“

PHIPA DECISION 271

File HI19-00038

Dr. Rita Kilislian/Kawartha Endodontics

Andrew Curnew

February 3, 2025

Summary: This decision concludes an IPC-initiated file arising from allegations made by two different information sources about unauthorized disclosures of personal health information by the respondents Dr. Rita Kilislian, the owner and operator of Kawartha Endodontics (the clinic), and/or Andrew Curnew, her former spouse. Some of the allegations concern the dissemination of a memo authored by Andrew Curnew in the context of a Health Services Appeal and Review Board proceeding in which he represented Dr. Kilislian. The respondents denied the allegations, including based on claims the information in the memo is not personal health information and is information available in the public domain.

The IPC conducted a self-initiated review of the matter under the Personal Health Information Protection Act, 2004  (PHIPA ). During the IPC review, the Health Professions Appeal and Review Board (HPARB) issued decisions on complaints made to Dr. Kilislian’s regulatory college about some of the same events at issue in the IPC review. The IPC considered the impact the HPARB decisions ought to have on its disposition of the allegations made to the IPC. The IPC also addressed in a private interim decision Andrew Curnew’s request that the IPC disclose to him the identities of the information sources to the IPC, and the information provided by them.

In this final decision, the adjudicator declines to issue orders in respect of three of the allegations made to the IPC, in view of other proceedings that appropriately addressed the same matters. With respect to the remaining allegation—concerning the posting of personal health information on social media—the adjudicator describes the steps taken during the review to seek the respondents’ cooperation in containing a potential contravention of PHIPA . While the adjudicator is unable in the circumstances to make finding on whether Andrew Curnew made the social media posts at issue, she orders Dr. Kilislian to take all steps that are reasonable in the circumstances to remedy the potential contravention of PHIPA . This includes retrieving from Andrew Curnew any personal health information still in his possession for which there is no authority under PHIPA  for his ongoing use or disclosure of that information.

Statutes Considered: Personal Health Information Protection Act, 2004,  SO 2004, c 3, Sch A, sections 2  (definitions), 3(1), 4 (definition of “personal health information”), 7(1)(b)(ii), 12, 17, 29, 30(2), 49, 58(1), 61(1), and 68(3) and (4); Regulated Health Professions Act, 1991 , SO 1991, c 18, section 36(3) .

Decisions Considered: PHIPA Decisions 17, 80, 82, and 192.

Cases Considered: Baker v. Canada (Minister of Citizenship and Immigration), 1999 CanLII 699 (SCC).

OVERVIEW:

[1] This decision concludes a self-initiated review by the Office of the Information and Privacy Commissioner of Ontario (IPC) into allegations of privacy breaches by Dr. Rita Kilislian, the owner and operator of Kawartha Endodontics (the clinic), and/or Andrew Curnew, the former spouse of Dr. Kilislian. The IPC received these allegations from two separate information sources. Some of the allegations concern a memo authored by Andrew Curnew in the context of a tribunal hearing in which he represented Dr. Kilislian. The memo, which contains information about a named patient of the clinic, was later emailed to various area dental practices through a clinic email account, and posted on social media. Another allegation involves a claim that Andrew Curnew offered to disclose to a reporter the personal health information of clinic patients.

[2] After receiving these allegations, the IPC opened the present file to address potential contraventions of the Personal Health Information Protection Act, 2004  (PHIPA ), and informed Dr. Kilislian and Andrew Curnew of the allegations. Each denies that the events at issue qualify as privacy breaches, including based on claims the memo does not contain personal health information. Each also denies responsibility for disseminating the memo by email or on social media.

[3] As the matter could not be satisfactorily resolved at the investigation stage, the file proceeded to adjudication. At this stage, I decided to conduct an IPC-initiated review of the matter under section 58(1)  of PHIPA . Section 58(1) permits the IPC to conduct a review of any matter, on its own initiative, where it has reasonable grounds to believe that a person has contravened or is about to contravene a provision of PHIPA  or its regulations.

[4] During the review, I shared with Dr. Kilislian and Andrew Curnew my understanding of the facts, the specific allegations made against them, and some preliminary views based on the information before me and potentially relevant sections of PHIPA . I invited each of them to address these matters in written representations to me, which they did. I also invited each of them, and the information sources,[1] to address two additional matters that arose during the course of my review. These are the impact, if any, that certain decisions of a review board released during the review ought to have on my consideration of the issues under PHIPA ; and a procedural request made by Andrew Curnew for disclosure of the identities of the information sources to the IPC, along with the information provided by them.

[5] During the review, I issued a private interim decision to the parties on Andrew Curnew’s disclosure request, which I ultimately granted in part. I briefly summarize the request, and my decision on disclosure, below.

[6] I also briefly address below some claims of bias made by Andrew Curnew during the course of the IPC process. As I explain, I find no reasonable basis for these claims, and I have declined Andrew Curnew’s request that I recuse myself from this matter.

[7] In the discussion that follows, I conclude that some discrete allegations at issue in this review have been appropriately dealt with by means of another procedure—namely, proceedings before the review board—and I exercise my discretion not to issue an order in respect of those allegations.

[8] On the remaining allegation—concerning postings of personal health information on social media—I explain why I am unable to make a finding, on a balance of probabilities, about who made the postings at issue. After outlining the steps taken during the review to address the issues raised by this allegation, I conclude it is necessary to issue certain orders to Dr. Kilislian to remedy a potential contravention of PHIPA , and to help ensure the respondents’ compliance with PHIPA  in future.

