PHIPA DECISION 309

Complaint HC23-00022

A named dentist/a named dental practice

October 30, 2025

Summary: The complainant was a patient of the respondent, a named dentist operating a dental practice. After learning that the respondent had in its possession video recordings of three virtual care sessions she had with two different dentists at that practice, she filed a privacy complaint with the IPC. The complainant alleges that the video recordings were made without her knowledge or consent, in violation of PHIPA, and she seeks remedies including deletion of the recordings and fines for the respondent’s breach of her trust.

In this decision, the adjudicator finds there are no reasonable grounds to review the matter under PHIPA. While there were some deficiencies in the respondent’s practices around virtual care sessions at the time of the events at issue, she finds credible the respondent’s evidence that patients were notified before and at the time of any video recordings. She also finds that the respondent has taken reasonable steps since that time to address the gaps in its practices, and has responded adequately to the complaint. For these and other reasons, she concludes that a review is not warranted in the circumstances. She dismisses the complaint.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sched A, sections 2  (definitions), 3, 4 (definition of “personal health information”), 18, 29, 57(3) and (4), and 61.

OVERVIEW:

[1] The complainant received dental care from a dentist who operates a dental practice in her name. In discussion that follows, I will refer to the dentist and to her dental practice interchangeably as the “respondent.”

[2] After requesting her patient files from the respondent, the complainant found among them video recordings of three virtual care sessions she had with two different dentists working for the respondent. The complainant says she was unaware these sessions were being recorded, and did not consent to any such recordings, and thus alleges the recordings were made and retained in violation of the Personal Health Information Protection Act, 2004 (PHIPA). The complainant asked the Office of the Information and Privacy Commissioner of Ontario (IPC) to investigate the matter and to make orders under PHIPA to remedy the harms she experienced, including the breach of her trust.

[3] At the early resolution stage of the IPC process, an analyst gathered information from the parties about the issues raised by the complaint. The matter was then moved to the adjudication stage for a determination of whether the circumstances warrant a review under PHIPA. Based on all the information before me, I formed the preliminary view that there are no reasonable grounds to conduct a review.

[4] I informed the complainant of the reasons for my preliminary view, and I invited her to make submissions on my preliminary view before any final decision on the matter. The complainant provided submissions, which I have considered.

[5] In the discussion that follows, I explain why I have decided this matter does not warrant a review under PHIPA. I dismiss the complaint.

DISCUSSION:

[6] One of the purposes of PHIPA is to protect the confidentiality of personal health information and the privacy of the individuals to whom the information relates. One of the ways PHIPA achieves this purpose is by setting out rules to ensure the security of “personal health information” in the custody or control of “health information custodians,” as those terms are defined in PHIPA.[1]

[7] “Health information custodian” is defined in section 3(1) of PHIPA to include a “health care practitioner” or a person who operates a group practice of “health care practitioners” (at paragraph 1).[2] The respondent is and was at the relevant time a dentist licensed with the Royal College of Dental Surgeons of Ontario (the College), and is a “health care practitioner” within the meaning of that term in PHIPA. In this complaint, there is no dispute that whether in that role, and/or as the person who operates the group practice of health care practitioners that is the dental practice, the respondent is the health information custodian with respect to the information at issue in this complaint.

[8] It my understanding that the other dentist named in the complaint practised with the respondent and was an “agent” of the respondent, within the meaning of PHIPA, at the relevant time. Under PHIPA, an agent is a person who acts on behalf of the custodian, and not for the agent’s own purposes, with respect to personal health information. Custodians remain responsible under PHIPA for personal health information handled by their agents on their behalf.[3]

[9] The result is that the respondent is ultimately responsible under PHIPA in respect of “personal health information” in its custody or control as a result of or in connection with its role as a custodian. PHIPA defines personal health information to mean identifying information about an individual, including, among other things, information relating to the individual’s physical or mental health [paragraph (a) of the definition at section 4(1)], and information relating to the providing of health care to the individual (paragraph (b) of the definition). It is not in dispute that the video recordings at issue in this complaint are records of the complainant’s “personal health information” within the meaning of PHIPA.

