Prior to the enactment of private sector privacy legislation over the past couple of decades it was generally accepted that the filing of a complaint provided implied consent for the practitioner to review their files and make a response. This was true even if the access and response involved confidential client information. In JK v Gowrishankar, 2019 ABCA 316, http://canlii.ca/t/j26r6 the issue was whether privacy legislation altered this approach. In that case a patient made complaints against two practitioners about their treatment: one to the health facility and one to the regulatory body. For the complaint to the regulatory body the patient provided consent for the regulatory body to have access to the patient’s personal health information. However, the practitioners themselves accessed the patient’s files to respond to the complaint.
The patient then made a complaint to the Information and Privacy Commissioner about the practitioners accessing the patient’s personal health information to respond to the complaints. The designated delegate of the Commissioner found in favour of the patient. However, on judicial review both levels of the Court reversed the finding and held that the practitioners had not breached the privacy legislation. They relied on the statutory exception permitting use for “conducting investigations, discipline proceedings, practice reviews or inspections relating to the members of a health profession or health discipline”.
The Court of Appeal concluded that the practitioners were covered by the exception because the use of the information was related to the investigation and was not for their personal use:
Any investigation requires the gathering of relevant information. An investigation is also contextual in that the information gathered will depend on the nature of the matter being investigated. At a minimum, it requires information surrounding the matter under investigation. It also assists the investigation if the person being investigated provides their response to the matter at issue. The response of the person being investigated is not for their personal benefit but for the benefit of the investigation as a whole.
The Court warned that the access and use of the information would have to relate to the scope of the investigation and not go beyond that.
The Court also held that the consent signed by the patient for the regulator to have access to the patient’s personal health information also authorized the actions of the practitioners.
The Court concluded:
A reasonable interpretation of the [privacy statute] requires a balancing of the competing values identified in s 2 of the Act. The adjudicator’s interpretation gives prominence to the privacy of the individual over appropriate sharing and access of health information to manage the health system. A complaint to a professional governing body, like the College, engages potentially serious consequences to a physician including the loss of his or her license to practice. While the jeopardy faced by the physician is not that of a criminal proceeding, the physician must be able to respond to the complaint… An interpretation that fails to balance competing values is unreasonable…
While the pathway of legal reasoning is different from what existed before private sector privacy legislation, the outcome seems quite similar. In fact, the approach taken in this case might even support practitioners accessing and using personal client information where the complaint is made by someone other than the client.