PHIPA DECISION 19

Complaint HA14-63

Ministry of Health and Long-Term Care

January 8, 2016

Summary: In this decision the IPC decides that it has jurisdiction to receive a complaint from an individual about a health information custodian’s refusal to disclose the personal health information of a deceased family member. The individual stated that he required the information to make decisions about his own health care. However, the IPC determines that the individual did not meet the conditions permitting disclosure of the information.

Statutes considered: Personal Health Information Protection Act, 2004, ss. 1(a), 1(d), 38(4)(c), 40(1), 52(1), 56(1), and 61.

Cases Considered:   TransCanada Pipelines Ltd. v. Beardmore (Township) (2000), 186 DLR (4th) 403 (ONCA); Criminal Lawyers’ Assn. v. Ontario (Ministry of Public Safety and Security), 2010 SCC 23; Roncarelli v. Duplessis, [1959] SCR 121; British Columbia (Education) (Re), 2010 BCIPC 42 (Canlii).

INTRODUCTION

[1]  This case concerns a request by an individual for the personal health information of a deceased family member, the obligations of a health information custodian under the Personal Health Information Protection Act, 2004 (PHIPA or the Act) in considering a request for disclosure of such information, and the role of the Information and Privacy Commissioner of Ontario (the IPC or this office) in inquiring into the custodian’s response to such a request.

BACKGROUND

[2]  Section 38(4)(c) of the Act permits a health information custodian to disclose the personal health information of a deceased individual to specified family members, if they reasonably require the information to make decisions about their own health care or that of their children:

A health information custodian may disclose personal health information about an individual who is deceased, or is reasonably suspected to be deceased,

….

(c) to the spouse, partner, sibling or child of the individual if the recipients of the information reasonably require the information to make decisions about their own health care or their children’s health care. 

[3]  The complainant in this case submitted a “Request to Access Personal Health Information” form to the Ministry of Health and Long-Term Care (the ministry), stating that he was requesting access to all available medical records pertaining to his deceased brother. The complainant indicated on the form that he was relying on section 38(4)(c) of PHIPA.

[4]  The ministry responded by stating that it did not believe section 38(4) applied to the circumstances. The complainant made a complaint to this office stating that he disagrees with the ministry’s response and wishes to have access to the information he seeks.

[5]  The information sought by the complainant consists of a list of the names of the medical practitioners who submitted OHIP claims in respect of the complainant’s deceased brother prior to his death by apparent suicide in June 2011.

[6]  The IPC assigned a mediator to explore a resolution of the complaint. As no resolution was possible, it was forwarded to the adjudication stage of the IPC’s processes. I decided to initiate a review of the complaint, during which I sought and received written submissions from the complainant and the ministry.

[7]  On this date, I am issuing this and three other decisions relating to disclosure under section 38(4)(c).

DISCUSSION

[8]  Unlike the Freedom of Information and Protection of Privacy Act (FIPPA) and its municipal equivalent, PHIPA does not provide a general right of access to information held by the organizations to which it applies. The only right of access established under PHIPA is the right, under section 52(1), of individuals to obtain access to their own personal health information.

[9]  PHIPA draws a distinction between the provision of “access” to personal health information, and the “disclosure” of personal health information by a health information custodian. Individuals have a right of access to records of personal health information about themselves in the custody or control of health information custodians, subject to limited and specific exceptions. An individual’s right of access under section 52(1) of PHIPA must be exercised by the individual about whom the records relate or (if applicable) that person’s lawfully authorized substitute decision-maker on his or behalf. [1] The health information custodian is obliged to respond to the request for access and, if no exceptions apply, provide access.

[10]  On death, the right of access may only be exercised by the estate trustee or, in the absence of an estate trustee, the person who has assumed responsibility for the administration of the deceased’s estate. [2] In this case, the complainant is not the estate trustee for his deceased brother’s estate, and he is therefore not entitled to request access under section 52(1) of PHIPA.

[11]  In addition to the provisions of PHIPA governing “access” to records of personal health information, PHIPA contains provisions governing when health information custodians may “disclose” personal health information. Under PHIPA, disclosure is permitted with the individual’s consent or the consent of the individual’s substitute decision-maker (where applicable). In the case of a deceased individual, only the estate trustee or the person who has assumed responsibility for the administration of the deceased’s estate (if there is no estate trustee) may give or refuse consent. Disclosure without consent is also permitted, and in some cases required, under specific provisions in the Act. [3]

[12]  In this case, there is an estate trustee, and the estate trustee has not consented to disclosure of the deceased’s personal health information to the complainant. Accordingly, the issue before me is whether PHIPA permits disclosure to the complainant without consent. In the circumstances of this case, the complainant believes he qualifies for disclosure without consent under section 38(4)(c).

