ORDER PO-3689

Appeal PA12-358

St. Joseph's Health Care London

January 20, 2017

Summary: An individual submitted a request to the hospital under the Freedom of Information and Protection of Privacy Act  for all records related to her during the time she was a medical resident at the hospital. The hospital granted partial access to the records identified as responsive. Some records were withheld in part or in full based on the labour relations and employment exclusion in section 65(6) or the exemptions in section 49(a), together with sections 14(1)(i) (security of a system) or 19 (solicitor-client privilege), and section 49(b) (personal privacy).

In this order, the adjudicator upholds the hospital’s claim of the section 65(6)3 exclusion and the section 19 exemption, but does not uphold section 14(1)(i). The adjudicator orders the records withheld on that basis disclosed to the appellant. Finally, the adjudicator partly upholds the hospital’s search, but orders it to conduct additional searches for records from the relevant time period of certain individuals and staff, including medical residents, given that records created or received by the latter individuals would be in its custody or control for the purpose of section 10(1). If new records are identified by these searches, the hospital is to issue a decision to the appellant accordingly.

Statutes Considered: Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F.31 , as amended, sections 2(1) definition of “personal information,” 10(1), 10(2), 14(1)(i), 19, 24(1), 49(a), 65(6)3, 69(2).

Orders Considered: Orders PO-3257, PO-3346, PO-3363, PO-3408 and PO-3642.

OVERVIEW:

[1]  This order addresses the issues raised by an individual’s request under the Freedom of Information and Protection of Privacy Act  (FIPPA  or the Act ) to St. Joseph’s Health Care, London (SJHC or the hospital) for access to the following information:

…copies of all records, documents, notes, information, communications (paper or electronic) relating to [me] from July 1, 2004 to present, in all offices of London Health Sciences Centre [LHSC] and St. Joseph’s Health Care and with all staff and residents of London Health Sciences Centre and St. Joseph’s Health Care, including but not limited to, the following:

1.   The Department of Diagnostic Radiology;

2.   Human Resources;

3.   Integrated Vice-President; and

4.   Medical Education and Medical Affairs.

In conducting your search, we request a search of all records relating to [named individual] with the following name variations: [10 specified variants].

[2]  Responding on behalf of both hospitals, SJHC issued an interim access decision with a fee estimate before issuing a final access decision in which partial access was granted to the responsive records. The hospital withheld some records in full or in part pursuant to the exemptions in sections 14(1)(i) (system or building security), 19 (solicitor-client privilege), 21 (personal privacy) and the exclusion in section 65(6) (employment or labour relations). SJHC also claimed that section 67 applied to two records. [1]

[3]  During mediation, the following occurred:

• The parties agreed that the appellant’s request would include human resources and administrative records.
• The parties agreed that the academic aspect of the request would be addressed by the University of Western Ontario [Western or the university]; [2] SJHC transferred some of the responsive records to the university. The appellant confirmed that the transferred records are not at issue in the appeal and those records are no longer at issue in Appeal PA12-358. [3]
• The appellant indicated that she was not pursuing access to any information in the records that is identified as: non-responsive, relating to other individuals or personal health information. [4]
• The appellant maintained that additional responsive records should exist because there were doctors, administrators, and residents communicating about her amongst themselves and using their hospital email accounts to do so. A search for human resources and administrative records did not capture records from these communications. The reasonableness of SJHC’s search was added as an issue on appeal.
• As the records appeared to contain the personal information of the appellant, the mediator raised the possible application of sections 49 (a) and (b) of the Act .

[4]  Mediation did not resolve the appeal and the file was moved to the adjudication stage of the appeals process where an adjudicator conducts an inquiry under the Act . The adjudicator formerly responsible for the inquiry sent Notices of Inquiry to the hospital and the appellant. Several sets of representations were exchanged between the parties in accordance with section 7 of the IPC’s Code of Procedure and subject to the confidentiality criteria in Practice Direction 7. I then assumed carriage of this appeal. Given the recurrent concerns of the appellant as to the identification of additional responsive records, I decided that I ought to invite the hospital to elaborate on its position respecting custody or control and search for responsive “medical residents’ records.” Following the exchange of representations between the parties on the search and custody or control issues, my inquiry concluded.

[5]  In this order, I uphold the hospital’s decision that certain records are excluded from the scope of the Act  as a result of the application of the exclusion for records containing labour relations or employment-related information in section 65(6) 3 of the Act . I uphold the exemption of some of the records under section 49(a), together with section 19, but not section 14(1) (i), of the Act . I uphold the hospital’s search for responsive records, in part, but order it to conduct additional searches of a specified medical secretary’s and medical residents’ records. If new responsive records are identified, the hospital must issue a decision letter to the appellant in accordance with the Act .

RECORDS:

[6]  The records at issue in this appeal consist of letters, emails, handwritten notes, and a photograph.

ISSUES:

1. Does the labour relations exclusion in section 65(6) apply?
2. Do the records contain personal information?
3. Does section 49(a), together with section 14(1)(i), apply?
4. Does section 49(a), in conjunction with section 19, apply?
5. Should the hospital’s exercise of discretion be upheld?
6. Did the hospital conduct a reasonable search for records within its custody or under its control?

DISCUSSION:

Preliminary Issue: additional disclosure of records

[7]  The hospital states the following under its representations on the exercise of discretion under section 49(a):

We carefully went through each of the records at issue again when we received the initial Notice of Inquiry to determine whether in our relative inexperience with FIPPA at the time that the redactions were initially made had any impact on our discretion at the time. We concluded that based on the experience we now have with the legislation, we would disclose in full pages 267 and 353 of the records at issue.

[8]  It is not clear from the file whether this disclosure was ever made to the appellant, as apparently contemplated by the hospital in this portion of its representations. Accordingly, I will provide for this additional disclosure in the terms of this order.

A.  Does the labour relations exclusion in section 65(6) apply?

[9]  The hospital claims that the emails at pages 246-251 are excluded from the Act  under section 65(6)3. [5] If this provision applies, the records are not accessible under FIPPA. Therefore, I must determine this issue before addressing the other issues, including the possible application of the exemption in section 14(1)(i), which was also claimed for the same records.

[10]  Section 65(6)3 states:

Subject to subsection (7), this Act  does not apply to records collected, prepared, maintained or used by or on behalf of an institution in relation to any of the following:

Meetings, consultations, discussions or communications about labour relations or employment related matters in which the institution has an interest.

[11]  If section 65(6) applies to the records, and none of the exceptions found in section 65(7) applies, the records are excluded from the scope of the Act . Section 65(6) is record-specific and fact-specific. If it applies to a specific record in the circumstances of a particular appeal, and none of the exceptions listed in section 65(7) are present, then the record is excluded from the scope of the Act .

[12]  Under this provision, the hospital was required to establish that:

1. the records were collected, prepared, maintained or used by the hospital or on its behalf;
2. this collection, preparation, maintenance or usage was in relation to meetings, consultations, discussions or communications; and
3. these meetings, consultations, discussions or communications are about labour relations or employment-related matters in which the ministry has an interest.

