CITATION: The Estate of Richard Martin v. Health Professions Appeal and Review Board, 2023 ONSC 2993
DIVISIONAL COURT FILE NO.: 080/20
DATE: 2023/05/18
ONTARIO
SUPERIOR COURT OF JUSTICE
DIVISIONAL COURT
McWatt ACJSCJ, Sachs and Hackland JJ.
BETWEEN:
The Estate of Richard Martin, by its Litigation Administrator, Sarah Martin
Applicant
– and –
Health Professions Appeal and Review Board and Dr. Amit Shah
Respondents
Amani Oakley, for the Estate of Richard Martin, Applicant
David P. Jacobs, for the Health Professions appeal and Review Board, Respondent
Carolyn Brandow and John Petrella, for Dr. Amit Shah, Respondent
Morgana Kellythorne, for the College of Physicians and Surgeons
HEARD at Toronto by videoconference: January 11, 2023
Sachs and Hackland jj.
NATURE OF PROCEEDING
[1] This is a judicial review of a decision of the Health Professions Appeal and Review Board (“HPARB”), dated January 16, 2020, confirming the decision of the Inquiries, Complaints and Reports Committee (“ICRC”) of the College of Physicians and Surgeons (“CPSO”) that dismissed the complaint against the Respondent Dr. Shah. The Applicant seeks to have the decision set aside and remitted back to the ICRC with directions from this Court.
[2] Dr. Shah provided treatment to Robert Martin (who died after the commencement of this application) on one occasion over a four-hour period. Subsequently, Mr. Martin commenced a medical malpractice action against Dr. Shah. While pursuing his action, Mr. Martin discovered that Dr. Shah accessed his medical records on several occasions over a four-year period, despite the fact that he was no longer involved in Mr. Martin’s care and despite the fact that Dr. Shah had transferred Mr. Martin to another hospital.
[3] Mr. Martin complained to the CPSO about Dr. Shah’s conduct in accessing his medical records. The ICRC investigated the complaint and decided to take no further action against Dr. Shah. Key to this decision was the ICRC’s finding that Dr. Shah had accessed Mr. Martin’s medical records for the purpose of instructing counsel and defending himself in the medical malpractice proceeding and that such access was permitted under s. 37(1)(h) of the Personal Health Information and Protection Ac, 2004. S.O. 2004, c. 3 Sched. A. (“PHIPA”). On review, the HPARB found that the ICRC’s decision was reasonable. It also found that the ICRC’s investigation was adequate.
[4] The Applicant challenges the HPARB’s conclusion regarding the adequacy of the ICRC’s investigation and also asserts that HPARB erred in upholding the ICRC’s decision that s. 37(1)(h) of PHIPA authorized Dr. Shah to access the records in question.
[5] For the reasons that follow, we would allow the application and remit the matter to the HPARB for reconsideration in accordance with these reasons.
FACTUAL BACKGROUND
Dr. Shah’s Involvement in the Care of Mr. Martin
[6] On November 29, 2011, Mr. Martin fell down a set of stairs. Following the incident, he was taken to the emergency room at St. Thomas Elgin General Hospital (“STEGH”) via ambulance, where he was diagnosed with a left-leg tibial fracture. While at STEGH, the Respondent ,Dr. Shah, an emergency room physician, treated the patient for roughly four hours. That same day, roughly seven (7) hours later, Mr. Martin was transferred to London Health Sciences Centre (“LHSC”) for further treatment.
Events Giving Rise to the Complaint
[7] In November 2013, Mr. Martin initiated an action in the Superior Court of Justice by way of a Statement of Claim against Dr. Shah, several other physicians, STEGH and LHSC for failing to identify compartment syndrome, which he developed while at STEGH. Mr. Martin’s left leg was left severely deformed and entirely disabled as a result.
[8] In the course of the litigation, Mr. Martin requested information from LHSC regarding which health professionals had accessed his medical records. The outcome of this request showed that the respondent, Dr. Shah, had accessed his medical records on five (5) occasions: December 13, 2011 ( two weeks after Dr. Shah ceased treating Mr. Martin); December 3, 2013 (shortly after the Statement of Claim in the civil action was served, but over two years after Dr. Shah’s treatment of Mr. Martin had ceased) ; December 3, 2013 (5 hours later); January 29, 2014; February 6, 2014 and December 30, 2015 (over four years after Dr. Shah had finished treating Dr. Shah.). Mr. Martin’s counsel filed a complaint with the CPSO on December 31, 2017 regarding Dr. Shah’s access of Mr. Martin’s medical records.
