PHIPA DECISION 275

Complaint HA23-00012

Queensway Carleton Hospital

February 25, 2025

Summary: An individual asked a hospital for access to correspondence, messages and documentation between specified doctors related to her deceased father’s two-day hospital stay. After receiving records from the hospital, the complainant stated that additional records should exist.

In this decision, the adjudicator finds that the hospital did not conduct a reasonable search for records as it is obliged to do under the Personal Health Information Protection Act, as it did not search for email communications to and from one named doctor. The adjudicator orders the hospital to conduct a further search for records responsive to the complainant’s request, to provide the adjudicator with a written explanation of the search, and to issue an access decision to the complainant regarding the any additional records it locates as a result of the further search.

Statutes Considered: Personal Health Information Protection Act, 2004, c. 3, Sched A, as amended, sections 53, and 54

Decisions Considered: PHIPA Decision 17 and 18.

BACKGROUND:

[1] The complainant made a request under the Personal Health Information Protection Act, 2004 (PHIPA or the Act) to Queensway Carleton Hospital (the hospital) for documentation regarding her deceased father, asking to be provided with the following:

1. Any and all correspondence, messages or documentation between [two identified physicians] regarding an assessment, radiologist reports, CT scans, X-rays, diagnosis, surgery consult, NG Tube insertion, Vital signs NEWS2 Total score prognosis, or any other notes that relate to [the complainant’s deceased father].
2. Any and all correspondence, messages or documentation between [the first physician identified above and a third physician], regarding an assessment, radiologist reports, CT scans, X-rays, diagnosis, surgery consult, NG Tube insertion, Vital signs NEWS2 Total score, prognosis, or any other notes that relate to [the complainant’s deceased father].

[2] The complainant provided background information as to her reasons for making the request, and listed examples of what the requested records may include.

[3] The hospital issued an access decision to the complainant, advising that in its efforts to locate responsive communications it identified a messaging feature within Meditech, its electronic health records system. The hospital stated that though it has discouraged the use of this feature, it conducted a search of this messaging feature. The search located some messages relating to her deceased father between the specified physicians. The decision letter stated that the hospital was providing the complainant with all available communications.

[4] The complainant filed an access complaint to the Information and Privacy Commissioner of Ontario (IPC) regarding this matter. The complainant’s position was that the hospital provided her with “just disparate meaningless fragments,” rather than actual messages.

[5] A mediator was assigned in an effort to resolve the complaint. During mediation, the complainant stated that additional records should exist. Although there were communications between the parties via the mediator, the complainant was not satisfied with the hospital’s responses and no further mediation was possible. The complaint was transferred to the adjudication stage of the complaint process, where an adjudicator may conduct a review. The assigned adjudicator conducted a review in which she sought and received representations from the parties.[1]

[6] The complaint was then transferred to me. Following my review of the file, I sought and received additional representations from the hospital and the complainant.

[7] For the reasons that follow, I find that the hospital did not provide sufficient evidence to demonstrate that it conducted a reasonable search for records. The hospital is ordered to conduct a further search for records responsive to the complainant’s request and to provide a written explanation to the complainant regarding the results of the search.

DISCUSSION:

Did the hospital conduct a reasonable search for records?

[8] The only issue before me is whether the hospital conducted a reasonable search for records responsive to the complainant’s request.

[9] Where a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53 and 54 of the Act. These sections address the written request an individual may make to a custodian to exercise a right of access to records, and the obligations on the custodian in responding to the access request. If I am satisfied that the search carried out was reasonable in the circumstances, the custodian’s decision will be upheld. If I am not satisfied, I may order further searches.

[10] In PHIPA Decisions 17, 18, and later decisions,[2] the IPC applied the principles outlined in orders addressing the issue of reasonable search under the Freedom of Information and Protection of Privacy Act [3] and its municipal counterpart.[4] These decisions establish that PHIPA does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show it made a reasonable effort to identify and locate responsive records.[5] To be responsive, a record must be “reasonably related” to the request.[6]

[11] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester (in this case, the complainant) still must provide a reasonable basis for concluding that such records exist.[7]

The hospital’s representations

[12] The hospital provided details on searches it conducted following the request, as well as its searches made in response to the complainant’s earlier requests.

