PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-030024-1

 

 

Ministry of Health and Long-Term Care

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NUMBER        PC-030024-1

 

 

MEDIATOR:                                                            Giselle Basanta

 

 

INSTITUTION:                                            Ministry of Health and Long-Term Care

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

On May 8, 2003 the Ministry of Health and Long-Term Care (the Ministry) notified this office of possible breach of the Freedom of Information and Protection of Privacy Act (the Act).

 

On February 17, 2003 the Ministry received a request in the form of a document entitled, “Consent to Disclose O.H.I.P. Records” authorizing the disclosure of a record of claims under the Ontario Health Insurance Plan (OHIP) relating to a named individual to a particular insurance company.  The individual specified in the consent form that the records to be disclosed to the insurance company were restricted to:

 

(a)                the period between January 1998 to the present and;

(b)               any records referencing medical services for hearing loss, ringing in the ears, tinnitus, headaches and head injury.

 

One of the Ministry’s claims assessors logged the request on its tracking system on February 18, 2003 from the insurance company the next day.  Another of the Ministry claims assessors was assigned the file on March 14, 2003 and she completed processing the request by retrieving and disclosing the records on March 17, 2003. 

 

Together with a Ministry form entitled, “Disclosure of Requested Information” dated March 17, 2003 the Ministry disclosed to the insurance company a decoded summary of OHIP claims relating to the individual between the specified time period and not just those claims referencing medical services for hearing loss, ringing in the ears, tinnitus, headaches and head injury as set out in the consent form. 

 

On April 1, 2003 a lawyer representing the individual advised the Ministry that the incorrect records had been disclosed to the insurance company.  The Ministry reviewed the file on April 2, 2003 and acknowledged that the complete decoded summary provided to the insurance company covered the time period specified, but did not take into account the restriction on the consent form to records relating to a specific set of medical services.

STEPS TAKEN BY THE MINISTRY:

 

Once the Ministry was aware that the incorrect records were disclosed to the insurance company, program staff advised the Regional Manager and the Ministry contacted counsel for the individual and immediately offered an apology. 

 

On April 8, 2003 the Service Manager notified the Ministry’s Security Manager and also advised the insurance company that the decoded OHIP summary relating to the individual contained incorrect information and was provided in error.  The Ministry requested that the incorrect record be returned and the correct records would be sent via mail.  On April 11, 2003 the correct records were mailed to the insurance company.  On April 17, 2003 the Ministry received the incorrect decoded OHIP summary from the insurance company. 

 

On May 1, 2003 the Service Manager advised the claims staff of the procedures regarding requests for OHIP summary information and of the consequences if procedures were not followed correctly.  The Service Manager also met with claims staff who deal with requests for OHIP summaries to review the procedures and explained a new procedure that each request for OHIP summaries will only be assigned to one claims assessor who will have responsibility for the file from beginning to end including accountability for the accuracy of any disclosure.  The Ministry’s procedures for handling requests for OHIP summaries are as follows:

 

•         Confirm there is a signed/dated original Authorization/Direction

•         Note any restrictions and record them on the request form

•         The request is assigned to one claims assessor immediately upon receipt who will be responsible for the completion of the request from start to finish

• Once the file is ready for mailing, the Service Manager reviews and signs the document verifying accuracy

 

On May 2, 2003 the Ministry confirmed the return of the incorrect record in writing with the insurance company, requested that any copies of the incorrect records should be destroyed and advised the insurance company that the correct records had been sent.  It is not clear, however, whether the insurance company had made copies of the records in question, and if so, whether such copies were subsequently destroyed.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act provides, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c)        any identifying number, symbol or other particular assigned to the individual,

…

The information contained in the records that were disclosed to the requester consist of a OHIP summary for the period January 1998 to March 14, 2003.  These records contain the name, date of birth, sex, OHIP number, and a summary of OHIP claims charged to the OHIP number the individual to whom it relates, including information relating to medical service providers, clinics attended, medical conditions treated, when the individual was treated and the fees billed for the medical services.  In my opinion, this information qualifies “personal information” as defined in section 2(1) of the Act.  The Ministry does not dispute this finding.

 

Was the disclosure of the “personal information” in accordance with section 42 of the Act?

 

Section 42 of the Act provides, in part:

An institution shall not disclose personal information in its custody or under its control except,

(a)        in accordance with Part II;

(b)        where the person to whom the information relates has identified that information in particular and consented to its disclosure;

…

The Ministry does not dispute that though the written consent received from the individual specified only those portions of the record containing information related to certain medical conditions were to be disclosed to the insurance company but the complete decoded summary was disclosed in error.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation.

 

1.         The information contained in the record that the Ministry initially disclosed to the insurance company is the personal information of the individual to whom it relates.

 

2.         The record disclosed to the insurance company did not conform to the instructions on the consent form provided by the individual and therefore the disclosure was not in compliance with section 42 of the Act, but was a result of human error.

 

3.         The Ministry addressed the breach in a timely fashion.  As soon as the Ministry was advised that the record disclosed to the insurance company contained information that did not conform to the instructions on the consent form, the Ministry acknowledged the error, offered an apology, and subsequently retrieved the record that it sent in error from the insurance company.  The Ministry then provided the insurance company with a record that contained the correct information.  Although the Ministry requested that the insurance company destroy all copies of the incorrect record, it is not clear if the insurance company confirmed that this is the case.  Therefore, I will be recommending that the Ministry confirm with the insurance company that it did not make or retain any copies of the record that was sent to it in error.

 

4.         The Ministry amended its procedures with respect to requests for OHIP summary and reviewed these procedures with staff in a timely and appropriate manner to minimize future risk of human error.

 

RECOMMENDATION:

 

I recommend that the Ministry obtain an assurance from the insurance company that it did not make or retain any copies of the record that was sent to it in error.

 

Within three months of the date of this report, the Ministry of Health and Long-Term Care should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

 

 

                                                                                                            December 9, 2003                  

Giselle Basanta

Mediator