BACKGROUND:

[9] In late 2019, the IPC received an email and attachments from an information source (Source 1), alleging that Dr. Kilislian and Andrew Curnew had breached the privacy of a patient of Dr. Kilislian’s clinic. Among other allegations, Source 1 claimed that Andrew Curnew improperly disclosed the patient’s personal health information in the context of a tribunal proceeding involving Dr. Kilislian, and had also emailed that patient’s information to various dental practices outside that proceeding.

[10] Based on the nature of the allegations and the professional capacity in which Source 1 provided this information, among other considerations, the IPC opened this file as an IPC-initiated matter. Later, a representative for a second information source (Source 2) contacted the IPC to provide additional information regarding the allegations made by Source 1. Source 2 also provided information about other potential contraventions of PHIPA  by one or both of Dr. Kilislian and Andrew Curnew.

[11] The allegations made by the two information sources are as follows:

1. That Andrew Curnew inappropriately disclosed the personal health information of a named clinic patient (to whom I will refer in this decision as Patient X) to the Health Services Appeal and Review Board (HSARB);
2. That Andrew Curnew offered to disclose the personal health information of various clinic patients to a member of the media;
3. That Andrew Curnew inappropriately disclosed Patient X’s personal health information to various dental practices by email; and
4. That Andrew Curnew inappropriately disclosed Patient X’s personal health information on two different social media sites.

[12] Upon opening the file, the IPC notified Dr. Kilislian of the allegations and asked her to address a number of questions about them. The IPC received responses to these questions from Andrew Curnew. At a later stage, the IPC sought additional submissions from Dr. Kilislian, and received separate responses from Dr. Kilislian, counsel for Dr. Kilislian, and Andrew Curnew. Based on the information obtained at this stage, the IPC added Andrew Curnew as a second respondent in this matter, and transferred the file to the adjudication stage.

[13] At the adjudication stage, I conducted a review, during which I sent each respondent a Notice of Review setting out, among other things, my understanding of the facts, details of the allegations made against them, potentially relevant sections of PHIPA , and some preliminary views I had formed based on the information before me. I later sent each respondent a Supplementary Notice of Review setting out some further preliminary views on Allegation #4 (about the disclosure of personal health information on social media), and I requested representations from them on some proposed courses of action to remedy a potential ongoing contravention of PHIPA .

[14] During the review, I became aware of two recent decisions of a review board (the Health Professions Appeal and Review Board) that may relate to one or more of the allegations at issue in the present matter before the IPC. I also received from Andrew Curnew a request that I disclose to him the identities of the two information sources to the IPC, along with copies of documentation provided by them. I invited representations from the respondents, as well as from the information sources, on these two additional matters.

[15] During the review, I received representations on the issues from a representative of the respondent Dr. Kilislian. I also received representations from counsel for one of the information sources on the two additional matters on which I had invited comment.

[16] The respondent Andrew Curnew made extensive representations on his own behalf. In addition to addressing the issues under review, he made numerous unsolicited submissions on a variety of topics. These include allegations of conflict of interest or bias on the part of the IPC, and a request for disclosure relating to the two information sources to the IPC. I will briefly address each item in turn.

Andrew Curnew’s allegations of conflict of interest or bias

[17] Throughout the IPC process, Andrew Curnew raised a number of concerns about the IPC’s handling of this matter. Among other things, he asserted that the allegations made against him and Dr. Kilislian are frivolous and vexatious and an abuse of process, motivated by animus on the part of the information sources. He asserted that this IPC proceeding into allegations made by the information sources is not in the public interest, and he requested on multiple occasions that the IPC dismiss the allegations or otherwise discontinue its review with an apology and costs to the respondents. His extensive submissions to the IPC included court filings and other documentation in a variety of legal proceedings in which he and/or Dr. Kilislian are involved, some of which also involve parties who he alleges are the information sources in this IPC file. Among other claims, he says these parties have engaged the IPC process to criminally harass him and Dr. Kilislian.

[18] During the review, Andrew Curnew commenced a civil claim against the IPC and a number of other parties, alleging, among other things, conspiracy to harm him, malicious prosecution, and fraudulent investigation. This claim was later dismissed by the court. Before and after the dismissal of the claim, he alleged that the IPC inappropriately aligned itself with some of other defendants named in his claim. He also made a more specific allegation that my adjudication of the present file could be inappropriately affected by his civil claim against the IPC, including by undue influence of me by IPC staff involved in the litigation. As a remedy he proposed that the adjudication be transferred to a third-party investigation company. Later, he requested that I recuse myself from this file because my surname is the name of a company in which he has business interests, and, he says, a public decision against him issued in my name could cause public confusion that could have negative market impacts.

[19] Andrew Curnew made numerous other statements in support of his claims of conflict of interest or bias on the part of particular individuals and/or the IPC. While I have considered all his submissions, I have summarized the most pertinent of these above. I find it unnecessary to set the others out here. In summary, Andrew Curnew asserts that the allegations made to the IPC are unfounded, including because they were made by individuals motivated to harm him, and that in the interests of impartiality and transparency, and to avoid a miscarriage of justice, I ought to be removed as the adjudicator in this matter.

[20] During the review, I informed Andrew Curnew of my view that he had not established a reasonable basis for his claims, and that I would not be recusing myself from this matter. I confirm this decision here.

