The Information and Privacy Commissioner of Ontario just issued decision 84, which is a new access decision.

Bottom Line: This decision is consistent with other decisions of the IPC and does not require a change to practice.

In this case, a patient of a hospital was concerned that hospital staff were inappropriately viewing her record. The hospital conducted an audit and then additional audits on request. The patient asked for the results of the audit and asked for a “lockbox” for her record. The hospital provided the patient with a copy of the audit results and implemented the lockbox directive. The patient complained to the IPC.

The IPC found the hospital acted in accordance with the privacy legislation. The hospital responded to the access request for copies of the audit results. The complainant’s health information was used appropriately by the hospital and was not improperly disclosed. The complaint was dismissed.

Don’t let my summary fool you. This was a complicated case with a comprehensive decision – 22 pages. That’s significant since most IPC decisions are not half as long. The IPC described in detail the results of the audits and the analysis of why hospital staff were entitled to view or use the records. This case provides a good overview of the rights of access and the steps necessary to respond to access requests.