Dr. Shah’s Response to the Complaint
[9] Dr. Shah responded to the complaint by stating that he had not had time to complete his record keeping with respect to his treatment of Mr. Martin on the day that he transferred him to LHSC. Thus, he accessed Mr. Martin’s chart on December 13, 2011 to complete that record keeping. With respect to the other instances that he accessed the records, Dr. Shah’s counsel gave one explanation for that conduct and Dr. Shah gave another. In counsel’s letter to the ICRC dated April 17, 2018 she stated: “All but of the (sic) accesses were before Dr. Shah had retained met with his lawyer…and so, before Dr. Shah received or knew he would receive a copy of the records through his lawyer.” In Dr. Shah’s letter to the ICRC dated April 4, 2018, he stated that he was served with the Statement of Claim on December 3, 2013 and accessed Mr. Martin’s records on that day in order to request assistance in defending the lawsuit. He accessed the records on January 29 and February 6, 2014 in order to prepare for a meeting that he had with the lawyer retained to defend him in the lawsuit. He did so again on December 30, 2015 to help him defend the lawsuit.
[10] Dr. Shah could not recall what records were accessed on which occasion, but he did recall that he did not access any records that were not relevant to the issues in the litigation and that were not subsequently produced in the litigation.
[11] Once it was clear to Dr. Shah that Mr. Martin did not want him to access his records at LSHC, he stopped doing so.
ICRC Investigation
[12] Dr. Shah’s response to the complaint was provided to Mr. Martin’s counsel, who sent an 8-page letter of additional comments, along with a copy of the transcript from Dr. Shah’s examination for discovery in the civil litigation.
[13] The ICRC then requested additional submissions from Dr. Shah regarding his compliance with the CPSO policy on Medical Records and his compliance with PHIPA. In particular, the ICRC noted that s. 37(1)(h) of PHIPA allows a “health information custodian” to access medical records for use in defending a proceeding against it. It therefore inquired how Dr. Shah met the definition of “health information custodian” in s. 3(1) of PHIPA. Section 3(1) of PHIPA defines a “health care custodian” as including a “health care practitioner or a person who operates a group practice of health care practitioners.”
[14] On July 18, 2018, Dr. Martin’s counsel replied to this request as follows:
With respect to the issue of health information custodian, the legislation describes “HIC” as including a health care practitioner. Dr. Shah is a health care practitioner. He is required by the hospital to use their record system for his work in the hospital setting. Dr. Shah is a party to the litigation commenced in which the care of the patient in the hospital setting is at issue. Dr. Shah only reviewed records which related to or is a matter in issue in the lawsuit and, in fact, records that were provided to his lawyer in the lawsuit. Dr. Shah reviewed the records in the hospital system only before he was informed and aware that he should not or there was objection to his access of the copy of the records within the hospital’s records system rather than the same record produced to his lawyer. As soon as Dr. Shah was aware that there was a concern about him reviewing the copy of the records on the hospital system rather than the copy of the same records produced in the litigation, he stopped reviewing records on the hospital system.
[15] The ICRC requested the emergency room records relating the Dr. Shah’s treatment of Mr Martin and an audit trail for November 29, 2011 to December 2015. It also asked Mr. Martin’s counsel if she had any other information she wished to provide.
The ICRC Decision
[16] The ICRC found that it was satisfied that Dr. Shah accessed Mr. Martin’s chart in December of 2011 for the purpose of completing his chart and that this was appropriate.
[17] With respect to the other four times Dr. Shah accessed Mr. Martin’s medical records, the ICRC cited s. 37(1)(h) of PHIPA, which reads as follows:
A health information custodian may use personal health information about an individual…
(h) for the purpose of a proceeding or a contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding.
