Information and Privacy Commissioner of Ontario
INVESTIGATION REPORT
INVESTIGATION PC-000011-1
MINISTRY OF HEALTH AND LONG-TERM CARE
June 29, 2000
INTRODUCTION
The Ontario Hepatitis C Assistance Plan
The Ministry of Health and Long-Term Care (the Ministry) administers the Ontario Hepatitis C Assistance Plan (OHCAP). The OHCAP program provides compensation to certain individuals who can establish that they contracted Hepatitis C through the blood system.
Under the OHCAP program, a member of the public can request an application form from the Ministry. Applicants are required to disclose, in detail, their medical history with respect to any blood transfusions they may have had during the time period covered by the program. They are also required to sign a consent form, allowing the hospital where they received treatment to disclose hospital records to the Ministry for the purposes of determining eligibility.
Once the Ministry receives a signed consent and other required application documents, the Ministry initiates a search for hospital records. The Ministry contacts hospitals and asks them to search for and send copies of all relevant records concerning the particular applicant to the Ministry.
Once the hospital records are received by OHCAP, the file is assigned to a Nurse Case Manager to obtain additional information through a questionnaire. This additional information is particularly important if the blood records for an applicant have not been located. Once the questionnaire is completed, the file is forwarded to the OHCAP Program Adjudicator to make a determination of eligibility based on the information in the file. If an applicant is deemed eligible, compensation is paid. If an applicant is deemed ineligible, a letter of ineligibility is sent to the applicant explaining the review process and relevant time lines.
All contact with OHCAP program applicants is handled by the Ministry’s Infoline, administered by the Communications and Information Branch. Public Information Officers (PIOs) at Infoline are specifically designated to respond to requests for information about the OHCAP program. PIOs have access to a limited amount of personal information about existing applicants which can be accessed from a computer database. Once PIOs have verified that they are indeed speaking to an OHCAP applicant, they can answer certain questions, usually regarding the status of the applicant’s file.
If Infoline PIOs do not have the information requested by the applicant, they are required to send an e-mail message to their Supervisor, which includes the applicant’s name, OHCAP file number, date of birth, physician’s name and particulars of the requested information. If the applicant raises a contentious or high profile issue, PIOs are required to flag the e-mail message as “urgent”. The Supervisor in turn forwards the e-mail message to an OHCAP staff member specifically designated for this purpose. The OHCAP staff member then accesses the applicant’s file, determines the answer to the query, and sends an e-mail response to the Supervisor who in turn forwards it to the Infoline PIO. The PIO is dependent on a follow-up call from the applicant in order to convey the information provided by the OHCAP program staff. There is no regular direct contact between applicants and OHCAP program staff.
Background of the Complaint
In March 1999, a member of the public (the Applicant) made an application under the OHCAP program. The Applicant provided the Ministry with the required consent for collection, use and disclosure of any relevant records originally held by two hospitals that had provided medical services to the Applicant in the 1970s.
The Ministry then requested and received the Applicant’s records from the two hospitals. In September 1999, the Applicant requested and received a copy of her hospital records from OHCAP. Upon review of the records provided by the two hospitals, the Applicant advised the Ministry that some relevant personal medical information from one of the hospitals (the Hospital) was missing from her file. The Ministry contacted the Hospital and received additional records.
The Ministry then reviewed the Applicant’s file in its entirety and, in a letter dated January 28, 2000, the Applicant was advised by the then OHCAP Program Adjudicator that she was ineligible for compensation.
In February 2000, the Applicant informed the Ministry that two pages of another individual’s (Person B) personal medical information were included in the records she received from OHCAP in September 1999. The Ministry asked the Applicant to return these two records to the Ministry, and the then Program Adjudicator advised the Applicant that all copies of Person B’s records in the possession of the Ministry would immediately be destroyed.
Without waiting for the return of the records from the Applicant, the then Program Adjudicator destroyed all copies of Person B’s records in the possession of the Ministry.
On February 15, 2000, the Applicant filed a Request for Review form to the OHCAP Review Committee. When the Review Committee receives the Request for a Review form, they open a file and provide a copy of the form to the Ministry. A staff member at the Ministry’s OHCAP program, upon receipt of the form, prepares three copies of the applicant’s complete file, and sends two copies to the Review Committee and one copy to the applicant.
