PHIPA DECISION 328

Complaint HC25-00387

A named dentist/a named dental practice

PHIPA Decision 309

January 28, 2026

Summary: This decision addresses the complainant’s request for reconsideration of PHIPA Decision 309. PHIPA Decision 309 concerned a complaint about a named dentist and her dental practice’s collection and use of the complainant’s personal health information through its provision of virtual care through an online platform, and its recording of three virtual care sessions, along with its retention of those recordings. The complainant alleged these activities were done without her consent, in violation of PHIPA , and she asked that the recordings be deleted and fines be issued for breach of her trust.

In PHIPA Decision 309, the adjudicator agreed there were deficiencies in the respondent’s practices around virtual care at the time of the events at issue. She concluded, however, that the respondent had taken reasonable steps to address these deficiencies, and had responded adequately to the complaint. She declined to conduct a review of the complaint under PHIPA .

In her request for reconsideration of PHIPA Decision 309, the complainant alleges fundamental defects in the adjudication process and other errors and omissions in the decision. In this reconsideration decision, the adjudicator finds the complainant has not established any ground for reconsideration of PHIPA Decision 309. She denies the reconsideration request.

Statutes Considered: Personal Health Information Protection Act, 2004 , SO 2004, c 3, Sched A, sections 18 , 29 , 57(3)  and (4) , and 61 .

Decisions Considered: PHIPA Decisions 25 and 309.

OVERVIEW:

[1] In this decision, I consider the complainant’s request for reconsideration of PHIPA Decision 309, in which I declined to conduct a review of her complaint against a named dentist and a dental practice under the Personal Health Information Protection Act, 2004  (PHIPA ). As in that decision, in the discussion that follows I will refer to the dentist and the dentist’s practice interchangeably as the “respondent.” For reasons set out further below, I deny the complainant’s reconsideration request.

[2] PHIPA Decision 309 arose from the complainant’s discovery, after requesting her patient files from the respondent, that the respondent had made video recordings of three virtual care sessions she had with two different dentists working for the respondent. The complainant said she had been unaware these sessions were being recorded, and had not consented to the recordings. She alleged that the recordings were made and retained in violation of PHIPA . She asked the Office of the Information and Privacy Commissioner of Ontario (IPC) to investigate the matter and to make orders under PHIPA  to remedy the harms she experienced, including the breach of her trust.

[3] In PHIPA Decision 309, I found that the respondent is a health information custodian governed by PHIPA  in its handling of personal health information, including when it collected and used the complaint’s personal health information in conducting virtual care sessions with her via an online platform, and in recording three of those sessions and retaining the recordings. As a result, to comply with PHIPA , the respondent’s collections and uses of this information had to be made with consent, or otherwise authorized by PHIPA  to be made without consent (section 29).

[4] The complaint giving rise to PHIPA Decision 309 arose from the parties’ different accounts of whether the complainant had consented to the respondent’s collection and use of her personal health information, both in respect of its provision of health care to her through the online platform, and its recording of (and its retention of the recordings of) three virtual care sessions conducted through the platform. As I discuss further below, the respondent described the practices it had in place at the relevant time to obtain patient consent to conduct virtual care sessions, and to record the sessions. The complainant maintained that she never gave any consent to sharing her personal health information through the online platform, or to recording the sessions at issue.

[5] In arriving at my findings in PHIPA Decision 309, I considered all the circumstances, including the requirements of PHIPA  with respect to consent, and the parties’ different accounts of the events at issue. I also considered the context in which the events took place. As noted in PHIPA Decision 309, the sessions at issue occurred in late 2020 and early 2021, in the months following the worldwide COVID-19 outbreak, at a time when the provision of virtual care was a relatively new undertaking for health care providers like the respondent, and when there existed no formal guidance on this topic from the IPC or the respondent’s governing body, the Royal College of Dental Surgeons of Ontario (the College). I took into account that at the time of the events, the respondent had in place policies and practices around virtual care that it believed, based on its research and knowledge at the time, to comply with relevant privacy legislation. I also considered that since the events, the respondent had made changes to these policies and practices to incorporate guidance later issued on this topic by the IPC and the College.

