PHIPA DECISION 274

Complaint HA22-00138

Queensway Carleton Hospital

February 25, 2025

Summary: An individual asked a hospital for records from her deceased father’s two-day hospital stay. After receiving records from the hospital, the complainant stated that additional records should exist.

In this decision, the adjudicator finds that the hospital conducted a reasonable search for records responsive to the request, as it is obliged to do under the Personal Health Information Protection Act, 2004. The adjudicator dismisses the complaint without issuing an order.

Statutes Considered: Personal Health Information Protection Act, 2004, c. 3, Sched A, as amended, sections 52(1), 53, and 54.

Decisions Considered: PHIPA Decisions 17, 18, and 152.

BACKGROUND:

[1] The complainant made a request under the Personal Health Information Protection Act, 2004 (PHIPA or the Act) for all information relating to her now-deceased father’s stay at the Queensway Carleton Hospital (the hospital). She specified the types of information that she was seeking in the request, which read as follows:

All information available as it pertains to hospital visit of [specified two days] - from initial ER assessment to stay in ER Observation A, Observation B and 4th floor, all test results (e.g. blood work, urinalysis, scans, COVID tests, etc.), medical imaging, consultation notes, doctors and nurses notes (patient monitoring - vitals measured and recorded like BP, urinary output, etc.), medication prescribed until end of [last day of visit].

[2] The hospital provided the complainant with an electronic set of documents in response and later sent the complainant an email confirming that she had been provided with full access to the records requested.

[3] The complainant filed an access complaint to the Information and Privacy Commissioner of Ontario (IPC) regarding this matter. The complainant’s position was that she did not receive all records responsive to her request. She stated that some records had been edited, and she asked to be given information about any edits. The complainant also asked to be provided with any late entries, and for the hospital to identify any redacted information.

[4] During mediation, the complainant claimed that additional records should exist, providing examples such as entries that she stated were missing from the records. After being told of these concerns, the hospital sent the complainant a letter addressing them. In that letter, the hospital stated that it had made efforts to search for the records the complainant identified as missing, including searching locations she had identified. The hospital described its search efforts and stated that it provided the complainant with a copy of the complete electronic health record as well as diagnostic images.

[5] The complainant subsequently raised a number of additional concerns, which the hospital addressed individually in a later letter. The complainant was not satisfied with the hospital’s responses.

[6] No further mediation was possible and the complaint was transferred to the adjudication stage of the complaint process, in which an adjudicator may decide to conduct a review under the Act. The adjudicator originally assigned decided to conduct a review of the complaint. She began the review by inviting and receiving representations from both parties.[1]

[7] The complaint was then transferred to me to complete the review and issue a decision. I reviewed the file and the parties’ representations. I then sought and received additional representations from both the hospital and the complainant.

[8] In this decision, I find that the hospital conducted a reasonable search for records responsive to the complainant’s request and dismiss the complaint.

PRELIMINARY ISSUE – SECTION 52(1) OF THE ACT

[9] Some months after all representations had been sought and received from both parties, the complainant submitted additional documentation directed at demonstrating that she was the substitute decision-maker and estate trustee for her late father. In these representations, the complainant stated that the hospital’s use of the terms “disclose” or “disclosure” brought into question whether the hospital’s decision was treating her request as a request for disclosure under Part IV of the Act, rather than an access request under Part V of the Act.

[10] I have reviewed the disclosure of personal health information provisions in Part IV of the Act; none appear to apply to the circumstances at hand.

[11] From my review, the complainant asserted that she made her request under the access provisions in section 52(1) of the Act. There is no dispute, and I find, that the complainant, as the estate trustee of her father, has a right of access to the records of personal health information of the deceased individual.[2] Based on the evidence before me, the hospital correctly treated this request as a request for access to personal health information under Part V of the Act.

DISCUSSION:

[12] The only issue before me is whether the hospital conducted a reasonable search for records responsive to the complainant’s request. In the circumstances of this complaint, I am satisfied the hospital did.

[13] Where a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53 and 54 of the Act. These sections address the written request an individual may make to a custodian to exercise a right of access to records, and the obligations on the custodian in responding to the access request. If I am satisfied that the search carried out was reasonable in the circumstances, the custodian’s decision will be upheld. If I am not satisfied, I may order further searches.