[13]  The type of records excluded from the Act  by section 65(6) are documents related to matters in which the institution is acting as an employer, and terms and conditions of employment or human resources questions are at issue. Employment-related matters are separate and distinct from matters related to employees’ actions. [6]

[14]  For the collection, preparation, maintenance or use of a record to be “in relation to” the subjects mentioned in paragraph 1, 2 or 3 of this section, it must be reasonable to conclude that there is “some connection” between them. [7]

[15]  The term “labour relations” refers to the collective bargaining relationship between an institution and its employees, as governed by collective bargaining legislation, or to analogous relationships. The meaning of “labour relations” is not restricted to employer-employee relationships. [8]

[16]  The term “employment of a person” refers to the relationship between an employer and an employee. The term “employment-related matters” refers to human resources or staff relations issues arising from the relationship between an employer and employees that do not arise out of a collective bargaining relationship. [9]

Representations

[17]  The hospital submits that the information withheld under section 65(6)3 falls within the exclusion because it relates specifically to the appellant’s dismissal from her employment with SJHC and the corresponding actions taken by the hospital to deactivate her access to the hospital’s computer network. According to the hospital, the records were prepared, maintained and used by the hospitals – SJHC and LHSC - after the conclusion of discussions and meetings about the appellant’s termination. The hospital explains that the specified actions were taken to protect the personal, and personal health, information on their systems as part of their legislated responsibilities under FIPPA and PHIPA. [10] The hospital acknowledges that “some of the information that the requester is seeking is her own personal information, [but] those records also cross into an area that is excluded from FIPPA (i.e. employment information).”

[18]  The appellant relies on the Tax Court of Canada case Kandasamy v. The Queen [11] for the finding that medical residents are full time students, in that case for the purpose of claiming certain tax credits. The appellant explains that Kandasamy is relevant because the records at issue in this appeal relate to the appellant’s status as a student in the residency program; therefore, since the records were created, maintained and used by SJHC in its capacity as a teaching hospital and relate to the appellant’s academic performance and conduct as a student, “they are not capable of attracting the labour and employment exemption.”

[19]  The appellant also submits that if I determine that the records were created in connection with the appellant’s status as an employee of the hospital, then I should distinguish between records related to matters in which the hospital is acting as an employer and terms and conditions of employment or human resources, which would be excluded, and matters related to employee actions, which would not. [12] The appellant maintains that the records deal with her actions and the hospital’s response, so the focus is not on the human resource or employment aspect of their relationship. Finally, the appellant reiterates that the withheld information is her own personal information and “it ought to be produced.”

[20]  In reply, the hospital refers to Order PO-3257 in which Adjudicator Stephanie Haly addressed the dual role of medical residents in an appeal with the University of Ottawa, where there were related appeals with teaching hospitals in the city. The hospital submits that the adjudicator accepted the affected party, Professional Association of Residents of Ontario’s characterization of the dual role, which “clearly defines a medical resident as hospital staff.” SJHC states that the appellant’s role as a student was addressed in this instance “by Western University as per our documented correspondence with the requester.”

[21]  In sur-reply, the appellant argues that the hospital’s position in reply is a “red herring,” since there are records in the hospital’s possession which relate to the appellant in her capacity as a resident. The appellant submits that the determination of the possible application of the exclusion in section 65(6) should not be conflated with the search issue and, specifically, which institution is responsible in that regard.

Analysis and findings

[22]  The hospital claims that the emails at pages 246-251 are excluded from the Act  under section 65(6)3. I agree.

[23]  To begin, whether the records an institution claims are excluded under section 65(6) contain a requester’s own personal information is not relevant to the determination of whether the exclusion applies. If I find that the exclusion applies, it follows that FIPPA does not and the records are removed from the public right of access. I have no continuing authority over them, including ordering them disclosed as suggested by the appellant.

[24]  Beginning with the first part of the test for exclusion under section 65(6)3, I am satisfied from my review of them that these emails were exchanged between employees of the hospital and, therefore, that they were collected, prepared, maintained or used by the hospital. Regarding part two, I am also satisfied that this collection, preparation, maintenance or usage was in relation to meetings, consultations, discussions or communications, specifically, those involving the actions taken by hospital staff following the termination of her employment. [13] Accordingly, I find that parts 1 and 2 of the test under section 65(6)3 have been met.

[25]  To establish part 3 of the section 65(6)3 test, the hospital was required to provide evidence to demonstrate that the consultations, discussions or communications that took place were about labour relations or employment-related matters in which SJHC had an interest.

[26]  The phrase “in which the institution has an interest” means more than a “mere curiosity or concern”, and refers to matters involving the institution’s own workforce. [14] In this appeal, the hospital cites Order MO-1654-I because records related to an employee’s dismissal were found to be about “labour relations or employment-related matters.” I accept this submission. The hospital also cites Order PO-3257 for its description and explanation of the dual role of medical residents in the access to information context under FIPPA, which was provided by the affected party in that appeal, PARO. [15] Another decision addressing an access request by a medical resident is Order PO-3408, where Adjudicator Stephanie Haly determined the issues raised in the resident’s appeal of the University of Ottawa’s Heart Institute access decision. [16] The adjudicator canvassed the complex web of academic and employment relationships created by a medical residency and ultimately concluded that section 65(6)3 applied to exclude some of the responsive records from the scope of the Act . These are matters about which I have similar evidence in this appeal. The records withheld under section 65(6)3 clearly demonstrate that the hospital was acting as the appellant’s employer in addressing issues related to her access to the computer network following the termination of her medical residency. The focus is on human resources matters directly flowing from the end of the employment relationship between SJHC and the appellant. Therefore, I conclude that part three of the test under section 65(6)3 has been met.

[27]  Accordingly, I find that the records for which section 65(6) has been claimed were collected, prepared and used for meetings, discussions and consultations about labour and employment related matters in which the hospital has an interest. I find that pages 246-251 are excluded from the Act  pursuant to section 65(6)3.

[28]  Before reviewing the exemption claims for the remaining records, I will comment on the hospital’s partial claim to section 65(6)3 for page 251. The emails at pages 246-250 were withheld in full, while page 251 was disclosed in part, notwithstanding the exclusion claim. About this, Adjudicator Jenny Ryu had this to say in Order PO-3642:

[29] This office has consistently taken the position that the exclusions at section 65(6)  of the Act  (and the equivalent section in the Act ’s municipal counterpart) are record-specific and fact-specific. [17] This means that in order to qualify for an exclusion, a record is examined as a whole. This whole-record method of analysis has also been described as the “record-by-record” approach when applied by this office in considering the application of exemptions to records. [18]

[30] …

In each of these cases, the question is whether the collection, preparation, maintenance or use of the record, as a whole, is sufficiently connected to an excluded purpose so as to remove the entire record from the scope of the Act . This approach to the exclusions is consonant with the language of the exclusions, which applies to records that meet the relevant criteria. I also find it corresponds to the Legislature’s decision not to incorporate into the Act a requirement for the severance of excluded records, in contrast to its treatment of records subject to the Act ’s exemptions. [19]

[29]  Therefore, consistent with past orders of this office, I find that although the hospital partly disclosed page 251, the email is excluded in its entirety from the Act  by operation of the exclusion in section 65(6)3. Regardless, in light of my finding that the exclusion in section 65(6)3 applies, I will not review pages 246-251 further in this order.