[18] The ICRC found that s. 37(1)(h) “clearly sets out an exemption around the privacy considerations related to a patient’s personal health information, for the purposes of litigation.” As it was satisfied that Dr. Shah only reviewed Mr. Martin’s records “for the purposes of litigation,” it declined to take any further action against him.
The HPARB Decision
[19] The HPARB first considered whether the ICRC had conducted an adequate investigation. Mr. Martin asserted that it had not for a number of reasons, including that it failed to investigate what actual records Dr. Shah had accessed and that it failed to obtain the relevant hospital policies governing access to personal health information.
[20] The HPARB found that it was not possible for the ICRC to discover which records Dr. Shah had accessed and that the ICRC had done what it needed to do to make an informed decision about the issues in the complaint. Accord to HPARB, this was an investigation where the facts were not really in dispute.
[21] With respect to the merits of the ICRC decision, the HPARB found that there was nothing to suggest that Dr. Shah was lying about the reasons why he accessed the records in question. Further, Dr. Shah’s access to the records after litigation was commenced against him “fell squarely” within the provision of s. 37(1)(h) of PHIPA.
ISSUES RAISED
[22] This application raises the following issues:
What is the applicable standard of review? The Applicant asserts that it is correctness, and the other parties argue that it is reasonableness.
Did HPARB err when it accepted the ICRC’s interpretation of s. 37(1)(h) of PHIPA?
Did HPARB err when it concluded that the ICRC had conducted an adequate investigation?
STANDARD OF REVIEW
[23] The Applicant essentially gave two reasons for asserting that the applicable standard of review is correctness. First, HPARB was not interpreting its “enabling” statute and, therefore, its decision should not attract deference from a reviewing court. Second, the issue is one that will have a profound effect on a number of areas of the law and a number of pieces of legislation, including the Rules of Civil Procedure. Given this, it is a question that impacts the rule of law and therefore, it must be answered correctly.
[24] In Canada (Minister of Immigration and Citizenship) v. Vavilov, 2019 SCC 65, the Supreme Court of Canada revised the framework for judicial review. As a result, it is no longer necessary for courts to engage in a contextual inquiry to identify the appropriate standard of review. The contextual inquiry was driven by a perceived need to determine whether the administrative decision maker had greater expertise than the reviewing court. Thus, factors such as the qualifications of the administrative body’s members, their experience in a particular area, the nature of the question being looked at and whether it involved its “home” statute were assessed and weighed. In Vavilov the Supreme Court accepted that “this contextual analysis proved to be unwieldy and offered limited practical guidance for courts attempting to assess an administrative decision maker’s relative expertise”: at para. 28. Therefore, the court chose to move away from a model which decided the appropriate standard of review based on a weighing of the expertise of the administrative decision maker. The Applicant’s submission that we should determine the applicable standard of review based on the fact that the HPARB was not interpreting its enabling statute is an invitation for us to do what the Supreme Court has explicitly told us we should no longer be doing.
[25] The new framework for determining the applicable standard of review involves starting with the presumption that the applicable standard is reasonableness. Further, “while this presumption applies to the administrative decision maker’s interpretation of its enabling statute, the presumption also applies more broadly to other aspects of its decision”: Vavilov, at para. 25.
[26] There are only five situations in which there may be a derogation from the presumption of reasonableness. Two of those situations arise out of legislative intent—legislated standards of review or statutory appeal mechanisms (which do not arise in this case). The other three arise because a correctness review is required by the rule of law: Vavilov, at para. 69. This is essentially the Applicant’s submission.
[27] In Vavilov, the Supreme Court went on to clarify when the rule of law requires a correctness review. In so doing it limited it to three situations: “ constitutional questions, general questions of law of central importance to the legal system as whole, questions regarding jurisdictional boundaries between administrative bodies”: Vavilov at para. 69.
[28] This application does not raise a constitutional question or a question regarding the jurisdictional boundaries between administrative bodies. Does it, as the Applicant argues, raise a general question of law of central importance to the legal system as a whole?
