PHIPA or FIPPA? PHIPA Decision 17
At the beginning of November 2015, the Information and Privacy Commissioner of Ontario (“IPC”) released PHIPA Decision 17, its first decision involving a combined complaint review under the Personal Health Information Protection Act, 2004 (“PHIPA”) and inquiry under the Freedom of Information and Protection of Privacy Act (“FIPPA”). The dispute in this case arose as a result of a decision made by a hospital in response to a request from a man (the “complainant”) for access to records relating to the birth and death of his infant daughter and the care provided to his wife and daughter at the hospital. The infant’s death was reported to the Coroner’s office and the hospital produced an internal investigation report regarding the incident. The complainant subsequently launched complaints about the doctors and nurses involved in his wife and daughter’s care to the College of Physicians and Surgeons of Ontario and the College of Nurses of Ontario. He also filed a lawsuit against the Hospital and certain staff.
The complainant made his initial access to information request in March 2012. Through discussions with the hospital, the request was clarified to include records generated by specified hospital teams, an internal review report, records of the hospital’s board, and email communications of named individuals. The hospital identified 1,473 pages of records as being responsive to the request and eventually provided full or partial release of 1,074 pages. Access to the remaining pages was denied on the basis of exclusions and exemptions in PHIPA and FIPPA. The complainant subsequently launched a complaint with the IPC.
The IPC’s decision involved a consideration of the status of the hospital under PHIPA and FIPPA, the proper understanding of the request made to the hospital, the application of PHIPA and FIPPA to the records, and the complainant’s right of access under PHIPA and FIPPA to the remaining records and parts of records to which the hospital denied access. The hospital had initially treated the complainant’s request as a request for access to information under FIPPA, in part because he had submitted a form to the hospital entitled “Freedom of Information Request”. The IPC explained that in order to determine which statute applies to which records, the focus should be on the context out of which the request arose and the nature of the information sought by the requester. In this case, the IPC stated that the hospital’s treatment of the request was too narrowly focused on the form rather than on the substance.
The IPC reviewed the requests and found that PHIPA applied, with one limited exception, to the complainant’s request on behalf of his wife and deceased infant daughter for access to their personal health information (“PHI”). A subset of the PHIPA records contained the complainant’s personal information and so was subject to both PHIPA and FIPPA, and the small number of records that related to the complainant’s own personal information contained in e-mail correspondence with the hospital, were governed by FIPPA. The IPC also found that the complainant was the substitute decision-maker for his wife and daughter under PHIPA.
The IPC then considered the hospital’s claims to deny access to information in the records on the basis of exclusions and exemptions in PHIPA and FIPPA, including:
Quality of care information
Legal privilege or information that relates to legal proceedings
Interference with law enforcement matter and/or serious threat to safety or health of an individual
Advice or recommendations that is subject to solicitor-client privilege
Advice or recommendations of a public servant, any other person employed in the service of an institution or a consultant retained by an institution
Closed meetings of hospitals
Personal privacy (e.g. staff members’ personal e-mail addresses and information about their personal activities)
The IPC largely upheld the hospital’s decision to refuse access to the remaining records and portions of records.
With respect to the complainant’s personal information in email records, the hospital relied on a number of FIPPA exemptions to deny access, including that the disclosure could reasonably be expected to interfere with a law enforcement matter or seriously threaten the safety or health of an individual. The IPC explained that for this exemption to apply, the hospital could not take the position that the harms were self-evident from the record or that the exemption applied simply because of the existence of an ongoing law enforcement matter. Instead, it had to provide detailed and convincing evidence about the potential for harm that goes well beyond the merely possible or speculative (although there is no need to prove that disclosure of the personal information at issue will in fact result in such harm).
In this case, the IPC did not accept the hospital’s arguments that its history of interactions and communications with the complainant gave rise to concerns about the safety of its staff and the complainant’s own health and safety.
The complainant submitted that the public interest override in section 23 of FIPPA applied to permit the disclosure of records containing his personal information that could otherwise be withheld under certain exemption in FIPPA. The IPC explained that for this exemption to apply, the following two requirements had to be met: (1) there must be a compelling public interest in disclosure of the records; and (2) this interest must clearly outweigh the purpose of the applicable exemption. In determining whether there is a “public interest” in disclosure of a particular record, it is important to consider the relationship between the record and FIPPA’s main purpose of shedding light on the operations of a public institution, such as the hospital. As explained by the IPC, a public interest will not exist where the interests being advanced are essentially private in nature, unless such private interest raises issues of more general application.
In this case, the IPC found that the public interest override did not apply, given that the complainant had a private interest in the records, rooted in his desire to come to terms with the circumstances of his daughter’s death. The IPC did not find that there was a wider interest in this private matter between the hospital and the complainant’s family, or a broader public interest in systemic issues regarding the care provided to the complainant’s wife and daughter at the hospital.
