PHIPA DECISION 282

Complaint HA23-00012

Queensway Carleton Hospital

May 30, 2025

Summary: This decision disposes of the outstanding issue of the reasonableness of a search conducted by the Queensway Carleton Hospital (the hospital) for correspondence, messages or documentation relating to a patient’s hospital stay.

In PHIPA Decision 275, the adjudicator did not uphold the hospital’s search for responsive records and ordered it to conduct further searches, including for email records between doctors specified in the request.

In this decision, the adjudicator finds the hospital’s further searches conducted in accordance with PHIPA Decision 275 to be reasonable. She upholds the hospital’s search for records responsive to the complainant’s request and dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004, c. 3, Sched A, as amended, sections 53 and 54.

Decisions Considered: PHIPA Decision 275.

BACKGROUND:

[1] This decision addresses the reasonableness of the Queensway Carleton Hospital’s (the hospital) search for responsive records relating to the complainant’s deceased father’s hospital stay, after having been ordered to conduct a further search in PHIPA Decision 275.

[2] By way of background, the hospital received a request under the Personal Health Information Protection Act (the Act or PHIPA) for the following documentation relating to her deceased father:

1. Any and all correspondence, messages or documentation between [two identified physicians] regarding an assessment, radiologist reports, CT scans, X-rays, diagnosis, surgery consult, NG Tube insertion, Vital signs NEWS2 Total score prognosis, or any other notes that relate to [the complainant’s deceased father].
2. Any and all correspondence, messages or documentation between [the first physician identified above and a third physician], regarding an assessment, radiologist reports, CT scans, X-rays, diagnosis, surgery consult, NG Tube insertion, Vital signs NEWS2 Total score, prognosis, or any other notes that relate to [the complainant’s deceased father].

[3] The hospital issued an access decision to the complainant, advising that it located some messages relating to her deceased father between the specified physicians within its electronic medical records (EMR) system’s internal messaging system. The decision stated that the hospital was providing the complainant with all available communications.

[4] The complainant made a complaint to the Information and Privacy Commissioner of Ontario (IPC) regarding this matter. A mediator was assigned to explore the possibility of resolving the complaint. During mediation, the complainant stated that additional records should exist.

[5] As a mediated resolution was not reached, the complaint was transferred to the adjudication stage of the complaint process, where an adjudicator may conduct a review. The assigned adjudicator conducted a review in which she sought and received representations from the parties. The file was then transferred to me to complete the review, which I did by issuing PHIPA Decision 275.

[6] PHIPA Decision 275 addressed the search efforts of the hospital, as well as whether the hospital was required, under section 53(3)[1] of the Act, to offer assistance to the complainant in reformulating her request, a matter raised by the complainant. In my discussion of section 53(3), I noted that the complainant and the hospital had different interpretations of her request. At paragraph 38, I summarized the complainant’s view as follows:

The complainant’s view of her request is that it includes more than direct communication from one identified doctor to another. This can be seen from her proposal for a reasonable search, which in her view would include exploring portions of the Meditech system “that physicians typically consult for evidence of notes and reports by the physicians who recorded in the patient record, to explore the EMR Notes and EMR Reports, etc.”

[7] The hospital interpreted the complainant’s request as asking for direct communications. The hospital stated that it based this on the complainant previously asking for (and receiving) the patient’s entire health record, such that the hospital stated “it was reasonable for the hospital to conclude that the complainant was seeking correspondence and communications that may not have been included under the previously completed request for the complete legal health record.”

[8] I found that the hospital’s interpretation of the complainant’s request was reasonable, noting at paragraph 40:

While the parties have different interpretations, the request specifies that the complainant is seeking “correspondence, messages or documentation” between named physicians. In my view, the use of “between” implies communications flowing from one party to the other, as the hospital interpreted it.

[9] However, I found that the hospital had not provided sufficient evidence that its search efforts has included a search for email communications specifically between the named doctors. As such, I found that the hospital had not conducted a reasonable search for records responsive to the complainant’s request. I therefore ordered the hospital to conduct a further search for records responsive to the complainant’s request. I also ordered the hospital to provide an explanation of its search in affidavit form, which “must identify, at a minimum, the efforts made to identify emails to and from the doctors specified in the complainant’s November 27, 2022, request.”

[10] Subsequently, the hospital conducted further searches, which did not locate any additional records, and submitted representations including two affidavits outlining its search efforts. I shared these with the complainant and invited her representations, which she provided.

[11] In this decision, I uphold the hospital’s search as reasonable and dismiss the complaint.

DISCUSSION:

[12] The sole issue to be determined in this access complaint is whether the hospital conducted a reasonable search in response to PHIPA Decision 275.

