PHIPA DECISION 269

Complaint HA23-00251

Mackenzie Health

December 10, 2024

Summary: A requester asked the hospital for video surveillance footage after his visit to the hospital. The hospital found several hours of video footage, but stated that some of the requested footage had been deleted in accordance with its retention policy. The requester complained about the hospital’s response to the IPC, stating that it had improperly deleted the footage. The fee the hospital was charging for the footage, and the hospital refusing a fee waiver, was also disputed in the complaint.

In this decision, the adjudicator finds that the hospital did not improperly delete the video footage, and he upholds the hospital’s fee and denial of a fee waiver. He dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004 , S.O. 2004 c. 3, Sched. A, sections 53 , 54(10) , 54(11) , and 54(12) .

BACKGROUND:

[1] An individual made an access request to Mackenzie Health (the hospital) under the Personal Health Information Protection Act, 2004  (PHIPA ) for hospital video surveillance recordings from two specified dates when he attended the hospital. After asking for the recordings, the requester discussed the request with the hospital, clarifying and adding to it. A chart was produced outlining the specific dates, times, and locations in the hospital where the requester was seeking video footage.

[2] The hospital issued an interim decision letter and fee estimate, outlining 11 video recordings totaling about 15 hours with related details, recordings that it determined were “not found/do not exist,” a fee estimate outlining a total cost of $2695.00, and information about how to request a fee waiver. For the video footage that it could not locate, the hospital explained that video surveillance footage is retained for 30 days, as outlined in its video surveillance policy. It also explained that not all areas of the hospital are equipped with video surveillance capabilities. In total, the hospital was unable to locate video recordings for three of the days for which the requester was seeking access. It stated that one day was unavailable because cameras did not record the requested area, and for the other two it stated that the video recordings were overwritten following the hospital’s video surveillance retention policy.

[3] The requester (now the complainant) submitted multiple complaints to the Information and Privacy Commissioner of Ontario (IPC). In his complaints, he raised issues with how the hospital treated him and the hospital stating that video recordings of these incidents were not available. He also stated that the hospital had intentionally deleted video footage and intentionally misunderstood the days he was seeking video footage for.

[4] The complaints were grouped together. During mediation, the hospital issued a final access decision, further to its earlier interim decision, granting partial access to responsive video footage and reiterating the fee estimate of $2695.00. The hospital claimed section 52(e)(i) (serious harm to recovery of an individual) of PHIPA  to withhold portions of the records, which the complainant did not dispute. It reiterated that records for three days could not be found, and provided additional information about its video surveillance retention policy.

[5] The complainant was not satisfied with the hospital’s response and no further mediation was possible. The complaint was transferred to the adjudication stage of the complaint process, where an adjudicator may conduct a review. I conducted a review in which I sought and received representations from the hospital. The complainant reiterated his general concerns about how the hospital treated him but did not otherwise provide substantive representations. Representations were shared in accordance with the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004.

[6] For the reasons that follow, I dismiss the complaint without issuing an order.

RECORDS:

[7] The records being sought by the complainant are eleven videos totaling about 15 hours, as outlined in the hospital’s revised decision letter. Deleted video footage for two specified dates is also being sought.

ISSUES:

1. What is the scope of the complainant’s request and does the hospital have appropriate information practices in place?
2. What is the appropriate fee for access?
3. Should the hospital’s denial of the fee waiver request be upheld?

DISCUSSION:

Preliminary Issues: the hospital is a health information custodian, the request was made under PHIPA, and the surveillance footage at issue contains the personal health information of the complainant

[8] During the review, the parties did not dispute, and I find, that the hospital is a health information custodian as defined in section 3(1)  of PHIPA .

[9] It was also not disputed that although the hospital is governed by both PHIPA and the Freedom of Information and Protection of Privacy Act (FIPPA), the complainant made the access request under PHIPA , and he only seeks access to information that constitutes his personal health information, as defined in section 4  of PHIPA .

[10] Lastly, the hospital did not dispute, and I find, that the surveillance footage can be reasonably severed to only contain the complainant’s personal health information for the purposes of providing the complainant access, in accordance with section 52(3)  of PHIPA .[1]

Issue A: What is the scope of the complainant’s request and does the hospital have appropriate information practices in place?

[11] The complainant initially took issue with the hospital’s search efforts following mediation, but during the review I determined that the hospital’s search efforts were not being disputed. Rather, the complainant appeared to take issue with the hospital’s information practices with respect to the retention times for surveillance footage, and there was a dispute about the scope of the complainant’s initial request. I asked the hospital and the complainant to explain if they disagreed with this characterization of the complaint, and neither party disputed it.

[12] Section 53  of PHIPA  imposes certain obligations on requesters and health information custodians when submitting and responding to requests for access to records.

This section states:

1. An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information.
2. The request must contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts.
3. If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2).