[29] In Vavilov the Supreme Court describes such questions as questions that are of “fundamental importance and broad applicability, with significant legal consequences for the justice system as a whole or for other institutions of government”: at para. 59. For example, a question involving solicitor client privilege attracted the correctness standard both because it had implications for a wide variety of statutes (the submission in this case) and because solicitor client privilege is necessary for the functioning of the administration of justice. “The mere fact that a dispute is of ‘wider public concern’ is not sufficient for a question to fall into this category- nor is the fact that the question, when framed in a general or abstract sense, touches on an important issue”: Vavilov at para. 61.
[30] The issue of when a doctor can breach patient confidentiality is both important and an issue of wide public concern. It also has implications for other statutes and laws. However, it does not rise to the level of magnitude necessary to be considered a general question of law that is of central importance to the legal system as a whole.
Was the decision of HPARB reasonable in accepting ICRC’s interpretation of s. 37(1)(h) of PHIPA?
[31] The ICRC found Dr. Shah acted appropriately in accessing Mr. Martin’s chart on December 13th, 2011 for the purpose of completing his medical charting for the patient’s visit to the STEGH emergency room on November 29th, 2011. This access was included in the complaint to the ICRC but was not pursued before HPARB or this court. Dr. Shah had not only the right but the professional obligation to complete his medical charting as part of the medical care he provided to Mr. Martin, as the ICRC concluded. The ICRC reminded Dr. Shah of the importance of the timely completion of his medical records.
[32] However, Dr. Shah accessed Mr. Martin’s chart some two years later on two occasions on December 3, 2013 in connection with his initial meeting with his legal counsel. He had just been served with the statement of claim in Mr. Martin’s medical negligence action. As noted, he subsequently accessed the chart again on January 29, 2014, February 6, 2014 and one further time on December 30, 2015. ICRC accepted as a factual matter that Dr. Shah’s access to Mr. Martin’s medical record on these four occasions was to instruct his counsel in defence of the legal proceeding in which he was a named defendant. This was a reasonable conclusion and there was no suggestion of Dr. Shah having any other reason to do so. We would show deference to that important finding of fact.
[33] The central question before HPARB was the reasonableness of ICRC’s conclusion that Dr. Shah was entitled to access his former patient’s personal health information (“PHI”) on four occasions during the course of a civil action in which he was a named party. The ICRC found that Dr. Shah was entitled to do so by reason of s. 37(1)(h) of PHIPA which permits a health information custodian to use PHI about an individual for the purpose of a proceeding in which “the custodian or the agent or former agent of the custodian” is a party, “if the information relates to a matter in issue in the proceeding”.
[34] If Dr. Shah was an agent of the health information custodian, then subsection 37(2) would apply. The relevant subsections of s. 37 provide:
37 (1) A health information custodian may use personal health information about an individual,
(h) for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding;
Agents
(2) If subsection (1) authorizes a health information custodian to use personal health information for a purpose, the custodian may provide the information to an agent of the custodian who may use it for that purpose on behalf of the custodian.
[35] There are two discretionary aspects to subsection 37(2). The phrase “the custodian may provide the information to an agent of the custodian” must be interpreted to mean the health information custodian has a discretion to provide the information to an agent for the purpose of the proceeding and if that occurs the agent “may use it for that purpose on behalf of the custodian”. However, the latter phrase, “on behalf of the custodian” is not a requirement that the information be used by the agent only on behalf of the custodian. The agent in his or her discretion “may” do so, but the subsection should be read as allowing the agent to use the information for the agent’s own defence in the lawsuit, as occurred in the present case.
[36] Section 37(1)(h) and 37(2) must be read together with s. 41(1) and 41(2) of PHIPA which govern disclosure of an individual’s PHI by a health information custodian and by an agent. In each case the disclosure must be “subject to the requirements and restrictions” of the proceedings, which would entail compliance with the Rules of Civil Procedure in the case of a civil lawsuit. Subsections 41(1) and (2) provide:
Disclosures for proceedings
41 (1) A health information custodian may disclose personal health information about an individual,
(a) subject to the requirements and restrictions, if any, that are prescribed, for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding;
(d) for the purpose of complying with,
(i) a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information, or
(ii) a procedural rule that relates to the production of information in a proceeding.