After receiving the copy of her file, the Applicant called the Ministry’s Infoline in April 2000. She requested forms pertaining to the Review Process, and also informed the Infoline PIO that her file included a third page containing Person B’s medical records. The Applicant refused at that time to return the two pages of Person B’s records identified in September 1999 and the third page identified in February 2000 to the Ministry until she was provided with assurances that Person B was not in possession of the Applicant’s personal information. The PIO sent an urgent e-mail to the Supervisor, who in turn forwarded it to the designated OHCAP staff member. The response to this e-mail from OHCAP addressed the issue of the forms but not the reported disclosure of the personal information relating to Person B. The Applicant never called back to the Infoline.
In May 2000, the Applicant also advised the Review Committee that her file contained Person B’s records, and the Review Committee notified the OHCAP Program Adjudicator. The Program Adjudicator in turn advised senior management staff of the Ministry.
On May 4, 2000, the Minister wrote to this Office asking me to “... investigate the circumstances relating to this incident.” On May 5, 2000, I responded to the Minister agreeing to her request, and thanked her for notifying me of a potential breach of the Freedom of Information and Protection of Privacy Act (the Act). I immediately initiated an investigation pursuant to my responsibilities under the Act.
On May 8, 2000, Ministry staff personally attended at the Applicant’s home and retrieved the records containing Person B’s medical information.
Before discussing the substantive issues and results of my investigation, it is important to state that my Office received full and complete co-operation from staff at the Ministry and the Hospital. We were quickly permitted access to all relevant individuals and documentation, and everyone involved conducted themselves in an open and forthright manner. This enabled our investigators to conduct interviews, obtain the information that they required, and to conclude the investigation in a timely fashion.
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question “personal information” as defined in section 2(1) of the Act?
(C) Was the personal information disclosed in compliance with section 42 of the Act?
(C) Were reasonable measures taken with respect to the security and the destruction of the information contained in the records pertaining to Person B, in accordance with the requirements of sections 3 and 6 of Regulation 459 and section 4 of Regulation 460 of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question “personal information” as defined in section 2(1) of the Act?
Section 2(1) of the Act states, in part, “personal information” means recorded information about an identifiable individual, including,
(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,
(D) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,
(a) any identifying number, symbol or other particular assigned to the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
The records at issue contain “personal information” as defined in section 2(1) of the Act, specifically the name, address, telephone number, religion, age, sex, marital status, medical and psychological information relating to Person B.
The Ministry does not dispute this finding.
Conclusion: The information in question was personal information as defined in section 2(1) of the Act.
Issue B: Was the personal information disclosed in compliance with section 42 of the Act?
Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information. None of these circumstances are present in this instance and, in our view, the disclosure of personal information by the Ministry was not in compliance with the Act.
The Ministry does not dispute this finding.
Conclusion: The disclosure of personal information was not in compliance with section 42 of the Act.
Issue C: Were reasonable measures taken with respect to the security and the destruction of the information contained in the records pertaining to Person B, in accordance with the requirements of sections 3 and 6 of Regulation 459 and section 4 Regulation 460 of the Act?
Section 3 and 6 of Regulation 459 of the Act provides as follows:
s.3 Where personal information is in the custody or under the control of an institution, no person shall destroy it without the authorization of the head.
s.6(1) Every head of an institution shall ensure that the institution maintains a disposal record setting out what personal information has been destroyed or transferred to the Archives and the date of that destruction or transfer.
s.6(2) The head shall ensure that the disposal record maintained under subsection (1) does not contain personal information.
Section 4 of Regulation 460 of the Act provides as follows:
(1) Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.
(2) Every head shall ensure that only those individuals who need a record for the performance of their duties shall have access to it.
(3) Every head shall ensure that reasonable measures to protect the records in his or her institution from inadvertent destruction or damage are defined, documented and put in place, taking into account the nature of the records to be protected.
During the course of our investigation, we interviewed a number of OHCAP program staff including the three Program Adjudicators involved in the Applicants file, two of whom had reviewed and considered the personal medical information in the Applicant’s file for the purpose of determining eligibility for compensation. A list of individuals interviewed during the course of the investigation can be found in Appendix A.
How did Person B’s records end up in the Applicant’s file?
Our investigators were advised by Hospital staff that whenever the Hospital receives a request from OHCAP for an applicant’s information, the consent is received and verified and the appropriate sections of the Hospital are searched. The Hospital also liaises with its blood transfusion services department to verify whether or not there had been a transfusion. Hospital documents are copied and sent back to one person in the Health Records Department who reviews them and sends them on to the Ministry via regular mail.