[21] It is a well-established principle of administrative law that there is a presumption, absent evidence to the contrary, that an administrative decisionmaker will act fairly and impartially. The onus of demonstrating conflict of interest or bias lies on the person who alleges it, and mere suspicion is not enough.[2] Furthermore, while actual bias need not be proven, the threshold for establishing a reasonable apprehension of bias is a high one.[3]

[22] In assessing whether given circumstances give rise to a reasonable apprehension of bias, the IPC has adopted the test applied by the courts.[4] Specifically, in deciding whether there is a reasonable apprehension of bias on the part of the IPC, the test is whether a well-informed person, considering all the circumstances, could reasonably perceive bias on the part of the decisionmaker. The test is not whether the “very sensitive or scrupulous conscience” would perceive bias. To be reasonable, the grounds for the apprehension must be “substantial.”[5]

[23] A “conflict of interest” is commonly understood as a situation in which a person has a private or personal interest sufficient to appear to influence the objective exercise of the person’s official duties.[6] In considering whether there is a real or perceived conflict of interest on the part of institutional staff making decisions on access-to-information requests, the IPC has considered factors including: whether the decisionmaker has a personal or special interest in the records at issue; and whether a well-informed person, considering all the circumstances, could reasonably perceive a conflict of interest on the part of the decisionmaker.[7]

[24] With respect to Andrew Curnew’s claims about the motivations of the information sources and the credibility of the allegations made by them, I considered these in initially deciding whether to conduct a review of this matter. The IPC has a mandate under PHIPA  to review any matter where it has reasonable grounds to believe there has been or will be a contravention PHIPA . I found there were such grounds here. I have also considered all of Andrew Curnew’s submissions, including his claims about the motives of the information sources, where relevant in deciding the merits of the privacy breach allegations at issue in this review.

[25] With respect to Andrew Curnew’s claims about bias or conflict of interest on the part of the IPC, I do not accept the general assertion that the IPC’s investigation and adjudication of these allegations (instead of a dismissal of these allegations as frivolous or vexatious at an earlier stage) demonstrates bias or gives rise to a reasonable apprehension of bias. The IPC decided to review the allegations after determining that there were reasonable grounds to do so. The IPC’s having proceeded in the manner that it did does not establish unfairness or partiality on the part of the IPC.

[26] I have also considered Andrew Curnew’s arguments against my specific involvement in this file. These too fail to establish a conflict of interest or bias, or a reasonable apprehension of either of these. His claims, which are speculative at best, fail to displace the presumption that I, as the decisionmaker, will act fairly and impartially in this matter.

[27] As Andrew Curnew has not established a reasonable basis for his claims of conflict of interest or bias on my part, I will not further consider them in this decision.

Andrew Curnew’s request for disclosure

[28] During the review, Andrew Curnew asked the IPC to provide him with “the name of the complaint and the disclosure for that complainant.” I interpreted his request, made in emails to IPC staff, to be a request for disclosure of the identities of the two sources who provided information to the IPC that resulted in the opening of the present file, along with disclosure of the documentation these sources provided.

[29] After inviting and receiving some submissions from the respondents and information sources on the disclosure request, I issued a private interim decision to the parties. My decision was to grant the disclosure request in part. Specifically, I granted Andrew Curnew’s request for the identity of and copy of documentation submitted to the IPC by one information source (Source 1). I decided to withhold the identity of the second information source (Source 2), and to disclose a severed version of the documentation provided by Source 2, redacted to remove any information that would reveal Source 2’s identity.

[30] I explained to the parties that my decision on the disclosure request was made in consideration of the Supreme Court of Canada’s decision in Baker v. Canada (Minister of Citizenship and Immigration)[8] and PHIPA Decision 192.

[31] In Baker, the Supreme Court addressed the duty of procedural fairness in the context of administrative proceedings whose decisions affect the rights, privileges, or interests of an individual. In that decision, the Court identified a non-exhaustive list of factors relevant to determining what procedural rights the duty of fairness requires in a given set of circumstances. Among others, these factors include: the nature of the decision being made and the process followed in making it; the nature of the relevant statutory scheme; the importance of the decision to the affected individuals; and the choices of procedure made by the decisionmaking body. In PHIPA Decision 192, the IPC applied the factors established in Baker to determine the requirements of procedural fairness in addressing an affected person’s request for the disclosure of certain documents in a review under PHIPA .

[32] I found that many of the considerations set out in PHIPA Decision 192 were applicable in making my decision on the disclosure request in the present file. Among other factors, I considered that the matter before me concerns allegations that one or both respondents inappropriately disclosed the personal health information of a specific clinic patient through various avenues, including on social media. I considered that Andrew Curnew is a respondent in this matter, who is entitled to sufficient information to know and to respond to the case made against him. I also considered that Andrew Curnew has not been identified as the health information custodian in this matter, but rather potentially as an agent or recipient of the personal health information at issue (as I discuss at Issue B, further below).

[33] I considered the IPC’s mandate under PHIPA  to administer and enforce rules concerning the confidentiality and protection of privacy in respect of personal health information, and the broad discretion conferred to the IPC to develop its own procedures in doing so.[9] I also considered the potential relevance of particular sections of PHIPA  that address the confidentiality of information that comes to the knowledge of the IPC in the exercise of its functions under PHIPA .[10] More broadly, I considered that the IPC must interpret its governing statute and exercise its discretion with respect to the procedures it chooses in light of the common law right to procedural fairness.[11]

[34] In my interim decision to the parties, I explained why and how I applied these factors to arrive at my decision to disclose to Andrew Curnew the identity of and relevant documents supplied by Source 1, and a severed copy of relevant documents supplied by Source 2, redacted to withhold Source 2’s identity. I explained why I was satisfied that withholding Source 2’s identity does not prejudice Andrew Curnew’s ability to know and to respond to the allegations made against him, including because I had already provided him (and the other respondent) with detailed information about each of the allegations, among other relevant information.

[35] I noted in particular that the identity of the individual whose personal health information is at issue in this review (i.e., the clinic patient to whom I refer in this decision as Patient X) had not been withheld from the respondents, and that each respondent had submitted representations in the review identifying Patient X by name.