[13] The hospital stated that two months prior to the request at issue in this case, the complainant asked for correspondence, messages, or documentation relating to the deceased patient that occurred between two of the doctors named in her later request: Drs. A and B. In response to this earlier request, the hospital states that it searched the hospital’s email system for any messages or correspondence between the named physicians. This search was intended to capture any emails between Drs. A and B during the relevant time frame, regardless of whether the deceased patient was named. The hospital states that following this search, it would then conduct “a more focussed analysis … to determine whether or not there were any responsive records that related to the named patient.”

[14] The hospital provided an email setting out the search criteria to be used in the search, which was “[From: [Dr. A] OR [Dr. B]] AND [To: [Dr. A] OR [Dr. B]]”. The time frame was a four-day period, consisting of the patient’s two-day stay in the hospital plus a day on either side. The hospital states that it searched for the hospital email addresses and personal email addresses of Drs. A and B.

[15] The hospital says that it did not locate responsive records when it ran the above search. As such, the hospital did not then have to take the next step of searching for the patient within the emails located.

[16] Also at that time, the hospital conducted internal inquiries to determine if there were any additional communication mechanisms in place, beyond email. The hospital’s search team “identified a Multisite Physician Message/Task access feature within the Meditech Electronic Health record application accessible to physicians.”

[17] As this feature was part of the Meditech system, the IT analyst searched for the name of the deceased patient in the main data table of the Meditech Data Repository, returning message instances associated with that name. Each message had an associated ID number, which was then used to search the remaining data tables for other relevant data. That search was for the same four-day period as the email search.

[18] The hospital also notes that there is only one Medical Record Number (MRN) connected with the patient, and that messaging within the Meditech system is connected to the patient MRN by default.

[19] The hospital states that did not identify any communications or messages between Drs. A and B in the Meditech messaging system that related to the deceased patient.

[20] Following this, the hospital received the request at issue in this complaint, in which the complainant asked for “correspondence, messages or documentation” between Drs. A and C, and between Drs. B and C. The hospital referred to this request as a “revised request.”

[21] The hospital states that it then reran queries on the Meditech messaging system, expanding the time frame to run from the month of the hospital stay (March) to the end of that calendar year, when the latest search was conducted. The hospital states that it located one record, an update to the status of lab results by Dr. C. The hospital states that it regarded this record as a task, rather than a communication. The hospital also located results from one additional physician not named in the request.

[22] The hospital says that in the interest of transparency, it provided these results to the complainant, despite these results not being communications between the named physicians.

[23] The hospital states that it did not conduct an email search in response to the later request, providing the following reasoning:

Although the email search following the November request did not specifically search email communications from [Dr. C], the initial request from September had specified communications both received from and to the other 2 physicians. Had any communication occurred between [Dr. C] and the other 2 Physicians, this would have been captured in the original query of the email system related to the September request.

[24] The hospital also denied the complainant’s allegation that it had applied an inpatient filter in its searches, stating that it had conducted a complete record search.

[25] Finally, the hospital also addressed the complainant’s allegations that it did not properly inquire with her to clarify her request pursuant to section 53(3) of the Act. It is the hospital’s position that there was no need to do so. The hospital states that the request was clear and it therefore did not need to offer assistance in reformulating the request. The hospital cited guidance from PHIPA Practice Direction 1 – Clarifying Access Requests[8] as authority for this position, and provided the following rationale:

The hospital submits that the request from the complainant was very precise and specific and did not require further clarification. The complainant had previously requested and been furnished with the complete health record for her deceased father and the request for additional communications was interpreted to supplement the prior request. We submit that it was reasonable for the hospital to conclude that the complainant was seeking correspondence and communications that may not have been included under the previously completed request for the complete legal health record.

The complainant’s representations

[26] The complainant says that she made this request because the records she received in response to earlier requests did not include “the actions and determinations of certain physicians that were a key part of the patient’s circle of care.” The complainant describes her request as targeted, stating that it “focussed exclusively on physicians and any and all of their correspondence, messages or documentation.” She states that she requested that the search be wide enough to include late entries into the patient record.

[27] The complainant’s representations focus on two main objections to the hospital’s searches. First, the complainant states that the hospital essentially narrowed her request to messages. Second, she states that the hospital relied on previous searches when it was not appropriate to do so.