[13] The IPC has addressed analogous provisions in public sector freedom-of- information legislation and has determined that institutions should adopt a liberal interpretation of a request in order to best serve the purpose and spirit of freedom-of- information legislation, and that, generally, ambiguity in a request should be resolved in the requester’s favour.[2] The IPC has also determined that to be considered responsive to a request, records must “reasonably relate” to the request.[3]

[14] In the present complaint, the complainant initially requested surveillance footage for three days. The dates were later amended, with an earlier date added, and additional times specified. The range was later expanded to be for the entirety of the complainant’s four-day stay at the hospital. After the request was clarified, the hospital stated that it could not provide surveillance footage for the first two days of the complainant’s stay because it had been overwritten in accordance with the hospital’s retention policy.

[15] I asked the hospital to provide representations on how it characterized the complainant’s request, specifically whether it considered the request to be for specific, discrete points in time in specific locations, or more broadly to be related to the complainant’s stay at the hospital during the requested times. I also asked it to provide an explanation of any steps it takes following an access request to preserve footage that, while not necessarily directly responsive to a particular request, may otherwise relate to the footage being sought by a requester and may reasonably be expected to be sought after a requester reviews the initial footage. I also asked the hospital to provide a rationale for its 30-day retention period for surveillance footage.

Representations

[16] The hospital explains that it understood the request to be for specific dates and times in specific locations, as per the wording of the original request. It states that the complainant subsequently provided additional discrete times, expanding the request to include two additional dates.

[17] The hospital submits that when its privacy office receives a request for video footage with dates, locations, and approximate times, the office contacts the hospital’s security team to request footage from the generalized locations and times to be saved. It explains that, in practice, this includes a window of time from the camera in a relevant area, which the privacy office will then review to identify or confirm the identity of the requester, reduce the video duration to the responsive period given the interpretation of the request received (with remaining footage saved), and through the reduction of footage reduce any expenses related to redaction for video that is not responsive to the request.

[18] It further explained that the hospital does not save all footage from all cameras for dates and times before or after periods of interest pending a “subsequent theoretical request.” The hospital states that it acts in good faith to secure the available footage, focused on the request received, and it works with requesters to articulate areas that are and are not covered by hospital cameras. It further submits that it recognizes that it has a responsibility to provide what video footage is available under PHIPA and FIPPA, and to act expediently to secure and review footage, and advise requesters accordingly.

[19] It states that for this request, the privacy office had a 90-minute phone call with the complainant to discuss what was available from the video footage to support the complainant to refine the scope of the request to what may be available and of interest, as well as to appreciate that some of the requested footage did not exist due to the locations of cameras.

[20] With respect to the 30-day retention period, the hospital states that security surveillance cameras are not positioned to capture conventional care delivery, and are not intended as a tool for patient management or monitoring, and footage is therefore only retained so long as to fulfill its security-oriented purpose. It states that 30 days has been found to be the amount of time reasonably necessary to report an incident that occurred in the space under surveillance, and that this determination was based on internal and external consultations, and retention periods for other organizations.

[21] The complainant did not provide specific representations on the hospital’s characterization of his request or its information practices, but generally raised concerns about how he was treated by hospital staff.

Analysis and finding

[22] I have considered the representations of the parties and underlying circumstances of the complaint, and I am satisfied that the hospital properly characterized the complainant’s access request and took appropriate steps to secure video footage in response to it.

[23] The complainant’s initial request was for several specified times, and based on my review of the hospital’s interactions with the complainant, the hospital spent a significant amount of time clarifying the request with the complainant. While it appears that some of the surveillance footage sought by the complainant was deleted by the time that the scope of the request was fully understood, based on the information before me I am not satisfied that this shows that the hospital acted unreasonably in the circumstances.

[24] The complainant sought a significant amount of footage in his initial request, and based on the information provided in the mediator’s report it is clear that what he specifically sought was frequently changed. I find that it was reasonable for the hospital to only locate and secure the specific footage that the appellant was seeking. It would have certainly been preferable from the complainant’s perspective if the hospital had retained all possible footage that he may have requested, but in this particular case with the information before me, I find that the hospital’s failure to do so does not merit any further review or orders. Additionally, I find that the hospital has provided an adequate rationale for its 30-day retention period for video surveillance footage.

Issue B: What is the appropriate fee for access?

[25] Sections 54(10)  and (11)  of PHIPA  allow the hospital to charge a fee for access, after giving an estimate:

(10) A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[26] Regarding section 54(11), PHIPA  contains no prescribed fee amounts and does not define the “amount of reasonable cost recovery.” The IPC has concluded that “reasonable cost recovery” within the meaning of the PHIPA  does not mean “actual cost recovery” or full recovery of all costs borne by a health information custodian in fulfilling a request for access to an individual’s own personal information.[4]

[27] The IPC has also concluded that the use of the word “reasonable,” to describe cost recovery, suggests that costs should not be excessive, and that, as a whole, section 54(11) must be interpreted in a manner that avoids creating a financial barrier to the important purpose of PHIPA  to grant a right of access to one’s own personal health information. As noted in PHIPA Decision 17, these past orders concluded that a fee scheme set out in a proposed regulation to PHIPA , published by the Minister of Health and Long-Term Care in 2006 (the “2006 framework”), though never adopted, provides the best framework for determining the amount of “reasonable cost recovery” under PHIPA .