The Hospital explained that it implemented a centralized patient index system in 1986. At that time, demographic information stored on various hardcopy index cards was transferred to the new automated system. The software had the capability to match identifiers and selected demographic data elements and determine if a patient had been assigned two different identifiers. The software also allowed the information to be merged together under one unique identification number, in accordance with an established procedure. The patient’s physical medical records were stored on microfilm and once the electronic conversion was completed, the applicable microfilm numbers were noted against the patient’s new identification number.
When the request was received by the Hospital from the Ministry regarding the Applicant, the Hospital looked up her patient identification number, reviewed the noted microfilm pages and produced paper copies of all records relevant to OHCAP’s request. It appears that the Applicant’s records were combined with Person B’s records at some point following the conversion process and, when the Ministry requested the Applicant’s records from the Hospital in May 1999, the records provided to the Ministry by the Hospital included Person B’s records. It is significant to note that the Applicant and Person B have the same name and similar date of birth and used the services of the same hospital during the 1970s.
Ministry’s First Disclosure of Personal Information - September 1999
As stated earlier, the Applicant requested and was provided with a copy of her hospital records from the Ministry in September 1999. After reviewing the records, she advised the Ministry that some were missing, and the Ministry obtained additional records from the Hospital in December 1999. These additional records were not forwarded to the Applicant at that time. The complete file of hospital records was then used by the Program Adjudicator to assess eligibility for OHCAP benefits. The Program Adjudicator determined that the Applicant was ineligible for benefits in January 2000, and advised the Applicant accordingly.
After receiving her letter of ineligibility, the Applicant advised the Ministry in February 2000 that she was in possession of two pages which related to Person B. The then-Program Adjudicator asked the Applicant to return the documents, and advised her that all copies of records pertaining to Person B in the possession of the Ministry would be destroyed. The then-Program Adjudicator destroyed these records before retrieving the copies from the Applicant. No follow up with the Applicant took place, and there is no evidence that senior officials in the Ministry were advised of the disclosure of Person B’s personal information.
Because as of February 2000 the only records provided to the Applicant by the Ministry were those included in the September 1999 distribution, and there is no dispute that two pages of records containing Person B’s personal information were indeed in the possession of the Applicant at the time of her call to the Ministry in February 2000, we have concluded that the Ministry’s first improper disclosure of Person B’s personal information to the Applicant took place in September 1999.
Ministry’s Second Disclosure of Personal Information - March 2000
From our review of the records, it appears that the third page of records containing Person B’s personal information was received by the Ministry when they obtained additional records from the Hospital in December 1999. In March 2000, the Applicant received a copy of her complete file upon filing her request for a review of the Ministry’s decision. In April 2000, the Applicant notified the Ministry through the Infoline that she had not received certain forms with respect to the review process and also that in reviewing the records, she found the third record relating to Person B. The Applicant also advised the Review Committee that she had received Person B’s personal information.
OHCAP staff responded to the Applicant’s request for the forms but did not address the second disclosure of Person B’s personal information. The OHCAP staff member who dealt with this matter told our investigators that she thought the Applicant was referring to the Ministry’s first disclosure,
and that this issue had been resolved in February 2000. As a result, the Applicant’s concern regarding the Ministry’s second disclosure was not immediately brought to the attention of the Program Adjudicator. The Program Adjudicator was made aware of the disclosure only when advised by the Review Committee in May 2000.
The Retrieval of Person B’s Information
The current Program Adjudicator, upon learning in May 2000 that the Applicant had personal medical information relating to Person B, took immediate steps to retrieve the records from the Applicant.
The Program Adjudicator asked an OHCAP staff member to contact the Applicant to obtain clarification of the facts relating to this incident. This staff member contacted the Applicant and was advised of two separate occasions where a disclosure of Person B’s personal medical information had occurred. The Applicant indicated that her primary concern was to obtain confirmation that hospital records containing the Applicant’s personal information had not been in turn sent to Person B. When the Applicant declined to return Person B’s records to the Ministry, the Program Adjudicator advised her Director, Legal Counsel, the Deputy Minister and the Minister’s staff.
On May 8, 2000, an OHCAP staff member attended at the Applicant’s home to retrieve any records containing information which related to Person B. In exchange for a letter from the Ministry confirming that the Applicant’s records had never been inappropriately disclosed, the Applicant provided the staff member with two pages of records pertaining to Person B. The first record is page 1 of a two-page physician letter and the second record is a Hospital Summary Sheet.
