First Decision under Ontario's New Health Information Legislation

The Information and Privacy Commissioner of Ontario (Commissioner) launched an investigation last month after receiving word from a reporter for the Toronto Star that patient records containing personal health information had been strewn about the streets of a downtown Toronto intersection during a movie shoot. The incident brought into play the provisions of Ontario's new Personal Health Information Protection Act, 2004, (PHIPA). On October 1st, Toronto was filling in for New York City during the filming of a mini-series based on the September 11, 2001 terrorist attack on the World Trade Center. The "scrap paper" containing the patient records was being used as fake garbage to recreate the scene. The records in fact related to health services provided in 1992 -1994 and were traced to an unnamed Toronto X-ray and ultrasound clinic (Clinic). The information included descriptions of services provided to patients, as well as patients' names, addresses, dates of birth and Ontario health card numbers. Under PHIPA, the Clinic, as a health information custodian, had a responsibility to handle and dispose of documents containing personal health information in a secure manner. The documents in question had been picked up by a paper disposal company but, due to a misunderstanding, instead of being shredded, the documents were delivered to a recycling company that provided the paper to the film set. In her report published October 31, 2005, the Commissioner stressed that recycling is not equivalent to secure disposal. Personal health information must be "physically destroyed in an irreversible manner prior to being disposed of, sold or recycled." The Commissioner found that the Clinic had failed to take reasonable steps to ensure that the personal health information within its custody or control was disposed of in a secure manner. She also emphasized the need for a written agreement or contract between organizations handling sensitive personal information and third parties providing services with regard to that information. In this case, there was no written agreement between the Clinic and the paper disposal company that set out their mutual understanding of how the records of personal health information were to be handled. To read the Commissioner's Order, see: http://www.ipc.on.ca/docs/ho-001.pdf For the October 2, 2005 article in the Toronto Star, see: http://makeashorterlink.com/?V23F51F1C Summary by: Clare McCurley