[14] In PHIPA Decisions 17, 18, and later decisions,[3] the IPC applied the principles outlined in orders addressing the issue of reasonable search under the Freedom of Information and Protection of Privacy Act [4] and its municipal counterpart.[5] These decisions establish that PHIPA does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show it made a reasonable effort to identify and locate responsive records.[6] To be responsive, a record must be “reasonably related” to the request.[7]

[15] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester (in this case, the complainant) still must provide a reasonable basis for concluding that such records exist.[8]

The hospital’s representations

[16] The hospital states that it conducted a thorough and reasonable search for the records requested.

[17] The hospital states that the original request asked for “[all] information available as it pertains to the hospital visit of [specified dates]” and notes that the complainant included the subject line of “Request for Health records – [name of complainant’s father] (deceased)”. Based on this, the hospital states that its response was directed at the health record information of that deceased patient.

[18] The hospital’s initial search was conducted by a Release of Information Officer within the Health Records Team. Following some clarification from the complainant, the hospital’s Director of Privacy reviewed the information provided and conducted an additional search. The hospital states that during this process, the hospital consulted a number of internal stakeholders, including clinical experts, quality control specialists, technology services personnel, and health records specialists. The hospital states that it did so to ensure the completeness and accuracy of the deceased patient’s record.

[19] The hospital later provided a timeline of the searches it conducted, together with additional information on the staff who were consulted or otherwise involved in responding to the complainant’s request. The hospital noted that searches for records were conducted by two directors with significant experience. This included the hospital noting that its Director of Privacy “is qualified to determine the appropriate search criteria that would yield the responsive records.”

[20] The hospital provided a description of the search criteria used:

The patient was identified through a search of all Meditech records using the following criteria:

a. Any patient named [last name of patient] or with the [patient’s medical record number] in the Meditech system, which includes clinical documentation, laboratory results, imaging reports, medication orders and administration, nursing notes, physician orders and progress notes, discharge summaries, and other related records.

b. It is also important to note that the hospital’s Meditech Electronic Medical Record System includes the ability to search for partial names as well as Soundex Searches which provide search results that include common misspellings and variations in names.

c. Since the subject and scope of the request relates to medical records and communications related to medical records, all documentation is stored under the patient’s name and does not reference the “Estate of” the patient.

[21] The last of these points was made in response to the complainant raising the issue that the medical records located did not include any referencing the “estate of” the patient, despite the complainant being aware of billing records that did.

[22] The hospital states that following the complaint to the IPC, its Technology Services Clinical Analysts conducted additional searches that focussed on locating any documents or graphical views that may not be included in the standardized views. The hospital states that in doing so, it conducted searches for information “well beyond the scope of the original PHIPA request.”

[23] Regarding the complainant’s statement that she had not been provided with paper records, the hospital states that all paper records are routinely scanned into its electronic health record system, a process that is set out in its Interdisciplinary Documentation Policy. The hospital’s position is that a lack of paper records does not indicate that relevant information does not exist, but rather that this information has been transitioned to the electronic format in which it is stored.

The complainant’s representations

[24] The complainant raised a number of issues with the hospital’s approach that she believes call into question the reasonableness and completeness of its search for records. I have grouped these into four general areas:

• The hospital’s searches may not have captured any late entries.
• The hospital did not provide a sufficient level of detail as to how it conducted its searches.
• The hospital took too narrow a view of her request.
• The searches were conducted by inexperienced staff or staff who were in a conflict of interest.

[25] I will set each of these categories out separately.

Failure to capture late entries

[26] The complainant is not satisfied that the hospital searched for all records from the relevant two-day hospital stay. The complainant notes that records are subject to revision over time. She says that there may be entries to those records that were made some time after the actual time of the hospital stay.

[27] The complainant states that she had previously asked whether the date range was only for the two days in question, or for “a wider time frame that would accommodate late entries for that hospital visit.” [emphasis omitted] She states that she has not been provided with a response from the hospital that would satisfy her that its searches would have captured any late entries.

Insufficient description of searches

[28] The complainant states that the hospital did not provide sufficient details of the searches that it conducted. She characterized the hospital’s responses as “very general and generic in nature.” The complainant’s position is that the descriptions provided by the hospital do not demonstrate that it met its burden of conducting a reasonable search for responsive records. The complainant says that the hospital provided either no detail or insufficient details regarding:

• The particular searches conducted by each staff member/resource of the hospital, including their search criteria;
• The types of queries used, including the search terms;
• The date ranges and data sources;
• The time each staff member spent searching; and
• Which staff members collected the data.

