Medical professional accessed the patient's health records to defend a medical malpractice case against him
The Ontario Superior Court of Justice has clarified the rules on permissible access to a patient’s hospital records by health information custodians and their agents.
In Martin (Estate) v Health Professions Appeal and Review Board, 2023 ONSC 2993, Robert Martin was taken to the emergency room at St. Thomas Elgin General Hospital (STEGH) after he fell down the stairs. Dr. Amit Shah, an emergency room physician, treated Martin for roughly four hours before transferring him to London Health Sciences Centre for further treatment.
Martin commenced a medical malpractice lawsuit against Dr. Shah for allegedly failing to identify compartment syndrome, which he developed while at STEGH. Martin’s left leg was left severely deformed and entirely disabled.
While pursuing his action, Martin discovered that Dr. Shah had accessed his medical records on several occasions over four years, even though he was no longer involved in Martin’s care and the fact that Dr. Shah had transferred Martin to another hospital. Martin complained to the College of Physicians and Surgeons and Ontario (CPSO) about Dr. Shah’s conduct in accessing his medical records.
The CPSO’s Inquiries, Complaints and Reports Committee (ICRC) investigated the complaint and decided to take no further action against Dr. Shah. The ICRC found that Dr. Shah had accessed Martin’s medical records to instruct his counsel and defend himself in the medical malpractice lawsuit and that the Personal Health Information and Protection Act (PHIPA) allows such access. The Health Professions Appeal and Review Board (HPARB) reviewed and found the ICRC decision reasonable. Martin challenged the HPARB’s decision before the Ontario Superior Court of Justice.
The court explained that the PHIPA allows a “health information custodian” to access medical records to defend a proceeding against it. The PHIPA defined a “health care custodian” as “a health care practitioner or a person who operates a group practice of health care practitioners.”
The court noted that the ICRC and HPARB were satisfied that Dr. Shah accessed Martin’s chart once to complete his chart. The ICRC and HPARB were also satisfied that Dr. Shah accessed Martin’s records four other times to defend the medical malpractice action against him.
The distinction between agent and custodian
The court found that the ICRC ruled in favour of Dr. Shah upon finding that he was entitled to access Martin’s records because of s. 37(1)(h) of PHIPA, which permits a health information custodian to use personal health information about an individual for a proceeding in which “the custodian or the agent or former agent of the custodian” is a party “if the information relates to a matter in issue in the proceeding.
The court clarified that the PHIPA governs the disclosure of an individual’s personal health information by a health information custodian and an agent. The court found that the ICRC and the HPARB did not analyze whether Dr. Shah was, in fact, a health information custodian of the hospital records he accessed. The court stressed that PHIPA distinguishes between a custodian and an agent of the custodian. The act imposes restrictions on collecting, using and disclosing personal health information, which differs between custodians and agents.
The defendant is an agent
The court explained that PHIPA deals with “agents” of the health information custodian in a manner which permits more restrictive access to PHI in conjunction with and subject to the discretion of the health information custodian. The health information custodian must be a person or organization who “has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s power or duties.”
The court found that Dr. Shah was an agent of the health information custodian, the London Health Sciences Centre (LHSC). Dr. Shah electronically accessed Martin’s hospital records, which were in an electronic database in the custody and control of LHSC. LHSC granted the sign-in ability to Dr. Shah.
The court further explained that agents of a health information custodian must check with their custodian to see whether the custodian will exercise its discretion to permit the use or disclosure of the information. In this case, the court found that Dr. Shah unilaterally accessed Martin’s hospital chart on several occasions without consulting the LHSC, in circumstances where the LHSC may have declined to disclose the information.
The court concluded that ICRC failed to identify that Dr. Shaw was not a health information custodian but an agent of the health information custodian and had compliance obligations to the LHSC before accessing, using and disclosing such information in the lawsuit.
The court further found that the Committee failed to consider s. 30 of PHIPA, which provides that personal health information must not be disclosed when unnecessary to do so. The court found that Dr. Shah accessed the records in circumstances where his counsel had already given him copies of the relevant parts of the hospital records that the counsel obtained under the Rules of Civil Procedure.
Accordingly, the court decided to set aside the decision of HPARB and remit the matter back to the board for reconsideration of its decision.
