PHIPA DECISION 143

Complaints HA19-00054 and HA19-00157

Islington Medical Centre

March 30, 2021

Summary: The complainant sought access under the Personal Health Information Protection Act, 2004  to her chart, and that of her son, from the respondent medical centre, for the purpose of transferring the charts to their physician’s new practice. The complainant took issue with the medical centre’s fee for access, and made a complaint to the Information and Privacy Commissioner. During the adjudication of the complaint, the medical centre revised its fee to $40 for each of the complainant and her son, itemized as $30 for the electronic transfer of medical records and a $10 administration fee for providing a USB flash drive. The adjudicator upholds the custodian’s revised fee in each complaint and dismisses the complaints. No order is issued.

Statutes Considered: Personal Health Information Protection Act, 2004, S.O. 2004 , c. 3, sections 54(10)  and (11) .

Decisions Considered: PHIPA Decisions 111, 130 132, and 133.

BACKGROUND

[1] The complainant, her son and her husband are patients of a physician who practiced out of the respondent medical centre. When the physician moved her practice to another medical centre, the complainant sought access to her chart, and that of her son, [1] from the respondent medical centre for the purpose of transferring the charts to their physician’s new practice. To that end, the complainant made an access request under the Personal Health Information Protection Act (PHIPA or the Act) to the respondent medical centre (the custodian or the respondent medical centre) for her personal health information, and that of her son.

[2] The custodian invoiced fees in the amount of $82 for the complainant’s chart (188 pages) and $53.25 for her son’s (73 pages). [2] Specifically, the invoice for each of the charts set out photocopy costs plus an “administration fee” of $10. [3]

[3] The complainant filed two complaints with the Information and Privacy Commissioner (IPC) regarding the fee charged in each case. In particular, the complainant took issue with the photocopy fee, in light of the fact that she had requested the records on a USB.

[4] During mediation of the complaints, the complainant again stated that she wanted to receive the records electronically and she disagreed with paying 25 cents per page for electronic records.

[5] The custodian took the position that the existing fee framework does not specifically address whether it can charge 25 cents per page for an electronic record. The custodian stated that it should be able to recover some of its costs relating to both paper and electronic records by charging 25 cents per page for both types of records. As a result, the custodian was not prepared to revise its fee.

[6] As no mediated resolution of the complaints was reached, the complaints moved to the adjudication stage, where an adjudicator may conduct a review under PHIPA. I began my review by inviting representations from the custodian. The custodian’s representations included a revised fee decision of $40 for each of the complainant and her son, itemized as $30 for the electronic transfer of medical records and a $10 administration fee for providing a USB flash drive.

[7] The complainant then filed representations in response, followed by the custodian’s reply and the complainant’s sur-reply. The parties’ representations were shared with one another in accordance with Practice Direction Number 3 of the IPC’s Code of Procedure for complaints under PHIPA.

[8] In this decision, I uphold the custodian’s revised fee in each complaint and dismiss the complaints. No order is issued.

DISCUSSION

[9] The sole issue in each of these complaints is whether the custodian’s fee for access to the records should be upheld.

Reasonable cost recovery for access as set out in PHIPA

[10] Sections 54(10) and (11) of PHIPA address fees that may be charged by a health information custodian, such as the respondent medical centre, for access to records of personal health information. Those sections read:

54 (10) A health information custodian that makes a record of personal health information or a part of it available to an individual under [Part V of PHIPA] or provides a copy of it to an individual under clause (1)(a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

[11] Section 54(11) of PHIPA prohibits a health information custodian from charging a fee that exceeds “the prescribed amount” or the “amount of reasonable cost recovery” if none is prescribed. Given the absence of a regulation prescribing the amount of the fee that may be charged, the IPC has the authority pursuant to Part VI of PHIPA to conduct a review to determine whether the fee charged exceeds “the amount of reasonable cost recovery” within the meaning of PHIPA.

[12] PHIPA does not define “amount of reasonable cost recovery” for the purpose of section 54(11). However, the IPC has previously considered the meaning of this phrase for the purposes of the fee provisions in PHIPA, [4] and has found that the phrase “reasonable cost recovery” in PHIPA does not mean “actual cost recovery,” or full recovery of all the costs borne by a health information custodian in fulfilling a request for access to an individual’s own personal health information. [5] These decisions have also concluded that the use of the word “reasonable,” to describe cost recovery, suggests that costs should not be excessive, and that, as a whole, section 54(11) must be interpreted in a manner that avoids creating a financial barrier to the important purpose of PHIPA to grant a right of access to one’s own personal health information. [6]

[13] These past decisions have also concluded that a fee scheme set out in a proposed regulation to PHIPA, published by the Minister of Health and Long-Term Care in 2006 (the “2006 framework”), [7] though never adopted, provides the best framework for determining the amount of “reasonable cost recovery” under PHIPA. [8]

[14] The 2006 framework applied in those orders establishes a set fee of $30 that the custodian may charge to complete specifically defined work required to respond to a request, as well as fees that a custodian may charge over and above that set fee. The 2006 framework reads, in part, as follows:

Fees for access to records

25.1(1) For the purposes of subsection 54(11) of [PHIPA], the amount of the fee that may be charged to an individual shall not exceed $30 for any or all of the following:

1. Receipt and clarification, if necessary, of a request for a record.

2. Providing an estimate of the fee that will be payable under subsection 54(10) of [PHIPA] in connection with the request.