Disclosure by agent or former agent
(2) An agent or former agent who receives personal health information under subsection (1) or under subsection 37 (2) for purposes of a proceeding or contemplated proceeding may disclose the information to the agent’s or former agent’s professional advisor for the purpose of providing advice or representation to the agent or former agent, if the advisor is under a professional duty of confidentiality.
[37] It can be seen that the use and disclosure of PHI by a health information custodian or an agent must be carried out subject to the requirements and restrictions of the Rules of Civil Procedure in the context of a civil lawsuit. These requirements are not consistent with a health care provider, whether a health information custodian or agent", unilaterally accessing a former patient’s hospital records without the patient’s knowledge and consent and outside the procedures provided for in the proceeding, being the Rules of Civil Procedure.
Health Information Custodians and agents
[38] Neither the ICRC nor HPARB carried out an analysis as to whether Dr. Shah was in fact a health information custodian of the hospital records he accessed. PHIPA distinguishes between a “health information custodian” and an “agent” of the custodian. The Act imposes a series of restrictions on the collection, use and disclosure of personal health information, which differ as between the custodian and the agent.
[39] PHIPA deals with “agents” of the health information custodian, in a manner which permits more restrictive access to PHI in conjunction with and subject to the discretion of the health information custodian. The custodian has oversight responsibilities under the Act for its agent’s access to such information.
[40] Importantly, PHIPA defines health information custodian to include a public hospital or a health care practitioner, but in either case the health information custodian must be a person or organization who “has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s power or duties”. The Act states:
3(1) In this Act,
“health information custodian”, means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any:
A health care practitioner or a person who operates a group practice of health care practitioners
A person who operates one of the following facilities, programs or services:
(i) A hospital within the meaning of the Public Hospitals Act.
[41] PHIPA distinguishes an “agent” of the health information custodian:
2(1) “agent”, in relation to a health information custodian, means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by the custodian and whether or not the agent is being remunerated
3(3) Except as is prescribed, a person described in any of the following paragraphs is not a health information custodian in respect of personal health information that the person collects, uses or discloses while performing the person’s powers or duties or the work described in the paragraph, if any:
- A person described in paragraph 1, 3 or 5 of the definition of “health information custodian” in subsection (1) who is an agent of a health information custodian.
[42] In other words, a physician (or other health care practitioner) who does not have custody and control of personal health information, but instead accesses such information through the electronic patient records of a public hospital, is an agent of the health information custodian (i.e., of the public hospital). Such an agent is specifically stated in s. 3(3) of PHIPA to not be a health information custodian.
[43] In the present case, Dr. Shah electronically accessed the PHI (the hospital records) of Mr. Martin, which were in an electronic data base in the custody and control of the London Health Sciences Centre (LHSC). LHSC granted sign-in ability to Dr. Shah pursuant to arrangements or hospital policies which are not before the court, nor were they part of the Record before HPARB. In the circumstances of this case, LHSC was the health information custodian. Dr. Shah was an agent of the health information custodian. While physicians and other health care practitioners can be health information custodians (for example with respect their own office records or clinic records), Dr. Shah did not have custody and control of Mr. Martin’s electronic hospital chart. He had sign-in ability to LHSC’s electronic medical records as an agent of LHSC. Under PHIPPA, this distinction is significant, as explained below.
Medical Records Policy of the College of Physicians and Surgeons (the CPSO)
[44] The distinction between a health information custodian and an agent is clearly recognized and explained in the CPSO’s Medical Records Policy #4-12 entitled “Advice to the Profession: Protecting Personal Health Information”. The Policy begins with this observation:
Protecting patients' personal health information (PHI) is fundamental to providing high quality patient care. To establish and preserve trust in the physician-patient relationship, patients must be confident that their PHI is protected. This Advice document is intended to help physicians interpret and understand the legal and professional obligations to protect patients' PHI.
[45] The Policy explains the distinction between “health information custodians” and “agents”:
PHIPA refers to "health information custodians· and "agents”. What are these?
A "health information custodian" ("custodian") is a person or organization who, as a result of their power, duties, or work, has custody or control of PHI. This includes health care organizations such as hospitals, pharmacies, and laboratories, as well as some individual physicians (such as owners of a clinic and physicians working as a sole practitioner in their own practice).