[28] The complainant states that by searching the Meditech messaging system, the hospital searched in an area where responsive records were least likely to be found, given that it discouraged use of this messaging system. She states that she clearly communicated that the hospital was to search in the “legal health record” and that the hospital did not search for correspondence or documentation. She provided the following description of what she believes a reasonable search would entail:

A reasonable search would have involved, as a first step, leveraging the available reports in Meditech (both standard and custom reports). To explore the Acute Provider tab, for instance, that physicians typically consult for evidence of notes and reports by the physicians who recorded in the patient record, to explore the EMR Notes and EMR Reports, etc. And to search other recognized sources such as paper‐based correspondence.

[29] The complainant states that the hospital’s interpretation of her request was incorrect, and that it should have contacted her to clarify this before proceeding with the searches.

[30] The complainant also states that the hospital discounted undertaking additional searches in response to her request and relied on the results of earlier searches instead. The complainant objects to the hospital claiming that it had already conducted searches of the complete file, stating that records can change over time. She states that the hospital cannot be certain that nothing in the patient’s health record has changed since its earlier searches, therefore necessitating new searches to address the later request.

[31] In particular, the complainant states that correspondence could have occurred subsequent to the search the hospital conducted relating to the earlier request, and these would not have been captured if the hospital relied only on those earlier search efforts. The complainant states that the information provided by the hospital in its representations “not only latches on to apparent search activity for a different request, it deflects and distracts from the lack of search activity in relation to the request that is actually the object of this adjudication.” [emphasis omitted]

Analysis and findings

[32] As noted above, PHIPA requires that a health information custodian provide sufficient evidence to show that it made a reasonable effort to identify and locate responsive records. A health information custodian is not required to prove with absolute certainty that further records do not exist.

Reformulation of the request under section 53(3)

[33] The complainant’s position is that the hospital should have contacted her to clarify her request, based on its obligation under section 53(3) of PHIPA.

[34] Section 53(2) requires that a request “contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts.” Section 53(3) states:

If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2).

[35] The request at issue was for the following:

Any and all correspondence, messages or documentation between [two identified physicians] regarding an assessment, radiologist reports, CT scans, X-rays, diagnosis, surgery consult, NG Tube insertion, Vital signs NEWS2 Total score prognosis, or any other notes that relate to [the complainant’s deceased father].

[36] The request was in two parts, but the only difference between the parts was that they named different physicians. Following the two-part request, the complainant provided examples of what the request could include and her reasons for making this request. In this background section, the complainant states that she knew of a note in which Dr. A wrote that he saw the patient at the request of Dr. B. The complainant wrote that she had found no such referral in the records she had been provided with.

[37] The hospital’s position is that the complainant’s request was specific and precise, requiring no further clarification. The hospital further states that as the complainant had previously asked for (and been provided with) the patient’s entire health record “it was reasonable for the hospital to conclude that the complainant was seeking correspondence and communications that may not have been included under the previously completed request for the complete legal health record.”

[38] The complainant’s view of her request is that it includes more than direct communication from one identified doctor to another. This can be seen from her proposal for a reasonable search, which in her view would include exploring portions of the Meditech system “that physicians typically consult for evidence of notes and reports by the physicians who recorded in the patient record, to explore the EMR Notes and EMR Reports, etc.”

[39] The hospital and the complainant have different interpretations of the request at issue. Based on this, the complainant’s position is that the hospital was obliged to contact her to offer assistance to reformulate the request pursuant to section 53(3) of the Act.

[40] I do not agree. While the parties have different interpretations, the request specifies that the complainant is seeking “correspondence, messages or documentation” between named physicians. In my view, the use of “between” implies communications flowing from one party to the other, as the hospital interpreted it. I agree with the hospital’s position that the request itself provided sufficient information to identify and locate the records, without offering the complainant assistance in reformulating the request as set out in section 53(3) of the Act.

[41] I note that the complainant provided examples in her request letter of what responsive records could include. In these, she listed views within the health records system relating to the patient’s two-day stay in the hospital. However, the complainant had previously made a request for all medical records related to the patient’s stay in the hospital. Taking into account both this previous request and the wording of her two-part request, it was reasonable for the hospital to interpret her request as seeking direct communications between those named parties. I find that the hospital did not act contrary to its obligations under section 53(3) of the Act.

