I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Health Privacy Update – Do not ignore patient access requests for records

Posted by

There are two recent health privacy decisions of the Information and Privacy Commissioner of Ontario that have similar facts and similar outcomes.

The main message: A doctor (or any other health information custodian) should never ignore a patient’s access request for records. If you do, the IPC won’t be happy. We want a happy IPC.

Decision #77:

On July 31, a woman sought access to the health records of her late husband held by his doctor’s office. That physician had left the group practice.  On September 20, the woman sent a deemed refusal complaint to the Information and Privacy Commissioner of Ontario (IPC) having not heard back from the group practice about her request.   The IPC contacted the group practice a number of times in October and November. The clinic did not provide a response to the IPC.

The IPC issued an order for the group practice to respond to the complainant’s request for access within ten (10) days.

The IPC concluded that the group practice is a “person who operates a group practice of health care practitioners” and is therefore a custodian. Even though the physician had left the group, the IPC concluded the complainant was entitled to suspect that the group practice had custody or control of the deceased’s records.

The IPC concluded the group practice had not responded to a request for access within the requisite 30 days.  The custodian was deemed to have refused the request having failed to answer. The IPC also noted the group practice had failed to appropriately communicate with the IPC.

Bottom Line: Custodians must always respond to access requests in a timely way. If a practitioner has left a group, it should be clear who has taken over responsibility for the practitioner’s records – or whether the departed practitioner took the records on departure. If it isn’t obvious – never ignore messages and communications from the IPC.

Decision 79:

On June 18, 2018, a father asked a doctor for access to his sons’ health records. He was the children’s substitute decision-maker and had the authority to make an access request.  The doctor’s office responded twice; once to acknowledge the request and then August 2 to ask for a new request for access through the father’s lawyer. The father made a complaint to the IPC stating the doctor should be found to have refused the request indicating it had been more than 30 days since he made the request.  The IPC contacted the doctor’s office. By December 2018 the doctor had still not responded to the request or the IPC.  The IPC ordered the doctor to respond and noted the doctor had ignored the IPC.

I’m going to go out on a limb and guess at the backstory here. It is possible that the father was suing the doctor.  That might explain why the doctor’s office asked the father to have his lawyer make a request for the records. In such cases, even if litigation has commenced or has been threatened, custodians must still be responsive to health record requests under PHIPA.  Do not ignore a patient (or SDM’s) right of access to health records.

Bottom Line:  Ignore health records requests at your peril.  When someone asks for a copy of their record (or as an authorized substitute decision-maker) it is never a good idea to play ostrich and bury your head in the sand. I can only imagine that the situation became worse when the IPC got involved  and yet the doctor still did not provide a response.

Here’s a summary of all the IPC’s decisions to date: Summary of IPC Decisions


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Team Privacy Training Events

April 15, May 3, June 7, 13, 20 & 25

For Primary Care clinics and FHTs

Kate trains health professionals from many more primary care organizations how being privacy-respectful can improve therapeutic relationships. more details...

Speaking event

April 10, 2019

At Osgoode Hall

Kate speaks at the Osgoode Health Law Certificate workshop on privacy for health care organizations. More details...

Primary care webinars: Contracts & Communications

April 11 and May 2, 2019, 12 noon

Part of Kate’s monthly webinar series.

Our April webinar is on employee contracts, and in May our title is communication faux pas.

Full details of the 2019 webinar series and registration here.

Privacy Officer training

April 30 through June 4, 2019

Kate’s specialist training course for Privacy Officers in health organizations.

Open to all health Privacy Officers, as well as those hoping to become Privacy Officers. Full details and registration for Privacy Officer training next spring here...

Advanced Privacy Officer training

June 18, 2019

For experienced Privacy Officers within healthcare organisations.

This one day training course focuses on how to handle difficult privacy situations using real-life (but anonymized) case studies and role-play. Full details and registration here...

Free healthcare privacy webinar - ask me anything!

April 3, 2019 12 noon - 1 pm and
May 1, 2019 9 - 10 am

Free webinar - advance registration needed

Whether you're an experience privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

Should a doctor always disclose a terminal illness? Absolutely yes. Every time. Then I read the article. It gave m… https://t.co/aY37fzR1K8

29 minutes ago

A recent Canadian study published in the JAMA found that hospitals have a serious issue when it comes to throwing a… https://t.co/UUl5wP4nPe

about 3 hours ago

What do #FamilyHealth teams need to know about #SocialMedia and the #Law? https://t.co/6nakmScCGP #healthprivacy #FHTs #HealthLaw #employee

about 15 hours ago

contact details

901 King Street West Suite 400 East Tower
Toronto Ontario M5V 3H5

(416) 855 9557