[29] In her representations, the complainant posed questions seeking a granular level of detail regarding the documents provided and the searches that they resulted from. This included asking about the staff listed and their involvement in producing the file, the specific search criteria, and whether and how records were added into the final version of a resulting file.

[30] The complainant states that the hospital has not been sufficiently precise in its responses. Referring to the hospital’s statement that paper records “would have been scanned and incorporated into the electronic health record system,” the complainant stated that this was not equivalent to the hospital confirming that they actually had been scanned into those systems.

[31] The complainant also states that the hospital did not adequately explain the fee it charged her for records, noting that this was not addressed at all in the hospital’s representations.

[32] The complainant also states that she was not provided with notice as to why the hospital refused access to some records, as required under section 54(1) of the Act, citing PHIPA Decision 152 as authority for that requirement.

Hospital viewed request too narrowly

[33] The complainant’s position is that the hospital has taken too narrow a view of her request. She notes that at the beginning of the request process, hospital staff initially told her that it does not provide emergency room records. She also states that the hospital informed her that records she asked for, such as electrocardiogram test results, are “not typical” to a patient’s health record.

[34] The complainant has expressed skepticism that the hospital conducted searches covering the entirety of her request, stating “it is reasonable to openly ask what else was either found in the custodian’s searches or exists in the patient record but did not fit the custodian’s pre-determined view of standard content.”

[35] Similarly, the complainant states that the hospital may have not used appropriate search terms. She states that the hospital searched only for a particular Medical Record Number (MRN), basing this on the decision letter referring to this number rather than the patient’s name. She notes that this may mean that the hospital provided records for an account, rather than a patient, as she had requested. The complainant also states that the records she has include a different MRN, which the hospital may not have searched for. Similarly, the complainant states that the hospital failed to search for responsive records listed under the “estate of” the patient, despite billing records including this nomenclature.

[36] By way of demonstrating the narrow view of the hospital regarding the scope of her request, the complainant notes that she received much more in the way of records from other hospitals when she submitted requests for her father’s health records.

Staff concerns

[37] The complainant raises two different concerns regarding the staff who conducted the searches. First, the complainant states that it appears that the Director of Privacy started in his role only a few months prior to her request, and did not have recent experience at an Ontario hospital. She bases this assessment on LinkedIn posts and other online job postings. The complainant’s position is that the Director of Privacy may not be sufficiently experienced in PHIPA to have directed a reasonable search. The complainant also notes that other staff members were still involved in searches some time after the Director of Privacy took over the file.

[38] Second, the complainant also states that the Director of Patient Safety was involved in searching in some capacity, as she was listed as an author within the metadata of the pdf packages of responsive records. The complainant alleges that this individual was in a conflict of interest because, previous to these searches, the complainant had made a complaint to the hospital’s patient ombudsman. The complainant states that this complaint implicated issues for which the Director of Patient Safety would have ultimately been responsible, and that she therefore should have recused herself from the relevant searches.

Analysis and finding

[39] As noted above, PHIPA requires that a health information custodian must provide sufficient evidence to show that it made a reasonable effort to identify and locate responsive records.[9] A health information custodian is not required to prove with absolute certainty that further records do not exist.[10]

[40] The request was for all information pertaining to the deceased patient’s two-day hospital stay. In responding to this request, the hospital states that it searched for both the patient’s last name and MRN in its electronic medical records system. This system can search for partial names or common variations of the name. The hospital did not search for “estate of [the patient]” because its medical records system stores records under patients’ names and does not use that terminology.

[41] The hospital notes that after the initial search, the Director of Privacy conducted “a more detailed review of the information in the record.” The hospital provided a timeline of the searches it conducted and its responses to the complainant subsequent to the initial search, as well as noting the staff members that were contacted as part of its search. This includes enlisting its information technology department to conduct searches that may not be included within its standardized views.

[42] The complainant’s description of the hospital’s early view of her request indicates that the hospital may well have taken too narrow a view of what she was seeking, initially. A request for all information pertaining to a hospital visit would reasonably include both emergency room records and test results, if that visit included an emergency room visit and administration of those tests. However, the hospital has been clear that it subsequently did search for those records, given that it searched for all records in the patient’s name. These early communications, while unfortunate, do not negate the hospital’s subsequent search efforts.

