Information Privacy Commissioner (IPC) of Ontario PHIPA Decision 117
The IPC recently released a PHIPA decision that provided guidance to health information custodians on the fees that are considered to be “reasonable cost recovery” under the Personal Health Information Protection Act (PHIPA).
The complainant requested access to his medical records following a visit at a hospital, as well as access to video surveillance of the complainant’s exit from the hospital. He was provided full access to his medical records. The hospital blurred facial images of other individuals in the surveillance footage, but denied the request for access to the video in its entirety due to concerns that the complainant could utilize software to reverse the blurring process. In order to protect the privacy of the other individuals in the video, access was denied. The complainant appealed the hospital’s decision.
The IPC found that the video images identified the complainant as a person seeking health care, and was therefore “personal health information” pursuant to s 4(1)(b) and s 4(3) of PHIPA. The adjudicator also found that none of the video footage was dedicated primarily to the complainant’s personal health information, so he only had a right of access to his reasonably severable personal health information in the video, i.e. the images of him in the hospital hallways, and the surroundings, with images of other individuals severed (obscured). The IPC ordered the hospital to provide access to the severed video surveillance. The hospital was able to charge a fee to the complainant for access to the footage.
The IPC indicated that the access fee had to be limited to “reasonable cost recovery”, and the hospital had to first provide the complainant with an estimate of the access fee. The IPC offered guidance to health information custodians in determining what fee may be allowed under the PHIPA, further to s 54(10) and s 54(11):
- “reasonable cost recovery” in PHIPA does not mean actual cost recovery or full cost recovery of all costs incurred by the health information custodian in fulfilling an access request for an individual’s own personal health information;
- costs should not be excessive – a financial barrier to an individual accessing their own personal health information is to be avoided;
- the best framework for determining the amount of “reasonable cost recovery” under PHIPA is the fee scheme set out in a proposed regulation, published by the Minister of Health and Long-Term Care in 2006 (though it was never adopted) – see Ontario Gazette 139-10 (11 March 2006) ();
- the health information custodian may charge a set fee of $30.00 to complete the following tasks required to respond to the access request:
- receipt and clarification, if necessary, of a request for a record.
- providing an estimate of the fee that will be payable in connection with the request.
- locating and retrieving the record.
- review of the contents of the record for not more than 15 minutes by the custodian (or their agent) to determine if the record contains personal health information to which access may be refused.
- preparation of a response letter to the individual.
- preparation of the record for photocopying, printing or electronic transmission.
- photocopying the record to a maximum of the first 20 pages, or printing if stored electronically, to a maximum of 20 pages, excluding the printing of photographs from electronic format.
- packaging the copy of the record for shipping or faxing.
- if the record is stored in electronic format, electronically transmitting a copy of the electronic record.
- the cost of faxing a copy of the record to a number in Ontario, or mailing the record to a Canadian address by regular mail.
- supervising the individual’s examination of the original record for not more than 15 minutes.
The framework also provides maximum fees that can be charged for additional services. Fees for severing video footage was not set out in the list of additional services in the framework. The adjudicator found it was reasonable to allow a health information custodian to charge the reasonable cost recovery of this service to the individual making the access request. Of note, a health information custodian is permitted to waive the payment of all or any part of the fee, if in its opinion, it is fair and equitable to do so (see s 54(12) of PHIPA).
Health information custodians should avoid charging a fee in excess of that set out in the framework to respond to an access request, or have a well-documented explanation for charging a higher fee. Given the guidance provided by the IPC in PHIPA Decision 117, a complaint brought against a custodian for charging a higher fee will likely result in a finding in favour of the complainant.
