Privacy Commissioner Can Review Exercises of Discretion by Health Information Custodians
Earlier this year, in PHIPA Decision 25, the Information and Privacy Commissioner of Ontario (“IPC”) denied the Ministry of Health and Long-Term Care’s (the “Ministry”) request for reconsideration of PHIPA Decision 19 – a decision in which the main issue was the IPC’s jurisdiction over complaints about refusals to disclose the personal health information (“PHI”) of deceased family members (see our blog post about it here). PHIPA Decision 25 is important because it suggests that the IPC has the authority to review complaints about wrongful exercises of discretion by health information custodians (“HICs”).
Review of PHIPA Decision 19
The portion of PHIPA Decision 19 at issue in PHIPA Decision 25 involved section 38(4) of the Personal Health Information Protection Act, 2004 (“PHIPA”), which states that a HIC “may” disclose PHI about a deceased individual where certain conditions are met. The Ministry argued in PHIPA Decision 19 that because its decision under section 38(4) of PHIPA was discretionary, the decision could not be characterized as a “contravention” of PHIPA. Furthermore, as such a decision was not a “contravention” of PHIPA, it could not be the subject of a complaint to the IPC, because section 56(1) of PHIPA limits complaints to circumstances in which someone has reasonable grounds to believe that another person “has contravened or is about to contravene” PHIPA or its regulations. The IPC adjudicator addressed this submission in PHIPA Decision 19 and concluded that a breach of the duty to exercise discretion based on proper considerations, in good faith or for a proper purpose amounted to a contravention of PHIPA. Ultimately, however, the adjudicator agreed with the Ministry that the complainant had not met the requisite conditions under section 38(4) and upheld the Ministry’s decision not to disclose the PHI of the complainant’s deceased brother on this basis.
Ministry’s Arguments
Despite the fact that no order was issued in PHIPA Decision 19, the Ministry asked for the decision to be reconsidered on the basis that the IPC made four errors in concluding that an exercise of discretion could give rise to a complaint under section 56(1). Specifically, the Ministry argued that the IPC:
failed to correctly define the term “contravention” in light of its grammatical and ordinary sense;
failed to consider the nature of a permissive power and the context of Part IV of PHIPA;
conflated the discretionary disclosure framework under PHIPA with the provisions under PHIPA and the Freedom of Information and Protection of Privacy Act (“FIPPA”) that permit an individual to exercise a right of access to certain information; and
failed to address the absence of specific language authorizing it to review an exercise of discretion, and failed to consider the availability of judicial review as a remedy for an alleged improper exercise of discretion if and when required.
PHIPA Decision 25
The IPC adjudicator ultimately concluded that these submissions amounted to an attempt to re-argue the issues decided in PHIPA Decision 19, a purpose which the reconsideration power is not intended to serve. Nonetheless, the adjudicator reviewed each argument and dismissed them in turn on the basis that the Ministry had not established any fundamental or jurisdictional defect that would give the IPC grounds to reconsider the decision.In support of its first argument that the IPC failed to correctly define the term “contravention”, the Ministry provided definitions and case law with respect to the term “contravene”. The IPC adjudicator found that the documents referred to by the Ministry in fact supported the finding from PHIPA Decision 19 that the failure to exercise a discretionary decision based on proper considerations, in good faith, or for a proper purpose could be considered a contravention within the context of section 56(1) of PHIPA. The adjudicator noted that the finding did not imply that the IPC would be able to decide on the correctness of the result of a discretionary decision and order the disclosure of PHI. Instead, PHIPA Decision 19 provides that where a HIC is found to have wrongfully exercised its discretion, the IPC would have the authority to order a HIC to review the matter again and/or to provide the HIC with comments and recommendations.
As part of the second argument that the IPC failed to consider the nature of a permissive power and the context of Part IV of PHIPA, the Ministry submitted that PHIPA Decision 19 could lead to results that were not contemplated by the legislature. Such unintended results could include complaints to the IPC regarding discretionary decisions to collect, use or disclose PHI under other sections of PHIPA. The IPC adjudicator responded to this argument by explaining that PHIPA Decision 19 did not determine the scope of the IPC’s authority with respect to these other discretionary decisions. At the same time, the adjudicator noted that the Ministry had not addressed how these decisions would be beyond the contemplation of the legislature if they involved a wrongful exercise of discretion.
The third argument that the IPC conflated the discretionary disclosure framework under PHIPA that permit an individual to exercise a right of access to certain information was rejected on the basis that it entailed a selective reading of PHIPA Decision 19, which failed to recognize that the adjudicator had distinguished discretionary disclosure decisions under PHIPA from the access provisions under PHIPA and FIPPA.
With respect to the fourth argument that the IPC failed to address the absence of specific language authorizing it to review an exercise of discretion, and failed to consider the availability of judicial review as a remedy, the IPC noted that the statutory purposes of PHIPA would not be served by requiring individuals with complaints about discretionary decisions made under PHIPA to bring “time consuming and expensive judicial review applications” when the IPC has been designated by the legislature as the tribunal with expertise to review and resolve disputes under PHIPA. Furthermore, the adjudicator noted that the finding that the IPC has jurisdiction to review exercises of discretion does not preclude court oversight at a later stage.
Implications
As a result of PHIPA Decision 25, it appears that exercises of discretion under PHIPA may be subject to review by the IPC. What remains to be clarified, however, is whether the authority to review discretionary decisions is applicable to all exercises of discretion or limited to those made under section 38(4) of PHIPA with respect to requests for disclosure of a deceased family member’s PHI. For the time being, the most prudent course of action would be for HICs to keep a detailed record of the factors considered in any exercise of discretion to disclose PHI. This would provide assistance in proving that the exercise of discretion was not based on improper consideration, in bad faith, or for an improper purpose if the decision later became the subject of a complaint and IPC review.
In our role as advisors to health care institutions and health care professionals, we frequently assist in responding to requests for personal health information. Please do not hesitate to contact us to learn more about how we can assist you as a health care professional or health care organization, or for further information about PHIPA.
