A recent decision of the Ontario Information and Privacy Commissioner (OPC) highlights the potentially broad application of the Personal Health Information Protection Act (PHIPA).1
The vast majority of PHIPA's obligations are imposed upon "health information custodians" – those individuals and organizations that collect information from patients – doctors, clinics and hospitals.2 But what happens when the custodian goes bankrupt? The recent decision inViterna Health Centre Inc. indicates that whoever is left in possession of the information is "it". This could potentially affect a number of unsuspecting commercial parties.
A copy of the decision can be found here.
Where did all the health information custodians go?
The Viterna case involved a number of health clinics that closed their doors and entered bankruptcy proceedings. The problem, however, was that the companies running the clinics simply left patient records in boxes, in the leased premises across Toronto. While under bankruptcy proceedings, the companies were no longer allowed to conduct any business and are subject to a stay under the Bankruptcy and Insolvency Act (BIA).3 The result was that the clinics avoided responsibility for securing the records.
In November 2015, the OPC issued a Notice of Review to the clinics' former landlords and trustee in bankruptcy, asking for representations about a potential order to secure the records. As it made clear in its decision, the OPC's concern was that "the Records were at imminent risk of being lost, destroyed, disclosed, or disposed of in contravention of [PHIPA]..."4
Most of the landlords agreed to secure the records on an interim basis, although one of them (Pelican) refused to do so. Pelican took the position that the records were the responsibility of the tenant clinic, which had vacated without notice and was in default of its lease obligations, and that it was concerned about the potential liability of assuming responsibility for securing the records. Pelican also made clear it wanted to find another tenant as soon as possible.5
Who is responsible?
There are 3 aspects of the decision worth considering:
- Application of PHIPA: The starting point of the OPC's analysis in Viterna was an often-overlooked provision of O Reg 329/04, made under PHIPA. Section 3 of the Regulation expands PHIPA's definition of "health information custodian." Specifically, s 3(7) provides that:
Every person who, as a result of the bankruptcy or insolvency of a health information custodian, obtains complete custody or control of records of personal health information held by the health information custodian, is prescribed as the health information custodian with respect to those records.6
Once a person or company falls within this definition, it is subject to all of PHIPA's obligations and prescriptions.7
- Adoption of the RJR-MacDonald analysis: Interestingly, the OPC purported to apply the RJR-MacDonald analysis in determining whether to force Pelican to secure the records. The most notable departures from the normal application of the RJR-MacDonald analysis were that (i) the potential harm considered was that of a non-party – the patients whose records were at issue, and (ii) the balance of convenience analysis only concerned the impact of Pelican.8
It is unclear why the OPC adopted a RJR-MacDonald-like analysis, especially as the wording of s 61 of PHIPA, which grants the OPC its remedial powers, is very broad.9
It is also unclear why the OPC relied on s 61(1)(h) in making its order. Subsection (h) permits the OPC to make an order against an "agent" of a health information custodian. But, if the landlord was deemed to be a custodian under s 3(7) of O Reg 329/04, why couldn't the OPC make a direct order under subsection (c)?
- Federal paramountcy: In its written submissions, Pelican's trustee in bankruptcy argued that the OPC's notice was an "action" under the BIA and, therefore, the OPC required leave of the Bankruptcy Court in order to proceed. It also argued that the BIA affords specific protection to a trustee in the administration of an estate and, as the BIA is a federal statute, those protections are paramount to the provisions of PHIPA.
The OPC made no finding on this issue, but it is an important one. In this case, there was another party against which the OPC could make an order – Pelican. However, in other instances, the trustee may be the only entity that could, practically speaking, secure health records, collected by a bankrupt. Moreover, in contrast to this situation, the securing and management of those records may constitute a significant cost, if the records are numerous and managed electronically.
Going forward, it will be interesting to see if similar situations arise and how they are managed.