[36] In these circumstances, I decided that disclosure of the requested documents, severed in the manner described, was relevant, and proportionate, to meet the requirements of procedural fairness to Andrew Curnew.

[37] After notifying the information sources of my decision, I provided all the parties with my interim decision on the disclosure request, and I gave Andrew Curnew the disclosure as described. I then proceeded with the review. Throughout this process, the parties’ representations were shared in accordance with the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004.

[38] This final decision disposes of the substantive allegations made against the respondents.

ISSUES:

1. Is the information at issue “personal health information” within the meaning of PHIPA ?
2. At the relevant times, what was Andrew Curnew’s status in relation to the personal health information at issue?
3. What is the impact of the 2022 HPARB decisions on my disposition of the allegations in this review?
4. Does Allegation #4 establish a contravention of PHIPA ? If so, what is the appropriate remedy?

DISCUSSION:

[39] One of the purposes of PHIPA  is to protect the confidentiality of personal health information and the privacy of the individuals to whom the information relates. PHIPA  achieves this purpose by, among other things, requiring that all collections, uses, and disclosures of personal health information be made with the appropriate consent, or otherwise be authorized by PHIPA  (section 29 ). PHIPA  also imposes duties on health information custodians to take reasonable steps to protect personal health information in their custody or control (section 12).

[40] During the review, I shared with the respondents my preliminary view that Dr. Kilislian is a “health information custodian” within the meaning of PHIPA  for the purposes of this review. That term is defined in section 3(1)  of PHIPA  to mean a person or organization who has custody or control of personal health information as a result of or in connection with performing certain powers or duties. Specifically, it was my preliminary view that Dr. Kilislian, a member of the Royal College of Dental Surgeons of Ontario and operator of the clinic, is a health information custodian as a “health care practitioner” and/or the person who operates the clinic.[12]

[41] The respondents did not dispute my preliminary view, and I confirm it here. Dr. Kilislian is a health information custodian with duties under PHIPA  to protect personal health information in her custody or control, as discussed further below.

A. Is the information at issue “personal health information” within the meaning of PHIPA?

[42] A key matter of dispute in this review is whether the information at issue in the allegations is “personal health information” within the meaning of PHIPA . If, as the respondents assert, the information is not personal health information, the rules and protections in PHIPA  do not apply.

[43] “Personal health information” is defined in section 4  of PHIPA  to mean, generally, identifying information about an individual that relates to certain health-related topics, including an individual’s physical or mental health, or the providing of health care to the individual.[13] It can also include information about an individual that is not specifically health-related, if it appears with together with health-related information of the individual.[14]

[44] As noted, the allegations at issue in this review are the following:

1. That Andrew Curnew inappropriately disclosed the personal health information of Patient X to the Health Services Appeal and Review Board (HSARB);
2. That Andrew Curnew offered to disclose the personal health information of various clinic patients to a member of the media;
3. That Andrew Curnew inappropriately disclosed Patient X’s personal health information to various dental practices by email; and
4. That Andrew Curnew inappropriately disclosed Patient X’s personal health information on two different social media sites.

The HSARB memo contains personal health information within the meaning of PHIPA (Allegations #1, 3, and 4)

[45] Allegations #1, 3, and 4 concern the dissemination of a memo authored by Andrew Curnew and addressed to HSARB, in which Andrew Curnew identifies himself as the clinic’s representative in the matter before HSARB.[15] The matter before HSARB involved Dr. Kilislian’s challenge to certain orders made by public health officials against Dr. Kilislian and the clinic.

[46] Andrew Curnew’s memo to HSARB, made in the context of that HSARB proceeding, contains a number of details about a different, concluded, proceeding held before a different body, the Health Professions Appeal and Review Board (HPARB).[16] The concluded HPARB proceeding arose from an applicant’s request that HPARB review a decision made by Dr. Kilislian’s regulatory college in a complaint about the conduct and actions of Dr. Kilislian in providing care to a specific patient.

[47] Andrew Curnew’s memo to HSARB refers to that prior HPARB proceeding, alleging, among other things, that the applicant and the patient in the HPARB matter (both of whom he identifies by name in his memo, though neither is identified by name in the public HPARB decision) are friends with the public health official who later made the order at issue in the HSARB proceeding. His memo includes a number of statements about the patient involved in the HPARB matter (who is Patient X in this review), including about Patient X’s past health experiences and health conditions, and that Patient X was a patient of the clinic. The HSARB memo also indicates that it includes (as an attachment) a report by a specialist that Dr. Kilislian submitted to HPARB for the purpose of that proceeding. The specialist’s report contained detailed information about Patient X, including the specialist’s opinions about a specific health condition of Patient X, and its causes.

[48] The respondents in the present review deny that Andrew Curnew’s memo contains personal health information within the meaning of PHIPA . This is because they assert that all the information contained in the memo is “public knowledge.”

[49] In my Notice of Review to the respondents, I said that I understood their claim to be that the information in the memo is already publicly available in decisions made by HPARB and/or HSARB. I asked the respondents to support their claim by identifying each specific piece of information in the memo that is “public knowledge,” and, for each of piece of information, to identify the public source.

[50] I also invited the respondents to consider and comment on the IPC’s broad interpretation of “personal health information” in previous decisions, including in PHIPA Decision 17. I noted in particular that in PHIPA Decision 82, the IPC confirmed that personal health information may include information about an individual that is already in the public domain in the form of a public tribunal decision. In PHIPA Decision 82, the IPC found that that a custodian’s statements consisting only of information already known to the public, via the tribunal decision, nonetheless qualified as personal health information for the purposes of PHIPA .