[10] As a result, PHIPA governs the respondent’s handling of the video recordings at issue in this complaint. The complaint before me is an allegation that the respondent made and retained these recordings in contravention of PHIPA.

Should the complaint proceed to a review under PHIPA?

[11] Sections 57(3) and (4) of PHIPA set out the IPC’s authority to review or not to review a complaint. These sections state, in part:

(3) If the Commissioner does not take an action described in clause (1) (b) or (c) [which relate to attempts at settlement], or if the Commissioner takes an action described in one of those clauses but no settlement is effected within the time period specified, the Commissioner may review the subject-matter of a complaint made under this Act if satisfied that there are reasonable grounds to do so.

(4) The Commissioner may decide not to review the subject-matter of the complaint for whatever reason the Commissioner considers proper, including if satisfied that,

(a) the person about which the complaint is made has responded adequately to the complaint;

(b) the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure, other than a complaint under [PHIPA.]

[12] I have considered all the circumstances of the complaint, including the complainant’s submissions in response to my preliminary views. For the reasons that follow, I decline to conduct a review of this matter under PHIPA.

The respondent has responded adequately to the complaint about unauthorized collection and use of personal health information

[13] The main issue raised by this complaint is whether the respondent was authorized under PHIPA to make and to retain the video recordings at issue. The complainant says she was unaware that her virtual care sessions with the respondent were being recorded, and that she did not consent to any such recordings. She says the respondent’s recording and retention of videos of these sessions was therefore done in contravention of PHIPA.

[14] The respondent acknowledges that the complainant’s patient file contains video recordings of three virtual care sessions conducted with the complainant in late 2020 and early 2021, in the months following the worldwide COVID-19 outbreak. The respondent says it appropriately notified the complainant of its intention to record the sessions, and that the complainant consented to the recordings by participating in the sessions after receiving this notice.

[15] The respondent explains that it implemented virtual care sessions during this time to provide health care to its patients during the COVID-19 pandemic, while doing its best to protect patient privacy in accordance with the knowledge and resources available to it at that time. The respondent says that for health care providers like dentists, virtual care sessions were uncommon prior to the COVID-19 outbreak. It notes that at the time of the events at issue, there existed no formal guidance on this topic from its governing body (the College), or from the IPC. (The respondent notes that since that time, both the College and the IPC have issued guidance on the provision of virtual care. I discuss this guidance further below.)

[16] Among other steps, the respondent says it sourced a reputable platform for virtual care that was compliant with the Health Insurance Portability and Accountability Act (a US federal law that establishes rules for protected health information handled by entities covered by that statute). Based on its research and knowledge at the time, the respondent understood the platform to comply with relevant Canadian privacy legislation.

[17] The respondent explains that before any virtual care session was scheduled through the platform, patients were asked for their oral consent to the respondent’s entering their personal health information into the platform. If a patient did not give this consent, then the virtual care session was not scheduled. With respect to the three virtual care sessions at issue in this complaint, the respondent says it documented the complainant’s oral consent to its entering her personal health information into the platform, and conducting the virtual care sessions through the platform.

[18] The respondent explains that it recorded virtual care sessions on rare occasions. The respondent says it recorded the three virtual care sessions at issue in this complaint because of the expected length and complexity of the discussions at these sessions, and the need to ensure the accuracy and completeness of its records of these sessions.

[19] The respondent says that any recording of a virtual care session triggered pop-up notices to session attendees, advising them that a recording would be taking place. Attendees were then given the option to continue with the virtual care session, or to leave the session if they did not agree to its being recorded. In addition, for the duration of a recording, an attendee’s screen would display a visual indicator reminding them that the session was being recorded.

[20] The respondent acknowledges that it did not have advance discussions with the complainant about recording the virtual care sessions at issue. In the context of these particular recordings, however, the respondent’s position is that it took appropriate steps in the circumstances to inform the complainant of and to obtain her consent to recording the sessions. It refers to the technical features (described above) of the online platform through which the virtual care sessions were conducted. These features were intended to notify session attendees that the session would be and/or was being recorded, and to provide attendees with the option to exit the platform prior to or at any point during the recording. Thus, while the respondent says that it has since improved its policies and practices around recording virtual care sessions (as I will discuss further below), it says that in the circumstances, it acted reasonably and in compliance with PHIPA.