[13]  This case raises issues about the obligations of a health information custodian when deciding whether or not to disclose information under section 38(4)(c), the rights of individuals to complain to the IPC about a custodian’s decision to not disclose information to them under this section, and the extent of the IPC’s authority to inquire into such a complaint.

Representations

[14]  The ministry submits that the IPC’s jurisdiction to review this complaint is unclear. The complainant, in the ministry’s submission, is requesting disclosure of personal health information, rather than access based on section 52(1) of PHIPA. The ministry references a letter in a previous matter in which, it submits, an analyst from this office addressed a similar issue (involving disclosure to an individual’s insurer), and concluded that the IPC had no jurisdiction to proceed with the complaint. The ministry requests that I address the issue of the IPC’s jurisdiction to proceed with this complaint.

[15]  The ministry requests that I also consider how section 56(1) applies. Section 56(1) addresses the filing of a complaint to this office, in the following terms:

A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of this Act or its regulations may make a complaint to the Commissioner.

[16]  In the ministry’s submission, its decision not to disclose the personal health information at issue cannot be characterized as a “contravention” of the Act.

[17]  In any event, the ministry submits that section 38(4)(c) is an exceptional and very specific disclosure provision. It permits a health information custodian to disclose personal health information if the conditions of the section are met. However, in the ministry’s submission, since the provision is entirely discretionary, it also permits the custodian not to disclose that personal health information as long as the exercise of discretion is based on proper considerations, and is not in bad faith, or for an improper purpose.

[18]  The ministry also refers to section 61 of PHIPA, setting out the IPC’s powers after conducting a review, and submits that none of these provisions give the IPC the power to make an order requiring a health information custodian to disclose personal health information requested by an individual.

[19]  In this case, the ministry submits that the complainant has not provided sufficient evidence to demonstrate that the conditions for disclosure under section 38(4)(c) have been met. In denying the complainant’s request, the ministry told him that it did not have the type of medical information that would be useful in making health care decisions. It maintains a computer record of OHIP claims submitted by health care providers for billing purposes. The data does not reveal the services actually rendered to the patient by the providers.

[20]  Further, the ministry states that it took the following factors into account in exercising its discretion to refuse disclosure under this provision:

• The requester is not a “substitute decision-maker” within the meaning of PHIPA;
• The requester could ask the substitute decision-maker to make a request for the information sought;
• The purpose of section 38(4)(c) is to permit health care practitioners to disclose actual medical information about genetic or other hereditary conditions to a family member; it is not meant to be used to access the contact information of physicians who may have treated a deceased individual for any number of medical issues that are not genetic or hereditary; [4]
• Section 38(4)(c) should not be used to circumvent the access provisions of PHIPA in a situation where the authorized substitute decision-maker may not wish to share the deceased’s personal health information with family members; the substitute decision-maker may not want the personal health information disclosed to the complainant for any number of reasons that are not apparent to the ministry.

[21]  The complainant made no submissions on the questions raised by the ministry about the scope of the IPC’s jurisdiction.

[22]  In his complaint, he stated that he has no other way of finding out who the health care providers to his brother were and without the contact information in the possession of the ministry, he is unable to make a request directly to those health care providers.

[23]  The complainant agrees he is not the estate trustee, and that the person who is the estate trustee has refused consent to the disclosure of his brother’s health information to him. With his submissions, the complainant provides a number of documents that, he states, should be taken into account in the exercise of any discretion, and that also prove the existence of health and safety concerns. One document consists of a long letter which he states he wrote to the police officer who attended the scene of his brother’s apparent suicide. In the letter, the complainant outlines a number of concerns and events, including his belief that his ex-wife was involved with his deceased brother, concerns about his ex-wife’s actions and motives, and disputes over the estate of his deceased mother. He describes medical conditions suffered by his late mother and aunt. He states that he wishes to find out whether his brother’s illness was genetic or a result of the relationship with his ex-wife. The complainant states that he understands that his brother left a “derogatory” letter about him, and wishes to see any notes or letters left by his brother to confirm that they were in his brother’s handwriting. He states that his brother’s death seems very suspicious to him, and that although the suicide was most likely as it appeared and described in a Coroner’s report, the illness that may have caused him to take his life is difficult to accept.