[28] In applying the 2006 framework, a custodian must first consider the set fee of $30 set out in section 25.1(1) of the 2006 framework. Included in that $30 charge are fees for a number of listed administrative tasks involved in processing the request, such as the first 15 minutes of review by the health information custodian to determine if the record contains personal health information to which access may be refused, and photocopying or printing of the first 20 pages of the responsive records. It also includes costs incurred for packaging the photocopied or printed copy of the record for shipping and for mailing a copy of the record by ordinary mail to an address in Canada.

[29] Section 25.1(2) of the 2006 framework references fees that a custodian is permitted to charge, over and above the set $30 fee, for a number of defined tasks. These include fees for making the records available to the requester on various mediums and fees for review. Fees for severing video footage prior to granting access to it are not included in that table. In prior complaints, the IPC has determined that it is reasonable to allow a health information custodian to claim costs, representing reasonable cost recovery, of the services of a third party for severing a record of personal health information for the purpose of granting access to the remainder.[5]

Representations, analysis, and finding

[30] The hospital did not provide additional information in its representations on the fee for access, relying on the explanation it provided prior to the adjudication stage. The complainant also did not provide representations on the hospital’s fee.

[31] I have reviewed the hospital’s fee as outlined in its initial response to the access request, and its subsequent responses after the complainant requested a fee waiver. The hospital’s initial fee included a $2655.00 fee for redacting approximately 15 hours of surveillance footage (calculated as $45 for every 15 minutes of review after the first 15 minutes), as well as a $10.00 fee for providing the information on electronic media, and a $30.00 administrative fee. After the complainant requested a fee waiver, the electronic media and administrative fees were waived, and the redaction fee was reduced to the actual cost incurred by the hospital using a third-party service, for a new fee of $1159.20.

[32] While the fee is substantial, considering that it represents redactions for 15 hours of video surveillance footage, and given that the complainant has not explained why the fee should be different, I am satisfied it represents reasonable cost recovery for the hospital in the circumstances and I will uphold it.[6]

Issue C: Should the hospital’s denial of the fee waiver request be upheld?

[33] The complainant initially requested a fee waiver and the custodian reduced the fee. The complainant remains dissatisfied with the fee.

[34] Section 54(12)  of PHIPA  provides the custodian with the discretion to waive the payment of all or any part of the fee if, in the custodian’s opinion, it is fair and equitable to do so. A requester must first ask the custodian for a fee waiver, and provide detailed information to support the request, before this office will consider whether a fee waiver should be granted.

[35] When deciding whether to waive payment of all or part of a fee, a custodian must exercise its discretion. Given the language of section 54(12)  of PHIPA , the IPC has held that its review of a custodian’s decision to deny a fee waiver request is limited to a review of its exercise of discretion under that section.[7] The custodian may decide that only a portion of the fee should be waived. While PHIPA does not specify what constitutes fair and equitable, prescribed factors considered under analogous provisions in FIPPA and its regulation may be instructive.[8]

Representations, analysis, and finding

[36] The hospital submits that it exercised its discretion to partially waive the fee in consideration of the information the complainant provided. With respect to the remainder of the fee, the hospital submits that it has already excluded all internal costs for retrieval, review, and redaction planning (identifying the timestamps and subjects for redaction). It states that the redaction costs incurred by services of a third-party will not be waived, recognizing that these are real, net-new costs incurrent by the hospital above and beyond the locate, retrieval, and release efforts. It submits that providing a waiver for these fees, which can be significant in cost, establishes a precedent for future requests for security video surveillance footage that will result in financial harm.

[37] The appellant did not provide representations on the hospital’s refusal to waive the remainder of the fee.

[38] I have reviewed the considerations relied upon by the hospital and I find that it properly exercised its discretion in response to the fee waiver request. Based on its submissions, it properly considered the purpose of PHIPA and sought to balance the complainant’s right to access his personal health information with other considerations, such as the significant financial cost of waiving the fee.

[39] I find that the hospital did not exercise its discretion to not fully waive the fee for any improper purpose or in bad faith and, particularly considering that it waived a substantial portion of the fee, that there is no evidence that it failed to take relevant factors into account or that it considered irrelevant factors. Accordingly, I uphold the hospital’s exercise of discretion in refusing to further waive the fee.

NO ORDER:

I dismiss the complaint.

Original Signed by:		December 10, 2024
Chris Anzenberger
Adjudicator