Retired Health Information Custodians Must Still Respond to Requests to Access Records
A patient’s right to access their personal health information (under Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”) does not lapse when a health care provider retires. PHIPA Decision 332 reinforces that there are strict statutory timelines for responding to an individual’s request to access their own personal health information and illustrates the consequences of failing to respond.
In this case, the complainant submitted a written request to their retired physician (the “Doctor”) for access to their personal health information (“PHI”), as defined under PHIPA (i.e. their own medical records). The request was sent to an email address published on the Doctor’s public registry entry by the College of Physicians and Surgeons of Ontario (“CPSO”) and was specifically indicated as the preferred means for former patients seeking records to contact the Doctor. Despite this, the Doctor did not respond to the complainant’s request within the 30-day statutory time limit. More than six months later, the complainant filed a complaint with the Information and Privacy Commissioner of Ontario (“IPC”).
The IPC made several attempts to reach the Doctor before ordering the Doctor to respond. First, the IPC sent the Doctor an email warning that they would issue a Notice of Expedited Review if no response was received. The following month, a Notice of Expedited Review was issued, encouraging the Doctor to comply with PHIPA and respond to the request by a specified date. The Doctor failed to respond, which led to the IPC making the decision in this case.
The IPC found that, as a physician, the Doctor was a “health care practitioner” and therefore a “health information custodian”, notwithstanding his retirement. The Doctor was required to respond to the request for access following the process prescribed under PHIPA, which provides that a health information custodian must respond to a request for access within 30 days, subject only to a lawful extension (which requires notice to the requestor). Over a year had passed since the complainant made their request for access and they had received no response from the Doctor. The IPC therefore found that the Doctor was deemed to have refused the request.
If a request is refused, it may be appealed to the IPC and the burden of proof in respect of the refusal lies with the health information custodian. This empowered the IPC to review the deemed refusal and use its powers under section 61 of PHIPA to order that the Doctor respond to the complainant’s access request by a specified date with no option to extend the timeline further. To verify compliance, the Doctor was also ordered to provide a copy of their response to the complainant to the IPC. The decision in this matter also notes that the Doctor had been subject to other similar orders, indicating that this was an ongoing issue for this health information custodian.
This decision reinforces that access to personal health information is a core patient right and that statutory timelines are enforceable, even against retired professionals and other health information custodians that are non-responsive. For health care providers and retire andns who are health information custodians, the message is clear: establish reliable processes for receiving and responding to access requests, ensure continuity when practitioners retire, and treat IPC communications as urgent compliance matters—not optional correspondence. Failure to do so may result in a deemed refusal, investigation, and a binding, published order from the IPC.
If you are a health information custodian and have questions regarding responding to access requests or planning how to discharge your obligations after retiring or winding down your business, contact us.