[51] The respondents maintain that the HSARB memo does not contain personal health information.

[52] Andrew Curnew asserts that all the information in his memo is available publicly, including through the HPARB decision, CanLII,[17] Google, and “members of the public.” Though he was asked to, he did not identify the specific information in the memo that could be traced to any of these sources, nor provide links to or other evidence of the public availability of this information.

[53] Dr. Kilislian adopts Andrew Curnew’s representations. She says all the information in the memo is part of a publicly documented complaint, “available on CanLII for the world to see,” but she fails to provide any specific evidence for this claim. She additionally proposes that parties who make public complaints (e.g., to a health professional’s regulatory college) waive their privacy rights in respect of their medical information, and cannot blame others for sharing this information in other public forums.

[54] I find the memo contains Patient X’s personal health information within the meaning of PHIPA .

[55] It is undisputed that the memo contains information about Patient X, whom Andrew Curnew identifies by name, that relates to her physical health and to her health care, including the identification of the clinic as a provider of health care to her. This is personal health information of the type specified in the definition at section 4(1)  of PHIPA .

[56] The memo is also replete with other identifying information of Patient X that is not specifically health-related information of the type listed in section 4(1), but that nonetheless qualifies as personal health information because it is also contained in the memo.[18] This includes details such as Patient X’s occupation, and Andrew Curnew’s speculations about Patient X’s personal relationships and other activities.

[57] I see no basis in PHIPA  for a claim that Patient X’s involvement in a proceeding that led to a publicly available decision means this information no longer qualifies as personal health information protected by PHIPA .[19] I note again here that neither respondent provided evidence to support their repeated assertions that all the information about Patient X in the memo is publicly available. I also note again that the public decisions to which the respondents refer do not identify Patient X by name. Moreover, and as I advised the respondents during the review, the IPC has explicitly found that the availability of information in the public domain does not preclude a finding that the information is personal health information subject to PHIPA .[20]

[58] As I have found the memo contains personal health information within the meaning of PHIPA , Allegations #1, 3, and 4 (about the dissemination of the memo by one or both respondents) are subject to PHIPA .

[59] Allegation #4 also includes an allegation about a different social media posting, made on a different social media site, that does not reproduce the HSARB memo. This posting contains negative comments about Patient X and other individuals, who are identified by name, and includes reference to a health condition. While the posting does not attribute the health condition to any particular one of the named individuals, the health condition is the same one that Andrew Curnew attributes to Patient X (identified by name) in his HSARB memo. In the circumstances, I am satisfied that this posting also contains personal health information of Patient X. The part of Allegation #4 that concerns this other social media posting is also subject to PHIPA .

The offer to share clinic records with a reporter (Allegation #2)

[60] Allegation #2 is an allegation that Andrew Curnew offered to disclose the personal health information of clinic patients to a reporter at a media event held at the clinic. This allegation arises from a short passage in a local newspaper article about the event. In this passage, the reporter states that Andrew Curnew offered the reporter “a chance to look at patient records, so long as it was not recorded.” (The reporter says he declined the offer.)

[61] The next day, the online version of the article was amended with a clarification that read, in part, as follows:

Curnew initially offered the reporter an opportunity to view all of the clinic’s records, which would include patient records. He has since clarified he is not offering patient records, but records of sterilization for patients.

[62] The respondents maintain that Andrew Curnew did not disclose or offer to disclose any personal health information of clinic patients. They rely on the clarification posted online, explaining that Andrew Curnew misspoke at the event and never intended to offer to share patient records. They explain that the “sterilization records” that Andrew Curnew meant to refer to do not contain any patient information. Dr. Kilislian provided the IPC with copies of these records.

[63] Based on the information before me, I shared with the respondents my preliminary view that the records at issue in this allegation do not contain personal health information within the meaning of PHIPA . However, because of some developments that I discuss further below, it is unnecessary for me to make a definitive finding on this matter, and I decline to do so.

B. At the relevant times, what was Andrew Curnew’s status in relation to the personal health information at issue?

[64] In addition to covering health information custodians like Dr. Kilislian, PHIPA  contains rules about the handling of personal health information by persons who act on behalf of or who receive personal health information from a custodian. These persons may be “agents” of the custodian, or “recipients” of personal health information from the custodian.

[65] An agent is a person who acts on behalf of the custodian, and not for the agent’s own purposes, with respect to personal health information.[21] When an agent handles personal health information on behalf of a custodian, the agent must comply with PHIPA and with the information practices established by the custodian in respect of personal health information (section 17). Custodians remain responsible for personal health information handled by their agents [sections 17(1) and 17(3)(b)].

[66] A person who is neither a custodian nor an agent may also be subject to PHIPA  in respect of personal health information that the person receives from the custodian.[22] In general, recipients of personal health information may use and disclose that information only for the purpose for which the custodian was authorized to disclose the information to them under PHIPA , or for the purpose of carrying out a statutory or legal duty (section 49(1)  of PHIPA ).[23]

[67] Both agents and recipients are also subject to rules generally requiring that they handle no more personal health information than is reasonably necessary for the authorized purpose [sections 30(2) and 49(2)].

[68] I asked the respondents to explain whether Andrew Curnew was an agent of Dr. Kilislian, or a recipient of personal health information from her, for the purposes of PHIPA , at the time of the events at issue in this review.

[69] Andrew Curnew says that he is a regulatory consultant and landlord of the building in which the clinic is located, and in this context represented Dr. Kilislian in the HSARB proceeding for which he drafted the memo at issue in this review. He denies that he has or had any access to the clinic or to clinic records in this limited role. He also says that during some of the events at issue in this review, there was a restraining order against him that prevented him from contacting Dr. Kilislian, the clinic, or her patients.