In contrast, an “agent" is a person who is authorized by a custodian to perform certain activities on its behalf regarding PHI. Generally speaking, this includes physicians practising in hospitals and certain medical clinics, as well as administrative staff in a medical clinic or hospital. Custodians are ultimately responsible for PHI, as well as the actions of their agents.
While PHIPA's framework is complex, custodians and agents are ultimately obliged to meet the same general expectations regarding the collection, use, and disclosure of PHI. The expectations in the policy therefore apply to all physicians, regardless of whether they are a custodian or agent, as does the guidance in this Advice document unless noted otherwise.
[46] The Policy goes on to advise of the need for physicians, who are agents, to check with the custodian “to see whether disclosure is permitted”.
Permitted and Required Disclosures
In what situations am I permitted to disclose PHI without consent?
In some circumstances, PHIPA permits physicians to disclose PHI without consent. In some of these cases - including a), b), c), e), and f) below - disclosure is only permitted at the discretion of the custodian. If you are acting as an agent, check with your custodian to see whether the disclosure is permitted ...
f. A proceeding or contemplated proceeding in which you or your hospital is, or is expected to be, a party or witness.
[emphasis added]
[47] This Policy correctly reminds physicians of the applicable law, that when they are agents of a health information custodian (such as a Public Hospital) and they wish to access a former patient’s hospital records because they are expecting to be a party or witness to a proceeding, they are to check with their custodian to see whether the custodian will exercise its discretion to permit use of or disclosure of the information.
[48] In the present case, Dr. Shah unilaterally accessed Mr. Martin’s hospital chart on several occasions without consulting the LHSC, in circumstances where the LHSC may well have declined to permit disclosure of the information. The ICRC omitted to look into this important issue, apparently because they failed to identify or attach significance to the fact Dr. Shah was an agent of the health information custodian (the LHSC), to which PHIPA and the College’s Policy applied.
Section 17 of PHIPA
[49] Neither the ICRC nor HPARB referred to s. 17(1) of PHIPA which governs the relationship between health information custodians and agents concerning PHI. The custodian has oversight responsibility for this information. Under this section the custodian “may permit” its agent to use or disclose PHI on the custodian’s behalf “only if” the custodian is permitted to use or disclose the information, is necessary in the course of the agent’s duties, and is not contrary to PHIPA or another law. Further such permission is subject to such conditions or restrictions as the custodian “may impose”. Subsection (1.1) and (2) prescribe what an agent is permitted to do by way of use and disclosure of PHI. These subsections provide:
(1.1) A permission granted to an agent under subsection (1) may be subject to such conditions or restrictions as the health information custodian may impose.
Restriction, collection, use, etc. by agents
(2) Subject to any exception that may be prescribed, an agent of a health information custodian may collect, use, disclose, retain or dispose of personal health information only if,
(a) the collection, use, disclosure, … of the information, as the case may be,
(i) is permitted by the custodian in accordance with subsection (1),
(ii) is necessary for the purpose of carrying out his or her duties as agent of the custodian,
(iii) is not contrary to this Act or another law, and
(iv) complies with any conditions or restrictions that the custodian has imposed under subsection (1.1);
[50] As Dr. Shah did not notify or request authorization from the health information custodian, the LHSC, for access to Mr. Martin’s hospital records, it is unknown what position LHSC would have taken or what conditions it might have prescribed pursuant to its statutory responsibility under Section 17 of PHIPA. Clearly ICRC did not consider s. 17 of PHIPA to apply, either because it failed to appreciate that Dr. Shah was an agent of the health information custodian or that s. 37(1)(h) obviated the need to comply. We are of the view that the ICRC erred in failing to consider Dr. Shah’s failure to comply with s. 17 of PHIPA, which in turn prevented LHSC from complying with its obligations concerning PHI in its medical records system.
[51] The applicant further submits a health information custodian must first determine whether the use or disclosure of PHI is necessary or if other information will serve the purpose. In a civil proceeding the Rules of Civil Procedure enacted pursuant to the Courts of Justice Act are designed to govern the production of medical records and PHI (and other relevant information) by a plaintiff who asserts a claim connected with their health care. Section 30 of PHIPA provides:
30 (1) A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.