[6] In PHIPA Decision 309, I found there were deficiencies in the respondent’s policies and practices around virtual care at the time of the events at issue, including in the adequacy of the notice it provided to the complainant about recording. Taking into account all the circumstances, I declined to proceed to a review under PHIPA . Among other reasons, I was satisfied that the respondent had taken steps since the time of the events to better comply with PHIPA , and had adequately responded to the complaint. I also noted additional circumstances supporting my decision not to proceed to a review. These included the existence of proceedings in other forums involving the same parties and the same underlying facts, and the nature of the remedies sought by the complainant.

[7] After receiving PHIPA Decision 309, the complainant asked for reconsideration of the decision. She asserts there was a fundamental defect in the adjudication process, and that the decision contains errors or omissions warranting reconsideration.

[8] For the reasons set out below, I deny the complainant’s reconsideration request.

DISCUSSION:

Are any of the grounds for reconsideration present?

[9] Section 64(1)  of PHIPA  provides for reconsideration of orders made following a review under PHIPA . This section states:

After conducting a review under section 57 or 58 and making an order under subsection 61 (1), the Commissioner may rescind or vary the order or may make a further order under that subsection if new facts relating to the subject-matter of the review come to the Commissioner’s attention or if there is a material change in the circumstances relating to the subject-matter of the review.

[10] Section 64(1)  of PHIPA  does not apply to the complainant’s request for reconsideration. In PHIPA Decision 309, I found no reasonable grounds to review the complaint, and thus I conducted no review and issued no order.

[11] In addition to the power under section 64(1)  of PHIPA , the IPC has recognized its discretion to reconsider a decision on other grounds. These are set out in the IPC’s Code of Procedure for Matters under the Personal Health Information Protection Act, 2004  (the Code ), which governs IPC proceedings under PHIPA . Section 27.01 of the Code  states:

The IPC may reconsider a Decision at the request of a person who has an interest in the Decision or on the IPC’s own initiative, where it is established that:

a) there is a fundamental defect in the adjudication process;

b) there is some other jurisdictional defect in the Decision;

c) there is a clerical error, accidental error or omission or other similar error in the Decision; or

d) new facts relating to an Order come to the IPC’s attention or there is a material change in circumstances relating to the Order.

[12] The reconsideration power is not intended to provide a forum for re-arguing or substantiating arguments made (or to raise arguments not previously made) during a review, nor to address a party’s mere disagreement with a decision or legal conclusion.[1] As noted in PHIPA Decision 25, the Supreme Court has acknowledged the sound policy basis for recognizing the finality of proceedings before administrative tribunals.[2]

[13] The complainant seeks reconsideration of PHIPA Decision 309 on the basis there was a fundamental defect in the adjudication process (paragraph (a) of section 27.01) and errors or omissions in the decision [paragraph (c)] of the Code . I will consider each of these claims in turn.

Allegation of a fundamental defect in the adjudication process

[14] Under this heading, the complainant says that my failure to compel and to consider certain evidence before arriving at my findings in PHIPA Decision 309 amounts to a fundamental defect in the adjudication process. Specifically, she says it was a “core process defect” for me not to compel production of the video recordings and of the native platform audit logs of the recordings. She says the video recordings would show “whether any verbal consent was sought or obtained,” while the native platform audit logs would show whether recording banners appeared, whether the banners required an active click-through and whether she in fact clicked through, whether pop-ups were present or were suppressed, and any recording starts and stops.

[15] By way of background, in PHIPA Decision 309, I considered the practices the respondent had in place, at the time of the events at issue, for obtaining patient consent to conduct virtual care sessions through the online platform, and consent to record sessions.

[16] The respondent explained that its practice before scheduling any virtual care session with a patient through the platform was to ask the patient for oral consent to the respondent’s entering the patient’s personal health information into the platform. If a patient did not give this consent, then the virtual care session would not be scheduled. The respondent said that in accordance with this practice, it documented the complainant’s oral consent to its entering her personal health information into the platform and conducting virtual care sessions with her through the platform.