[70] Dr. Kilislian adopts Andrew Curnew’s representations on this issue. She says Andrew Curnew has no access to her patient records, and that his actions do not relate in any way to her or to the clinic. She says in fact she sought a court order to ensure she would not be held responsible for his actions.

[71] In seeking representations from the respondents on this issue, I asked them to explain, among other things, where Andrew Curnew obtained the information (including the personal health information of Patient X) that is contained in his memo to HSARB, and whether his uses and disclosures of that information were made in accordance with PHIPA .

[72] The respondents do not address this question directly, except to repeat their assertions that the memo does not contain personal health information, and/or consists exclusively of information that is already in the public domain, so that PHIPA  does not govern its use or disclosure. I have already rejected those arguments, above.

[73] In the circumstances, I find it unnecessary to make a definitive finding on whether Andrew Curnew was an agent or a recipient in handling personal health information for the purposes of the HSARB proceeding. In either case, it is undisputed that he prepared the memo for HSARB in his role as Dr. Kilislian’s representative in that proceeding. Whether as her agent under PHIPA  or as the recipient of information for that specific purpose, Andrew Curnew was subject to the rules in PHIPA  requiring that his use and disclosure of that information for this purpose be authorized by PHIPA—for example, under provisions that address the handling of personal health information in a proceeding in which the custodian is a party.[24]

[74] I recognize that Dr. Kilislian asserts that at least some of the information in Andrew Curnew’s memo did not originate from her clinic records and instead came from public sources. For example, Dr. Kilislian says she would not have maintained notes in her clinic files about health conditions that Patient X developed after the dental procedure at the clinic, because Dr. Kilislian is an endodontist and not a medical doctor and would not keep records about patient health matters that are non-dental in nature. I understand Dr. Kilislian to be making this claim in support of an argument that Andrew Curnew obtained from public sources (and not from her) certain information that appears in his memo, so that she should not be held responsible under PHIPA  for any inappropriate dissemination of that information. This claim may be relevant because the definition of “disclose” in PHIPA  refers to a custodian’s or a person’s making available or releasing to another person personal health information in the custodian’s or person’s custody or control.[25],[26]

[75] As I noted above, the respondents have not provided evidence for their claim that all the personal health information in the memo was solely derived from public sources. For instance, while the HPARB decision relied on by the respondents describes a certain health condition experienced by a patient after a clinic procedure, the public decision does not attribute this condition to a specific named individual, as Andrew Curnew’s memo does. His memo also contains numerous other details about Patient X (including non-health information, which also qualifies as Patient X’s personal health information, as I have explained above) that is not contained in the public HPARB decision.

[76] Thus while the IPC has previously found that facts contained in a publicly available tribunal decision are not in the custody or control of a custodian (so that the custodian’s mere repetition of those facts did not qualify as a disclosure within the meaning of PHIPA ),[27] this finding has no application to the situation before me. Andrew Curnew’s memo contains details that go well beyond what is contained in the public HPARB decision the respondents directed me to, and, as I have noted, they have not identified any other specific public sources for the information in the memo. In any event, because of the manner in which I dispose of the specific allegations concerning the memo (below), it is unnecessary for me to make a finding on Dr. Kilislian’s claim about her custody or control of this one specific piece of information about Patient X.

C. What is the impact of the 2022 HPARB decisions on my disposition of the allegations in this review?

[77] During the review, I became aware of two related HPARB decisions issued during the review that may be relevant to this matter before the IPC. (These two related HPARB decisions, which were issued in December 2022, are distinct from the HPARB decision I discussed above, including at paragraphs 46-47.) The 2022 HPARB decisions arose from two complaints made to Dr. Kilislian’s regulatory college about certain conduct and actions of Dr. Kilislian, including some alleged disclosures of patient information by Dr. Kilislian and/or Andrew Curnew.

[78] I informed the respondents and the information sources of my preliminary view that the 2022 HPARB decisions may relate to some of the allegations at issue in the present matter before the IPC, and I invited their representations on the relevance, if any, of these decisions on the IPC’s review of this matter.

[79] In seeking representations on this topic, I drew the parties’ attention to PHIPA Decision 80, in which the IPC considered whether to proceed with a privacy complaint that had already been the subject of proceedings before a custodian’s regulatory college and the college’s review body. In PHIPA Decision 80, the IPC concluded that despite a statutory prohibition on the admissibility of certain information related to health regulatory proceedings,[28] the IPC can appropriately take notice of the existence of the prior proceedings, and of the issues considered in those proceedings, for the limited purpose of deciding whether or not to conduct a review of the matter under PHIPA .[29]

[80] Unlike the situation in PHIPA Decision 80, the matter before me did not arise from a complaint under PHIPA . In the present file, the IPC had also commenced a self-initiated review. However, PHIPA Decision 80 describes certain considerations of judicial finality, economy, and fairness in the exercise of the IPC’s discretion not to proceed with a matter, which may be relevant in the current circumstances. I thus invited the parties to make representations to me on the impact the 2022 HPARB decisions ought to have on my review under section 58(1) of the allegations at issue in this file, and/or on my disposition of the review (or part of the review) pursuant to section 61  of PHIPA .