3. Locating and retrieving the record.

4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access may be refused.

5. Preparation of a response letter to the individual.

6. Preparation of the record for photocopying, printing or electronic transmission.

7. Photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages, excluding the printing of photographs from photographs stored in electronic form.

8. Packaging of the photocopied or printed copy of the record for shipping or faxing.

9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping or faxing the printed copy.

10. The cost of faxing a copy of the record to a fax number in Ontario or mailing a copy of the record by ordinary mail to an address in Canada.

11. Supervising the individual’s examination of the original record for not more than 15 minutes.

(2) In addition to the fee charged under subsection (1), fees for the services set out in Column 1 of Table 1 shall not, for the purposes of subsection 54(11) of [PHIPA], exceed the amounts set out opposite the service in Column 2 of the Table.

[15] Section 25.1(2) of the 2006 framework indicates that a custodian may charge fees over and above the set $30 in amounts set out in an attached table. [9] The following item set out in that table is of particular note in the circumstances of this review:

ITEM	COLUMN 1	COLUMN 2
3.	For making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form	$10

Representations of the parties

[16] The complainant submits that the 2006 framework as well as the CPSO’s [10] policy state that the amount charged for records should not exceed $30. She notes that the records are not being printed and since she is willing to supply a new USB to the custodian onto which to put the records, there are no material costs. The only cost to the custodian is the time required for the administrative staff to locate and transfer the digital files.

[17] The custodian submits that its fee reflects a reasonable cost recovery and complies with the IPC framework. It submits that custodians are entitled to review the requested records before providing them regardless of whether or not the patient requests such a review. This is to ensure custodians fulfill their obligations under PHIPA and to ensure that they are granting access only to the personal health information to which the patient is entitled.

[18] The custodian submits that in this case, both charts are straightforward. [11] Each chart contains information such as patient summary; clinical notes detailing complaints, assessments, diagnosis, treatment and follow-up; and other documents such as prescriptions issued, tests requisitioned, referrals made and any associated laboratory reports and results.

[19] The custodian notes that the IPC has endorsed a 5-second-per-page review time estimate for charts requiring straightforward review. [12] Although this would exceed the 15 minutes of professional review provided for by the $30 flat-fee under the 2006 Framework for the complainant’s chart, no additional professional review fee is reflected in the custodian’s revised fee. Added to the professional review fee is a $10 administration fee associated with producing each chart electronically on USB flash drive.

[20] The custodian concludes that in the circumstances, the revised fee of $40 for the electronic production of each of the charts at issue is entirely reasonable and appropriate. It says that this fee accords with recent IPC jurisprudence, the principle of “reasonable cost recovery,” the 2006 Framework, and subsections 54(11) and (12) of PHIPA.

[21] The custodian goes on to state its concerns with the complainant’s proposal to provide her own USB flash drive to the custodian.

[22] First, it states that the USB flash drive might be corrupted, contain malware or a virus, and/or contain other malicious software that could infect and expose the clinic's EMR as well as put at risk the personal health information on the custodian's servers. Moreover, the USB flash drive might be formatted incorrectly for the custodian's EMR, server and operating system, making it unusable. Where formatting is required, any existing information on the USB flash drive might be irretrievably lost.

[23] The custodian also points out that the $10 administration fee does not solely reflect the retail cost of a USB flash drive. The 2006 Framework states that the $10 is charge for "[f)or making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form." Although not defined or explained in the 2006 Framework, the custodian submits that “making'” the USB flash drive must logically and plainly refer to steps such as, for example, formatting the USB flash drive, installing software for viewing the records, and implementing safeguards and security protection.

[24] The custodian concludes that the practical, logistical, security, liability and cost implications make it unreasonable to force custodians to accept patients' personal USB flash drives for the purposes of providing electronic copies of medical records. It is more efficient, effective and secure if custodians provide the USB for electronic transfer of medical records, so long as the fee charged for doing so is reasonable. In the custodian’s submission, the 2006 Framework and the $10 fee it provides for strike a reasonable and appropriate balance between the principle of “reasonable cost recovery” and the custodian’s imperative to ensure “practical, logistical, security, liability and cost certainties” in the process of providing electronic copies of medical records.

