Privacy Orders Address Deceased Individuals' Records
On January 8, 2016, the Information and Privacy Commissioner of Ontario (“IPC”) released four new decisions with respect to complaints made under the Personal Health Information Protection Act, 2004 (“PHIPA”): PHIPA Decision 19, 20, 21 and 22 (the “Decisions”). The Decisions, which were issued by Assistant Commissioner Sherry Liang, concern requests by individuals for the personal health information (“PHI”) of a deceased family member of the requestor. The Decisions raise important issues, including: the obligations of a health information custodian (“HIC”) under PHIPA in considering whether or not to disclose PHI about an individual who is deceased; the rights of individuals to complain to the IPC about a HIC’s decision not to disclosure this information; and the role of the IPC in inquiring into such a complaint.
Disclosure under Section 38(4) of PHIPA
Under PHIPA, a HIC may only disclose an individual’s PHI with the individual’s consent or the consent of the individual’s substitute decision-maker (“SDM”). Where an individual is deceased, consent to disclose his or her PHI may only be obtained from: (a) the estate trustee; or (b) the person who has assumed responsibility for the administration of the deceased’s estate, if there is no estate trustee. Under certain circumstances, however, PHIPA permits (and in some cases even requires) disclosure without consent.
Section 38(4) contains exceptions to the general rule requiring consent for the disclosure of PHI. The following provisions of PHIPA were specifically at issue in the Decisions:
subsection 38(4)(b)(ii), under which a HIC may disclose PHI about a deceased individual for the purpose of informing any person who it is reasonable to inform in the circumstances, of the fact that the individual is deceased, and the circumstances of death, where appropriate; and
subsection 38(4)(c), under which a HIC may disclose the PHI of a deceased individual to specified family members if they “reasonably require the information to make decisions about their own health care or their children’s health care.”
The Decisions involved consideration of a variety of circumstances, as well as submissions from various parties. Each of the Decisions involved a request for information by a family member of a deceased person where the estate trustee did not consent to the disclosure of the information sought. In each case, the IPC had to consider whether an exception under section 38(4) applied. In doing so, the IPC had the opportunity to consider the rights and obligations of requestors and HICs under section 38(4) and to provide guidance on the interpretation of this section.
Key Principles for Health Information Custodians from the Decisions
The Decisions contain a number of key takeaway points for health care institutions and providers to consider when responding to requests from individuals for disclosure of PHI records relating to a deceased family member. These principles are separated below in terms of those that apply to section 38(4) as a whole, and those that apply specifically to section 38(4)(b)(ii) or section 38(4)(c), respectively.General Principles Applicable to Section 38(4) – Exceptions to Requirement of Consent to Disclose Deceased Person’s PHI
If the conditions of any of the exceptions under section 38(4) are met, a HIC is permitted to disclose PHI relating to a deceased person without consent. Although it may be reasonable for a HIC to advise an individual seeking disclosure of a deceased person’s PHI to try to obtain consent, consent is not a requirement for disclosure under section 38(4).
Disclosure of a deceased individual’s PHI under section 38(4) is discretionary. This means that if the conditions of an exception under section 38(4) are met, a HIC may disclose PHI either verbally or in a record, but is not obliged to do so.
HICs have an “implied public statutory duty” to exercise their discretion under section 38(4) in accordance with proper considerations, and not in bad faith or for an improper purpose. This duty requires a HIC to turn its mind to the request for disclosure under section 38(4), to consider whether the person seeking the information meets the conditions for disclosure, and decide whether and how much information to disclose.
In response to a complaint under section 38(4), the IPC has no authority to order that a HIC disclose certain information. However, in circumstances where the issue is the improper exercise of discretion under section 38(4), or where a HIC has not turned its mind to whether the circumstances for disclosure under section 38(4) have been met in the face of such a request, the IPC may order the custodian to review the matter again, or provide comments or recommendations on the HIC’s exercise of discretion under the provision.
Principles Applicable to Section 38(4)(b)(ii) – Where PHI required for purpose of informing a person of the fact and circumstances of death
files (locked)
Under section 38(4)(b)(ii), a HIC is given discretion to decide whether it is “appropriate” to disclose PHI about the fact and circumstances of a death to an individual.
Disclosure under section 38(4)(b)(ii) is not limited to family members. The provision permits a HIC to inform “any person who it is reasonable to inform in the circumstances” as to the fact and circumstances of death. It is reasonable to expect family members to be included amongst those to whom disclosure undersection 38(4)(b)(ii) may be appropriate.
A HIC is entitled to take into account a compassionateneed for the information, in deciding whether and howmuch disclosure is “appropriate”.
Principles Applicable to Section 38(4)(c) – Where PHI requested reasonably required by family members to make health care decisions
The PHI of a deceased individual may be disclosed under section 38(4)(c) to the spouse, partner, sibling or child of this individual where the recipient reasonably requires it to make decisions about their own health care or their children’s health care.
In order to establish that disclosure is permitted under this section, the person requesting disclosure must be able to show a link between disclosure of the PHI of his or her family member and the ability to make informed decisions about his own health care or that of his children.
Section 38(4)(c) does not provide HICs with a broader discretion to disclose information for sympathetic or compassionate reasons.
There are no limits set out in section 38(4)(c) regarding the type of information that might be “reasonably required” by a family member in order to make informed decisions about health care. Information about mental illness, in particular, is not excluded.
Although information from a health care practitioner is not a precondition for disclosure under section 38(4)(c), supporting documentation from a physician establishing what information is being requested and how it is relevant to an individual’s ability to make informed decisions about his or health care or that of his or her children will help to establish that disclosure is permitted.
Where individuals are denied disclosure of a deceased family member’s PHI and they genuinely believe, or can establish, that the conditions under s. 38(4)(c) have been met, they have the right to seek the IPC’s assistance by filing a complaint.
For assistance with managing requests for PHI or any other privacy-related issues, please contact us.