[81] The respondents did not directly address this issue. However, counsel for Source 2 provided representations in which she confirms that some of the issues addressed in the 2022 HPARB decisions are the same as those before me in the present matter. Counsel for Source 2 invites me to consider the HPARB’s findings as evidence in making my own determinations on these same allegations. Instead, I find this overlap is a basis for me to exercise my discretion under PHIPA  to conclude my review of certain allegations without issuing an order.[30]

[82] Allegations #1 and 3 before the IPC involve the memo drafted by Andrew Curnew for the HSARB proceeding in which he acted as Dr. Kilislian’s representative. Allegation #1 is that the memo itself constitutes an improper disclosure of personal health information to HSARB, while Allegation #3 concerns the distribution of that memo to various dental practices by email. Details contained in the 2022 HPARB decisions confirm that the same HSARB memo was the basis for complaints to Dr. Kilislian’s regulatory college about potential violations of a patient’s privacy. The complaints considered by the college, and later by HPARB, included allegations that Dr. Kilislian and Andrew Curnew improperly included confidential personal health information in the memo to HSARB for the HSARB proceeding, and later distributed that memo to various area dental practices by email.

[83] Allegation #2 before the IPC is the allegation that Andrew Curnew offered to disclose the personal health information of clinic patients to a reporter at a media event held at the clinic. This same allegation is addressed in one of the 2022 HPARB decisions.

[84] Having regard to the factors outlined in PHIPA Decision 80, I conclude that Allegations #1, 2, and 3 have been appropriately and completely dealt with by means of another procedure, and that fairness militates in favour of concluding the IPC review on these allegations without an order.

[85] It is clear that the substance of these allegations is the same as the matters considered by Dr. Kilislian’s regulatory college and HPARB. It is undisputed that these bodies had the authority to consider the matters under their governing legislation. There is no claim that these those prior proceedings were procedurally unfair to the parties.

[86] I acknowledge and agree with the statement in PHIPA Decisions 80 and 176 about the differences in the purpose and scope of proceedings between health regulatory colleges and HPARB, and those before the IPC, in light of the bodies’ different mandates, and the differences in the available outcomes and their purposes. As noted in those decisions, dispositions issued by health regulatory colleges are generally directed at improving an individual member’s conduct or future practice, or disciplining the member where appropriate, while the IPC’s focus is on addressing systemic issues arising from complaints.[31]

[87] Here I find these differences present no reason for the IPC to issue its own orders with respect to complaints already considered by the college and HPARB. These particular allegations do not in my view disclose systemic issues that warrant a re-examination of the same events by the IPC. And considerations of finality, economy, and fairness, including the interest in avoiding inconsistency, weigh in favour of concluding the review without an IPC order on these same allegations.

[88] For these reasons, I decline to issue orders under PHIPA  concerning Allegations #1, 2, and 3.

D. Does Allegation #4 establish a contravention of PHIPA? If so, what is the appropriate remedy?

[89] The remaining allegation for me to consider is Allegation #4, concerning the posting of Patient X’s personal health information on two different social media sites. As I explain, only the posting on social media site #2 remains active as of the date of this decision.

[90] The IPC was provided with screenshots of postings made on three different dates to social media site #1 by a user with a profile name and handle that contain variations of Andrew Curnew’s name. The screenshots showed postings that reproduced pages of Andrew Curnew’s HSARB memo. The posted excerpts of the memo contained information about Patient X and other individuals, including, among other things, details of Patient X’s health status and health conditions.

[91] At some point, the postings to social media site #1 were removed, and the user’s account deleted.

[92] Allegation #4 also concerns a posting made to social media site #2, by a user with a name that is a variation of Andrew Curnew’s name. The posting, which remains active at the time of this decision, contains negative comments about Patient X and other individuals, all of whom are identified by name. It includes reference to a specific health condition that is the same condition Andrew Curnew attributes to Patient X (whom he identifies by name) in his HSARB memo.

[93] The respondents deny any responsibility for the postings on either social media site. Dr. Kilislian says that to her knowledge, Andrew Curnew does not have accounts on either social media site. For his part, Andrew Curnew says he has a celebrity profile—as evidenced, he says, by his being certified on various social media platforms—and that because of his high profile, people open fake accounts on social media in his name.

[94] During the review, I shared with the respondents my preliminary view that the postings at issue in Allegation #4 could constitute disclosures of personal health information within the meaning of PHIPA . I noted that the postings contain information about Patient X that is also contained in Andrew Curnew’s memo to HSARB, which he prepared in his role as Dr. Kilislian’s representative. I noted that PHIPA  applies to disclosures of personal health information by a custodian’s agents, or by other individuals to whom a custodian discloses personal health information. I further noted the IPC’s powers to issue orders to address contraventions of PHIPA , and to direct those orders to a custodian, the custodian’s agents, and any other person whose activities are the subject of an IPC review.

[95] In a supplementary Notice of Review to the respondents, I observed that the postings on social media site #1 appear to have been removed. I told the respondents that these circumstances could be relevant in my deciding whether to issue an order or to take other steps if I were to find these postings contravened PHIPA . I said that in deciding whether or not remedies under PHIPA  are necessary, I may take into account that the postings appear to have been removed from social media site #1, and that there does not appear to be an ongoing violation of PHIPA .

[96] By contrast, I noted, the posting at issue on social media site #2 remains active. I shared with the respondents my preliminary view that this posting contains Patient X’s personal health information. I noted that the respondents had not, to that point, identified any statutory or legal authority for any disclosure of personal health information through the posting on social media site #2.

[97] In this supplementary Notice, I acknowledged the theory advanced by the respondents that the posting might have been made by another individual using Andrew Curnew’s name. I observed that under this theory, the posting would appear to be in violation of social media site #2’s community guidelines, which, among other things, prohibit impersonating other individuals or violating their privacy. I also noted that social media site #2’s terms of service give the site the right to remove a posting for violations of its community guidelines or terms of service, or for other reasons. I provided the respondents with links to these guidelines and terms of service for their information.