[17] With respect to the recording of the three virtual care sessions in particular, the respondent acknowledged that it did not have advance discussions with the complainant about its intention to record. The respondent said it made the recordings because of the expected length and complexity of the discussions at these sessions, and the need to ensure the accuracy and completeness of its records of the sessions.

[18] The respondent relied on certain technical features of the online platform that are, by default, present before and during a recording as having provided notice of recording. Specifically, the respondent explained that any recording of a virtual care session through the platform triggers pop-up notices to session attendees, advising them that a recording will be taking place. Attendees are then given the option to continue with the virtual care session, or to leave the session if they do not agree to being recorded. In addition, for the duration of a recording, attendees’ screens display visual indicators reminding them that the session is being recorded. The respondent took the position that these features notified session attendees (including the complainant) that the sessions at issue would be and/or were being recorded, and of the option not to consent to being recorded (i.e., by exiting the platform and the online session).

[19] By contrast, the complainant maintained that she never gave any consent to sharing her personal health information through the online platform. She said the respondent never discussed with her the purpose of the virtual care sessions, or the types of information that would be collected through the platform during these sessions. With respect to the specific issue of recording, the complainant maintained that she never saw any of the technical features described by the respondent, either before or during the recording of any of the sessions, so was never aware the recordings were being made or that she could opt out of the recordings.

[20] In her reconsideration request, the complainant proposes that in the face of these opposing accounts, I ought to have obtained additional evidence in the form of the video recordings themselves, and the audit logs of the recordings. She says that without this evidence, “there is no credible proof that consent was obtained.” She argues that the onus in PHIPA  was on the respondent to provide meeting-specific audit logs to prove its claims about consent and the existence of the technical features it described, and that its failure to provide this proof is evidence there was no consent. She alleges that by relying on the respondent’s unverified account, I shifted the burden of proof away from the respondent, which she says is a flaw in the adjudication process.

[21] Related to this claim, she says that my failure to obtain this additional evidence “effectively blurs the line between consent to use the platform and consent to recording.” She reiterates her submission, made during the complaint, that she did not log onto the platform for the virtual care sessions thinking or understanding that she was going to be recorded. She suggests that PHIPA Decision 309 contains an interpretation of PHIPA  that would mean every time a person logs onto a healthcare platform, she is implicitly consenting to being recorded and to having that recording retained indefinitely.

[22] I disagree with the complainant’s claim that PHIPA Decision 309 elided the issues of consent to participating in virtual care sessions and consent to recording those sessions. These matters are addressed as separate issues throughout PHIPA Decision 309, including at paragraphs 22, 25, and 26-31.

[23] I also reject the claim that PHIPA Decision 309 contains a finding that a patient’s consent to participating in a virtual care session may be treated as a valid implied consent under PHIPA  to having those sessions recorded and retained indefinitely. In fact, I found the opposite in PHIPA Decision 309. I found that any recording of virtual care sessions should be done with express, rather than implied, consent, and I described some ways to obtain express consent (paragraphs 27 and 30-32). I also found that the technical features of the platform relied on by the respondent (e.g., pop-up notifications and visual indicators of recording) cannot be interpreted as eliciting a patient’s express consent to recording.

[24] I understand the complainant’s main objection to be that I found credible the respondent’s explanation that these technical features of the platform (i.e., those notifying session attendees of an imminent and/or ongoing recording) are part of the online platform, and were present (i.e., were not disabled) for the recordings at issue in this complaint. As noted in PHIPA Decision 309, I made this finding despite the complainant’s assertion that she never saw any of these technical features during the sessions at issue. Noting that one of the recordings begins partway through a session, with the complainant in mid-sentence, she speculates that the respondent may have suppressed or configured the platform’s pop-ups and banners to prevent her from seeing them and from knowing about the recordings. I understand the complainant to be saying that if I had compelled the production of audit logs from the platform provider, I could have obtained proof of the respondent’s manipulation of the platform in this manner, and I would not have accepted the respondent’s account of events that is at odds with hers.

