:		October 15, 2024
Anna Kalinichenko
Adjudicator