Commissioner finds custodians must exercise discretion when considering request for records by access parent

Requests from parents to access their children’s personal health information (“PHI”), particularly in connection with custody disputes, are the most common – and most challenging – issue faced by health information custodians, and the issue most frequently referred to legal counsel. These requests raise challenging questions about what entitlement, if any, a non-custodial parent may have, as well how to respond to the request. A recent decision by the Information and Privacy Commissioner (“IPC”) provides limited guidance to custodians in these circumstances, confirming only that discretion must be exercised.

A. Background

This complaint was brought by a father who had requested access to information related to any services that his children may have received from Family Services Peel (“FSP”). The father was divorced from the children’s mother. The mother had sole custody of the children, and the father only had a right of access.

The father requested the following information:

• List of dates of appointments that had been scheduled;

• Any documents provided to the children’s mother as part of the intake and referral process; and

• Any documents provided to the mother to execute the children receiving services from the organization.

FSP treated the father’s letter as a request for access to PHI, and wrote back advising that the request was denied. FSP based this denial on the Child and Family Services Act, which states that if a child is 12 or older, the child’s consent is required to permit a parent to access information.In response to this denial, the father filed a complaint with the IPC.

In response to the mediation phase of the complaint, FSP also took the position that the denial of the father’s request to access for information was based on sections 52 and 23 the Personal health Information Protection Act, 2004 (“PHIPA”). Section 52 permits an individual to access their own information, and section 23 identifies who may act as a substitute decision maker (“SDM”) and provide consent on an individual’s behalf.

FSP’s position was that since the father was not seeking access his own information, and was not an SDM, he had no right of access to the information.

During the mediation phase of the complaint, both parties made representations to the IPC. The parties were not able to reach a mediated solution, so the matter was put before an IPC adjudicator for decision.

B. IPC’s Decision

1. Information Requested Was PHI

The father argued that the information that he was requesting was not PHI, but rather was just administrative records. He was not requesting the actual counseling records, just the details of when the appointments for counseling had been scheduled, and any information provided to the mother about these counseling sessions.

However, IPC Adjudicator Jenny Ryu concluded that the information requested was PHI. At a minimum, the information sought by the father could identify FSP as a provider of health care to the children, which is explicitly included in the definition of personal health information at section 4(1)(b) of PHIPA. Moreover, Adjudicator Ryu concluded that it was consistent with the broad interpretation of PHI in PHIPA to find that even advising that the children were not receiving services from FSP would be the children’s personal information. Accordingly, the IPC neither confirmed nor denied whether the records sought by the father existed.

2. Father Did Not Have a Right of Access

Adjudicator Ryu went on to conclude that, if FSP did possess the records requested by the father, the father did not have a right to access these records. PHIPA only provides a right for an individual to access their own PHI, or for a lawfully authorized SDM to access that individual’s PHI.Section 23 of PHIPA establishes who may act as an SDM for a capable individual. Section 23(1) provides that for children under the age of 16 years of age, a parent can provide consent, unless the information relates to:

i. treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or

ii. counselling in which the child has participated on his or her own under the Child, Youth and Family Services Act, 2017

However, section 23(2) specifically states that a “parent” does not include a parent with a right of access. Accordingly, the father was not a substitute decision maker under PHIPA.

Moreover, even if the father was an SDM, section 23(3) further provides that in the case of a mentally capable child under the age of 16, a decision of the capable child in respect of his or her own personal health information prevails over a conflicting decision of the SDM.

3. FSP Failed to Consider Its Discretionary Authority to Disclose the Records

Although Adjudicator Ryu concluded that FSP had correctly determined that the father did not have a right of access, she also concluded that FSP had failed to consider whether it had discretionary authority to disclose the records under a number of potentially applicable provisions.

During the mediation phase of the complaint, the father provided additional information in support of his position that he was entitled to access to the information, including:

1. An email from the mother to FSP staff, in which the mother asks FSP staff to confirm for the father whether, as of the date of that email, the mother and children had attended any counselling appointments at FSP;

2. A court order in relation to the parents’ divorce requiring the mother to execute all consents necessary to permit the father “to obtain information about the children and their progress in counselling, if such access to information is permitted by the agency’s mandate”;

3. Section 16(5) of the Divorce Act, which states that unless a court orders otherwise, a spouse that has been granted access to “children of the marriage has the right to make inquiries, and to be given information, as to the health, education and welfare of the child.”

Adjudicator Ryu found that in light of this information, FSP had a duty to consider whether it was permitted to disclose the PHI under several potentially relevant provisions of PHIPA, specifically:

1. Disclosure with the consent of the custodial parent (in light of the email) or the children (who were now over 16 years of age) pursuant to section 29 of PHIPA;

2. Disclosure “for the purpose of complying with a summons, order, or similar requirement,” pursuant to section 41(1); and

3. Disclosure “permitted or required by law or by treaty, agreement or arrangement made under an Act” of Ontario or of Canada, pursuant to section 43(1).

Accordingly, Adjudicator Ryu sent this matter back to FSP to consider whether it should exercise its discretionary authority to disclose the records under one of the above provisions.

Further guidance as to how custodians are to exercise discretion to disclose PHI to an access parent will hopefully come through future decisions or guidance documents. For now, this decision confirms that custodians cannot simply dismiss requests for access to PHI records from access parents.

For assistance in responding to requests for access to records in challenging circumstances, please contact us.