In very broad terms, the HIA establishes a regulatory regime for the storage and dissemination of medical records. This regime is gaining even more importance as sensitive information becomes increasingly accessible electronically.
Some key provisions for the purposes of the judicial review included the following:
Prohibition re use of health information:
No custodian shall use health information except in accordance with the HIA.
Use of individually identifying health information:
A custodian may use individually identifying health information in its custody or under its control for providing health services; determining or verifying the eligibility of an individual to receive a health service; conducting investigations, discipline proceedings, practice reviews or inspections relating to the members of a health profession or health discipline.
Prohibition regarding disclosure of health information:
No custodian shall disclose health information except in accordance with the HIA.
Disclosure of individually identifying health information to be with consent:
Subject to sections 35 to 40 of the HIA, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure.
At judicial review, the applicants and the AMA argued that the adjudicator’s interpretation of the HIA led to an absurd result. The court agreed. Justice J.S. Little quashed the adjudicator’s decision and determined that it was unnecessary to remit the matter back to the OIPC. In rendering his judgment, Justice Little analyzed the applicants’ use of medical information in 2008 and 2012 separately.
Use of Information in 2008
In 2008, the physicians accessed Netcare to respond to a complaint made to the hospital. The adjudicator found that the doctors were not conducting an investigation or proceeding as is permitted under section 27(1)(c) of the HIA. She determined that the physicians were using the information on Netcare purely for their own personal benefit and not on the Hospital’s authority. The court found that this was not within the range of reasonable conclusions available to the adjudicator. Justice Little explained that the hospital had instigated proceedings in order to investigate the mother’s complaint. While the physicians were not conducting the proceedings, they only consulted the information on Netcare as a result of said investigation.
Use of Information in 2012
In 2012, the physicians used Netcare to respond to the college complaint. The applicants had argued that the information release extended to the physicians and provided them with the necessary consent under section 34(1) of the HIA. However, the adjudicator found that the consent form only authorized the college to collect and use the information, not the physicians. The court determined that while this was technically correct, it was an unreasonable conclusion in the context of the inquiry.
The court held that the wording of the information release was sufficiently specific that it complied with the requirements of section 34 of the HIA and that the mother had reasonably provided her express consent by signing it.
The court ruled that adjudicator’s overly technical analysis and parsing of the HIA produced an absurd result; that is, a patient cannot make a formal complaint about a physician’s medical care and then subsequently claim that said physician contravened his or her statutory rights to privacy by reviewing the files necessary for responding to the original complaint. Although he appreciated her expertise, Justice Little explained that the adjudicator engaged in such a detailed analysis of the HIA that she lost sight of the legislation’s fundamental purpose.
According to the court, the purpose of the HIA is that it recognizes the potential for an individual’s privacy rights to be violated through the improper use and disclosure of sensitive medical information, so it establishes policies to ensure that such use and disclosure is restricted to legitimate medical uses. Again, access to said medical information by the doctors who created the information and who use it to defend themselves from patients that request treatment cannot be in contravention of the legislation.