[21] In response, the complainant is adamant that she never gave any consent to sharing her personal health information via the online platform. She says the respondent never discussed with her the purpose of the virtual care sessions, or the types of information that would be collected through the platform during these sessions. With respect to the specific issue of recording the sessions, the complainant maintains that she never saw any banner onscreen or clicked on any button during any of these sessions to indicate her consent to being recorded. She further observes that even in the absence of formal guidance, there existed at the time guidance from the College and the Canadian Dental Association on professional and ethical duties around informed consent. She says that even without formal guidelines, “it should be self-evident that recording a patient in distress without notice is unacceptable.”

[22] I find that in conducting virtual care sessions through the online platform, the respondent “collected” and “used” personal health information within the meaning of those terms in PHIPA.[4] The respondent similarly collected and used personal health information whenever it recorded any of these sessions, and relied on and retained these recordings for purposes including the provision of health care.

[23] Section 29 of PHIPA requires that all collections, uses, and disclosures of personal health information be made with consent, unless they are otherwise authorized by PHIPA to be made without consent.

[24] Consent under PHIPA may be express or implied. In either case, a consent must be valid. The conditions for a valid consent are set out in section 18 of PHIPA. Among other requirements, the consent of the individual must be knowledgeable, must relate to the information at issue, and must not be obtained through deception or coercion [section 18(1)]. Consent is knowledgeable if it is reasonable in the circumstances to believe that the individual knows the purpose of the given collection, use or disclosure, and that the individual may give or withhold consent [section 18(5)]. Custodians are entitled to assume the validity of consent, and that the individual has not withdrawn consent, unless it is not reasonable to do so [section 20(1)].

[25] On the matter of whether the complainant was aware of and consented to the sharing of her personal health information through the online platform, the parties have given opposite accounts. In the circumstances, I accept the respondent’s evidence that the complainant consented to participating in the virtual care sessions, and in doing so was aware that her personal health information would be collected and used through the platform on which the sessions were conducted. It is difficult to imagine that the complainant logged onto the platform to participate in these sessions without any awareness that her personal health information would be shared through the platform. Of course, this does not detract from the respondent’s responsibility to ensure it had the complainant’s valid consent for the collection and use of her personal health information, including by informing her of the purposes of the collection and use, and of her right to withhold or withdraw her consent at any time, among other obligations.

[26] On the matter of recording the three virtual care sessions at issue, the respondent has acknowledged that it did not have advance discussions with the complainant to explain its intention to record and its purpose in recording the sessions. Through this complaint process, the respondent has explained that it believed video recordings of these particular sessions was necessary to ensure appropriate care and continuity of care for the complainant.

[27] An explicit discussion in advance about the respondent’s intention to record these sessions could have helped to address some of the concerns the complainant has raised in this complaint. Among other things, an advance discussion could have given the respondent an opportunity to clearly explain its reasons for wanting to record the sessions, and to hear the complainant’s reservations about recording. Such a discussion might have given the parties an opportunity to address these reservations, and/or to propose mutually agreeable alternatives to recorded sessions.

[28] The respondent acknowledges that the IPC, in its guidance to custodians on conducting virtual care sessions, recommends that custodians only record sessions where necessary, and that custodians obtain express (i.e., not implied) consent when recording a virtual health care session.[5] Although the IPC’s guidance was issued after the events giving rise to this complaint, the respondent reports that since receiving the complaint, it has made changes to its policies and practices around virtual care to incorporate the IPC’s guidance, as well as guidance from its College, neither of which was available to it at the time of the events.[6] The respondent confirms that among other updates to its policies and practices on virtual care sessions, it now obtains express consent[7] from a patient to record a virtual care session.

