INVESTIGATION REPORT
INVESTIGATION I96-071P
WORKERS' COMPENSATION BOARD
February 18, 1997
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning the Workers’ Compensation Board (the WCB). The complainant stated that the WCB had improperly disclosed his personal information to a named insurance company (the Company), without his prior written consent.
He stated that in 1994, after he had filed a claim with the Company, he had signed an Authorization for certain parties to disclose information to the Company. It was his view that not only did this Authorization not apply to the WCB, but that it was not valid at the time the WCB disclosed his personal information to the Company in 1996.
The complainant believed, therefore, that the WCB’s disclosure of his personal information to the Company was not in compliance with the provisions of the Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question “personal information” as defined in section 2(1) of the Act? If yes,
(B) Was the disclosure of the complainant’s personal information in compliance with section 42 of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question “personal information” as defined in section 2(1) of the Act?
Section 2(1) of the Act states, in part:
"personal information" means recorded information about an identifiable individual, including,
(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,
(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,
(c) any identifying number, symbol or other particular assigned to the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
The information in question was a copy of the complainant’s WCB claim file. This included medical and correspondence sections, i.e. forms, memos, letters that contained the complainant’s age, address, telephone number, details of the accident and financial compensation by the WCB, stated weekly salary, the complainant’s medical condition and other information about him.
In our view, this information met the requirements of paragraphs (a), (b), (c), (d), and (h) of section 2(1) of the Act.
Conclusion: The information in question was “personal information” as defined in section 2(1) of the Act.
Issue B: Was the disclosure of the complainant’s personal information in compliance with section 42 of the Act?
The WCB informed us that on April 18, 1996, in response to a “reminder” telephone call from the Company, it had disclosed the complainant’s claim file to the Company.
Section 42 of the Act sets out the rules for disclosure of personal information other than to the individual to whom the information relates. This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 42(a) through (n).
It was the position of the WCB that the complainant’s personal information had been disclosed in compliance with section 42(b) of the Act which states:
An institution shall not disclose personal information in its custody or under its control except,
(b) where the person to whom the information relates has identified that information in particular and consented to its disclosure;
The complainant provided us with a copy of the Authorization he signed dated June 16, 1994. The relevant portions are:
To: Any physician, medical practitioner, hospital, clinic or other medically or medically related facility or provider of medical or dental services or supplies, and to any employer, group policyholder, or contract holder or insurer.
I authorize you to release to: The [Company] or its representatives “any and all information you may have about the medical and physical history, condition and treatment, and the wages and insurance coverage of [the complainant].”
I understand the information obtained by use of the Authorization will be used for the purpose of evaluating and administering a claim for benefits. Any information obtained will not be released by [the Company] to any person or organization EXCEPT to reinsuring companies, Medical Information Bureau, Inc., group Policyholder, or other persons or organizations performing business or legal services in connection with my claim, or as may be lawfully required or as I may further authorize. For the purpose of disclosing information, I understand that this authorization is valid for a period of one year.
If this authorization is given in connection with a claim for health benefits, disability or like insurance benefits, I understand that it is valid for the duration of the claim.
The complainant stated that the Authorization was valid for the claim he had filed against the Company in 1994 but not for his WCB claim in 1996. The complainant also stated that in his view this Authorization did not authorize the WCB to disclose any of his personal information since it was not on the list of those directed to disclose information.
However, the WCB stated that it considered itself to be an “insurer” for the purposes of the Authorization. It also provided us with a letter from the Company dated November 1, 1994, stating that the Company was handling a claim for Long Term Disability (LTD) benefits for the complainant and that this was the claim for which the Authorization had been signed.
The Company’s lawyer advised us that this LTD claim was ongoing as the complainant had commenced litigation against the Company, seeking to compel payment of benefits and a declaration of entitlement.
It was the WCB’s position that the Authorization was, therefore, valid at the time of disclosure because it fell within the “duration of the claim”, given the outstanding litigation with respect to the claim.
In our view, we have not been provided with conclusive information that the Authorization was valid at the time of the disclosure. Further, even if the WCB may, for certain legal purposes, be described as an“insurer”, it is not necessarily the case that it would have been clear to a person in the position of the complainant that the WCB would fall within this category of groups or individuals as indicated on the Authorization. In this regard, it would not be reasonable to assume that the complainant had knowledge of the WCB’s planned disclosure of his personal information to the Company when he signed the Authorization.
However, for the purposes of the discussion of section 42(b) of the Act that follows, we have assumed that the claim for disability benefits was ongoing, the Authorization had not expired and that the WCB was an “insurer”.
In order for section 42(b) of the Act to apply, the complainant had “to identify the personal information in particular” which the WCB disclosed to the Company and consented to its disclosure.
A copy of the complainant’s entire WCB claim file was disclosed to the Company. The Authorization signed by the complainant directed the disclosure of specific categories of information about him, i.e. “ any and all information you may have about the medical and physical history, condition and treatment, and the wages and insurance coverage...”. In our view, not all of the personal information contained in the complainant’s WCB claim file would have necessarily fallen within the categories cited, and therefore, the Authorization did not extend to a disclosure of his complete file.
It is also our view that while the complainant would have been aware of some of the documents in the file such as the letters to him from the WCB, he would not necessarily have been aware of all internal WCB memoranda, other external correspondence etc. In addition, he signed the Authorization in June 1994 in relation to a specific insurance claim against the Company. At that time, some of the records that were the subject of his complaint would not have been in existence.
The WCB did not confirm the contents of his claims file with the complainant prior to disclosing his personal information to the Company. Although the Authorization may be said to have covered certain documents that did not exist at the time of its signing, in these circumstances, we cannot conclude that the complainant identified the “personal information in particular” contained in these documents. It is thus our view that the WCB could not rely on section 42(b) of the Act for its disclosure of the complainant’s personal information to the Company. Therefore, the WCB’s disclosure was not in compliance with section 42(b) of the Act.
We have also examined the remaining provisions of section 42 and found that none applied to the disclosure of the complainant’s personal information.
Conclusion: The disclosure of the complainant’s personal information was not in compliance with section 42 of the Act.
SUMMARY OF CONCLUSIONS
The information in question was “personal information” as defined in section 2(1) of the Act.
The disclosure of the complainant’s personal information was not in compliance with section 42 of the Act
RECOMMENDATION
We recommend that the WCB take steps to ensure that personal information is only disclosed in compliance with section 42 of the Act.
Within six months of receiving this report, the WCB should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.
Original Signed By: February 18, 1997
Susan Anthistle Date
Compliance Review Officer