This bulletin follows our previous bulletin, FIPPA and Ontario Hospitals: Setting-up a FIPPA Compliance Office, in which we discussed some of the considerations in establishing an office responsible for compliance with the Freedom of Information and Protection of Privacy Act ("FIPPA" or the "Act"). This bulletin is intended to provide a general overview of legal issues relating to delegation, with some comments about how hospitals can effectively delegate responsibility under FIPPA.
The proper delegation of powers and duties under FIPPA is critical to compliance with the Act. To be effective, the delegation of powers and duties must reflect a hospital's particular organizational structure and culture, in addition to ensuring that the delegation does not give rise to ambiguity or gaps in responsibility.
Powers and Duties
Pursuant to FIPPA, the Board Chair of a public hospital is accountable for most of the hospital's decisions under the Act. The Board Chair also bears the responsibility for overseeing the administration of FIPPA within that hospital. (In the case of a private hospital, it is the Superintendent who is accountable for these decisions and who bears responsibility for this oversight – references in this bulletin to Board Chair should be read as references to Superintendent in the case of a private hospital).
The Board Chair is responsible for (among other powers and duties):
- deciding whether a request is frivolous / vexatious
- notifying affected parties and receiving representations concerning why a record or part of a record should not be disclosed
- deciding whether to apply exemptions and determining the extent of severances
- providing a written access decision to the requester
- deciding to extend the time period to respond
- deciding whether to waive payment of fees
- preparing and submitting the hospital's annual report under FIPPA
- ensuring that personal information is accurate, complete and up to date
- ensuring proper disposal of personal information
- compiling / updating personal information banks
- attaching a record of inconsistent use / disclosure to personal information
- making representations to the Information and Privacy Commissioner in an inquiry
While the Board Chair is ultimately accountable, FIPPA permits the Board Chair to delegate (a) the authority to exercise his or her powers under FIPPA, and (b) the responsibility for carrying out the duties imposed on the Board Chair by FIPPA.
Delegation means empowering an officer so that he or she has control over how a duty is carried out or whether and how a power is exercised. Delegation can be made to one or more officers of the hospital (or to officers of another hospital or institution subject to FIPPA). Once delegated, the Board Chair need not be involved in any later decision to exercise a delegated power or undertake a delegated duty. The delegate can act independently of the Board Chair.
Although a delegate can be assisted by other personnel, the delegate remains accountable for the powers and duties delegated to him or her. Because of this, delegates need to ensure that they reserve any discretionary decisions to themselves, and that they provide clear instructions to, and oversee the activities of, any personnel assisting the delegate. Sub-delegation, where the delegate attempts to further delegate powers or duties, is not permitted.
FIPPA requires that any delegation be made in writing and signed by the Board Chair. In the delegation document, the Board Chair may set out restrictions, limitations, conditions or requirements relating to the delegation of powers and duties – and if set out, these are binding. Any changes to, or revocation of, a delegation by the Board Chair must also be documented in writing.
Best Practice Considerations Due to the volunteer nature of their position, it is likely that the Board Chair will delegate all or most of his or her powers and duties under FIPPA. Although the ultimate decisions regarding delegation (i.e. whether to delegate and if so, to whom delegation should be made) rest with the Board Chair, the Board Chair should (at a minimum) consult with other members of the Board concerning the delegation.
It is important for the Board Chair to keep the following points in mind when considering any delegation under FIPPA:
- Understanding of FIPPA. Officers who are delegated powers or duties should have a thorough understanding of the hospital's obligations under FIPPA, as well as hospital operations generally.
- Hierarchical Delegation. It may be helpful to delegate some decision-making powers to officers in senior management positions, while personnel in less senior positions could be delegated powers and duties that are more administrative in nature. For example, the Board Chair may delegate the power to decide whether exemptions will apply to a record to a Vice-President, while delegating the duties to issue notices, establish and collect fees and coordinate record searches to the FIPPA Coordinator and departmental leads, respectively.
- Function Area Delegation. Because the Board Chair can impose conditions, restrictions, etc. on the delegation, a delegation could create "silos" of responsibility – for example, the Board Chair could delegate decision-making powers by subject area, such as delegating the power to invoke exemptions for any records relating to (a) finance and procurement matters to the Vice-President Finance; (b) human resources matters to the Director of Human Resources; and (c) any other matter to the Vice-President Operations. Note: it is important to specify a 'catch-all' category to ensure that the delegation is comprehensive.
- Delegate to Titles/Positions, Not Named Individuals. The delegation should be made to a title/position rather than a named individual (e.g., a delegation to the "FIPPA Coordinator", not to "Mary Fippa" personally). This ensures that the delegation remains effective despite any personnel change.
- Perils of Concurrent Delegation. Most, if not all, of the powers and duties under FIPPA should be delegated to only one officer at a given time (i.e., an exclusive delegation). If the same powers or duties are delegated to multiple officers so that they are "active" at the same time (i.e. a concurrent delegation), this could give rise to confusion, error or inconsistency. For example, at any given time, only one officer should have the power to decide whether to waive payment of fees relating to a freedom of information request. If more than one officer was able to exercise this power at a given time, it may lead to varying or conflicting approaches to fee waivers.
- Alternates. The delegation should contemplate an alternate officer in case the primary officer is unavailable (due to illness, vacation, etc.) or has a conflict of interest in relation to a freedom of information request. In light of the perils of concurrent delegation (noted above), the alternate officer would only be responsible for exercising delegated powers and carrying out delegated duties while the primary officer is unavailable or has a conflict of interest. This ensures that the hospital's FIPPA compliance efforts are not interrupted and avoids the need for the Board Chair to be called upon to deal with circumstances where a delegate is unavailable or unable to act due to a conflict of interest.
Determining an effective delegation of the Board Chair's powers and responsibilities under FIPPA is an essential part of setting up the hospital's overall FIPPA compliance processes. Knowing who has delegated authority is also an essential part of hospital-wide training programs – as hospital personnel will need to know who is authorized to perform functions or carry out duties under FIPPA. Hospitals (and Board Chairs) will need to make some important decisions as to what approach to delegation will work best for their organization. Although some hospitals may decide to simply delegate all of the Board Chair's powers to a FIPPA Coordinator, other hospitals may decide that a more nuanced structure will be more effective – and these latter hospitals should ensure that their delegation is carefully drafted before being signed by the Board Chair.
This bulletin is part of a series of bulletins on the topic of FIPPA implementation. The next bulletin will address the need to conduct a general inventory of hospital records. An inventory will help to improve a hospital's responsiveness to freedom of information requests, and is necessary to comply with the Directory of Records obligations imposed by FIPPA