B.  Do the records contain personal information?

[30]  Given the appellant’s indication that she does not seek access to any information about other individuals or any personal health information that may be contained in the records, any such information is removed from the scope of this appeal. I must determine whether the records contain personal information and, if so, to whom it relates. If the records contain the appellant’s own personal information, the hospital’s exemption claims are reviewed under the discretionary exemption in section 49(a) in Part III of FIPPA, rather than Part II.

[31]  “Personal information” is defined in section 2(1)  of the Act  as “recorded information about an identifiable individual,” including information such as an individual’s age or marital status (paragraph (a)), educational or employment history (paragraph (b)), address (paragraph (d)), their views and opinions (paragraph (e)) or the views and opinions of others about them (paragraph (g)). The list of examples of personal information under section 2(1) is not exhaustive. Information that does not fall under paragraphs (a) to (h) may still qualify as personal information.

[32]  Sections 2(3) and (4) provide exceptions to the definition of personal information for certain information about individuals in their business, professional or official capacity.

[33]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [20] Even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [21]

Representations

[34]  The hospital’s representations on this issue are brief, conveying agreement that the records contain personal information as defined in section 2(1)  of the Act .

[35]  The appellant submits that the information in the records primarily consists of information about individuals in their professional, employment or teaching capacities, which is not their personal information. The appellant argues that to the extent that opinions were being expressed about the appellant, the opinions were expressed by individuals in the performance of their official duties and are, therefore, essentially the views of the hospital. [22]

Analysis and findings

[36]  As outlined above, the definition of “personal information” in section 2(1)  of the Act  includes many different possible types of recorded information about an identifiable individual. Chief among the listed types in this appeal is paragraph (h), which refers to an individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual. I find that there is information of this type relating to the appellant and, on several pages, to other individuals.

[37]  I find that the records also contain the personal information of the appellant fitting within paragraphs (b) (employment) and (g) (view of others about the appellant) of the definition of personal information in section 2(1)  of the Act . The personal information of other identifiable individuals, apart from that fitting within paragraph (h), falls under paragraphs (e) (personal views) and (g) (views of others about them).

[38]  The appellant has taken the position that the personal (health) information of other individuals can be severed or removed from scope. On my review of the records, I find that they do not contain personal health information. [23] However, the non-responsive personal information of other individuals on pages 19, 194, 242 and 367 will not be considered as part of my review of the claimed exemptions.

C.  Does section 49(a), together with section 14(1)(i), apply?

[39]  Section 47(1)  of the Act  gives individuals a general right of access to their own personal information held by a government body. Section 49 provides a number of exceptions, including section 49(a), under which the hospital had the discretion to deny access to the appellant’s personal information where certain exemptions would otherwise apply to that information. Section 49(a) is intended to be applied with recognition of the special nature of requests for one’s own personal information and the desire of the legislature to give institutions the power to grant requesters access to their personal information. [24]

[40]  One of the exemptions listed in section 49(a) is the law enforcement exemption in section 14  of the Act . In this appeal, the hospital relies on section 49(a) in conjunction with section 14(1)(i) to deny access to 14 records. [25] This exemption provides that:

A head may refuse to disclose a record where the disclosure could reasonably be expected to,

endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;

[41]  Generally, the law enforcement exemption must be approached in a sensitive manner, recognizing the difficulty of predicting future events in a law enforcement context. [26] Furthermore, although section 14(1)(i) is found in a section of the Act  dealing with law enforcement matters, it is not restricted to law enforcement situations and can cover any building, vehicle or system which reasonably requires protection. ^[27]

[42]  It is not enough for an institution to take the position that the harms under section 14 are self-evident from the record. ^[28] The institution must provide detailed and convincing evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. ^[29]

Representations

[43]  The hospital submits that section 14(1)(i) applies because of the need to protect the measures that were taken to secure the electronic patient care systems and hard copy health records when the appellant was dismissed from her employment. In the confidential portion of their representations, the hospital also describes other measures taken when the appellant was dismissed. The hospital argues that:

It is important that the confidentiality of our various security measures that we have in place for our staff, physicians, patients, systems, etc. remain protected from disclosure under FIPPA. If even our most basic security measures become public, this could very easily jeopardize our ability to protect the people, systems and data for which we are responsible.

[44]  The appellant disputes the hospital’s basis for its section 14(1)(i) claim, saying that she is not seeking access to information pertaining to the controls that are in place to ensure that patient information is secured, “nor is she interested in the procedure by which her pass card privileges were revoked.” The appellant expresses concern that the hospital has withheld these records in their entirety, which fails to give proper effect to the principle of severance. In the appellant’s view, the hospital could have severed any sensitive information that would compromise security systems or procedures and disclosed the remainder of each record.

[45]  In reply, the hospital maintains that it considered the possibility of severing sensitive information, but did not do so because each record falls entirely within section 14(1)(i) due to it containing details of the controls that are in place to ensure the security of patient information and procedures for maintaining IT security. In sur-reply, the appellant expresses incredulity, saying that the IPC has consistently held that only the exempt portions of records are to be withheld, and she reiterates that these records are not fully exempt under section 14(1)(i).

Analysis and findings

[46]  To establish its claim of section 14(1)(i), the hospital was asked to provide sufficient evidence that disclosure of the withheld records could reasonably be expected to endanger the security of a system or procedures established for the protection of items, where such protection is reasonably required.

[47]  Establishing one of the exemptions in section 14  of the Act  requires that the expectation of one of the enumerated harms coming to pass, should a record be disclosed, not be fanciful, imaginary or contrived, but rather one that is based on reason. [30] This means that there must be some logical connection between disclosure and the potential harm the hospital seeks to avoid by applying the exemption. [31]

[48]  There is little question that the hospital’s electronic patient care and health records systems are items for which security or protection is reasonably required. However, with regard for both the evidence provided and the actual content of the records, I am not persuaded that disclosure of the withheld information could reasonably be expected to endanger the security of the hospital or the systems and procedures it has in place to protect those systems. The hospital suggests that disclosure of these records “could very easily jeopardize our ability to protect the people, systems and data for which we are responsible.” Section 14(1)(i) does not contemplate the protection of people, per se, but rather the procedures, strategies, measures or precautions employed to maintain security at the hospital. In my view, the information about such measures and precautions as may be conveyed in these emails, and the photograph attached to one of them, would be obvious to most people. In considering the content of these emails, I also accept that in certain situations, even information that appears innocuous could be used by some people in a manner that would jeopardize security if it could permit the drawing of accurate inferences about the possible absence of other precautions. [32] However, I am not persuaded that the withheld information is of a sufficient quality or descriptiveness to reasonably permit such inferences to be made. It follows, therefore, that the withheld information is not sufficiently detailed to demonstrate a risk of harm that is well beyond the “merely possible.” [33]

[49]  The parties focused on the issue of severance in these representations. The appellant is correct in stating that section 10(2)  of the Act  requires the hospital to disclose as much of a responsive record as can reasonably be severed without disclosing material which is exempt. However, the key question raised by section 10(2) is one of reasonableness and it does not require the severance and disclosure of portions of a record where doing so would reveal only “disconnected snippets,” or “worthless,” “meaningless” or “misleading” information. [34] Severance will not be considered reasonable where an individual could ascertain the content of the withheld information from the information disclosed. [35] In the present appeal, for example, if the content of these emails for which the hospital claimed section 14(1)(i) had qualified for exemption, it would not have been possible to sever and disclose, since only “To:” and “From:” lines (email addresses), brief salutations and sign-offs would have remained. This is the type of information that past orders have determined to be meaningless and therefore not meeting the reasonableness threshold.

