Flag On The Play? Recent Disclosure Of NFL Player's Medical Information Sparks Allegations Of Privacy Violations

The recent unauthorized disclosure of a National Football League ("NFL") player's medical records has garnered significant media attention. On July 8, 2015, ESPN reporter Adam Schefter posted images of NFL player Jason Pierre-Paul's medical charts on Twitter.1 The records detailed the medical procedures performed on Mr. Pierre-Paul's finger, which was injured in a fireworks incident on July 4th. In response to the news of his injury, the New York Giants pulled Mr. Pierre-Paul's long-term $60 million contract.2

The "twitterverse" quickly denounced Mr. Schefter's revelation as an improper violation of Mr. Pierre-Paul's privacy. While some people may disagree with Mr. Schefter's decision to post full medical records, the question of whether there has been a violation of legal privacy rights remains. If this situation had occurred in Canada, there would be a number of potentially relevant laws to consider.

Provincial Health Sector Legislation

Most Canadian provinces have implemented legislation governing collection, use and disclosure of personal health information.3 For example, in Ontario, the relevant legislation is the Personal Health Information Protection Act ("PHIPA").4 PHIPA applies to health information custodians within Ontario, and includes some provisions that apply to individuals and organizations that receive personal health information from such custodians.

Under PHIPA, a health information custodian who willfully discloses personal health information without consent can be found guilty of an offence and fined up to $50,000, if the person is a natural person, and otherwise up to $250,000.5 Furthermore, if a corporation commits such an offence, "...every officer, member, employee or other agent of the corporation who authorized the offence, or who had the authority to prevent the offence from being committed but knowingly refrained from doing so, is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence, whether or not the corporation has been prosecuted or convicted."6

In addition, if this incident had occurred in Ontario, Mr. Pierre-Paul could have a potential claim under PHIPA against the individual who disclosed his medical records to ESPN, if such individual was a health information custodian. Under PHIPA, a person affected by conduct giving rise to a conviction for an offence can sue for damages for actual harm caused by the contravention or offence.7 In addition, under PHIPA...