[13] Where a requester claims that additional records exist beyond those identified by a custodian, the issue to be decided is whether the custodian has conducted a reasonable search for records as required by sections 53 and 54 of the Act. These sections address the written request an individual may make to a custodian to exercise a right of access to records, and the obligations on the custodian in responding to the access request. If I am satisfied that the search carried out was reasonable in the circumstances, the custodian’s decision will be upheld. If I am not satisfied, I may order further searches.

[14] In PHIPA Decisions 17, 18, and later decisions,[2] the IPC applied the principles outlined in orders addressing the issue of reasonable search under the Freedom of Information and Protection of Privacy Act [3] and its municipal counterpart.[4] These decisions establish that PHIPA does not require the custodian to prove with absolute certainty that further records do not exist. However, the custodian must provide sufficient evidence to show it made a reasonable effort to identify and locate responsive records.[5] To be responsive, a record must be “reasonably related” to the request.[6]

[15] Although a requester will rarely be in a position to indicate precisely which records the custodian has not identified, the requester (in this case, the complainant) still must provide a reasonable basis for concluding that such records exist.[7]

The hospital’s representations

[16] The hospital’s affidavits outline searches of both the EMR messaging system and the hospital’s email system.

[17] The first affidavit, relating to the EMR messaging feature, states that hospital staff searched for messages between the named doctors that relate to the complainant’s father and were exchanged in March 2022, the month in which the relevant hospital stay occurred. The affiant states that he located no further messages beyond those that the hospital had located in previous searches.

[18] The second affidavit outlines the hospital’s search of its email system. The affiant states that he searched for emails between all three of the named doctors. Within these emails, he then searched for different terms identifying the patient. These included the patient’s medical record number (MRN), full name, first name, and last name. The defined search period was for March 2022. The affiant states that his email search did not find any responsive records or email communications relating the deceased patient between the specified physicians.

The complainant’s representations

[19] The complainant provides several points in reply to the hospital’s search description and affidavit. These include:

• The search date range does not correspond with her request.
• The affidavit addressing the search of the Meditech system includes information about previous searches and does not include the search results themselves or sufficient specifics regarding the searches.
• The hospital did not search for standard patient identifiers or MRN.
• The hospital searched for a MRN format that includes dashes, which are not used in MRNs.
• There is no evidence that the hospital’s search included “email content (email body) search, full-text search, nor email attachments.”
• The hospital did not identify the search coordinator/lead for the 2025 round of searches.
• The hospital did not use proper formalities in preparing its affidavits.
• The hospital’s current privacy officer did not sign the letter accompanying the affidavits.
• The hospital did not search the “typical locations and types of communications” and therefore did not include all aspects of the complainant’s request.

Analysis and finding

[20] As noted in PHIPA Decision 275, the basis for my ordering a further search was that the hospital had not provided me with sufficient evidence that it had searched for emails between all of the doctors that the complainant named. While the hospital stated that it had done so, the Boolean search as set out by the hospital in its representations indicated that they had only searched for emails between two of the three named doctors. As such, I ordered that the search affidavit, at minimum, identify the hospital’s efforts to search emails to and from the doctors specified in the complainant’s request.

[21] I have reviewed the affidavits provided by the hospital, and I am satisfied that the hospital has now searched for emails between all three of the doctors. The affidavit addressing the email search states that the hospital staff searched for emails relating to the patient between each of the three sets of two doctors (between Dr. A and Dr. B; between Dr. B and Dr. C; and between Dr. A and Dr. C) for emails relating to the patient. The affidavit states that to identify emails relating to the patient among all emails flowing between the doctors for the time period of March 2022, hospital staff searched for the patient’s MRN, full name, last name alone, and first name alone.

[22] For the search of the Meditech messaging service, the affiant repeated his search looking for any messages relating to the complainant. He reported locating no responsive records beyond what he had located in previous searches. Both the initial searches and the later search looked for all messages relating to the patient and then narrowed that search by looking for messages between the named doctors within those.

[23] As noted, the Act does not require a custodian to prove with absolute certainty that further records do not exist. Rather, a custodian is obliged to provide sufficient evidence to show it made a reasonable effort to identify and locate responsive records.

[24] I am satisfied that the hospital has now provided me with evidence demonstrating that it made a reasonable effort to identify and locate the records responsive to the complainant’s request. As the complainant had previously requested and been provided with the patient’s medical records, the hospital interpreted the complainant’s request for “correspondence, messages or documentation” as seeking communications between the named physicians that related to the patient. Based on this interpretation, which I have already found to be reasonable, the hospital searched the two messaging systems it identified as potentially containing responsive records. Both the initial and subsequent searches of the Meditech system had parameters capturing messages relating to the patient between the named doctors. While the initial searches of the email system only captured emails between two of the named doctors, I am satisfied that the parameters of the later search looked for emails between all three named doctors. I am also satisfied that the hospital’s searching for the patient’s full name, first name, last name, and MRN, successively, represents a reasonable effort to locate emails relating to the patient among the emails between the named doctors.

