INVESTIGATION REPORT

 

 

INVESTIGATION I94-042M

 

 

A MUNICIPALITY

 

 

 

 

 

 

 

 

 

 

November 28, 1994

INTRODUCTION

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a regional municipality (the Municipality).

 

The complainant stated that the Municipality had improperly disclosed that he was HIV-positive to a home care company (the Company), providing services to his mother.

 

The complainant lived with his mother who had suffered a stroke, and was her primary care giver.  The complainant's mother was receiving social assistance which included the provision of home care support by the Company.  As a result of his mother's subsequent loss of speech caused by her stroke, the complainant was acting as an intermediary between her and her Case Social Worker (the Case Worker) with the Municipality.

 

Soon after he was diagnosed as HIV-positive in August 1993, the complainant appealed to the Municipality to increase his mother's home care support as he and his doctor felt that the added stress of caring for his mother would be detrimental to his own health.  At that time, the complainant had only informed the Municipality that he was suffering from a chronic health condition. 

 

The Municipality denied the complainant's request for increases in his mother's home care.  The complainant then decided to disclose his HIV status to the Municipality in the hope that revealing the seriousness of his condition would influence the Municipality to extend further benefits to his mother.  The complainant authorized a hospital social worker who was advocating on his behalf, to disclose his HIV status to the Case Worker in November 1993.  The Case Worker in turn discussed the matter with her supervisor (the Supervisor).

 

In December 1993, the Case Worker contacted the complainant.  According to the complainant, the Case Worker informed him that she had no choice but to disclose his HIV status to the Company in order to protect the Company's home care providers. Although he requested that his status be kept strictly confidential, the Case Worker indicated that it was her intention to disclose this information, regardless of his wishes. 

 

The complainant then contacted the Supervisor and spoke with him at length.  The Supervisor told the complainant that he wished to do more research on the matter, but that in the interim, there would be no disclosure of his HIV status.  In later contact with the complainant, the Supervisor assured him that there would be no disclosure of his personal information without his consent.

 

In June 1994, the complainant telephoned the Manager of the Company to request a replacement for his mother's home care provider.  The complainant said that during this conversation, he learned that the Company already knew of his status.  The complainant stated that both the Manager and a Company Nurse admitted to having received this information from the Municipality, but they could not remember who had disclosed it to them.  The complainant believed that the Municipality had violated his privacy by disclosing his sensitive personal information to the Company, in contravention of the Municipal Freedom of Information and Protection of Privacy Act (the Act).

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information" as defined in section 2(1) of the Act?  If yes,

 

(B)       Did the Municipality disclose the complainant's personal information to the Company?  If yes,

 

(C)       Was the Municipality's disclosure of the complainant's personal information in compliance with section 32 of the Act?

 

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(h)        the individual's name if it appears with other personal information relating to the individual...

 

The information in question was the complainant's name together with the fact that he was HIV positive.  It is our view that this information satisfied the requirements of paragraph (h) of the definition of "personal information", in section 2(1) of the Act.

 

 Conclusion:   The information in question was "personal information" as defined in section 2(1) of the Act.

 

 

 

 

Issue B:           Did the Municipality disclose the complainant's personal information to the Company?

 

The Municipality stated that there had been no disclosure of the complainant's personal information to the Company.

The Municipality explained that, upon learning of the complainant's HIV status, the Case Worker had discussed the case with the Supervisor.  She and the Supervisor had discussed what health exposure problems existed for the home care providers and what the liability aspects were for the Municipality vis à vis the Company.   It was decided that the Case Worker would phone the complainant to discuss the issues of concern, and that she would also contact the Company to advise that there might be a potential health risk in the complainant's home and that precautions should be taken to ensure proper protection.

 

The Municipality said the Case Worker recalled that during her telephone conversation with the complainant, she had advised him "of her intention to bring her concerns about exposure to infections" to the Company's attention, and that it was her clear understanding and recollection that the complainant had understood her concerns and had agreed to her intention to contact the Company about these concerns.

 

The Municipality said that during her telephone conversation with the Manager of the Company, the Case Worker had expressed her concerns about the well-being of the Company's employees working in the complainant's residence, and had told the Manager that the employees should take precautions against infection.  The Case Worker recalled that the Manager might have commented that they had suspected there might be an infectious disease since the complainant did not look like a well person.  The Municipality further stated that the Case Worker could not recall if she had mentioned "HIV/AIDS," but she felt she would not have been that specific.

 

The Municipality said that the Supervisor had then telephoned the Manager and had generally inquired into the procedures the Company used in cases of infectious diseases.  The Municipality stated that the Manager had informed the Supervisor that the Company used "universal precautions."  (These are accepted procedures in home care and hospital settings to prevent the transmission of bloodborne diseases in those settings.)  The Municipality further stated that the Supervisor had informed the Manager that he would not be disclosing any personal information without written consent. 