[98] I then invited the respondents to clearly state if their position is that the posting on social media site #2 was made by an impersonator. If so, I asked the respondents to explain what steps they had taken to contain or to remediate this situation. In particular, I asked each respondent to tell me:

• Whether the respondent had contacted social media site #2 to report a case of impersonation by another user and/or a violation of another individual’s privacy, in contravention of social media site #2’s community guidelines; and, in that case, to provide me with all relevant documentation of these contacts.
• If the respondent had not contacted social media site #2 to report this issue, to explain why not, and to state whether the respondent would do so now.
• Details of any other steps taken by the respondent to report a user impersonating Andrew Curnew, and/or to have social media site #2 remove the posting at issue, and to provide me with all relevant documentation of these steps.

[99] In response to this invitation, the respondents reiterate that Andrew Curnew is a certified influencer with verified accounts on other social media platforms (that are not social media sites #1 or 2). They propose that it follows that Andrew Curnew did not make the postings on social media sites #1 or 2 (i.e., because the postings at issue were not made by users with verified accounts like Andrew Curnew has on other platforms).

[100] Dr. Kilislian also says that Andrew Curnew provided proof to HSARB and HPARB that he did not make the posting on social media site #2. But neither she nor Andrew Curnew provide this proof to the IPC, or elaborate on the issues considered by those other bodies in proceedings concerning that posting.

[101] The respondents do not otherwise address my questions about any steps they have taken to remedy concerns they may have about another person’s impersonating Andrew Curnew on social media.

[102] I do not find credible the respondents’ explanation that another individual, motivated by Andrew Curnew’s celebrity, made postings in Andrew Curnew’s name espousing the same views that Andrew Curnew expressed in other forums, including in the HSARB proceeding in which he represented Dr. Kilislian. I do not reach the conclusion, urged by the respondents, that another individual is responsible for these postings of Patient X’s personal health information.

[103] In this case, however, I face the difficulty of being unable to make a finding, on a balance of probabilities, about who made the postings on social media sites #1 and 2. Nonetheless, in the circumstances, and given the contents of the postings, I make the following observations and comments.

[104] As I found above, the postings at issue contain personal health information of Patient X. They include information about Patient X that is contained in the memo Andrew Curnew wrote and sent to HSARB in his role as Dr. Kilislian’s representative before that body. Whether in that context Andrew Curnew received and disclosed personal health information as an agent or a recipient for the purposes of PHIPA , I have been given no evidence of his authority to further use and to disclose that information on social media. If Andrew Curnew made the social media postings at issue in Allegation #4, then Dr. Kilislian, as custodian, may also be responsible under PHIPA  for unauthorized uses and disclosures of her patient’s personal health information.

[105] As I noted, the postings on social media site #1, consisting of excerpts from Andrew Curnew’s HSARB memo, have since been removed, and the user account deleted. As a result, any contravention of PHIPA  through the postings does not appear to be an ongoing matter. In the circumstances, which include my inability to say who made the postings, I decline to make a finding on this aspect of Allegation #4. I note that one potential remedy for a contravention of PHIPA  would have been an order to the appropriate person to remove the postings at issue. Since the postings have already been removed, such an order would serve no purpose here.

[106] By contrast, the posting on social media site #2 remains active. I sought but did not receive the respondents’ cooperation in remedying the potential ongoing contravention of PHIPA . In deciding how to address this problem, I have considered that both respondents have disclaimed any responsibility for the posting, and the nature of the personal health information contained in the posting, among other factors.

[107] In the circumstances, I have decided it is appropriate to issue orders to Dr. Kilislian, in view of her broad duties as health information custodian to protect personal health information in her custody or control.

[108] I thus order Dr. Kilislian to take all steps that are reasonable in the circumstances to investigate and to remedy the potential ongoing contravention of PHIPA  represented by the posting on social media site #2. Reasonable steps include making all necessary inquiries to determine whether an agent or recipient of personal health information from Dr. Kilislian made the posting. If Dr. Kilislian determines that an agent or recipient made the posting, she must take all reasonable steps to contain and to remediate the privacy breach, including reporting the matter to the IPC.

[109] In addition, as there is no evidence Andrew Curnew has a continuing need for the personal health information he received for the purposes of representing Dr. Kilislian in the now-concluded HSARB matter, I order Dr. Kilislian to take all steps that are reasonable in the circumstances to retrieve that personal health information from Andrew Curnew. This includes obtaining Andrew Curnew’s confirmation (e.g., in the form of an affidavit) that he has securely disposed of this personal health information, including any copies, and no longer has this information in his possession.

[110] With these orders, I conclude the review.

ORDER:

For the foregoing reasons, I decline to issue an order with respect to Allegations #1, 2, and #3.

Pursuant to section 61(1)  of PHIPA , I make the following orders with respect to Allegation #4:

1. I order Dr. Kilislian to take all steps that are reasonable in the circumstances to investigate and to remedy the potential ongoing contravention of PHIPA  represented by the posting on social media site #2. This includes making all necessary inquiries to determine whether an agent or recipient of personal health information from Dr. Kilislian made the posting.
2. I order Dr. Kilislian to take all steps that are reasonable in the circumstances to retrieve from Andrew Curnew the personal health information he received in his role as Dr. Kilislian’s representative in the now-concluded HSARB proceeding. This includes obtaining confirmation from Andrew Curnew (e.g., in the form of an affidavit) that he has securely disposed of this information, including any copies, and no longer has this information in his possession.

Original Signed by:		February 3, 2025
Jenny Ryu
Adjudicator