The staff member questioned the Applicant about page 2 of the physician letter. The Applicant stated that she cannot recall having received page 2 of the letter. The Applicant offered the staff member the opportunity to review any and all hospital records in her possession. Upon review, the Applicant and the staff member were unable to locate page 2 of the physician letter relating to Person B. The Applicant identified a page (marked “page 4”) of what seems to be a different record which she believes does not relate to her. The staff member retrieved page 1 of the physician letter, the Hospital Summary Sheet which appears to relate to Person B, and the other “page 4” record which the Applicant believes does not contain her personal information.
Upon returning to the Ministry, the staff member and the Program Adjudicator reviewed their copy of the Applicant’s file and were unable to locate a copy of the record marked as “page 4”. According to the staff member, OHCAP staff assumed that this record was one of the two pages previously destroyed by the Ministry in February 2000, and that page 2 of the physician’s letter, which clearly relates to Person B, does not exist. Because the Ministry did not document the records destroyed in
February 2000 it is not possible to confirm that page 2 of the physician’s letter was among the records destroyed at that time.
As noted above, two copies of the Applicant’s complete file were sent to the Review Committee and included with these copies was the Hospital Summary Sheet relating to Person B. In addition to taking immediate steps to retrieve the records from the Applicant, the Program Adjudicator also arranged for the retrieval of the copies sent to the Review Committee. An OHCAP staff member attended at the Review Committee office to retrieve the copies of the Hospital Summary Sheet relating to Person B. The Program Adjudicator advised that these copies are currently in a sealed envelope in her office.
Remedial steps taken by the Ministry
Since this incident occurred, the Ministry has taken the following interim remedial steps pending the outcome of this investigation:
secured their FAX machine behind locked doors;
obtained a shredder designated solely for the OHCAP program area;
asked OHCAP staff to review all files where names are similar;
asked OHCAP staff to advise the Program Adjudicator of any Infoline e-mails where concerns have been expressed by an applicant;
placed a physical flag on files where applicants have expressed concerns or where files are otherwise contentious.
CONCLUSIONS:
In its initial review of the records provided by the Hospital, the Ministry did not match the name of the Applicant to her date of birth, thereby missing the fact that Person B’s records were included in the Applicant’s file.
The Ministry destroyed records the Applicant identified as relating to Person B prior to retrieving the copies of these records from the Applicant, thereby creating a circumstance where it is impossible to verify if the destroyed records were the same records as those retrieved on May 8, 2000. The actions taken by the Ministry did not comply with the provisions of section 6(1) of Regulation 459.
The Ministry failed to follow up with the Applicant regarding the retrieval of Person B’s records once advised that the first inappropriate disclosure of personal information had occurred.
It appears that the Ministry did not review the records provided by the Hospital in December 1999 when the Applicant called in February 2000 to say she had information relating to Person B, but instead relied on the Applicant to identify Person B’s records. Given that the Ministry already knew at that point that there had been concerns with records received from the Hospital, we believe that had OHCAP staff checked the file thoroughly at that time, they would have found the Hospital Summary Sheet and prevented the second disclosure.
Subsequent to the second disclosure in March 2000, OHCAP staff failed to immediately respond to the April 2000 e-mail from Infoline. They also failed to alert management that the second incident had occurred, thus preventing any remedial action from being taken until the Applicant contacted the Review Committee in May 2000.
RECOMMENDATIONS
Given the likelihood that records being received by OHCAP originate from institutions that are not covered by the Act, once those records are received in the Ministry they enter into an environment where there are strict rules that must be followed surrounding the collection, use, disclosure, retention and destruction of the records.
- I recommend that OHCAP staff, when reviewing the personal information of applicants to the program, make all reasonable efforts to ensure that personal information leaving the program area relates to, and is received by, the individual to whom the information relates, including, but not limited to, checking both the name and the date of birth, and any other available identifiers for accuracy, in each and every record.
With respect to the public contact process and its relationship to the OHCAP program, even though I recognize that a verbal check is required for a staff member to verify that they are disclosing personal information to the applicant to whom that information relates, there appears to be more personal information relating to applicants who call Infoline with queries recorded in the e-mails exchanged between Infoline staff and OHCAP staff than is necessary for their purposes. The possibility for e-mails going astray in a large Ministry creates an environment for potential violations of privacy.
I recommend that the Ministry amend its procedures for the administration of the OHCAP program to require all contact by applicants to the program and all contact between the program and various hospitals to take place directly with OHCAP program staff and not through the Ministry’s Infoline.
Once recommendation 2 has been implemented, I recommend that Infoline staff no longer be permitted access to the database containing personal information of OHCAP applicants.