[24]  From this letter, it appears that the complainant was estranged from his brother from 2003, until his brother’s death in 2011. Although the complainant refers to his brother’s “illness”, he has not submitted any material showing what, if any, illnesses his brother suffered from in that period.

[25]  The second document is a report of a private investigator hired by the complainant to confirm any relationship between his ex-wife and his now deceased brother. The third is a transcript of a number of phone messages from the complainant’s son to the complainant, which he believes were instigated by his ex-wife. The fourth attachment is a letter the complainant states he received from his sister, shortly after the complainant had sent a letter notifying her of his intentions regarding the remainder of his mother’s estate.

[26]  The complainant submits that he has health and safety concerns that are “not only” hereditary ones. He states they relate to his now deceased’s brother’s involvement with his ex-wife and to what degree she may have affected the health of both him and his brother. He also suggests that section 40(1) (disclosure related to risk of serious bodily harm) of PHIPA may apply, based on his documents.

Analysis

[27]  There is no dispute that the information the complainant seeks is the “personal health information” of the complainant’s deceased brother, within the meaning of the Act.

Does the IPC have jurisdiction to accept this complaint regarding a refusal to disclose personal health information pursuant to section 38(4)(c)?

[28]  Section 38(4)(c) is an exception to the general rule requiring consent for the disclosure of personal health information. If the conditions of this section are met, section 38(4)(c) permits a health information custodian to disclose personal health information about a deceased person, even without consent. The custodian may disclose information under section 38(4) verbally, or in a record. Where an individual claims to qualify for disclosure under section 38(4)(c), the health information custodian must consider whether the individual meets the conditions for disclosure. The ministry states, and I agree, that since the provision is discretionary, it is also permitted not to disclose that personal health information, as long as the exercise of this discretion is based on proper considerations, is not in bad faith or for an improper purpose.

[29]  In the context of this discretionary provision, the ministry has questioned how section 56(1) applies to the facts of this case. As indicated above, section 56(1) states that a person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of the Act or regulations, may make a complaint to this office. The ministry submits that its decision not to disclose the personal health information at issue cannot be characterized as a “contravention” of the Act for the purposes of section 56(1).

[30]  I observe that the circumstances addressed by section 38(4)(c) are unique in the scheme of the Act, involving balancing the privacy rights of a deceased individual, with the interests of family members in making informed decisions about their own health. In this respect, this section furthers a policy objective that is consistent with the Act as a whole: facilitation of the effective provision of health care. Further, the underlying premise of this section, that the health information of a deceased relative may be relevant and vital to the health care of a family member, is consistent with the inclusion, in the definition of “personal health information” under the Act, of the health history of an individual’s family.

[31]  Two stated purposes of the Act are “to provide for independent review and resolution of complaints with respect to personal health information” and “to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care.” [5] The Act should be interpreted purposively to provide independent review of complaints regarding the disclosure of personal health information, particularly where the health care of an individual may be at stake. Facilitating the effective provision of health care is, it goes without saying, of fundamental importance to the individuals whose health care may be affected by discretionary decisions affecting personal health information. Given the purposes of the Act, I do not accept the proposition that this office would not have the jurisdiction to accept a complaint, even if a family member listed in section 38(4)(c) were able to plainly demonstrate that they reasonably required the information to make decisions about their own health care or their children’s health care. If that is the conclusion the ministry urges on me, based on the result in a prior complaint, I decline to follow that result. [6]

[32]  Although it is not the case here, some custodians may not give any reasons for refusing a request for disclosure under this section. It may appear to family members seeking information of a deceased individual that their request was denied for arbitrary or irrelevant reasons. Where individuals are denied disclosure of this kind of information and genuinely believe or, indeed, can establish that they reasonably require it in order to make decisions about their own health care (or the health care of their children), I conclude they should be able to seek the assistance of this office, through the filing of a complaint. Without such a recourse, individuals may have no way of knowing what factors were considering in denying a request for disclosure.