[25] After being provided with the hospital’s representations and affidavits, the complainant maintains that the hospital did not make a reasonable effort to search for responsive records. However, the matters that the complainant raised do not persuade me that the hospital did not conduct a reasonable search for responsive records.

[26] The complainant states that she is seeking records from the time of the hospital visit to the present day, rather than from only March 2022, and notes that the hospital applied a broader date range to her request in previous searches. The complainant states that electronic records can have changes made to them over time, and “[objects] to the hospital’s blocking my access to the transformations (e.g. updates, etc.) in my late father’s patient record.”

[27] In this case the March 2022 time frame used by the hospital applied only to emails between the named doctors, not other types of medical records. Given that the patient was in the hospital for a two-day period in the first half of March 2022, the hospital limited its search for emails to the month of that hospital stay. The complainant’s larger argument relating to the changeability of medical records does not provide me, given these particular circumstances, with a reasonable basis to conclude that additional responsive emails exist.

[28] The complainant is correct in observing that the affidavit relating to the Meditech searches addresses previous searches, not just those conducted in response to my order. However, my assessment of the searches is not limited to the most recent searches, and I am satisfied that the searches of the Meditech system, taken together, form a reasonable search of that messaging system.

[29] A number of the complainant’s arguments address the specific search terms or formats of search terms used. These address as to how the hospital could have better performed the searches, in the complainant’s view. However, the hospital has the most knowledge of its records and record-holdings system, and as such, is in the best place to determine how to conduct a search for its records. The hospital is obliged to conduct a reasonable search, not the search that the complainant would have conducted. The complainant’s arguments regarding the search terms and search fields, including what she believes to be the applicable patient identifiers, MRNs, and MRN formats do not provide me with a reasonable basis to conclude that additional responsive emails or messages exist.

[30] Similarly, I am not persuaded that the hospital did not provide sufficient evidence that it searched the emails themselves, rather than select fields within those emails. While the complainant questioned what portions of the emails were searched by the hospital, this is not sufficient to indicate that the hospital indeed limited its search to only select fields within the emails and does not provide a reasonable basis to conclude that additional responsive emails exist.

[31] The complainant also raises issues with formalities or technicalities that the hospital did not do in preparing its affidavits and cover letter. These include not identifying the search coordinator for the most recent searches; not paginating the affidavits; not including the expiry date relating to the Commissioner for Oaths before whom the affidavits were sworn; and not specifying that the Commissioner for Oaths was a hospital employee.

[32] The hospital is not required to specify the search coordinator. None of the remaining technical objections affect my finding that the hospital conducted a reasonable search in response to the request or persuade me that additional records exist. Similarly, the complainant’s questioning of why the hospital’s privacy officer did not sign the cover letter does not affect my assessment of the reasonableness of the hospital’s search.

[33] Finally, I note that the complainant states that the hospital did not search “typical locations and types of communications.” The complainant refers here to the hospital searching the portions of its record holdings that it identified as containing direct communications between doctors (the messaging and email services) rather than conducting searches of the patient’s electronic medical records. As noted above, the complainant’s position is that the hospital should have searched the patient’s Meditech records for communications responsive to her request, to look for “evidence of notes and reports by the physicians who recorded in the patient record, to explore the EMR Notes and EMR Reports, etc.” However, I considered the complainant’s position on this point in PHIPA Decision 275 and determined that the hospital’s interpretation of the request as relating to correspondence and communications between doctors was reasonable. As such, the complainant’s assertion that the hospital did not search other portions of the record holdings is not relevant to the question of whether the hospital conducted a reasonable search.

Conclusion

[34] In response to my order, the hospital conducted additional searches for the email records, including searches of emails between each of the three named doctors. The hospital also conducted additional searches of the Meditech messaging service and enumerated its earlier searches of that system. The hospital did not identify any additional responsive records from these searches.

[35] For the reasons set out above, I have found that the hospital has conducted a reasonable search for the records responsive to the request and the complainant has not provided me with a reasonable basis to conclude that additional emails or Meditech message may exist. Therefore, I uphold the hospital’s search for records responsive to the complainant’s request as reasonable and I dismiss the complaint.

NO ORDER:

For the foregoing reasons, I find the hospital has conducted a reasonable search in satisfaction of its obligations under PHIPA. I dismiss the complaint.

Original Signed by:		May 30, 2025
Jennifer Olijnyk
Adjudicator