The OIPC unreasonably balanced privacy of the individuals over appropriate sharing and access of health information to respond to complaints

Administrative law – Decisions reviewed – Information and Privacy Commissioner – Judicial review – Appeals – Legislative compliance – Fresh evidence – Standard of review – Reasonableness – Freedom of information and protection of privacy – Disclosure

Gowrishankar v. J.K., [2019] A.J. No. 1167, 2019 ABCA 316, Alberta Court of Appeal, August 30, 2019, B.K. O’Ferrall, E.A. Hughes and J. Antonio JJ.A.

The appellant, J.K., complained to the Office of the Information and Privacy Commissioner (OIPC) that two physicians improperly accessed her health information in 2008 and 2012 contrary to the Health Information Act, RSA 2000, c. H-5 (the “Act”). The OIPC determined that the physicians and Alberta Health Services (AHS) contravened the Act. On judicial review, the Court quashed the OIPC decision.

Two physicians accessed J.K.’s medical information for the purpose of responding to a complaint to their Department Chair in 2008 and the College of Physicians and Surgeons in 2012. The OIPC concluded that Capital Health Authority and AHS were custodians under the Act that used and disclosed J.K.’s health information in contravention of the Act, while the two physicians were affiliates under the Act who breached a different section of the Act.

The chambers judge held that it was unreasonable for the OIPC to conclude that the physicians would not access their patient’s medical information to respond to a complaint, either in the context of a complaint to the hospital (in 2008) or the College (in 2012).

Two preliminary matters arose in this case. First, the Court limited the OIPC’s submissions to the standard of review and its position on the Act considering its role as the initial decision-maker. Second, the Court dismissed the OIPC’s application to adduce fresh evidence.

The Court held that the chambers judge did not err in finding that the physicians’ use of the health information in 2008 and 2012 was done in accordance with the Act. The Court found that the physicians accessed J.K.’s health information in 2008 and 2012 to respond to a complaint which, in turn, permitted the respective investigators to complete their investigations. The Court also noted that J.K. and her mother executed a release consenting to the disclosure of J.K.’s health information to the College. Under section 34(1) of the Act, a custodian of an affiliate may disclose information if the individual consents. The Court held that the OIPC’s decision was unreasonable as it failed to balance privacy of the individuals over appropriate sharing and access of health information to manage a health system and complaint to a professional regulatory body.

The Court dismissed the appeal of J.K. and the OIPC.

This case was digested by Jackson C. Doyle, and first published in the LexisNexis® Harper Grey Administrative Law Netletter and the Harper Grey Administrative Law Newsletter.  If you would like to discuss this case further, please contact Jackson C. Doyle at jdoyle@harpergrey.com.

To stay current with the new case law and emerging legal issues in this area, subscribe here.