Canadian Insurance News

The ruling upheld an earlier decision that said the province’s health privacy laws do not bar patients from seeking legal action against hospitals if their privacy is breached.

In a potentially precedent-setting decision, the Ontario Court of Appeal granted patients the right to sue hospitals over privacy breaches Wednesday.

The unanimous ruling said provincial health privacy laws are not a roadblock to patients who want to seek justice in the courts when their medical records are snooped into by hospital workers.

The decision comes on the heel of aStar investigation into health-related privacy violations and oversights in Ontario’s health privacy legislation.

“This case is a vindication for all of those victims the Star has been writing about,” said Michael Crystal, lawyer for the patients.

Wednesday’s ruling could have sweeping implications for the province’s 155 hospitals as it has given the green light to a multimillion-dollar privacy class action launched against Peterborough Regional Health Centre.

Peterborough hospital would not answer questions from the Star about whether it intends to appeal the ruling to the Supreme Court of Canada, its last chance to get the case tossed out.

A massive privacy breach at the hospital between 2011 and 2012 saw hundreds of patient medical records snooped into and seven staff members fired. The breach included a domestic violence victim who was in hiding and 414 abortion files that were inappropriately accessed by a high profile anti-abortion campaigner.

A group of affected patients launched a $5.6-million privacy class action against the hospital, which in turn fought to have the case thrown out in the Ontario Superior Court of Justice, arguing the courts had no jurisdiction over health-related privacy breaches.

The crux of the hospital’s argument was that health privacy violations were the sole domain of the privacy commissioner and that the Personal Health Information Protection Act (PHIPA) ousts the jurisdiction of the courts.

The Superior Court ruled against the hospital so it took the fight up to the Court of Appeal, which dismissed the case Wednesday.

In its decision, the appeal court said health privacy legislation does not exclude the jurisdiction of the courts. Health privacy laws were tailored to handle “systemic issues rather than individual complaints,” the court said.

Peterborough Regional Health Centre declined to comment on the decision, saying “this matter remains in litigation before the courts.”

In a written statement to the Star Wednesday, a Peterborough hospital spokesperson said the center had a “zero tolerance policy with respect to inappropriate access to medical records.”

The hospital has 60 days to appeal the decision to the Supreme Court of Canada.

Acting Information and Privacy Commissioner Brian Beamish told the Star he was “very pleased” with the ruling.

All patients who are victims of privacy violations should have the option of filing a complaint to the privacy office or taking civil action, Beamish said.

Under PHIPA, the privacy commissioner’s office acts as a watchdog over health institutions, ensuring they are protecting patient information and abiding with privacy laws.

It is not up to the privacy commissioner, however, to determine whether a patient should be awarded monetary damages. The commissioner only has the power to recommend the Attorney General launch a prosecution under PHIPA, which allows for fining individuals up to $50,000 and institutions up to $250,000 if found guilty.

Only one prosecution has been lodged so far under the act, which was introduced in 2004.

“This was a really important issue to get judicial guidance on,” Beamish said.

Ontario, once a leader in health-information privacy laws, now seems to be lagging behind as other provinces tighten up reporting. Earlier this year the Star found that eight other jurisdictions have passed laws to force hospitals to report breaches to the appropriate privacy body.

The heart of the Peterborough case is “snooping” — where hospital staff willfully break the law by accessing medical records when they have no authority to do so, such as in the recent Rob Ford privacy violations, he said.

Health care workers can only access a patient’s medical record if they are involved in their care and, Beamish said, the Peterborough breach “highlights how seriously this issue of snooping needs to be taken.”

The lead plaintiff of the Peterborough case is Erkenraadje Wensvoort, who was in hiding when she had an operation at the hospital. In the statement of claim, she alleges that she had left an abusive relationship after 51 years of marriage.

Wensvoort says she was told a staff member had opened her file without authorization and she feared her allegedly abusive ex-husband had “paid someone to access her patient records in order to find her,” the decision read.

There is no evidence linking Wesnvoort’s ex-husband to the inappropriate access of her record, according to Crystal, her lawyer.

The court awarded Wensvoort $24,000 for the legal fees associated with the appeal.

Crystal, who is the lawyer for all the Peterborough patients, said the court’s ruling grants patients “access to justice.”

“The highest court in Ontario has spoken and said invasion of personal health information is not something that is simply the domain of the privacy commissioner,” he said.

“Patients do not have to go through the administrative nooks and crannies of PHIPA legislation to achieve access to justice.”

If the latest decision is not appealed by the hospital, Crystal said the next step would be setting dates for a motion of certification for the Peterborough case.

Privacy commissioners from other parts of Canada told the Star earlier this year that they have noted a rising trend of health-care professionals snooping into private medical records with malicious intent.

Source: http://www.thestar.com/life/health_wellness/2015/02/18/patients-can-sue-hospitals-for-invasion-of-privacy-appeal-court-rules.html