I recommend that the OHCAP program establish standards with respect to the level of detail when tracking the handling of a given file, and that the exchange of recorded personal information be restricted to that necessary to administer the program, in accordance with the requirements of section 4 of Regulation 460.
I recommend that the Ministry take the appropriate action to ensure that the destruction of records involved in the administration of the OHCAP program complies with the requirements of sections 3 and 6 of Regulation 459.
With respect to the retrieval of the records relating to Person B, I am concerned that page 2 of the physician’s letter has not yet been located.
I recommend that the Ministry contact the Hospital and obtain a description of page 2 of the physician’s letter, and then conduct a further search of records in the Ministry’s custody and control which may contain this record.
I recommend that the Ministry contact the Hospital for the purposes of determining whose personal information is contained in the “page 4” record, and advise me accordingly.
I recommend that OHCAP program staff contact the Applicant with a view to arranging for a further inspection of the records in her possession, to ensure that no further records concerning Person B, including page 2 of the physician’s letter, remain unidentified.
I recommend that all copies of the Hospital Summary Sheet relating to Person B, currently in the custody and control of the Ministry, be returned to the Hospital.
It is clear that a number of employees involved in the administration of the OHCAP program, as well as employees involved in the operation of the Ministry’s Infoline, particularly PIOs, do not have an adequate level of knowledge concerning the importance of personal information considerations and the duties and obligations imposed on employees of the Ministry under the privacy protection provisions of the Act. A similar concern was identified by this Office in an earlier 1997 report involving the same Ministry, entitled “A Special Report to the Legislative Assembly of Ontario on
the Disclosure of Personal Information at the Ministry of Health.” That report included a recommendation that “among other things, the Ministry should conduct periodic refresher courses to heighten awareness of privacy-related issues, or periodically issue reminder memoranda concerning the appropriate use and disclosure of sensitive personal information.”
- I recommend that all staff in the OHCAP program and the Ministry’s Infoline operation be given overall training on both the access and privacy provisions of the Act.
On June 7, 2000, I sent the Ministry and the Hospital a draft version of this report, and provided both organizations with an opportunity to identify any errors or omissions. In response, the Ministry advised that Recommendation 9 has been implemented, and that work is underway in response to Recommendations 1, 5, 6, 7, 8 and 10. I commend the Ministry for its prompt attention to these recommendations.
My office would be pleased to assist with any of the above recommendations.
Within three months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with all 10 recommendations.
FINAL COMMENTS
I feel that the content of the postscript in the above-referenced 1997 report is relevant and bears repeating in the circumstances of this investigation:
In my view, the circumstances from which this report arose reflect the ultimate fragility of the protection of personal information held by government organizations. They also point to a basic truth about privacy - privacy once lost cannot be regained. Once personal information is “out the door” there is simply no way of eliminating knowledge of it.
I believe it is essential for government organizations to be guided by the premise that they are only the stewards of the personal information entrusted to them. The information belongs to the person to whom it relates. Understandably, governments require personal information in order to perform the various services they provide. However, the fact that the personal information has been provided to them does not mystically transform the information into the “government’s” information. Indeed, this is the essence of the privacy rules contained in Ontario’s two freedom of information and protection of privacy acts.
In my opinion, privacy laws are only part of the answer to privacy protection. As with any law, they cannot provide an absolute guarantee. What is essential is that governments understand and respect the immense level of trust citizens place in government when they relinquish any detail of their personal information. They are disclosing details about their relationships, their finances and their health, after which point they have no control over what happens to the information. This lack of control is even more pronounced in an era of digitized information.
At its root, I feel the best privacy protection is grounded in attitude - an attitude which should flow naturally from an appreciation of the nature of the relationship between government and members of the public. Governments exist at the pleasure of the governed - and privacy protection is an essential part of the relationship.
Original signed by: June 29, 2000
Ann Cavoukian, Ph.D Date
Commissioner
APPENDIX A
LIST OF INDIVIDUALS INTERVIEWED
Director, Health Economics Branch
OHCAP Program Co-ordinator
Administrative Assistant to OHCAP Program Co-ordinator
OHCAP Manager of Hospital Relations
2 former OHCAP Program Co-ordinators
1 current OHCAP Administrative Staff Member
1 former OHCAP Administrative Staff Member
1 former OHCAP Nurse Care Manager
OHCAP Infoline Operator
OHCAP Infoline Supervisor
3 staff members of OHCAP Review Committee
Manager, Health Records for the Hospital
The Applicant