[50]  In sum, given the minimal detail provided in the withheld records, I find that their disclosure could not reasonably be expected to endanger the security of the hospital or the systems for its patient health records for the purpose of section 14(1)(i). Accordingly, I find that pages 235-237, 239, 241-244, 252, 253, 255, 257, 366 and 367 are not exempt under section 49(a), together with section 14(1)(i). As section 14(1)(i) was the only exemption claimed to withhold these records, I will order them disclosed to the appellant, subject to the severance of the non-responsive personal information of other individuals from pages 242 and 367.

D.  Does section 49(a), in conjunction with section 19, apply?

[51]  The hospital claims that the discretionary exemption for solicitor-client privilege in section 19  of the Act  applies to emails, notes, and letters. In total, there are only 16 pages partly or fully withheld under section 19(a) or (c), which state as follows:

A head may refuse to disclose a record,

(a) that is subject to solicitor-client privilege; …

(c) that was prepared by or for counsel employed or retained by an educational institution or a hospital for use in giving legal advice or in contemplation of or for use in litigation.

[52]  Section 19 contains two branches. Branch 1 (“subject to solicitor-client privilege”) is based on the common law. Branch 2 (prepared by or for Crown counsel or counsel employed or retained by an educational institution or hospital) is a statutory privilege. The hospital relies on both branches and must therefore establish that one or the other (or both) branches apply.

[53]  Branch 1 arises from the common law and section 19(a), encompasses two heads of privilege, as derived from the common law: (i) solicitor-client communication privilege; and (ii) litigation privilege. Branch 2 is a statutory exemption that is available in the context of Crown counsel giving legal advice or conducting litigation. The statutory exemption and common law privileges, although not necessarily identical, exist for similar reasons.

[54]  Solicitor-client communication privilege protects direct communications of a confidential nature between a solicitor and client, or their agents or employees, made for the purpose of obtaining or giving professional legal advice. [36] The rationale for this privilege is to ensure that a client may confide in his or her lawyer on a legal matter without reservation. [37]

[55]  The privilege applies to “a continuum of communications” between a solicitor and client:

. . . Where information is passed by the solicitor or client to the other as part of the continuum aimed at keeping both informed so that advice may be sought and given as required, privilege will attach. [38]

[56]  The privilege may also apply to the legal advisor’s working papers directly related to seeking, formulating or giving legal advice. [39] Confidentiality is an essential component of the privilege. Therefore, the institution must demonstrate that the communication was made in confidence, either expressly or by implication. [40]

[57]  Under branch 1, the actions by, or on behalf of, a party may constitute waiver of common law solicitor-client privilege. Waiver of privilege is ordinarily established where it is shown that the holder of the privilege knows of the existence of the privilege, and voluntarily evinces an intention to waive the privilege. [41] Generally, disclosure to outsiders of privileged information constitutes waiver of privilege. [42] Waiver has been found to apply where, for example: the record is disclosed to another outside party; the communication is made to an opposing party in litigation; and the document records a communication made in open court. [43]

[58]  Branch 2 is a statutory privilege that applies where the records were prepared by or for Crown counsel or counsel employed or retained by an educational institution or hospital “for use in giving legal advice or in contemplation of or for use in litigation.” The statutory exemption and common law privileges, although not identical, exist for similar reasons. This privilege would apply, for example, to records prepared by counsel employed or retained by the hospital “in contemplation of or for use in litigation.” It does not apply to records created outside of the “zone of privacy” intended to be protected by the litigation privilege, such as communications between opposing counsel. [44] The statutory litigation privilege in section 19 protects records prepared for use in the mediation or settlement of litigation. [45] In contrast to the common law privilege, termination of litigation does not end the statutory litigation privilege in section 19. [46]

Representations

[59]  The hospital claims that the records withheld under section 19 are solicitor-client privileged because they were either sent by the hospital’s or Western University’s legal counsel or directly refer to advice received from them. The hospital states that the two handwritten notes pertain to discussions with external legal counsel. According to SJHC, since these communications relate to the termination of the appellant’s employment and privileges, the confidentiality requirement is established because “employment information is regarded as highly confidential within our organizations and carries with it the expectation of confidentiality.” The hospital adds that the emails were maintained as confidential and only shared with the few staff and physicians for whom it was necessary to do their job. This is the reason, the hospital submits, that some of the withheld records were marked “secret” or “private and confidential.” Relying on Orders PO-3328 and PO-3248, the hospital asserts that all of these records form part of a continuum of communications relating to the larger issue of the termination.

[60]  The hospital also submits, without further elaboration, that the records are exempt under litigation privilege because the access request was submitted by the appellant’s legal counsel.

[61]  The appellant replies to the hospital by conceding that private communications passing directly between the hospital and legal counsel for the purpose of giving or obtaining legal advice are privileged. However, the appellant maintains that:

[I]f the communication copies third parties, or is disseminated, … it loses its cloak of privilege. A party that knows correspondence is privileged and discloses it to outside parties has generally waived privilege.[ [47] ] To the extent any of the record for which privilege is claimed has been copied to third parties, the privilege has been waived and the record should be disclosed.

In addition, to the extent advice from counsel is being relayed by one person at the Institution to another person within the Institution, it is only the advice that is privileged. The balance of the email/record should be produced as the claim for privilege cannot be expanded to include portions of the record that would not be protected in the absence of the advice.

[62]  The appellant also disputes the hospital’s position that records marked “secret” or “confidential” necessarily attract privilege by virtue of being labelled as such. In this context, emails exchanged between non-lawyers “have no basis to attract solicitor-client privilege” notwithstanding such labelling.

[63]  The appellant responds to the hospital’s position on litigation privilege by stating that it protects documents created for the dominant purpose of litigation; but litigation privilege does not apply simply because a record may be relevant to litigation and may contain evidence that would be used in litigation. The appellant argues that the dominant purpose for the creation of the document must be for litigation, not merely relating to the events being litigated. On this point, the appellant submits that the requester’s identity as counsel for the appellant is irrelevant to the determination of the privilege claim.

Analysis and findings

[64]  For me to find that the withheld portions of the records are subject to the common law solicitor-client privilege exemption in branch 1, I must be satisfied that the withheld records, or portions of them, consist of written communications of a confidential nature between a client and a legal advisor that is directly related to seeking, formulating or giving legal advice. [48] For the following reasons, I accept that the withheld information qualifies for exemption under section 19(a).

[65]  First, I have considered the circumstances of the creation of the records and the representations provided by the hospital, and I am satisfied that a solicitor-client relationship existed. Two legal advisors are identified in these records: external legal counsel for the hospital and the university’s legal counsel, whom I accept was acting as counsel to senior medical staff and administration employed by both the university and hospital in the specific context of the medical resident training program. The identified clients consist not only of the hospital’s senior medical staff and administrative personnel mentioned, but several other post graduate education and hospital employees involved in the appellant’s medical residency matters.