[25] In sur-reply, the complainant points out that this is the first the custodian has mentioned any review of the records being required before releasing them. She argues that even allowing for such review, the fee of $30 is excessive. Further, she states that the option to provide her own USB was initially at the suggestion of the custodian, and since she recognized the security concerns, she offered to provide a USB key that is still enclosed in the original packaging.

[26] The complainant also states that the custodian’s reply representations are the first time she has heard the argument that the administrative fee is for “making and providing” the records in electronic form. Originally, the custodian told her that if she provided her own device, the $10 fee would be waived. In her view, this implies that the $10 fee quoted was intended for the actual device itself.

[27] Finally, the complainant says that the fee to obtain the charts digitally should be less than the applicable fee for paper records.

Analysis and findings

[28] I will address first the complainant’s argument that the custodian did not initially refer to any review time in its fee, and only raised the issue in reply. Irrespective of when the issue was raised, I note that PHIPA Decision 111 established the principle that a health information custodian responding to a request for access to records of personal health information is entitled to review the records before granting access, and to charge fees for its review. The review fees that it is permitted to charge a requester are to be assessed according to the principle of “reasonable cost recovery.” This principle has been applied in decisions that followed. [13] I am satisfied that the custodian was entitled to include review time in its fee.

[29] I am not convinced that the review time should be any less just because the records will be provided electronically. In PHIPA Decision 130, the adjudicator rejected the complainant’s assertion that a review of records in electronic format will require less time than paper records, which was the format of the records discussed in PHIPA Decision 111. The adjudicator was not convinced in the circumstances of the case before her that the medium in which the information is displayed (electronic v. paper) affects the time required by the custodian to review those records in response to a request for access under the Act. Similarly, I see no basis for making such a distinction here.

[30] In any event, the initial fee allowed for by section 25.1 of the 2006 framework includes “any or all” of the activities listed, including “review of the content of the record for not more than 15 minutes”. Here, the custodian had to, at a minimum, locate and retrieve the charts, review their contents “to determine if the record contains personal health information to which access may be refused,” and prepare a response to the request. For reviewing the records alone, and using the 5 seconds per page benchmark for straightforward review established in Decision 111, the complaint’s chart (188 pages) would take over 15 minutes to review and her son’s (73 pages) 6 minutes. I see no basis in the circumstances for reducing the $30 fee set out for completing “any or all” of these tasks.

[31] Finally, I note the complainant’s argument that the custodian’s reply submissions were the first time it raised any concerns about transferring the charts onto the complainant’s own USB, and the first time it took the position that the $10 fee allowed for a CD includes “making” it. Although the custodian could have raised this earlier, I agree with the custodian that it is entitled to insist on using its own USB devices for chart transfers, for the security reasons described in its representations. I also agree that “making” the USB involves effort beyond simply providing it.

[32] For these reasons, I uphold the custodian’s revised fee in each complaint, as follows:

Initial fee for all tasks described in section 25.1(1) of the 2006 framework, including 15 minutes of review time.		$30
For making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form		$10
Total Cost of Processing Request	$30 + $10	$40

NO ORDER

For the foregoing reasons, no order is made. The complaints are dismissed.

Original signed by:		March 30, 2021
Gillian Shaw
Senior Adjudicator

APPENDIX

TABLE 1

Table 1

ITEM	COLUMN 1	COLUMN 2
1.	For making and providing photocopies or computer printouts of a record	25 cents for each page after the first 20 pages
2.	For making and providing a paper copy of a record from microfilm or microfiche	50 cents per page
3.	For making and providing a floppy disk or a compact disk containing a copy of a record stored in electronic form	$10
4.	For making and providing a microfiche copy of a record stored on microfiche	50 cents per sheet
5.	For making and providing a copy of a microfilm of a record stored on microfilm that is,
	i. 16mm	$25 per reel
	ii. 35mm	$32 per reel
6.	For printing a photograph from a negative or from a photograph stored in electronic form, per print,
	i. measuring 4” × 5”	$10
	ii. measuring 5” × 7”	$13
	iii. measuring 8” × 10”	$19
	iv. measuring 11” × 20”	$26
7.	For making and providing a copy of a 35mm slide	$2
8.	For making and providing a copy of an audio cassette	$5
9.	For making and providing a copy of a ¼”, ½”, or 8mm video cassette,
	i. that is one hour or less in length	$20
	ii. that is more than one hour but not more than two hours in length	$25
10.	For making and providing a copy of a ¾” video cassette,
	i. that is not more than 30 minutes in length	$18
	ii. that is more than 30 minutes in length	$23
11.	For producing a record stored on medical film, including x-ray, CT and MRI films	$5 per film
12.	For the review by a health information custodian or an agent of the custodian of the contents of a record to determine if the record contains personal health information to which access or disclosure may or shall be refused	$45 for every 15 minutes after the first 15 minutes
13.	For supervising examination of original records	$6.75 for every 15 minutes