Patients can sue over invasion of privacy

TORONTO – In a landmark decision, the Ontario Court of Appeal has granted patients the right to sue hospitals over privacy breaches. The unanimous ruling said provincial health privacy laws are not a roadblock to patients who want to seek justice in the courts when their medical records are snooped into by hospital workers.

The ruling could have huge implications for the province’s 155 hospitals, and it has given the green light to a multimillion-dollar privacy class action launched against Peterborough Regional Health Centre.

The Toronto Star reported that the Peterborough hospital would not answer questions about whether it intends to appeal the ruling to the Supreme Court of Canada, its last chance to get the case tossed out.

A massive privacy breach at the hospital between 2011 and 2012 saw hundreds of patient medical records snooped into and seven staff members fired. The breach included a domestic violence victim who was in hiding and 414 abortion files that were inappropriately accessed by a high profile anti-abortion campaigner.

A group of affected patients launched a $5.6-million privacy class action against the hospital, which in turn fought to have the case thrown out in the Ontario Superior Court of Justice, arguing the courts had no jurisdiction over health-related privacy breaches.

The core of the hospital’s argument was that health privacy violations were the sole domain of the privacy commissioner and that the Personal Health Information Protection Act (PHIPA) takes precedence over the courts.

The Superior Court ruled against the hospital, so it took the fight up to the Court of Appeal, which dismissed the case in February.

In its decision, the appeal court said health privacy legislation does not exclude the jurisdiction of the courts. Health privacy laws were tailored to handle “systemic issues rather than individual complaints,” the court said.

Peterborough Regional Health Centre declined to comment on the decision, saying “this matter remains in litigation before the courts.”

In a written statement to the Star Wednesday, a Peterborough hospital spokesperson said the center had a “zero tolerance policy with respect to inappropriate access to medical records.”

The hospital has 60 days to appeal the decision to the Supreme Court of Canada.

Acting Information and Privacy Commissioner Brian Beamish (pictured) told the Star he was “very pleased” with the ruling.

All patients who are victims of privacy violations should have the option of filing a complaint to the privacy office or taking civil action, Beamish said.

Under PHIPA, the privacy commissioner’s office acts as a watchdog over health institutions, ensuring they are protecting patient information and abiding with privacy laws.

It is not up to the privacy commissioner, however, to determine whether a patient should be awarded monetary damages. The commissioner only has the power to recommend the Attorney General launch a prosecution under PHIPA, which allows for fining individuals up to $50,000 and institutions up to $250,000 if found guilty.

Only one prosecution has been lodged so far under the act, which was introduced in 2004.

“This was a really important issue to get judicial guidance on,” Beamish said.

Healthcare workers can only access a patient’s medical record if they are involved in their care and, Beamish said, the Peterborough breach “highlights how seriously this issue of snooping needs to be taken.”

The lead plaintiff of the Peterborough case is Erkenraadje Wensvoort, who was in hiding when she had an operation at the hospital. In the statement of claim, she alleges that she had left an abusive relationship after 51 years of marriage.

Wensvoort says she was told a staff member had opened her file without authorization and she feared her allegedly abusive ex-husband had “paid someone to access her patient records in order to find her,” the decision read.

There is no evidence linking Wesnvoort’s ex-husband to the inappropriate access of her record, according to Michael Crystal, her lawyer.

The court awarded Wensvoort $24,000 for the legal fees associated with the appeal.

Crystal, who is the lawyer for all the Peterborough patients, said the court’s ruling grants patients “access to justice.”

“The highest court in Ontario has spoken and said invasion of personal health information is not something that is simply the domain of the privacy commissioner,” he said.

“Patients do not have to go through the administrative nooks and crannies of PHIPA legislation to achieve access to justice.”

If the latest decision is not appealed by the hospital, Crystal said the next step would be setting dates for a motion of certification for the Peterborough case.