Fairness Or Flaw: Ontario PHIPA Orders And Issue Estoppel In Privacy Breach Cases

On October 25, 2018, Perell J. of the Ontario Superior Court of Justice released a decision in Broutzas v. Rouge Valley Health System, 2018 ONSC 6317. Broutzas raises some important considerations for the health law field pertaining to medical records and privacy under the Ontario Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A ("PHIPA"), and the role, if any, played by Orders of the Information and Privacy Commissioner ("PHIPA Orders") in pre-determining civil liability for alleged violations relating to the PHIPA. As Broutzas demonstrates, these issues can be particularly important in the context of large-scale class actions for alleged privacy breaches.

Background

In Ontario, the PHIPA establishes a set of rules regarding the privacy rights attached to personal health information in the possession of "health information custodians". It provides, among other things, an avenue to bring a civil action for damages for actual harm suffered after a PHIPA Order has been issued or a person has been convicted of an offence under the PHIPA (s. 65). The Information and Privacy Commissioner in Ontario has jurisdiction under a variety of Acts, including the PHIPA and its related regulation, to oversee Ontario's access and privacy laws. Health information custodians must proactively notify the Information and Privacy Commissioner about certain privacy breaches. Moreover, it has wide powers to issue formal Orders pertaining to alleged privacy breaches and their amelioration as it generally sees fit (s. 61). These administrative decisions can then typically be subject to judicial review in the normal course.

In Broutzas, the plaintiffs advanced causes of action alleging: (a) intrusion on seclusion; (b) breach of the PHIPA; (c) negligence; (d) breach of contract and warranty; and (e) vicarious liability. Their claim alleges unauthorized access to hospital records about patients who had given birth at Rouge Valley Hospital, information from which was then used to solicit sales for Registered Education Savings Plans for the newborns. The plaintiffs moved for a determination of law under Ontario's Rule 21 that PHIPA Order HO-013, which had previously found violations, already determined Rouge Valley Hospital's liability in the civil matter on the basis of issue estoppel. The motion was brought in tandem with the certification motion which certified the class action (2018 ONSC 6315). The plaintiffs claim damages in excess of $400...