[66]  The next question to answer is whether the records reflect a written record of confidential communication between a solicitor and his client, and then whether each record is subject to privilege because it consists of the giving or seeking of legal advice.

[67]  Descôteaux v. Mierzwinski described the privilege as follows: [49]

... all information which a person must provide in order to obtain legal advice and which is given in confidence for that purpose enjoys the privileges attaching to confidentiality. This confidentiality attaches to all communications made within the framework of the solicitor-client relationship ...

[68]  As for the concept of “a continuum of communications” between a solicitor and client, Balabel v. Air India [50] established that:

... the test is whether the communication or document was made confidentially for the purposes of legal advice. Those purposes have to be construed broadly. Privilege obviously attaches to a document conveying legal advice from solicitor to client and to a specific request from the client for such advice. But it does not follow that all other communications between them lack privilege. In most solicitor and client relationships, especially where a transaction involves protracted dealings, advice may be required or appropriate on matters great or small at various stages. There will be a continuum of communications and meetings between the solicitor and client ... Where information is passed by the solicitor or client to the other as part of the continuum aimed at keeping both informed so that advice may be sought and given as required, privilege will attach. … [L]egal advice is not confined to telling the client the law; it must include advice as to what should prudently and sensibly be done in the relevant legal context. [51]

[69]  Although decided at a time when communications between solicitor and client were typically limited to formal written correspondence, the principles outlined in Balabel have equal application to email communications. Based on the hospital’s representations and my review of the withheld information, I am satisfied that both the withheld letters and emails contain information that forms part of a confidential continuum of communications between solicitor and client. These communications pertain to the appellant’s hospital privileges and employment as a medical resident and there is information provided to the legal advisors for the purpose of keeping them informed of relevant developments. Correspondingly, there are indications of what the legal advisor recommends should “prudently and sensibly be done,” including potential options and the possible implications of them. Therefore, I am satisfied that the portions of pages 18, 19, 129, 132-134, 136, 182, 183, and 194-196 for which section 19 is claimed are directly related to the seeking, formulating or giving of legal advice.

[70]  The handwritten notes on pages 131 and 137 are notes taken by (the client) hospital staff, while pages 80 and 265 are emails that were not sent to or from the hospital’s solicitor, but were, rather, exchanged between hospital staff. However, even where the authors were not lawyers, I am similarly satisfied that the severed portions of these four pages reflect the legal advice given to the hospital by its solicitors and that their disclosure would effectively reveal that legal advice.

[71]  The appellant argues that the hospital has waived any privilege that did attach to these records, suggesting that exchanges between non-lawyers or copying “third parties” on emails containing confidential legal advice has that effect. For its part, the hospital does not address waiver in its representations. However, there is no evidence of the sharing of the confidential legal advice or continuum of communications with individuals that would be considered “outsiders” to the particular events in process here. Since I am not persuaded that the hospital waived the privilege attached to these records, I find that the solicitor-client privilege is maintained.

[72]  In view of this conclusion, it is not necessary for me to decide whether the same records would also be litigation privileged.

[73]  I am also satisfied that the hospital adhered to section 10(2)  of the Act  in disclosing as much of each responsive record as can reasonably be severed without disclosing material which is exempt under section 49(a), together with section 19(a).

[74]  Consequently, pages 18, 19, 80, 129, 131-134, 136, 137, 182, 183, 194-196 and 265 are exempt from disclosure under the solicitor-client communication privilege component of exemption under section 49(a), together with section 19(a), subject to my review of the hospital’s exercise of discretion.

E.  Should the hospital’s exercise of discretion be upheld?

[75]  After deciding that a record or part thereof falls within the scope of a discretionary exemption, an institution is obliged to consider whether it would be appropriate to release the record, regardless of the fact that it qualifies for exemption. The solicitor-client privilege exemption in section 49(a), with section 19, is discretionary, which means that the hospital could choose to disclose information, despite the fact that it may be withheld under the Act .

[76]  In applying the exemption, the hospital was required to exercise its discretion. On appeal, the Commissioner may determine whether the hospital failed to do so. In addition, the Commissioner may find that the hospital erred in exercising its discretion where it did so in bad faith or for an improper purpose; where it took into account irrelevant considerations; or where it failed to take into account relevant considerations. In either case, I may send the matter back to the hospital for an exercise of discretion based on proper considerations. [52] According to section 54(2)  of the Act , however, I may not substitute my own discretion for that of the hospital.

[77]  As I have upheld the hospital’s decision to apply section 49(a), in conjunction with section 19, I must review its exercise of discretion in choosing to do so.

Representations

[78]  The hospital submits that it was understood when exercising its discretion to apply the solicitor-client privilege exemption that some of the information the appellant seeks is her own personal information. The hospital submits that it has historically and consistently sought to protect confidential discussions with, and correspondence from, its lawyers, as well as information of a legal nature, generally. The hospital submits that since only 39 of the original 375 pages of records remain at issue – a number reduced to 16 when considering only section 19 – it is clear that they made “redactions carefully and considered each and every one with the appropriate level of discretion and within the spirit of the legislation.”

[79]  The appellant submits that the hospital failed to weigh the competing interests in making its access decision and, specifically, failed to consider factors such as an individual’s right of access to their own information, the limited and specific nature of exemption claims, the relationship between the requester and affected persons and whether disclosure would increase public confidence in the operation of the institution. Given the alleged failure to properly exercise its discretion to apply section 19, the appellant submits that I should return the matter to the hospital for a re-exercise of discretion. The appellant adds to the argument about the limited and specific nature of exemptions applied by contending that the hospital has failed to sever only the portions of the records that are exempt, as section 10(2) requires.

Analysis and findings

[80]  Based on the hospital’s representations and my review of the information for which I have upheld the solicitor-client privilege exemption, I am satisfied that the hospital considered relevant factors in exercising its discretion, including the purposes of the Act , the nature of the exemption and the appellant’s reasons for seeking access to the information. I addressed the appellant’s concerns about severance under section 10(2), above, concluding that the hospital had in fact reasonably redacted the records, thereby affirming that section 19 was applied in a limited and specific manner. With regard to the specific information for which I upheld section 49(a), together with section 19, I accept the hospital’s explanation for its decision to exercise discretion to withhold it to preserve the confidential advice from its lawyers.

[81]  Ultimately, I am satisfied that the hospital exercised its discretion properly, and I will not interfere with it on appeal. Accordingly, I uphold the hospital’s claim for exemption under section 49(a), together with section 19(a).

F.  Did the hospital conduct a reasonable search for records within its custody or under its control?

[82]  Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 24 of FIPPA. [53]

[83]  Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist. [54] The Act  does not require the institution to prove with absolute certainty that further records do not exist. However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records. [55] To be responsive, a record must be "reasonably related" to the request. [56]

[84]  If I am not satisfied that the search carried out was reasonable in the circumstances, I may order further searches. In this situation, for example, I may order a further search if the hospital’s evidence does not demonstrate that it has made a reasonable effort to identify and locate all of the responsive records within its custody or control. [57]

[85]  As the appellant points out, under section 10(1)  of the Act , every person has a right of access to a record, or part of a record, in the custody or under the control of an institution. A record will be subject to the Act  if it is in the custody or under the control of an institution; it need not be both. [58] A finding that a record is in the custody or under the control of an institution does not necessarily mean that a requester will be provided access to it, since exceptions to the right of access may still apply. [59]

[86]  The issues of reasonable search and custody or control are very much interrelated in this appeal, and I will address them together.