[25] The complainant characterizes my failure to have compelled and examined audit log evidence as an inversion of the burden of proof, which should normally fall on the respondent to demonstrate that the claimed breaches of PHIPA  did not occur. I disagree.

[26] While I considered the complainant’s different account of what she saw, I accepted and placed weight on the respondent’s statement that the pop-ups and other technical features of the platform were present before and during the recordings at issue. It was open to me to make this finding based on the evidence before me. The fact that I placed weight on the respondent’s evidence on this point does not amount to an inversion of the burden of proof. In addition, there is no basis for a claim of a procedural or other defect in the adjudication process because I did not compel from a third party evidence that would support the complainant’s account. It was open to the complainant to provide me with this evidence if she believed it to be relevant to the issues in the complaint.

[27] The complainant also takes issue with my failure to compel from the respondent the video recordings at issue in the complaint. She claims the recordings would show “whether any verbal consent was sought or obtained.” I understand the complainant to be proposing that the recordings would support her account that she was never asked for and that she did not give consent, during any of the three recorded sessions, to participating in the virtual care sessions or to having the sessions recorded.

[28] As noted in PHIPA Decision 309, the respondent did not claim to have sought or to have obtained during any of the recorded sessions the complainant’s consent to participating in the sessions, or to recording the sessions.[3] There was also no claim that the presence or absence of the pop-ups and other technical features described by the respondent could be confirmed from the video recordings themselves. In these circumstances, I found it unnecessary to have before me the video recordings to decide the issues raised by the complaint. This is consistent with the IPC’s practices in handling personal health information for the purposes of addressing a complaint, which reflect the limiting principles in PHIPA and are set out in the Code .[4] I do not find persuasive a claim that my failure to obtain personal health information not reasonably necessary for the purposes of the complaint was a fundamental defect in the adjudication process.

[29] While I have addressed the complainant’s main claims about defects in the adjudication process, it is important to note again here that while I accepted the respondent’s assertion that the technical features of the platform were present during the recordings at issue, I did not agree with its claim that these features, by themselves, could be treated as having elicited the complainant’s express consent to the recordings. My decision not to conduct a review of the complaint was based on all the circumstances, which included this finding about consent. Given this, I do not agree with the complainant’s suggestion that additional evidence of what exactly was said at the sessions, and about whether and when the platform’s technical features around recording were deployed, would have led to a different finding about this consent, and to a different decision on whether to conduct a review under PHIPA .

[30] Finally, I do not agree that my finding that the respondent adequately responded to the complaint, and my decision not to conduct a review on this basis, is itself a deficiency in the adjudication process. The complainant’s dissatisfaction with the outcome does not itself establish a deficiency in the adjudication process, or any other ground for reconsideration of the decision.

[31] I conclude that the complainant’s submissions on the need for additional evidence and records of personal health information do not establish a fundamental defect in the adjudication process. They also do not establish any other ground for reconsideration of PHIPA Decision 309.

Allegation of errors or omissions or other similar errors in the decision

[32] The complainant also made a number of submissions about errors and omissions in PHIPA Decision 309.

[33] The complainant takes issue with the respondent’s account of its purposes for making the recordings. In PHIPA Decision 309, I noted that the respondent said it recorded the three virtual care sessions at issue because of the expected length and complexity of the discussions at these sessions, and the need to ensure the accuracy and completeness of its records of the sessions.

[34] I also noted that the complainant questions the respondent’s motives for recording these sessions. In PHIPA Decision 309, I acknowledged the complainant’s assertion that the respondent has made different claims, at various times and in different proceedings involving these same events, about its reasons for making the recordings. The complainant reports that the respondent has claimed that that the recordings were started inadvertently, or were made intentionally to ensure continuity of care and to ensure accurate documentation, or were made intentionally to allow the respondent to focus on the complainant and her needs rather than on notetaking during their sessions. I acknowledged that the complainant finds these different explanations to be mutually inconsistent, and that she believes the real purpose of the recordings was liability protection, not continuity of care. I understood the complainant to be proposing this is an illegitimate purpose under PHIPA .