[52] The applicant argues forcefully that in the context of a civil lawsuit, a health information custodian is precluded from disclosing and must not permit its agent to disclose an individual’s PHI where that information can be made available through the production and discovery process provided by the Rules of Civil Procedure.
[53] In the present case, Dr. Shah’s counsel emphasized in correspondence to the ICRC and in submissions to this court that Dr. Shah only accessed Mr. Martin’s PHI in the LHSC electronic records, that in fact had already been produced to his counsel in the civil action. The point seemed to be that Dr. Shah was not seeking further PHI beyond what he already had and therefore did not perceive his later access to Mr. Martin’s hospital chart as a privacy breach. However, under s.30(1) of PHIPA, a health care provider, whether a health information custodian, or the custodian’s agent, can not access or use PHI that they do not require because they already have or are about to receive the information, (in this case from disclosure from the former patient in the civil litigation process). There was no recognition or consideration of this contravention of Section 30 of PHIPA in either the ICRC or HPARB reasons.
[54] The established case law, as summarized in the leading case of Burgess v. Wu (2003), 2003 6385 (ON SC), 235 D.L.R. (4th) 341 , holds that “confidentiality is not automatically waived by a patient by starting a lawsuit”. The applicant submits in the context of a civil lawsuit there are limits to the plaintiff’s obligation to disclose their PHI, both in terms of relevance, time frame, and subject matter and other legal considerations. A party’s counsel is entitled to make an assessment of the required scope of production and disclosure, and such an assessment can be challenged in court by opposing counsel. However, HPARB’s decision, it is argued, did away with the opportunity and entitlement of a litigant to seek to impose limits as to the relevant time frame or subject matter of the disclosure of their medical information by allowing unrestricted access to their former physician.
[55] We agree that s.30(1) of PHIPA, when applied in the context of civil proceedings governed by the Rules of Civil Procedure that regulate the disclosure and production requirements of relevant PHI, will result in the production of “other information [which] will serve the purpose of the use and disclosure”. The Rules of Civil Procedure are an effective way of guarding the confidentiality of this information and appropriately balancing its use and disclosure with the health care provider’s interest in the fair adjudication of proceedings in which they are parties or witnesses. In the present case, we share the concern expressed by the applicant that had there been issues about the producibility of portions of Mr. Martin’s LHSC hospital record, based, for example on relevance, issues of privilege, or evidentiary requirements, Dr. Shah’s unilateral accesses to the hospital record could circumvent and potentially prevent any judicial consideration of such issues.
Case law
[56] Before HPARB, the applicant relied on several leading authorities which explain the common law obligation of health care providers to protect the confidentiality of a patient’s personal health information, such as McInerney v MacDonald, 1992 57 (SCC), [1992] 2 S.C.R. 138 and Burgess. The Boards observation was “The case law cited by the Applicant predated the coming into force of PHIPA and the provisions of that statute prevail.”
[57] In point of fact these cases still apply and form an important part of the legal framework surrounding a physician’s duty to protect the confidentiality of a patient’s personal health information and are useful tools in the interpretation of PHIPA. The Court of Appeal for Ontario in Hopkins v. Kay, 2015 ONCA 112, 124 O.R. (3d) 481, held that PHIPA does not create an exhaustive code that ousts the jurisdiction of the Superior Court to entertain common law actions arising out of an improper disclosure of patient health records.
[58] McInerney and Burgess continue to be cited by the courts on the physician’s duty to protect their patient’s or former patient’s personal health information. In 2017, Justice Perell in Barker v. Barker, 2017 ONSC 3397, 139 O.R. (3d) 96, cited McInerney for the proposition that “when a doctor is under a fiduciary duty, equity acts in personam to prevent the doctor from acting in a manner inconsistent with the interests of the patient to whom the duty is owed and that equity will intervene to protect the patient from an improper exercise of the physician’s discretion”: at para. 28. These cases provide an important guidepost to the interpretation of the complex provisions of PHIPA.
Did HPARB err when it concluded that the ICRC had conducted an adequate investigation?
