The Limitations of Privacy Legislation in Protecting the Health Information of Regulated Health Care Professionals

By Mia London

A recent decision by the Divisional Court highlights the potential limitations of the protections provided by the Personal Health Information Protection Act, 2004 to the personal health information of health care professionals.

In Hooper v. College of Nurses of Ontario, [2006] O.J. No. 2696 (Div. Ct.), the plaintiff, a registered nurse, brought an application for judicial review which challenged the actions of the College of Nurses. The College had acquired her Occupational Health and Safety department records without her consent. More precisely, the College asked for and acquired these records in the face of the nurse’s express refusal to provide consent for their disclosure.

On behalf of Ms Hooper, Liz McIntyre and Mia London of our firm argued that the College’s investigation breached the procedural protections provided by the Procedural Code to the Regulated Health Professions Act. Specifically, it was argued that the College improperly used their powers pursuant to disciplinary investigations to gather information which was intended to be used only incapacity investigations. Disciplinary investigations by the Executive Committee are governed by s.75(a) of the Procedural Code whereas incapacity investigations are governed by s.57 of the Code. In addition, counsel argued that the College had no authority or jurisdiction to use documents acquired under one process (discipline) in aid of the other process (incapacity).

In response, the College argued, first, that occupational health and safety records are not “personal health information” within the meaning of s.4 of PHIPA as they are maintained primarily for a purpose other than the provision of health care. In this case, the College argued, an employee’s occupational health and safety file is primarily an employment record.

The Divisional Court, in a decision written by Swinton J., disagreed. It held that occupational health and safety records are personal health information and are entitled to the protections provided by PHIPA. Had the College’s argument prevailed, it is probable that employers’ attempts to gain access to occupational health and safety records during grievance arbitrations would have increased significantly and may have succeeded.

However, the Divisional Court agreed with the College’s second argument when it held that two specific exemptions found in PHIPA with respect to regulatory health colleges permitted the College of Nurses to request from the hospital and the hospital to provide Ms Hooper’s occupational health and safety records to the College. At para.30:

“Nevertheless, PHIPA permitted the Hospital to release [Ms Hooper’s occupational health records] to the College. Section 43(1)(b) expressly provides that the Hospital may disclose personal health information about an individual to the College for the purposes of enforcing the RHPA and the Nursing Act. Moreover, s. 9(2)(e) of PHIPA provides that nothing in the Act interferes with the College's regulatory activities.”

Section 9(2)(e) and s.43(1)(b) read as follows:

9. (2) Nothing in this Act shall be construed to interfere with,

(e) the regulatory activities of a College under the Regulated Heath Professions Act, 1991, the College under the Social Work and Social Service Work Act, 1998 or the Board under the Drugless Practitioners Act[.]

43. (1) A health information custodian may disclose personal health information about an individual,

(b) to a College within the meaning of the Regulated Health Professions Act, 1991 for the purpose of the administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991 or an Act named in Schedule 1 to that Act[.]

The Divisional Court held that the language of these two sections was sufficiently broad to cover the provision of Ms Hooper’s occupational health records to the College without her consent.

We note, however, that nothing in the Divisional Court’s decision appears to restrict the application of ss. 9(2)(e) and 43(1)(b) to occupational health and safety records. Many College members receive medical care through practitioners who are located in the hospitals in which the members work. It remains an open question, and a concern, whether the regulated health colleges can request all medical records related to the members by application of these two sections of PHIPA. As PHIPA was created to protect the privacy of health information, there is no doubt that this is an anomalous result and one which must continue to be monitored.