Fairness Or Flaw: Ontario PHIPA Orders And Issue Estoppel In Privacy Breach Cases

On October 25, 2018, Perell J. of the Ontario Superior Court of Justice released a decision in Broutzas v. Rouge Valley Health System, 2018 ONSC 6317. Broutzas raises some important considerations for the health law field pertaining to medical records and privacy under the Ontario Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A ("PHIPA"), and the role, if any, played by Orders of the Information and Privacy Commissioner ("PHIPA Orders") in pre-determining civil liability for alleged violations relating to the PHIPA. As Broutzas demonstrates, these issues can be particularly important in the context of large-scale class actions for alleged privacy breaches.

Background

In Ontario, the PHIPA establishes a set of rules regarding the privacy rights attached to personal health information in the possession of "health information custodians". It provides, among other things, an avenue to bring a civil action for damages for actual harm suffered after a PHIPA Order has been issued or a person has been convicted of an offence under the PHIPA (s. 65). The Information and Privacy Commissioner in Ontario has jurisdiction under a variety of Acts, including the PHIPA and its related regulation, to oversee Ontario's access and privacy laws. Health information custodians must proactively notify the Information and Privacy Commissioner about certain privacy breaches. Moreover, it has wide powers to issue formal Orders pertaining to alleged privacy breaches and their amelioration as it generally sees fit (s. 61). These administrative decisions can then typically be subject to judicial review in...