Court Quashes Privacy Commissioner’s Decision Regarding Doctors’ Access to Patient Information
In Gowrishankar v JK, two physicians and Alberta Health Services (“AHS”) (collectively referred to as the “Applicants”) sought judicial review of an adjudicative order of the Office of the Information and Privacy Commissioner (the “OIPC”). The OIPC’s adjudicator (the “Adjudicator”) had determined that the Applicants accessed or permitted access to a patient’s medical information in contravention of the Health Information Act (“HIA”). In a ruling that has far-reaching implications on physicians’ right to access, use and disclose health information stored in the province’s Electronic Health Record, the Alberta Court of King's Bench quashed the Adjudicator’s decision.
1. Background
Between 2005 and 2007, a mother took her daughter to the Stollery Children’s Hospital (the “Hospital”), where she was treated by the two physician Applicants. One year later, the mother complained to the Hospital’s department chair about the medical treatment her daughter received. The department chair asked the two physicians to review their treatment of the daughter so that the Hospital could respond to the mother’s complaint.
To comply with the department chair’s request, the physicians accessed the Electronic Health Record (also commonly referred to as “Netcare”) Netcare is a computer database that stores information about a patient’s medical care and provides a comprehensive digital view of a patient’s health history. The Hospital offered the mother and daughter an apology, and the complaint was not pursued any further.
In 2012, the mother filed a formal complaint with the Alberta College of Physicians and Surgeons (the “College”) regarding the physicians’ treatment of her daughter. As part of that process the mother signed an authorized information release form ("Information Release") that allowed the College to obtain relevant medical records. The College asked the doctors for comments on the accuracy of certain portions of their reports about the daughter’s treatment. Once more, the physicians accessed Netcare to respond to the College’s request. The mother’s complaint was eventually dismissed by the College.
The mother filed another complaint in 2013, this time to the OIPC. She alleged that, by accessing Netcare as set out above, the physicians used and disclosed her daughter’s medical information in a manner that contravened the HIA. The OIPC ordered its Adjudicator to conduct an inquiry and, on July 29, 2016, the Adjudicator determined that, in accessing the Netcare information to defend themselves from the mother’s complaints in 2008 and 2012, the doctors had used the information in a manner not authorized by the HIA and that their use constituted a similarly unauthorized use by their employer, AHS.
The Applicants challenged the Adjudicator’s decision through judicial review. In August 2017, the Alberta Medical Association (“AMA”) was granted the right to intervene in the judicial review application for the purpose of representing the broader interests of physicians across Alberta. The AMA supported the Applicants’ position. It argued that the Adjudicator’s decision was incorrect and unreasonable not only in its interpretation of the HIA, but also for its practical implications for sharing health information in Alberta.
2. Relevant Legislation
In very broad terms, the HIA establishes a regulatory regime for the storage and dissemination of medical records. This regime is gaining even more importance as sensitive medical information becomes increasingly accessible electronically.
The key provisions for the purposes of the judicial review included the following:
Prohibition re use of health information
25 No custodian shall use health information except in accordance with this Act.
(…)
Use of individually identifying health information
27(1) A custodian may use individually identifying health information in its custody or under its control for the following purposes:
(a) providing health services;
(b) determining or verifying the eligibility of an individual to receive a health service;
(c) conducting investigations, discipline proceedings, practice reviews or inspections relating to the members of a health profession or health discipline;
(…)
Prohibition re disclosure of health information
31 No custodian shall disclose health information except in accordance with this Act.
(…)
Disclosure of individually identifying health information to be with consent
34(1) Subject to sections 35 to 40, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure.
3. Decision
At judicial review, the Applicants and the AMA argued that the Adjudicator’s interpretation of the HIA lead to an absurd result. The Court agreed. Justice J. S. Little quashed the Adjudicator’s decision and determined that it was unnecessary to remit the matter back to the OIPC. In rendering his judgment, Justice Little analyzed the Applicants’ use of medical information in 2008 and 2012 separately.
a. 2008 Use of Information
In 2008, the physicians accessed Netcare to respond to a complaint made to the Hospital. The Adjudicator found that the doctors were not conducting an investigation or proceeding as is permitted under section 27(1)(c) of the HIA. She determined that the physicians were using the information on Netcare purely for their own personal benefit and not on the Hospital’s authority. The Court found that this was not within the range of reasonable conclusions available to the adjudicator. Justice Little explained that the Hospital had instigated proceedings in order to investigate the mother’s complaint.
While the physicians were not conducting the proceedings, they only consulted the information on Netcare as a result of said investigation.
b. 2012 Use of Information
In 2012, the physicians used Netcare to respond to the College complaint. The Applicants had argued that the Information Release extended to the physicians and provided them with the necessary consent under section 34(1) of the HIA. However, the Adjudicator found that the consent form only authorized the College to collect and use the information, not the physicians. The Court determined that while this was technically correct, it was an unreasonable conclusion in the context of the inquiry.
The Court held that the wording of the Information Release was sufficiently specific that it complied with the requirements of section 34 of the HIA and that the mother had reasonably provided her express consent by signing it.
c. Conclusion
The Court ruled that Adjudicator’s overly technical analysis and parsing of the HIA produced an absurd result; that is, a patient cannot make a formal complaint about a physician’s medical care and then subsequently claim that said physician contravened his or her statutory rights to privacy by reviewing the files necessary for responding to the original complaint. Although he appreciated her expertise, Justice Little explained that the Adjudicator engaged in such a detailed analysis of the HIA that she lost sight of the legislation’s fundamental purpose.
According to the Court, the purpose of the HIA is that it recognizes the potential for an individual’s privacy rights to be violated through the improper use and disclosure of sensitive medical information and so it establishes policies to ensure that such use and disclosure is restricted to legitimate medical uses. Again, access to said medical information by the doctors who created the information and who use it to defend themselves from patients that request treatment cannot be in contravention of the legislation.
4. Implications
The practical impact of the Adjudicator’s decision is that it would have prevented physicians from using Netcare to effectively respond to patients’ complaints about the health services they provide. While the decision in Gowrishankar v JK brings some much needed clarity to this issue, it also demonstrates that the HIA requires a revisit. The statute is overly vague, incompatible with current modalities and, as was clearly demonstrated, capable of producing absurdities. Consequently the Court encouraged the parties in this action to reach out and consult with their provincial legislators to amend the HIA. He explained that with a little tweaking, the HIA would leave less room for doubt.
Such revisions cannot come soon enough. The landscape for creating, storing, and accessing health information has evolved significantly over the past two decades. Electronic formats are rapidly replacing paper charts in the collection, use, and disclosure of health information. As the scope of Netcare continues to expand, and as it inevitably integrates with other clinical information systems across the province, ensuring and facilitating appropriate access, and preventing misuse, will become even more critical.