Adequacy of searches

[42] The hospital states that the current request expands upon a similar request the complainant made two months prior. That previous request asked for the same records (“correspondence, messages or documentation” relating the deceased patient) but as between Drs. A and B, while the later request was for these records between 1) Drs. A and C and 2) Drs. B and C.

[43] The hospital identified two communication methods that may contain responsive records: Meditech’s messaging feature and the hospital’s email system.

[44] In response to the prior request, the hospital searched its Meditech system for message instances associated with the patient’s name, using the associated data to search for other relevant data. The hospital provided this information to the complainant, without limiting it to records involving the named physicians. Subsequently, for the search for the request at issue, the hospital expanded the data range of the search, such that it included the time from the day before the hospital visit to the end of that calendar year.

[45] Regarding the email searches, in response to the prior request the hospital searched for emails between the two doctors identified in the complainant’s request. The hospital found no responsive emails for the four-day period comprised of the day before the hospital visit, the hospital visit, and the day after. When the hospital received the request at issue, it states that it did not conduct an email search for emails between the doctors identified in that request. Its rationale was that “[had] any communication occurred between [third named physician] and the other 2 physicians, this would have been captured in the original query of the email system related to the September request.”

[46] The complainant objects to the hospital not conducting additional searches in response to the request at issue, stating that the record holdings may have changed. I take no position as to whether an access request will always necessitate new searches. There may be cases where earlier searches are sufficient to meet the search requirements under PHIPA.[9] However, the hospital has not demonstrated to me that, in this case, the earlier searches were sufficient to meet its search obligations for the present request.

[47] The hospital’s position that its earlier search would have captured emails from Dr. C is only correct if its earlier search captured the entirety of emails that Drs. A and B either sent or received during the relevant time frame. However, the description of the email search instructions set out in the email to the hospital’s information technology staff (included in the hospital’s representations) is that this search was for emails:

[From: [Dr. A] OR [Dr. B]] AND [To: [Dr. A] OR [Dr. B]]

[48] The above search captures email communications between Drs. A and B. It does not capture emails to or from either of those doctors to another party i.e. Dr. C. From this description, it appears that the hospital did not conduct a search of emails between Drs. A and C and between Drs. B and C, as requested by the complainant in the request at issue.

[49] I therefore find that the search for records responsive to the complainant’s request does not meet the threshold for being “reasonable.” My reason for this is solely that the hospital has not provided evidence to demonstrate that it searched for emails between Drs. A and C and between Drs. B and C. The hospital’s statement that those emails would have been found in its initial search is contradicted by the search instructions provided to its information technology staff. Due to this contradiction, I cannot find that the hospital has provided sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control.

[50] I reiterate that I reached the above finding solely based on the contradiction in the hospital’s description of its search for emails and not based on the hospital’s description of its searches for any other responsive “correspondence, messages or documentation.” I note that I have already found that the hospital did not act contrary to its obligations under section 53(3) of the Act.

[51] As a result, I will order the hospital to conduct a further search for records responsive to the complainant’s request and to provide me with the results of this search.

ORDER:

For the foregoing reasons, pursuant to section 61(1) of the Act:

1. I order the hospital to conduct, within 30 days, a further search for records responsive to the complainant’s access request.
2. Following the search described in order provision 1, the clinic must provide me with a detailed explanation of the search efforts within 30 days of the date of this decision. This explanation should be in the form of an affidavit sworn by the individual(s) who conduct the search, and must identify, at a minimum, the efforts made to identify emails to and from the doctors specified in the complainant’s November 27, 2022, request.

I will share the hospital’s explanation with the complainant, subject to the IPC’s confidentiality criteria as described in guidance provided to the hospital at earlier stages of the review. The hospital should state its position on sharing.

3. I order the hospital to issue a decision to the complainant under PHIPA on access to any additional records it locates as a result of the search. The hospital must issue any such decision within 30 days of the date of this decision.
4. I remain seized of this matter to address issues that may arise from order provisions 1 and 2.
5. I reserve the right to require the hospital to provide me with a copy of the access decision referred to in order provision 3.

Original Signed by:		February 25, 2025
Jennifer Olijnyk
Adjudicator