PHIPA DECISION 277

Complaint HA22-00025

Allevio Pain Management Clinic

March 18, 2025

Summary: The complainant made an access request to the clinic for all records containing his name or OHIP number. The clinic located eight pages of clinical notes and disclosed these to the complainant, but the complainant claimed that additional records exist. The adjudicator finds that there is insufficient evidence to conclude that the clinic conducted a reasonable search and orders the clinic to conduct another search.

Statute Considered: Personal Health Information Protection Act, 2004 , S.O. 2004, c.3, sections 53 and 54.

BACKGROUND:

[1] A requester made an access request under the Personal Health Information Protection Act, 2004 (PHIPA) to the Allevio Pain Management Clinic (the clinic) for the following information:

Reports, receipts, referrals, memos, notes, emails, forms, x-rays, documents, video, audio, voicemail, sign-in logs, “et al” bearing my name/OHIP number that are or were in your possession at any time.

[2] In response, the clinic provided the requester with a copy of his health records, but not a decision letter. The requester (now the complainant) filed a complaint with the Information and Privacy Commissioner of Ontario (IPC). The complainant explained that he had requested a full and complete copy of all of his health records, including every document ranging from the sign-in forms at the clinic to all online forms he completed for the clinic. The complainant believes that he was not provided with all of the records in the clinic’s possession.

[3] During the early resolution stage of the IPC complaint process, the complainant wrote to the early resolution analyst, stating:

I know beyond any shadow of a doubt that all of these documents exist because I populated/provided the information, and I watched the doctor and his assistant take notes. There were hours of consultations and forms and notes. I am seeking every document to determine if the doctor is guilty of malpractice. There were numerous forms that were filled out for the clinic and doctor to assess my problem, apply for funding to OHIP, and to formulate a treatment plan.

[…]

If I provided every piece of information to the clinic and doctor named in my complaint, and they are required to keep said information for a specific duration of time, why would those documents be anywhere but in their possession?

[4] The complainant provided a copy of the records he received from the clinic in response to his access request. The package includes eight pages of what are described as “encounters,” but does not include emails, sign-in logs, forms, or other documentation.

[5] The early resolution analyst sent a Notice of Health Complaint to the clinic, which was returned to the IPC, marked as returned to sender. The analyst then attempted to connect with the privacy officer originally listed for the file, but was unable to do so. The analyst then ran a corporate search for the clinic. Based on this search, the analyst sent a letter to the Registrant listed for the clinic (Allevio Holdings Inc.) requesting that a representative for the clinic contact the analyst as soon as possible. A representative contacted the IPC and confirmed that he is the appropriate contact person for the complaint, but also advised that the clinic is in bankruptcy and is transitioning patients to other clinics.

[6] The analyst asked the representative if the clinic had issued a decision letter to the complainant in response to their access request and, if so, to provide the IPC with a copy. The analyst also asked the clinic to issue a decision letter to the complainant if had not yet done so, and provide the IPC with a copy of it. The analyst attempted to contact the clinic on several occasions to follow-up regarding these issues, but received no response from the clinic in each case.

[7] The complaint was then moved to the adjudication stage of the complaints process. The adjudicator originally assigned to the complaint conducted a review where she sought and received representations from the clinic and the complainant. The complaint was then assigned to me to complete the review. I reviewed the representations of the parties and determined that I did not need to seek additional representations.

[8] For the reasons that follow, I order the clinic to conduct another search for records responsive to the complainant’s access request.

DISCUSSION:

[9] Neither party disputed during the inquiry, and I find, that the clinic is a health information custodian under section 3(1) of PHIPA, and the specified physician was an agent of the clinic.

[10] Having established that the clinic is a health information custodian, the only remaining issue in this complaint is if the clinic conducted a reasonable search for records in response to the complainant’s request. Where a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53 and 54 of PHIPA. If the IPC is satisfied that the search carried out was reasonable in the circumstances, the custodian’s decision will be upheld. If the IPC is not satisfied, it may order further searches.

[11] The IPC has extensively canvassed the issue of reasonable search in orders issued under FIPPA and its municipal counterpart, MFIPPA. It has also addressed the issue of reasonable search under PHIPA.^[1] In addition to what is set out in PHIPA Decision 18, principles outlined in IPC orders addressing reasonable search under FIPPA and MFIPPA are instructive to the review of this issue under PHIPA.

[12] PHIPA does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records.^[2] To be responsive, a record must be "reasonably related" to the request.^[3]

[13] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request.^[4] A further search will be ordered if the custodian does not provide sufficient evidence to demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control.^[5]

[14] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester still must provide a reasonable basis for concluding that such records exist.^[6] A requester’s lack of diligence in pursuing a request by not responding to requests from the custodian for clarification may result in a finding that all steps taken by the custodian to respond to the request were reasonable.^[7]

Representations, analysis, and finding

[15] The clinic submits that it previously sent “clinical notes and records in accordance with clinical best practice and as requested by the [complainant].” It states that it sent the “most exhaustive record set available through the clinical notes” and explains that the complainant’s former doctor passed away, and the clinic had also closed. It explains that the complainant knows how to reach the clinic and the clinic is as compliant as it can be in the circumstances.

[16] In response, the complainant submits that he does not have his complete records from the clinic. He explains that his request was made before the doctor died, and before the clinic closed. He also submits that the clinic did not cooperate with the IPC prior to the file moving to the adjudication stage, and reiterated that he has not received a complete set of records.

[17] Considering the representations of the parties, as well as the records received by the complainant, I find that the clinic has not provided enough evidence for me to conclude that it has conducted a reasonable search.

[18] The clinic provided minimal evidence of the search that it conducted, simply stating that it provided all of the records available through the clinical notes. However, as is clear from the complainant’s access request, the complainant is seeking not only access to the clinic notes, but any documents bearing his name or OHIP number within the clinic’s possession at any time. I am not satisfied that a reasonable search for these records would only produce clinical notes, and the clinic has not explained how the searches it conducted that produced only these records were reasonable in the circumstances.

[19] For these reasons, I find that I do not have sufficient evidence to conclude that the clinic conducted a reasonable search. More specifically, I find that I do not have sufficient evidence about the clinic’s efforts to identify and locate records that are responsive to the complainant’s request.

[20] I have also considered if the clinic’s bankruptcy has any bearing on the clinic’s responsibilities under PHIPA. If, for example, another entity had obtained complete custody or control of the clinic’s records of personal health information due to the clinic’s bankruptcy, it would become the health information custodian for these records.^[8] However, based on the information before me, and particularly considering that the clinic did disclose some records to the complainant, the clinic has maintained custody or control of these records of personal health information. Therefore, the duties and responsibilities under PHIPA with respect to access requests remain with the clinic. Accordingly, I will order the clinic to conduct an additional search for records.

ORDER:

For the foregoing reasons, pursuant to section 61(1) of PHIPA,

1. I order the clinic to conduct a further search for records responsive to the complainant’s access request within 30 days of the date of this decision.
2. I order the clinic to issue an access decision to the complainant with respect to any further records that are found as a result of the search ordered in Order Provision 1. The clinic must issue the decision in accordance with the provisions of PHIPA and within 30 days of the date of this decision.
3. I reserve the right to require the clinic to provide me with a copy of the access decision referred to in Order Provision 2.