Hospital for Sick Children v. Information and Privacy Commissioner of Ontario, 2025 ONSC 1911

CITATION: Hospital for Sick Children v. Information and Privacy Commissioner of Ontario, 2025 ONSC 1911

DIVISIONAL COURT FILE NOS.: DC-24-00000449-00JR DC-24-00000250-00JR DC-24-00000453-0000 DATE: 20250327

ONTARIO SUPERIOR COURT OF JUSTICE DIVISIONAL COURT

BETWEEN:

Hospital for Sick Children Applicant

• and -

Information and Privacy Commissioner of Ontario Respondent

AND BETWEEN:

Halton Children’s Aid Society Appellant

• and -

Information and Privacy Commissioner of Ontario Respondent

AND BETWEEN:

Halton Children’s Aid Society Appellant

• and -

Information and Privacy Commissioner of Ontario Respondent

Christine Muir and Travis Walker, for the Applicant Brendan Gray, for the Respondent

Christine Muir and Travis Walker, for the Applicant Brendan Gray, for the Respondent

Christine Muir and Travis Walker, for the Applicant Brendan Gray, for the Respondent

HEARD at Toronto: In Writing

REASONS FOR JUDGMENT

Shore J.

1The Ontario Hospital Association (the "OHA") seeks leave to intervene as a friend of the court, pursuant to Rules 13.02 and 13.03 of the Rules of Civil Procedure, in the Application for judicial review and in the Appeal brought by the Hospital for Sick Children ("SickKids") and the Halton's Children's Aid Society ("Halton CAS"), which have been ordered to be heard together on May 1, 2025.

2The Application and the Appeal concern decisions by the Information and Privacy Commissioner of Ontario ("IPCO") that found that cyberattacks that encrypted servers housing individuals' personal information ("PI") or personal health information ("PHI"), without the threat of the attackers accessing, taking or exfiltrating any data, still triggers the notification obligations under the Personal Health Information Protection Act, 2004 ("PHIPA") and the Child, Youth and Family Services Act, 2017 ("CYFSA").

3The parties to the appeal consent to OHA being granted intervenor status.

4For reasons set out below, the motion is granted.

Analysis:

5In determining whether to grant leave to intervene, the court will consider:

(a) the nature of the case;

(b) the issues which arise; and

(c) the likelihood of the proposed intervener being able to make a useful contribution to the resolution of the case without causing injustice to the immediate parties.

Nature of the case:

6The decision of the IPCO affects the notification obligations of not just the parties, but any organization subject to the same legislation, including hospitals. The decision appears to expand the obligation to situations where there have been cybersecurity attacks where there is no evidence to suggest PI or PHI were accessed, transferred or encrypted.

7OHA submits that its interest in this matter, particularly as it relates to the protection of PHI and notification obligations under PHIPA, flows directly from its mandate to serve its hospital member organizations - all custodians of PHI under PHIPA ("custodians") - and improve Ontario's health system.

8Custodians require clear legal guidance on notification requirements. The issues raised in the Applications and the Appeal transcend the immediate interests of the parties involved given the increasing threats of cybersecurity incidents. Because the court's decision will have broad implications on the health sector, the OHA submits the court will benefit from diverse perspectives.

Issues that arise:

9The issues raised impact all OHA hospital members and any organization that is a custodian under PHIPA and subject to breach notification obligations.

10Cyberattacks have become increasingly prevalent and it is important that the custodians are clear on their notification requirements.

Useful contribution:

11The OHA was founded in 1924 and represents the interests of approximately 135 of Ontario's hospitals. The OHA supports it members through advocacy, labour relations, member engagement and knowledge translation, and data and analytics to build and sustain a strong and innovative health care system. The OHA is very involved on issues of privacy and health care, including ensuring that legal development reflect the day-to-day realities of its members. They have been consulted by the government on issues concerning privacy and cybersecurity policy.

12I accept that the OHA has sector wide insights and deep knowledge of the PHIPA, and the operational impacts of privacy and security challenges on health care organizations.

13OHA intends to make submissions that the interpretation of PHIPA that results in overly broad notification should be avoided. They are costly, time consuming, can raise anxiety levels of affected individuals unnecessarily and contribute to notification fatigue and reluctance to share data with custodians.

14OHA is not seeking an extension on the current schedule, and I see no hardship or injustice being caused to any of the parties.

15Considering the consent of the parties, the nature of this case, the issue arising in this case, the expertise of the OHA, and their intended submissions, I find the test has been satisfied and the OHA should be given intervenor status.

Order:

16The Ontario Hospital Association has leave to intervene as a friend of this Court on the following terms:

(a) the OHA may serve a factum not exceeding 20 pages within three weeks of the Records of Proceedings being served by the Information and Privacy Commissioner of Ontario ("IPCO"), or on another date agreed upon by the parties and the OHA;

(b) to allow the IPCO additional time and factum length to respond to the OHA's intervention, the existing timetable will be amended to provide the IPCO an additional week to serve its responding factums, each of which shall not exceed 40 pages;

(c) the OHA may present oral arguments not exceeding 20 minutes at the hearing of the Applications and the Appeal;

(d) the OHA shall coordinate with the parties and make best efforts to avoid duplication of submissions;

(e) the OHA shall not raise new issues or adduce new evidence; and

(f) there shall be no costs awarded for or against the OHA in respect of this Motion for leave to intervene and the proposed intervention.

“Shore J.”

Released: March 27, 2025

CITATION: Hospital for Sick Children v. Information and Privacy Commissioner of Ontario, 2025 ONSC 1911

DIVISIONAL COURT FILE NO.: DC-24-00000449-00JR DC-24-00000250-00JR DC-24-00000453-0000