[29] I have considered all the circumstances of this complaint, including that the respondent implemented virtual care sessions as a novel means to provide health care in the early months of the COVID-19 pandemic, and in the absence of formal guidance on this topic from its regulatory college or the IPC. I have considered the measures the respondent took, in the absence of this formal guidance, to address the security of its patients’ personal health information in providing health care through virtual means. These included securing an online platform that the respondent believed to be compliant with relevant privacy legislation, and seeking consent from patients to collect and use their personal health information through the online platform for virtual care sessions.

[30] With respect to the specific issue of recording the virtual care sessions through the platform, the complainant has been clear that she did not see any pop-up notice of recording prior to any recording, or any visual indicator during recording informing her that the session was being recorded. I also understand her to be saying she did not see any of the other technical features described by the respondent, including the option to exit a session before recording began. Despite this, I find credible the respondent’s explanation that these technical features are part of the online platform, and were present (i.e., were not disabled) for any recording it made through the online platform, including those at issue in this complaint.

[31] In any event, however, I am not persuaded that a patient’s failure to exit a virtual care session after the presence of a pop-up and a visual indicator of recording should be interpreted as a patient’s express consent to recording. I agree with the IPC guidance, cited above, that in situations of collecting and using personal health information through a virtual care platform, the custodian should obtain informed consent from its patients, including by ensuring that patients are aware of the risks and limitations of virtual care, and of their ability to withdraw their consent at any time. With respect to the recording of virtual care sessions in particular, I agree with the IPC’s guidance that obtaining express,[8] rather than implied, consent in these situations is the preferred means of ensuring that the patient’s consent complies with PHIPA, including all the requirements of a valid consent under section 18.

[32] Obtaining express consent in these circumstances could mean having advance discussions with a patient about a custodian’s intention to record a virtual care session and its purposes in doing so, and documenting the patient’s positive act of agreement to the recording (for example, through the signing of a consent form, or an oral assent to being recorded). As noted, the respondent has since updated its policies and practices around virtual care, including by now seeking express consent to record any virtual care sessions.

[33] I understand the complainant continues to question the respondent’s motives for recording the virtual care sessions at issue. She reports that in different proceedings arising from these same events, the respondent has given different reasons for making the recordings. For instance, she says that the respondent has at various times said the recordings were started inadvertently, or were made intentionally to ensure continuity of care and to ensure accurate documentation, or were made intentionally to allow the respondent to focus on the complainant and her needs rather than on notetaking during their sessions. She finds these different explanations to be mutually inconsistent, and she proposes that the real purpose of the recordings was liability protection, not continuity of care. I understand the complainant to be proposing this is an illegitimate purpose under PHIPA.

[34] As noted, PHIPA requires that any collection, use, or disclosure of personal health information based on consent be, to the best of the custodian’s knowledge, “necessary for a lawful purpose.”[9] While this phrase is not defined in PHIPA, the IPC has said that a plain reading indicates that, at a minimum, the custodian must not be aware that the collection, use, or disclosure is for a purpose contrary to law.[10] The complainant’s evidence does not persuade me that the collections and uses at issue in this complaint were done for purposes contrary to law. And as I have noted, the respondent has since updated its policies and practices around virtual care to incorporate relevant IPC guidance, including the guidance that any recording of virtual care sessions only be done when necessary and on the basis of express consent.[11] I am satisfied that this aspect of the complaint has been adequately addressed.

[35] In summary, although the respondent’s practices around the recording of virtual care sessions did not conform with guidance later issued on this topic by the IPC and the College, I am satisfied that the respondent has since taken steps to better comply with PHIPA, including with the requirements around valid consent. In this regard, I find the respondent has adequately responded to this complaint about its collection and use of personal health information. I conclude there are no reasonable grounds to proceed to a review of this matter under PHIPA.

There is no useful purpose in proceeding to a review

[36] I have also considered additional circumstances supporting my decision not to proceed to a review on this matter.

[37] The first is the existence of proceedings in other forums involving the same parties and arising from the same underlying facts. These include proceedings before the College and a civil matter arising from allegations the complainant made against the respondent and named dentists relating to their actions and conduct in providing health care to her.