Representations

[87]  Relying on the premise that it need not prove with absolute certainty that further records do not exist, the hospital expresses its confidence that the searches conducted were reasonable based on the actions taken to clarify the request, define its parameters, canvas staff and physicians and expand the circle of consultation. The hospital’s submissions on the issue of search are supported by affidavit evidence from its Chief Privacy and Risk Officer, who was responsible for conducting the searches for responsive records. This affidavit outlines the steps taken to clarify the request with the appellant, which resulted in an agreement intended, in part, to avoid duplication of effort between the hospital and the university, since they had received the same request from the appellant. Under this agreement, the appellant would not require SJHC and LHSC emails from physicians acting as assistant, associate or full professors at the university if hospital emails were searched for them and those identified as responsive were forwarded to the university to issue a decision. Additionally, the search was to include the hospital’s Peoplesoft, Occupational Health, Benefits databases and email chains where the appellant was not included, but was to exclude records sent directly to or from the appellant. The hospital states that it sent a letter to the appellant in February 2012 confirming the agreed-upon terms of the search and advising that the data fields captured by the hospital’s Workbrain database would be provided so the appellant could decide if a search of it was required.

[88]  The hospital provided a list of the seven individuals – hospital staff and physicians – contacted by letter to request searches of their holdings for “all records, documents, notes, information, communications (paper or electronic)” relating to the appellant, as more specifically described in the request. The Chief of Radiology replied that she had already been contacted by the university to supply all relevant records; the hospital indicates that it worked with Western to obtain these records.

[89]  Individuals personally searched, or requested that administrative staff search, through files at SJHC for records in medical education and medical affairs, medical imaging, and human resources. Ten additional individuals assisted in identifying further records due to their involvement in relevant programs or services provided by the hospitals. The administrative assistant for medical education and medical affairs searched paper records, electronic files and email. The human resources searches consisted of a review of HR Consultant email accounts and hard drives, as well as PeopleSoft HRIS (the electronic employee payroll database). The hospital states that since the appellant’s human resource records were held at LHSC, four additional individuals in that HR department searched email folders, boxed records, computer “P:” drives and the “S:” drive of HR Client Services. This search included the appellant’s personnel and benefits files, as well as client services and HR consultant files for medical affairs and LHSC’s occupational health and safety disability database.

[90]  The hospital submits that its staff are bound by SJHC’s December 2008 records retention, storage and destruction policy, including the retention periods listed in the schedule. Copies of four SJHC policies and schedules were attached to the hospital’s representations. [60] I have reviewed them and I am satisfied that the related policies for LHSC are substantially the same.

[91]  On the question of whether responsive records exist that are not in SJHC’s possession, the hospital submits that its staff attended at the university three times to identify and search for records not in the hospital’s possession. The hospital lists 14 individuals – mainly physicians, but also staff – who identified and submitted records to the university, some of which were transferred under section 25  of the Act  to the hospital for an access decision. The hospital notes that it did not conduct searches of records generated by School of Medicine and Dentistry medical residents because those records would be under the custody and control of the university.

[92]  The appellant acknowledges the agreed-upon search parameters, but suggests that the searches were artificially and unilaterally limited. Regarding the Chief of Radiology’s indication that she had already been asked to search and provide records to the university, the appellant states that no records have been identified by either institution as emanating from this individual. The appellant submits that given this individual’s role in the appellant’s medical residency, this is indicative of the searches not being reasonable. In reply, the hospital states that as per the agreement, any records received by this individual are being dealt with through the access request to Western because her role is primarily connected to the university’s academic mission. The appellant expresses similar concerns about the follow up with the Integrated VP of Medical Education and Medical Affairs in that there is no confirmation that the person who replaced the individual who was in the role at the relevant time also searched his predecessor’s records as required. The hospital confirmed in reply representations that the new Integrated VP searched through all emails in his possession and this included any he inherited from the former VP. The appellant also questions the follow up with individuals who are said to have searched, but for whom there is no confirmation of whether any responsive records were identified or not. In reply, the hospital lists the records retrieved from various sources, and points out that the Act  does not impose a requirement of any greater specificity than that. [61]

[93]  The appellant takes issue with the completeness of the list of radiologists who were asked to search, suggesting that there are an additional 32 physicians (12 at SJHC and 20 at LHSC) whose names are not on the list provided by the hospital and who “appear to have not been canvassed for records.” The appellant submits that some of these individuals were directly involved in the case and all of them were recipients of a December 2010 email she wrote. The appellant suggests that there is likely considerable email communication involving some, if not all, of the listed radiologists, and these records should have been sought by the hospital. On this point, the hospital states in reply:

It is our understanding from Western University that 32 of the 34 physicians listed [62] were canvassed for records related to [the] access request to Western University and Western University has the documentation to support this. … [T]he records related to these physicians are part of Western University’s response…

[94]  The appellant poses similar questions about records potentially held by two additional people who were copied on her December 2010 email to the residents, doctors and staff. In response to these, the hospital advises that the first of these two additional individuals is not employed by the hospital, while the second person’s (a medical imaging secretary) records would have been captured by searches undertaken by the physicians canvassed.

[95]  In sur-reply, the appellant submits that the hospital’s representations still do not make clear whether it searched hospital emails relating to the appellant and Western academic matters in its accounts for radiologists, relevant physician administrators (three are named), radiology residents and other administrative staff. While accepting that what was retrieved was forwarded, the appellant maintains that “the details of what was searched have not [been] adequately provided.” In particular, the appellant submits that while she agreed to a process whereby academic mission records/emails would be forwarded to the university, she “did not agree to forego a search of the hospital emails related to the academic mission of Western.” The appellant argues that it remains unclear whether SJHC “conducted the requested search, cross-referenced responsive documents with Western and excluded duplicate, responsive records, or simply left a portion of the search to Western.” In the appellant’s view, if a portion of the search was not completed, but instead left to Western, the hospital has failed to discharge its duties under the Act .

[96]  Other points and concerns raised by the appellant in sur-reply include that: the Chief of Radiology and other physicians maintained multiple email addresses, only one of which would be accessible to Western, thereby necessitating an independent search by SJHC to ensure that all responsive records are captured; no confirmation has been provided that deleted emails were searched (e.g. the position of Integrated VP of Medical Education and Medical Affairs); and the scope of the search was to include medical secretaries and since the named one was not included, further searches including her records ought to be ordered.

[97]  Regarding the hospital’s submission that 32 of the 34 listed physicians were consulted, the appellant expresses concern that not all of them were consulted. The appellant is also concerned that the hospital did not canvass the physicians to obtain records from them that were not otherwise in the university’s control. The appellant emphasizes that the agreement she had with the hospital was that duplicate records would not be forwarded; the intention was not to “truncate the search or limit it to documents in Western’s control or possession.” The appellant “explicitly requested that St. Joseph search the hospital records/emails for residents, secretaries, and some physicians, particularly in administration and the postgraduate dean’s office” and since residents’ and secretaries’ record holdings were not searched, the hospital search was inadequate. The appellant argues that:

While St. Joseph is taking the position that the responsive records can easily be carved out between St. Joseph’s and Western, the fact is each institution needs to conduct a comprehensive search in order to ensure that all responsive records are retrieved. To the extent that St. Joseph is submitting that hospital emails were not used to discuss academic matters, it is incorrect. Attached as Schedule “A” to these representations is an email which was only picked up by Western in responding to the request because of [named person’s] email address. If [she] was not included as a recipient, this email would not have been captured as a responsive record by Western as all the other recipients had hospital email addresses.