[59] HPARB concluded it was satisfied the ICRC obtained the essential information relevant to making an informed decision regarding the issues raised in the complaint. The applicant raised several objections concerning procedural fairness, which we would not give effect to. However, when the ICRC mischaracterized Dr. Shah as a health information custodian under PHIPA, rather than an agent of the custodian, it failed to consider whether he complied with the CPSO Policy requiring physicians, who are agents, to contact the health information custodian (the LHSC) to determine whether the custodian would agree to the release of the former patient’s personal health information under its custody and control. As a result, the ICRC did not consider if the physician had complied with his obligations under s. 17(1) of PHIPA and did not obtain or review online or otherwise consider the relevant confidentiality policies of the custodian, the LHSC. In short, by focusing exclusively on s. 37(1)(h) of PHIPA, the IPRC did not adequately consider the lawfulness of Dr. Shah’s access to the hospital’s electronic health records system in the circumstances of this case.
Summary
[60] As noted previously, the ICRC decided to take no further action on Mr. Martin’s complaint that Dr. Shah had improperly accessed his personal health information without his knowledge or consent. The ICRC decision was based on its opinion that section 37(1)(h) of PHIPA permitted such access to Dr. Shah because he was a party to a lawsuit involving his patient care. HPARB considered the ICRC’s disposition of this complaint to have been reasonable.
[61] We do not agree that the ICRB’s decision was reasonable as it was based on a flawed and incomplete analysis of the governing statutory scheme. As put by the Supreme Court in Vavilov, at para. 105: “In addition to the need for internally coherent reasoning, a decision, to be reasonable, must be justified in relation to the constellation of law and facts that are relevant to the decision.” The fundamental importance of guarding the confidentiality of personal health information and of a patient’s medical records in particular, warranted a careful analysis of the relevant provisions of PHIPA and of the physician’s actions in the circumstances. It is undisputed that Dr. Shah was unilaterally and without the permission of the patient or the health care information custodian, the LHSC, accessing his former patient’s hospital records, some four years after the one occasion in which he rendered medical treatment and long after he ceased to be part of the patient’s circle of care. This occurred at a time when these hospital records were in an electronic data base under the custody and control of a public hospital with policies and oversight responsibilities for the use and disclosure of these records. Moreover, this happened in circumstances where Dr. Shah had already been provided by his counsel with copies of the relevant parts of the hospital record, obtained pursuant to the Rules of Civil Procedure which were applicable in the lawsuit.
[62] The ICRC failed to identify that Dr. Shaw was not a health information custodian, but rather was an agent of the health information custodian (the LHSC) and had compliance obligations to the LHSC before accessing, using and disclosing such information in the lawsuit. The Committee did not discuss Dr. Shah’s failure to comply with the policy of the CPSO, or with the provisions of PHIPA, other than giving an unduly broad application to section 37(1)(h) of the Act. The Committee gave no consideration to section 30 of PHIPA which provides that personal health information is not to be disclosed when it was not necessary to do so, as in the present case, given Dr. Shah already had the relevant hospitals records produced in the lawsuit. The committee wrongly considered the case law predating the enactment of PHIPA to be inapplicable and adopted an unduly broad interpretation of section 37(1)(h) inconsistent with the purposes of and protections afforded by the legislation.
[63] We would set aside the decision of HPARB and remit the matter back to the Board for reconsideration of its decision in accordance with these reasons.
Costs
[64] The applicant, as the successful party, is awarded costs of the application, fixed (by agreement) in the sum of $18,000 inclusive of disbursements and HST, payable by the respondent Dr. Shah.
Sachs J.
Justice C. Hackland
I agree _______________________________
McWatt ACJSCJ.
Released: May 18, 2023
CITATION: The Estate of Richard Martin v. Health Professions Appeal and Review Board, 2023 ONSC 2993
DIVISIONAL COURT FILE NO.: 080/20
DATE: 2023/05/18
ONTARIO
SUPERIOR COURT OF JUSTICE
DIVISIONAL COURT
McWatt ACJSCJ, Sachs and Hackland JJ.
BETWEEN:
The Estate of Richard Martin, by its Litigation Administrator, Sarah Martin
Applicant
– and –
Health Professions Appeal and Review Board and Dr. Amit Shah
Respondents
REASONS FOR JUDGMENT
Sachs and Hackland JJ.
Released: May 18, 2023