[35] In her reconsideration request, the complainant says the respondent’s admission that the recordings were intentional (rather than accidental) raises serious concerns about its decision to record a patient in visible distress without express discussion or consent. She says that the COVID-19 pandemic does not excuse the respondent’s deliberate choice to record without explicit consent, and that accepting the respondent’s reasons for wanting to record (i.e., to ensure the accuracy and completeness of its records of these sessions) sets a dangerous precedent that could permit custodians to secretly videotape their patients as a shortcut to proper charting.

[36] The complainant acknowledges that PHIPA Decision 309 finds that the respondent ought to have obtained express consent to record the sessions, and that the respondent did not obtain this express consent. However, the complainant says, the decision improperly focuses on the respondent’s later policy improvements and the early pandemic context, and “does not grapple with what it means for a practitioner to consciously bypass that standard.” She says that PHIPA Decision 309 fails to explicitly engage in the questions of whether charting convenience is a valid substitute for consent, and whether the consent met PHIPA ’s requirements of necessity and minimality.[5] She says I failed to address a number of other key points in the decision, including:

• That the treatment was not going well, and that the complainant was in ongoing pain and distress related to treatment choices and lack of consent around those choices, so that the complainant’s visible distress and emotional reactions are permanently captured on the recordings;
• That the respondent did not sufficiently explain why video recording was necessary in these circumstances, including why detailed notetaking would not have sufficed if its interest was in having complete and accurate records of the sessions;
• That there were already detailed chart notes and other records of these sessions, and the video recordings do not add any unique clinical content that is not already reflected in these other records; and
• That PHIPA and professional guidance emphasize that virtual appointments should be treated like in-person care, and that a dentist could not ethically or legally install a camera and record a distressed patient without explicit consent solely for the purpose of helping with charting.

[37] I understand the complainant to be saying that had I not made these errors and omissions, I would not have declined to review the complaint.

[38] These submissions do not establish an error or omission that warrants reconsideration of PHIPA Decision 309. To the extent the complainant proposes that additional analyses of the respondent’s compliance with PHIPA ’s rules around consent-based collection and use would have led to a different finding on consent for the recordings, and to a different decision on whether to conduct a review of the complaint, this claim has no merit. In PHIPA Decision 309, I found that the respondent ought to have had the complainant’s express consent to make the recordings at issue, and that it did not have this consent. As noted above, my decision not to conduct a review was made in consideration of all the circumstances, including this finding on consent.

[39] I also reject the complainant’s suggestion that PHIPA Decision 309 endorses a custodian’s surreptitious videorecording of patient sessions based on greater convenience to the custodian in recordkeeping. PHIPA Decision 309 contains no such statement, nor any finding about whether video recordings of patient sessions made on consent for purposes including accurate recordkeeping are “necessary for a lawful purpose” within the meaning of section 29 (a) of PHIPA . My only comment on this topic was that the complainant’s evidence did not persuade me that the respondent’s stated reasons for making the recordings are purposes contrary to law.

[40] I also disagree with the complainant’s suggestion that I gave undue weight to factors such as the respondent’s later updates to its policies and procedures, and the early pandemic context in which the sessions at issue took place. I found these factors to be relevant considerations in deciding that while there were deficiencies in the respondent’s practices around virtual care at the time of the events at issue, its later actions reflected an adequate response to the complaint. It was open to me to consider these relevant factors in exercising my discretion to decline to conduct a review under PHIPA . The complainant has not established that my consideration of these factors was an error in the decision within the meaning of paragraph (c) of section 27.01 of the Code .

[41] More broadly, I find that many of the complainant’s submissions under this heading consist of arguments that she raised, and that I considered, in arriving at my findings in PHIPA Decision 309. In this way, her submissions largely reflect her disagreement with my findings, and amount to a request that I revisit these findings in favour of an outcome she would prefer. As noted, however, the reconsideration process is not a forum for re-argument in the hopes of a better result. The complainant’s dissatisfaction with my findings is not a ground for reconsideration.