[43] I am not persuaded by the complainant’s argument that the hospital only provided a generic description of its searches. The hospital provided detailed information on the searches conducted, including the personnel it contacted to assist in these searches. The complainant’s position that the hospital must provide information as granular as the search criteria and queries used by each employee, the time they spent searching, and who collected the information is not reasonable. The hospital has the most knowledge of its records and record-holdings system, and as such, is in the best place to determine how to conduct a search for its records. My role is to evaluate whether the hospital, in the totality of its search efforts, conducted a reasonable search, and if not, order the hospital to conduct additional searches. The hospital provided a sufficient level of detail to allow me to determine whether their search efforts met the standard required under PHIPA.

[44] I am similarly not persuaded by the complainant’s position that the hospital has not assured her that its searches would have captured any late entries to the patient’s records. Nothing in the material before me indicates that the existence of such late entries is based on anything more than speculation. The hospital’s initial search took place two months after the two-day hospital stay at issue, and the hospital performed further searches after this time. In my view, PHIPA search obligations do not require the hospital to conduct additional searches for entries posted months after the date in question (and well after the date of the request itself), based only on speculation that these may exist.

[45] The complainant has pointed out that the Director of Privacy may lack recent experience with PHIPA, based on publicly available information regarding his recent employment history. This office has consistently held that a reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request.[11] However, it is not the role of this office to comment on the Director of Privacy’s previous employment. The hospital has stated that he has significant experience and “is qualified to determine the appropriate search criteria that would yield the responsive records.” The searches were carried out by the Director of Privacy or by other staff under his direction. The evidence before me indicates that the searches conducted were in accordance with the standard of an experienced employee (or employees) with knowledge of the subject matter.

[46] Based on my review, I am satisfied that the hospital conducted a reasonable search for records in response to the complainant’s request. The hospital searched its medical records system for the patient’s name and MRN. While the complainant raised records that were not initially provided, the hospital’s later search efforts encompassed searching for those types of records. The hospital enlisted relevant personnel, including those in information technology, to search for the records responsive to the request.

[47] Further, I am not satisfied that the complainant has provided sufficient evidence to establish a reasonable basis that additional responsive records exist. The complainant’s assertion that she received more records from PHIPA requests she made to other custodians does not establish that the hospital has additional records. Further, her statements that the hospital may have located additional records by using different search criteria or conducting searches targeted at late entries is speculation.

[48] Based on the evidence before me, I find that the hospital has met its obligations to conduct a reasonable search as required by PHIPA.

[49] Finally, I make no finding on the complainant’s allegation of a potential conflict of interest on the part of the Director of Patient Safety, and the complainant’s position that the director should have recused herself from search efforts. Conflict of interest is not an issue to be adjudicated in this complaint. The mediator issued a report to the parties at the end of mediation that identified reasonable search as the sole remaining issue in this complaint. There is no reference in the mediator’s report to the Director of Patient Safety in particular, or to a conflict of interest on the part of hospital personnel. The complainant may contact the hospital if she wishes to pursue that issue further.

OTHER MATTERS

[50] In her representations, the complainant raised two issues outside of the question of the issue of reasonable search: the fee that the hospital charged for access to the records and a failure by the hospital to meet the requirements of section 54(1) of the Act.

[51] As noted above, this file proceeded to adjudication solely on the question of whether the hospital performed a reasonable search for records responsive to the complainant’s request. The question of the fee charged by the hospital is not before me, and I will not address it further.

[52] Regarding the application of section 54(1) of the Act, there is nothing in the evidence before me to indicate that the custodian failed to meet the requirements set out in that section of the Act. Section 54(1)(c) requires that a health information custodian who refuses a request, in whole or in part, give a written notice providing a reason for the refusal.[12] From my review of the file, the hospital has not refused access to any records of personal health information.

[53] The complainant raised PHIPA Decision 152 as authority for the hospital’s obligation to provide written notice when refusing access. However, in that case, a hospital provided redacted copies of records of personal health information to an individual without providing reasons for refusing access to the redacted portions. As such, the investigator found that the hospital failed to comply with section 54(1)(c) of the Act. The same circumstances do not apply here, as there is no indication that the hospital has located responsive records but withheld them in whole or in part. As such, there is no evidence to establish that the hospital has acted contrary to its requirements as set out in section 54(1)(c) of the Act.

NO ORDER:

For the foregoing reasons, I find the hospital has conducted a reasonable search in satisfaction of its obligations under PHIPA. I dismiss the complaint.

Original Signed by:		February 25, 2025
Jennifer Olijnyk
Adjudicator