[38] As noted above, section 57(4) of PHIPA sets out the IPC’s authority not to review the subject-matter of a complaint for whatever reason it considers proper, including on certain specified grounds. One of these grounds, at section 57(4)(b), is the existence of another procedure that has dealt with, or could more appropriately deal with, the complaint before the IPC. The thrust of section 57(4)(b) is to confer a discretion on the IPC not to proceed with a complaint where doing so would amount to a re-litigation of issues addressed in another forum, or where a complaint to the IPC is premature.[12]

[39] In PHIPA Decision 80, the IPC considered the application of section 57(4)(b) in deciding whether to conduct a review of a complaint that had already been the subject of other proceedings. In that decision, the IPC concluded that it was appropriate to take notice of the existence of the other proceedings, and of the issues considered in those proceedings, for the limited purpose of deciding whether they had appropriately dealt with the matter brought to the IPC, and thus whether the IPC should exercise its discretion under PHIPA not to review the matter.[13] The IPC set out some factors for consideration in its exercise of discretion. They include: the issues in the other procedure, and how they relate to the issues before the IPC; the purpose and scope of the other procedure; the jurisdiction of the body conducting the other procedure; whether the other procedure was procedurally fair to the parties; and whether it would be unfair or unjust not to proceed with a review in the circumstances. These questions assist in determining whether the substance of a complaint has been “appropriately dealt with,” and whether, in any case, fairness to the parties militates in favour of reviewing the matter.[14]

[40] The complainant asks the IPC to proceed with a review despite the existence of other proceedings she has commenced against the respondent before the College and in Small Claims Court, because, she says, the IPC has a different mandate than those bodies and can make orders under PHIPA to remedy the privacy violations she has experienced.

[41] While the different mandates of the various bodies is one factor to consider, I would also have considered the nature of the issues the complainant raised before the IPC, and the remedies she seeks. In her complaint to the IPC, the complainant raises concerns about the conduct of the respondent and its recordkeeping practices that are better addressed through the respondent’s regulatory body. These include concerns that additional agents of the respondent were present at some of her health care appointments without her knowledge or consent, and that the respondent had a practice of “over-documenting” some of her health care sessions, by which I understand the complainant to mean the respondent documented these sessions through video recording as well as various forms of notetaking. The complainant believes the respondent’s manner of documenting these sessions is excessive and an “indicator of defensive intent.” The appropriateness of the respondent’s decisions around the provision of care to the complainant, and its manner of documenting that care, is not a matter for the IPC to address under PHIPA.

[42] Another factor concerns the nature of the remedies the complainant seeks for the harms she describes, including lasting traumatic psychological impacts. She says that given her evidence that the respondent made the video recordings at issue to protect itself from liability, dismissing the complaint will only increase motivation among custodians to violate privacy laws for self-serving purposes.

[43] The IPC’s powers to make orders and to impose other remedies arises only after it has conducted a review under PHIPA.[15] I found above that the complaint has been adequately addressed by the respondent, and does not warrant a review in the circumstances. Even if I decided that a review was warranted, it is not evident that the specific remedies the complainant seeks would be appropriate or legally available in the circumstances. For instance, the requested order for deletion of the video recordings would require, among other things, a determination that deletion (or “disposal”) of the recordings would not reasonably be expected to adversely affect the provision of health care to an individual.[16] It is not evident that this condition would be met. Additionally, with respect to the complainant’s proposal for fines on the respondent and specified dentists, the IPC’s new power to impose administrative monetary penalties came into effect well after the date of the events at issue, and the filing of this complaint.[17]

[44] These additional considerations support my decision that no useful purpose is served by a review of the complaint.

[45] Lastly, the complainant expresses an interest in obtaining logs of the virtual care sessions at issue, so that she can examine any stored details about the recording activities. She proposes to make the request directly to the provider of the platform. Any such request she decides to make is outside the scope of this complaint, and not for me to address here.

NO REVIEW:

For the foregoing reasons, no review of this matter will be conducted under Part VI of PHIPA.

Original Signed by:		October 30, 2025
Jenny Ryu
Adjudicator