[42] Finally, I have also considered the complainant’s submissions on my discussion in PHIPA Decision 309 of certain additional circumstances supporting my decision not to review her complaint. These were the existence of proceedings in other forums involving the same parties and arising from the same underlying facts, and the nature of the remedies she seeks through her complaint to the IPC.

[43] In PHIPA Decision 309, I noted that the complainant had commenced proceedings against the respondent before the College and in Small Claims Court, arising from her allegations about the actions and conduct of the respondent and named dentists in providing health care to her. I recognized that the complainant asks the IPC to proceed with a review despite the existence of these other proceedings because the IPC has a different mandate than those bodies, and can make orders under PHIPA  to remedy privacy violations.

[44] While my decision not to proceed with a review in this case was not based on a finding that another procedure has dealt with, or could more appropriately deal with, the complaint before the IPC,[6] I noted the purposes of this discretion available to the IPC not to conduct a review. In this context, I observed that some of the issues raised in the complaint to the IPC concern the respondent’s conduct and its decisions around the provision of care to the complainant. I noted these are matters better addressed through the respondent’s regulatory body than through a complaint to the IPC.

[45] I also noted the nature of the remedies the complainant seeks. I said that even if I had concluded that the complaint should proceed to a review (which I did not), it was not evident to me that the requested order for deletion of the video recordings would be appropriate or legally available in the circumstances.[7] I noted that the specific order she seeks would require, among other things, a determination that deletion (or “disposal”) of the recordings would not reasonably be expected to adversely affect the provision of health care to an individual.[8]

[46] In her reconsideration request, the complainant explains why she has pursued her allegations against the respondent in various forums. She says that while the College process addresses professional conduct and standards, and the Small Claims Court process is focused on monetary remedies, neither process can address the video recordings themselves, which she seeks to have deleted through an order from the IPC.

[47] She explains why she believes deletion of the video recordings would not reasonably be expected to adversely affect the provision of health care to her or to anyone else, and so would meet the conditions for this kind of order under PHIPA . She says no adverse effects could reasonably be expected because she does not currently receive health care from the respondent, and because, in her view, the video recordings were not necessary and do not add any unique clinical content that is not already reflected in other records of the sessions. She also explains how deletion of the video recordings would positively affect her health, by helping to address the trauma and other psychological harms she has experienced and continues to experience from the respondent’s recording of the sessions without her knowledge and consent.

[48] Through these submissions, I understand the complainant to be saying that I failed to properly consider the significant harms she experienced and the ameliorative effects of the specific remedy she seeks. She also suggests that I improperly considered other proceedings that cannot provide her with this remedy. I understand the complainant to be saying these are errors and omissions warranting reconsideration of the decision.

[49] As noted above, my decision not to conduct a review of the complaint was based on my consideration of all the circumstances, including my findings that there were deficiencies in the respondent’s practices around virtual care at the relevant time, and that it has since responded adequately to the complaint. I noted as additional circumstances the existence of other related proceedings involving the parties, and PHIPA ’s requirements around the specific remedies the complainant seeks. My decision not to conduct a review in this case was not based solely on these additional circumstances. I made no findings in PHIPA Decision 309 about whether the complaint had been, or could more appropriately be, dealt with by means of those other proceedings,[9] or whether the conditions for an order for disposal would be satisfied were I to conduct a review and then, at the conclusion of the review, decide to issue this particular order.[10]

[50] The complainant’s submissions on these topics do not establish an error or omission in the decision within the meaning of paragraph (c) of section 27.01 of the Code . They also do not establish a fundamental defect in the adjudication process, or any other ground for reconsideration of PHIPA Decision 309.

[51] For all the above reasons, I find the complainant has not established any ground for reconsideration of PHIPA Decision 309. I deny the reconsideration request.

NO RECONSIDERATION:

For the foregoing reasons, I deny the reconsideration request.

Original Signed by:		January 28, 2026
Jenny Ryu
Adjudicator