[33]  Further, while the disclosure permitted by section 38(4)(c) is discretionary, as a general principle, discretion must be exercised for the purposes underlying its grant. [7] This has been described as an “implied public statutory duty” [8] and is congruent with the ministry’s own submission that it is permitted not to disclose personal health information pursuant to section 38(4)(c), as long as the exercise of this discretion is based on proper considerations, is not in bad faith or for an improper purpose. In submitting that the IPC does not have jurisdiction, the ministry is apparently relying on a distinction between the improper exercise of discretion and a “contravention” of the Act within the meaning of section 56(1). In the context of the broader purposes of the Act, I see no reason to accept such a distinction.

[34]  For the reasons set out above, I find there is no “jurisdictional” impediment to the filing of this complaint. Further, my reviews on this and three other related complaints provides a range of facts, as well as submissions, through which to consider the rights and obligations under section 38(4) and to provide guidance on the interpretation of this section.

[35]  Given my decision on this complaint below, it is not strictly necessary to address the ministry’s submissions about the limits of my order-making authority with respect to complaints based on section 38(4). However, as it is an issue of broader importance, I will deal with it here. As a general principle, tribunals can only exercise the powers that are granted to them by the Legislature, through their governing statutes. [9] In the case of the IPC, the powers that can be exercised following a review under the Act are set out in section 61(1). I agree with the ministry's submissions that the only power given to the IPC to order a custodian to provide access to a record is found in section 61(1)(a), in response to an individual’s request for records of his or her own personal health information. This section does not provide the IPC with the authority to order disclosure of information in response to a complaint under section 38(4).

[36]  However, there are other parts of section 61(1) that are relevant to a review under section 38(4). Sections 61(1)(c) and (i) state:

After conducting a review under section 57 or 58, the Commissioner may,

(c) make an order directing any person whose activities the Commissioner reviewed to perform a duty imposed by this Act or its regulations;

(i) make comments and recommendations on the privacy implications of any matter that is the subject of the review.

[37]  Based on the above powers, in a case where a custodian has failed to put its mind to a request for disclosure under section 38(4), or has exercised its discretion improperly, I may order the custodian to review the matter again. I may, in addition, or alternatively, provide comments or recommendations on its exercise of discretion under this provision.

[38]  This approach is consistent with the remedies this office provides under FIPPA and its municipal equivalent, when an institution covered by one of those statutes has not exercised its discretion properly.

Determination of the complaint

[39]  I turn now to the facts of the complaint before me. I agree with the ministry that the information provided by the complainant is insufficient to establish that he “reasonably requires” the personal health information at issue to make decisions about his own health care within the meaning of section 38(4)(c). The information sought by the complainant is the contact information of medical practitioners who treated his brother for any number of medical issues. Even accepting the complainant’s contention that this information is his only route to seeking information from his brother’s health care providers, this section is not intended to support broad-based disclosure of such information by those health care providers, on the request of a family member. A custodian must have a basis to conclude that a family member listed in section 38(4)(c) requesting this information reasonably requires it to make decisions about his or her own health care (or the health care of the family member’s children).

[40]  As I have indicated, there is no material before me identifying what illness(es) the complainant’s brother may have experienced in the time before his death. The ministry’s records do not shed light on the nature of any illnesses he may have had. There is no information showing that any of the complainant’s brother’s personal health information may be relevant to his own health care. There is therefore no basis to question the ministry’s conclusion that the personal health information in its possession is not reasonably required in order for the complainant to make decisions about his own health.

[41]  I agree with the ministry’s assessment that the conditions for disclosure under section 38(4)(c) were not present. As such, I find that the ministry did not have discretion to disclose this personal health information pursuant to section 38(4)(c).

[42]  In reaching this conclusion, I considered the ministry’s argument that section 38(4) should not be used to “circumvent” the wishes of an authorized substitute decision-maker. To the extent the ministry suggests that the consent of a substitute decision-maker is necessary to disclosure under section 38(4), I reject this interpretation of section 38(4). As I have indicated above, section 38(4) provides an exception to the general rule requiring consent to the disclosure of personal health information. Disclosure under this section is not contingent on the wishes of a substitute decision-maker.

[43]  I find that the complainant’s submissions on section 40(1) (which he did not raise in his request to the ministry) provide no evidence that discretionary disclosure is permitted or justified under that section of the Act. The complainant may have questions and subjective concerns about members of his family, but they do not provide reasonable grounds for believing that disclosure of his brother’s personal health information is necessary for the purpose of “eliminating or reducing a significant risk of serious bodily harm”, as required by section 40(1).

NO ORDER:

For the foregoing reasons, no order is issued.

Original Signed by:		January 8, 2016
Sherry Liang
Assistant Commissioner