 

We contacted both the Manager and the Company Nurse. The Manager informed us that an employee of the Municipality had disclosed the complainant's HIV status to her, but she could not remember which employee it was.   She said that although they knew the complainant was not well, they had not known his exact medical condition prior to the disclosure by the Municipality.  The Manager also stated that the Municipality had advised her that the complainant had consented to the disclosure of his HIV status to the Company, but that the complainant had changed his mind the next day and withdrawn his consent.

 

Although the complainant was of the view that the Municipality had also disclosed his HIV status to the Nurse, she informed us that she had learned of his status from the Manager of the Company and not from an employee of the Municipality.

 

Having considered the information provided to us, it is our view that the Municipality disclosed that the complainant had an infectious disease to the Company, and that in all likelihood, the Municipality disclosed that this infectious disease was HIV.

 

Conclusion:    The Municipality disclosed the complainant's personal information to the Company.

 

 

Issue C:          Was the Municipality's disclosure of the complainant's personal information in compliance with section 32 of the Act?

 

Under the Act, personal information in the custody or under the control of an institution cannot be disclosed except in the specific circumstances outlined in section 32.

 

The Municipality submitted that if we were to conclude that it had disclosed the complainant's personal information, it would rely on sections 32(b), (d), and (h) of the Act for the disclosure.

 

Section 32(b)

 

Section 32(b) of the Act states that an institution shall not disclose personal information in its custody or under its control except,

 

if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

As previously indicated, the Municipality stated that the Case Worker believed the complainant had consented to her disclosing his medical information to the Company.  However, the Municipality was unable to provide any information such as a signed medical release, to show that the complainant had identified his HIV status in particular and consented to its disclosure. The complainant has vehemently denied that he ever consented to this disclosure of his personal information, saying that if he had consented, he would not have filed a privacy complaint. 

 

Having considered both the Ministry's and complainant's comments, it is our view that the Municipality's disclosure of the complainant's personal information did not comply with section 32(b) of the Act.

 

Section 32(d)

 

Section 32(d) of the Act states that an institution shall not disclose personal information in its custody or under its control except,

 

if the disclosure is made to an officer or employee of the institution who needs

the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions;

 

The Municipality stated that section 32(d) was applicable since the Company was an agent of the Municipality and required "the information to take appropriate steps for their safety and protection." 

 

 

Regardless of whether the Company could be considered an agent of the Municipality, since the employees or officers of the Company were not directly employed by the Municipality, they were not employees or officers of an institution within the meaning of section 32(d) of the Act.  Therefore, the Municipality's disclosure of the complainant's personal information to the Company was not permissible under section 32(d) of the Act.

 

Section 32(h)

 

Section 32(h) of the Act states that an institution shall not disclose personal information in its custody or under its control except,

 

in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates;

 

The Municipality did not provide us with any evidence that there were compelling circumstances that affected the health or safety of an individual, or that notification as required had been sent to the complainant. 

 

As previously stated, the Municipality believed that the Company needed the information in order to protect the safety of its staff.  However, in our view, it was not necessary for the Company to be informed of the complainant's HIV status since it was a Company policy to use "universal precautions" as standard procedure.  It is our view that the Company's home care staff did not need to know the complainant's specific medical information in order to be safe, particularly since they were not providing care for the complainant but rather, for his mother.  

 

It is our view that the Municipality's disclosure of the complainant's personal information did not comply with section 32(h) of the Act.

 

We have examined the remaining provisions of section 32 and have found that none applied in the circumstances of this complaint.

 

Conclusion:    The Municipality's disclosure of the complainant's HIV status to the Company was not in compliance with section 32 of the Act.

 

 

SUMMARY OF CONCLUSIONS

 

●         The information in question was "personal information" as defined in section 2(1) of the Act.

 

●         The Municipality disclosed the complainant's personal information to the Company.

 

●         The Municipality's disclosure of the complainant's HIV status to the Company was not in compliance with section 32 of the Act.

 

RECOMMENDATION

 

The Municipality stated that it has "addressed the need of staff training for those who may contend with similar situations in the future.  Throughout this approach, the intent is the protection of one's personal privacy as being paramount to opposing interests." 

 

We recognize that competing interests such as health and safety must at times be placed ahead of privacy.  However, in this case, the Municipality did not demonstrate that competing interests were served by forfeiting the complainant's privacy.  We do not believe the Municipality needed to reveal the complainant's HIV status in order to protect the safety of the home care providers. 

Therefore, our recommendation to the Municipality is that it should take steps to include as part of its staff training, specific information about the requirements of the Act regarding the disclosure of personal information.

 

Within six months of receiving this report, the Municipality should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

 

 

 

Original Signed by:                                         November 28, 1994      

Ann Cavoukian, Ph.D.                                    Date

Assistant Commissioner

 

 

 

****