The courts in Ontario are being asked to rule on whether patients whose medical records have been improperly accessed by the hospital holding the data and others can sue the hospital directly for invasion of privacy. Currently, breaches of the Personal Health Information Protection Act are the exclusive domain of the Ontario Privacy Commissioner. The courts are being asked to rule on whether that should continue to be the position in respect of medical records or whether affected individuals should be able to bring proceedings against the hospital directly, following the landmark case of Jones v Tsige in 2012. In Jones and Tsige a bank worker successfully sued a colleague – also her ex-husband’s new wife – for repeatedly accessing her bank account details and was awarded $10,000 in damages.

Hopkins v Kay and Jones v Tsige