[98]  After reviewing these sur-reply submissions, I concluded that SJHC should be asked to address the custody or control of “medical residents’ records” because it factors into the determination of the reasonableness of the hospital’s search. In setting out the custody or control issue in the hospital’s Notice of Inquiry, I requested “additional information about the decision not to conduct searches of residents’ records…”.

[99]  SJHC begins by indicating that the hospital does not dispute the fact that some of the records, including emails, of the radiology residents would have been in its custody or control. The hospital explains, however, that it interpreted the agreement with the appellant and university to mean that the university would be responsible for searching the records of the students/residents, since Western was responsible for teaching residents. SJHC submits that:

It was not about who had custody and control of the records as the residents (like our hospital physicians) have email accounts with both the university and the hospitals and they would have searched and submitted the records from both email accounts to whichever organization requested them.

[100]  On this issue, the appellant’s main point is that both the hospital and university have custody or control over the radiology resident’s emails and should, therefore, be required to search their respective records-holdings. [63] The appellant submits that according to the tripartite agreement between the parties,

Western would be responsible for searching, retrieving and producing records, including those from the radiology residents. In fact, the agreement was that both institutions would conduct independent searches, but would compare the results of their searches to avoid duplication in the production of records (not only that Western would conduct a search because many radiology residents’ emails would be sent and received on their hospital emails). [64]

[101]  Pointing out that SJHC acknowledges that it has custody or control over such records, the appellant submits that although the hospital was in a position to retrieve responsive records from radiology residents, it did not do so. Stating that she has “permanent access to her Western medical school email account …” the appellant argues that “radiology residents’ emails still exist … [and] the individual emails sent to and from the students would be contained and accessible on Western and St. Joseph’s servers.”

[102]  SJHC disputes the correctness of the appellant’s description of the tripartite agreement, stating that there was no agreement that the hospital and university would compare the results of the searches after the searches took place. The hospital submits that duplication was to be avoided by using a categorical approach of Western searching for all records related to its academic mission (i.e., the teaching of students) and the hospital (both SJHC and LHSC) searching PeopleSoft, Occupational Health and Benefits records,

… not by both organizations requesting all of the same records and then going through them one by one and removing any duplicates. That process would not have made sense from a practical perspective not to mention that neither we nor Western would have agreed to review each other’s records because we would then be sharing confidential business information and personal health information etc. with another organization.

[103]  SJHC notes that Western received its FIPPA request six months before the hospital did and when Western asked their “staff, doctors, etc.” to search for records, the records that were submitted included emails from both Western and hospital email accounts. When Western and SJHC met after the hospital received the FIPPA request in January 2012, the university advised that they “received numerous records that would technically be under the custody and control of the hospital (which they transferred to us). …” However, the hospital submits that most, if not all, of the residents are no longer at the hospital and their email accounts no longer exist: once residents leave the hospital, their email account is disabled for three months and “at three months, the email account and all email content is removed from our server.” In other words, the hospital argues, it is unlikely than any relevant records still exist, since the appellant’s residency began in July 2005 and ended in July 2011 with her dismissal from the program. The hospital concludes by stating that had it been aware when the request was received that the university had not canvassed residents for records and that SJHC was expected to, “it surely would have been done.”

[104]  In response, the appellant submits that her expectation that emails relating to the university’s academic mission would have been transferred and then produced by Western is supported by the passage from the hospital’s February 2012 letter that states “that all emails relating to Western’s academic mission as described here that are retrieved by St. Joseph’s and LHSC will be forwarded to Western to be considered in their response to your request for access.”

[105]  Regarding SJHC’s claim that email accounts of departed residents are disabled and then purged, the appellant points out that there may be individuals who were residents at the relevant time but who remain active on staff as physicians or as clinical assistants and whose accounts would still exist. In this context, the appellant urges me to order the hospital to conduct a search of its servers for any resident emails responsive to the request.

Analysis and findings

[106]  Under FIPPA, the adequacy of an institution’s search is measured by its reasonableness. While the Act does not require proof “with absolute certainty” that further records do not exist, the institution must still tender sufficient evidence to demonstrate that a reasonable effort was made to identify and locate responsive records that are in its custody or under its control. ^[65] A reasonable search is one in which an experienced employee knowledgeable in the subject matter of the request expends a reasonable effort to locate records which are reasonably related to the request. [66]

[107]  From my review of the hospital’s representations, including the affidavit evidence and the replies provided to the appellant’s submissions, questions and concerns, I partly uphold the searches conducted.

[108]  To begin, I observe that the time period and scope of the request was statutorily limited by the operation of section 69(2) of FIPPA, such that the Act  only applies to records in the hospital’s custody or control from January 1, 2007 onwards. Records from the request’s stated July 1, 2004 start-date up to December 31, 2006 are not part of my review of whether the hospital’s search was reasonable. [67]

[109]  Regarding the aspects of the hospital’s search that I conclude are reasonable, I am satisfied that the individual managing the searches on the hospital’s behalf – its Chief Privacy and Risk Officer - was sufficiently experienced and that the subject matter and parameters of the request were well understood. I am also satisfied that the individuals from the hospital’s medical and administrative staff who were contacted to conduct searches were appropriately selected, with two exceptions that I discuss below. I find that the individuals who were consulted expended reasonable efforts to locate responsive records by searching in locations that could be expected to bear fruit in this situation. Although the parties quibble about the number of relevant physicians who were canvassed, with the appellant expressing concern that only 32 of the 34 additional physicians she listed at paragraph 101 of her initial representations were consulted, I count only 32 names, not 34. As stated, the source of this numerical discrepancy is not clear, but in any event, I am prepared to accept that the relevant physicians were contacted to search their records. Specifically, I accept the hospital’s evidence that those individuals searched paper records, emails and electronic files in relevant databases and areas, including Medical Imaging (Department of Diagnostic Radiology), Medical Education and Medical Affairs, Integrated Vice President and Human Resources.

[110]  The appellant is concerned that the records of the Chief of Radiology, a key figure, were not properly searched because the searches appear to have been limited by assigning responsibility for them to the university, which would have had access only to that individual’s university email account. From the hospital’s evidence, however, I have a different understanding. Specifically, the hospital advises that any records related to this individual “are being dealt with through the access request to Western because her role is primarily connected to the university’s academic mission.” The hospital also submitted that when they met with university representatives after the receipt of the access request to the hospital, the university had identified “numerous records that would technically be under the custody and control of the hospital.” I accept that these records were sought, identified and transferred, noting that some of the records disclosed by this order include ones where the Chief of Radiology (at an LHSC email address) is a sender or recipient. In other words, the searches were approached on the basis of the individual being asked, not the institution to which their “multiple email addresses” belonged. It was up to each individual consulted to search their various email accounts or repositories of records, not the institution, which did not have access to the other institution’s accounts. Having provided the results of their searches to whichever institution requested the search, the institution was then responsible for transferring any records as required pursuant to section 25  of the Act . I find this approach to be reasonable.

