Ontario hospital loses bid to quash class action invasion of privacy lawsuit

A Peterborough, Ontario hospital facing a breach of privacy class action lawsuit, over improperly accessed medical records, was recently denied leave to appeal to the Supreme Court of Canada.

Court records indicate that Erkenraadje Wensvoort received two notices from Peterborough Regional Health Centre indicating that the privacy of her personal health information had been breached.

In a proposed class action lawsuit, it was alleged that the hospital “failed to adequately monitor its staff and implement policies and systems to prevent improper access to patient records,” wrote Mr. Justice Robert Sharpe, of the Court of Appeal for Ontario, in a decision against the hospital released in February, 2015. That allegation has yet to be proven in court.

However, “the hospital acknowledged that the medical records had been wrongfully and intentionally breached for no lawful purpose and apologized to all of the patients who had been affected,” wrote Mr. Justice Mark Edwards, of the Ontario Superior Court of Justice, in a decision released in January, 2014. Edwards dismissed the hospital’s motion to strike the statement of claim and his decision was upheld on appeal.

The hospital had argued that Ontario’s Personal Health Information Protection Act “is an exhaustive code that ousts the jurisdiction of the Superior Court to entertain any common law claim for invasion of privacy rights in relation to patient records.”

That argument was rejected on appeal. Last April, the hospital applied for leave to appeal to the Supreme Court of Canada, which on Oct. 29 dismissed the hospital’s leave application.

In the lawsuit, the plaintiffs are seeking general, punitive and aggravated damages.

They are alleging “that between 2011 and 2012, approximately 280 patient records of the Hospital were improperly accessed and in some cases improperly disseminated to unknown third parties, without the consent of the patient,” Justice Edwards noted in 2014. At the time, the case was indexed as Hopkins vs Kay. At the time, Jessica Hopkins was a representative plaintiff and Andrea Kay was an individual defendant. The Supreme Court of Canada cited the case as Peterborough Regional Health Centre, et al. v. Heike Hesse and Erkenraadje Wensvoort on behalf of themselves and all others similarly situated, et al.

In his decision released in January, 2014, Justice Edwards dismissed the hospital’s motion to strike the statement of claim.

To strike the statement of claim would require a decision, from the Court of Appeal for Ontario, ruling that there is no claim for breach of privacy and that the claim must rest on the provisions of PHIPA, Justice Edwards ruled.

But the province’s appeal court ruled that PHIPA “expressly contemplates other proceedings in relation to personal health information.”

The proposed lawsuit is based on the tort of “intrusion upon seclusion,” which the Court of Appeal for Ontario recognized nearly four year ago in its ruling in Jones vs Tsige.

In January 2012, the Court of Appeal for Ontario ruled in favour of Sandra Jones, who was suing Winnie Tsige, a co-worker at the Bank of Montreal. Court records indicate that Tsige – who was involved in a relationship with Jones’ former husband and wanted to confirm whether Jones was receiving child support payments – accessed and reviewed Jones’ bank records on 174 occasions in 2006 through 2009.

Jones lawsuit against Tsige was initially dismissed, in March 2011, by the Ontario Superior Court of Justice, which ruled at the time that Ontario has no tort of invasion of privacy. That ruling was overturned on appeal.

In the class action lawsuit against Peterborough Regional Health Centre, the issue on appeal was whether the plaintiffs should be “precluded from bringing a common law claim for intrusion upon seclusion in the Superior Court because PHIPA creates an exhaustive code.”

The hospital argued that the new tort, of intrusion upon seclusion, “does not apply to the breach of private health information in Ontario as this is completely and comprehensibly governed by PHIPA.”

The Ontario Hospital Association intervened in support of the hospital while the Information and Privacy Commissioner intervened to support the plaintiffs.

“PHIPA’s highly discretionary review procedure is tailored to deal with systemic issues rather than individual complaints,” Justice Sharpe wrote in his decision against the hospital. “Given the nature of the elements of the common law action, I do not agree that allowing individuals to pursue common law claims conflicts with or would undermine the scheme established by PHIPA, nor am I satisfied that the review procedure established by PHIPA ensures that individuals who complain about their privacy in personal health information will have effective redress. There is no basis to exclude the jurisdiction of the Superior Court from entertaining a common law claim for breach of privacy and, given the absence of an effective dispute resolution procedure, there is no merit to the suggestion that the court should decline to exercise its jurisdiction.”

The other two judges hearing Peterborough Regional Health Centre’s appeal – Madam Justice Katherine van Rensburg and Madam Justice Gladys I. Pardu – agreed.

PHIPA gives Ontario’s privacy commissioner the power to investigate complaints and issue orders, against any person whose activities the commissioner has reviewed.

The law “contemplates that any person affected by an order of the Commissioner can appeal to the Divisional Court,” Justice Edwards noted. “Only once the Commissioner has made an order under PHIPA that has become final may a person affected by the order commence a proceeding in the Superior Court of Justice for damages for ‘actual harm’ that the person has suffered as a result of a contravention of PHIPA or its regulations.”

However, those limits “should be contrasted with a potential claim for damages based on the common law tort of breach of privacy,” Justice Edwards added, noting that the Jones vs Tsige ruling established that “proof of harm to a recognized economic interest is not an element of the cause of action for a breach of privacy.”

A claim “that someone can pursue under PHIPA is quite different from the claim that can be brought for breach of privacy at common law,” he added.