Interim Order to Protect Health Records: PHIPA Decision 23
On January 14, 2016, the IPC issued an interim order under PHIPA directing the landlord of a premise containing abandoned health records to ensure the security of the records for two months, pending the completion of an ongoing IPC review.
The review under PHIPA had been initiated after the IPC received notice that three health services clinics (the “Clinics”) had made assignments in bankruptcy and that health records on the Clinics’ premises (the “Records”) had subsequently been abandoned. This information gave the IPC reasonable grounds to believe that the Clinics and the estate trustee of the Clinics may be, or may have been, health information custodians (“HIC”) and in this role, contravened PHIPA by failing to: (a) ensure that the Records were retained, transferred or disposed of in a secure manner; and (b) take steps that were reasonable in the circumstances to ensure the Records were protected against theft, loss and unauthorized use, disclosure, copying, modification, or disposal. In the early stages of the review, the IPC sought representations from the Clinics as it was concerned that the Records were at imminent risk of being lost, destroyed, disclosed or disposed of prior to the completion of the review.
Discussions between the IPC and some of the Clinics led to a resolution of concerns about the interim security of the Records at some premises that was satisfactory to the IPC. The IPC found, however, that an interim order was required to protect the Records at one Clinic location pending completion of the review. The landlord of this particular location had informed the IPC that its tenant, one of the Clinics, had vacated the premises on September 1, 2015 without notice and left Records behind. The landlord also indicated an intention to re-lease the premises as soon as possible, but did not confirm that it would keep the Records secure pending the completion of the IPC’s review, despite numerous requests from the IPC to do so. According to the landlord, it was concerned about storage costs and liability if it promised to keep the Records secure.
The IPC held that an interim order to protect the Records was justified in the circumstances, based in part on the fact that there was a potential for irreparable harms, including the theft, loss, destruction and disposal of the Records left in the premises, which would prevent individuals from requesting access to their own health records or to have these records used in their future health care. The IPC specifically ordered that the landlord secure the Records for a period of two months, by taking reasonable steps to ensure the PHI in the Records is protected against theft, loss, and unauthorized use or disclosure, and by agreeing not to dispose of, destroy or transfer the Records and/or the PHI in such Records, without the IPC’s prior written approval.