[111]  In aiming to cooperate with the university in responding to the request, it seems that the hospital’s understanding of the parameters of the searches suffered from ambiguity in the scope of the various parties’ assumed responsibilities. [68] The requirement for the hospital to conduct a search that is reasonable in the circumstances ought to have included all relevant staff, including the medical secretary identified by the appellant, and medical residents.

[112]  My determination that the hospital’s searches were not fully reasonable is directly traceable to the wording of the request itself. The appellant claims to have “explicitly requested” that the hospital search its record holdings for responsive records by certain physicians, particularly those in administration and medical education, but also secretaries and residents, and because no individuals from those latter two categories were consulted, the hospital’s search was inadequate. I agree with the appellant that there is no ready justification for the hospital declining to search for responsive records held by the medical secretary who received the appellant’s December 2010 email. The request clearly identifies “all records … (paper or electronic) … in all offices of [LHSC and SJHC] and with all staff and residents [of those two hospitals].” The hospital’s supposition that any responsive records held by the identified medical secretary would have been caught by searches conducted by the physicians canvassed does not provide an adequate answer; while the December 2010 email was removed from the scope of the appeal, there is an air of reasonableness to the belief that responsive records could reasonably be thought to exist in this individual’s email account. I will be ordering the hospital to search the email accounts of the named medical secretary not initially consulted due to the conclusion that her records would be caught incidentally by searches of staff physicians’ records.

[113]  The impact of the custody or control issue on adjudging the reasonableness of the searches regarding medical residents is clear. Under section 10(1) , the Act  applies only to records that are in the custody or under the control of an institution. In considering the issue, the approach taken by this office and the courts has been a broad and liberal one, as required to give full effect to the transparency purposes of the Act . [69] This office has developed a non-exhaustive list of factors to consider in determining whether or not a record is in the custody or control of an institution. ^[70] Some of the listed factors may not apply in a specific case, while other unlisted factors may apply. In determining whether records are in the “custody or control” of an institution, these factors are considered contextually in light of the purpose of the legislation. ^[71]

[114]  The evidence before me in this appeal indicates that the university and the hospital agreed that the hospital would not conduct searches for medical residents’ records – specifically, emails sent from or to them relating to the appellant – because matters relating to the residents were said to form part of the university’s “academic mission.” Ostensibly to avoid duplicative searches or repetition of tasks, the two institutions agreed to characterize the residents as students of the university, rather than employees of the hospital. Although the hospital does not dispute that it had custody or control of medical residents’ emails, the university does. Regardless, the effect of the agreement between them is that neither the hospital nor the university searched their record-holdings for medical residents’ emails responsive to this request.

[115]  The hospital does not dispute that it possessed, or had custody of, medical residents’ records. I also find that the hospital exercised the requisite degree of control over residents’ records, such that searches ought to have been conducted in relation to them. In reaching this conclusion, I found the following factors relevant: the activity in question – the concurrent activities of providing essential medical services and practical medical education (clinical training) – is a “core”, “central” or “basic” function of the hospital; [72] the hospital has (and admits as much) physical possession of records, pursuant to the employment relationship; [73] the hospital’s possession of records amounts to more than “bare possession;” [74] the hospital has the authority to regulate the record’s content, use and disposal; [75] the records are integrated with, and in the same manner as, other records held by the hospital; [76] and by customary practice of institutions similar to the hospital in relation to possession or control of records of this nature, in similar circumstances, based on numerous past orders of this office on the issue. [77]

[116]  This finding is “academic” to some extent, given that the hospital concedes that it has custody or control of residents’ records. However, it is an important finding to make in this situation. Past orders of this office have affirmed that medical residents are both students of the university and employees of the hospital for the purpose of FIPPA. [78] The Kandasamy tax case cited by the appellant is not particularly helpful in determining this issue. Regardless, the acknowledged dual role of medical residents has practical implications for the search responsibilities of each institution; it cannot be said that each institution’s record holdings are watertight compartments in these circumstances. Even had there been a meeting of the minds between the hospital, the university and the appellant, the university does not have access to the hospital’s paper or electronic records to conduct the search. Only the hospital has control over its email systems, so emails sent or received to residents using the hospital’s accounts would not necessarily have been captured by searches conducted by the university, even if such searches had been done. I agree with the appellant that there is no principled reason for distinguishing between the custody or control of hospital physicians’ records (some of whom, like the Chief of Radiology, are also clinical faculty and professors with the university) and those of medical residents. The effect of the approach taken was that certain avenues of search that it would have been reasonable to pursue in the circumstances simply were not. Moreover, the appropriate approach to this challenge has already been stated: the required searches must be carried out by asking the relevant individual.

[117]  The hospital maintains that it would have canvassed the relevant medical residents for records, if only it had been aware when the request was received that the university had not and that there was an expectation that the hospital would do so. Since these searches were not carried out, I will order the hospital to search its record holdings for responsive records of medical residents from the relevant timeframe. While the hospital argues that most, if not all, of the residents are no longer at the hospital (and that their email accounts no longer exist), I accept the appellant’s point that some of the relevant medical residents may still be employed by the hospital. Further, because the hospital has not searched residents’ records at all, I conclude that it would be reasonable to test the appellant’s hypothesis that since she has “permanent access to her Western medical school email account,” emails to and from other relevant radiology residents with Western medical school email accounts may reasonably be thought to exist and be accessible on the hospital’s servers. [79] The hospital should consult its IT department regarding how best to conduct searches for such emails, including deleted emails, on the hospital servers, with reference to this request, its email policy and procedure and the associated retention periods.

[118]  In sum, while I find that the search for records responsive to the request was partly reasonable for the purposes of section 24  of the Act , the hospital must conduct additional searches for responsive records, in accordance with the terms of this order.

ORDER:

1. I order the hospital to disclose pages 267 and 353 of the records to the appellant, if these pages have not already been disclosed.
2. I uphold the hospital’s claim of the exclusion in section 65(6)3.
3. Given my finding that section 49(a), together with section 14(1)(i), does not apply, I order the hospital to disclose pages 235-237, 239, 241-244, 252, 253, 255, 257, 366 and 367 to the appellant, subject to the severance of the non-responsive personal information of other individuals from pages 242 and 367. Copies of these pages are provided with the hospital’s copy of this order.
4. For the records identified in provisions 1 and 3, I order the hospital to disclose these to the appellant by February 27, 2017, but not before February 22, 2017.
5. I uphold the hospital’s exemption claim under section 49(a), in conjunction with section 19, and I also uphold the exercise of discretion under it.
6. I order the hospital to conduct additional searches for responsive records of the identified medical secretary and medical residents, especially for emails sent to or from these individuals during the time period of January 1, 2007 to January 3, 2012.
7. If responsive records are located as a result of the search(es) referred to in Provision 6, I order the hospital to issue a decision letter to the appellant regarding access to those records in accordance with the provisions of the Act , considering the date of this order as the date of the request.

Original Signed by:		January 20, 2017
Daphne Loukidelis
Adjudicator