Re Workers Compensation Board

							                                      ORDER NO. PP-04-004

                            Re: Workers Compensation Board

            Prince Edward Island Information and Privacy Commissioner
                                  Karen A. Rose

                                       November 30th , 2004


I.     Background

This Order arises from a privacy complaint received by this Office on April 10th, 2003
relating to the Workers Compensation Board (“the Public Body”). The complainant alleges
an improper collection and use of her personal information.


II.    Procedure


Section 50 of the Act permits the Commissioner to investigate and attempt to resolve
complaints that personal information has been collected, used or disclosed by a public body
in violation of Part II of the Act.


In order to obtain more information and to discuss the facts of this complaint in more detail,
a meeting was arranged between the Head of the Public Body and myself on May 5th, 2003.
The Complainant attended at my office on June 3rd, 2003 to discuss the complaint and to
explore the possibilities for resolution.


Over the following eleven months, proposals to resolve the complaint were made by both
parties, but resolution was ultimately unsuccessful. Submissions were exchanged between
the parties, with the last submission received from the Public Body on October 4, 2004. At
that time, the Complainant did not reply.
                                              2

III.   Issues


The issues arising from this complaint are as follows:


1.     Did the Public Body collect the Complainant’s personal information in contravention
       of Part II of the Act?


2.     Did the Public Body disclose the Complainant’s personal information in
       contravention of Part II of the Act?


IV.    Results of Investigation


The Complainant had applied to the Public Body as an injured worker. The Complainant
claims that her medical files were collected by the Public Body without her permission and
that the Public Body used these files to discontinue benefits to the Complainant. In addition,
the Complainant states that the Public Body discloses her medical information without proper
authority.


A.     Collection


The Public Body states that when a worker sustains a workplace injury, the worker and his
or her employer are required to submit to the Public Body a report of accident which includes
details of how the accident occurred and the injury sustained. As well, the worker’s treating
physician provides a report documenting the worker’s injury. Once the injury has been
identified and accepted by the Public Body as related to the workplace, physicians generally
will provide a copy of all reports to the Public Body. The Public Body is responsible for the
payment of fees associated with the treatment of injured workers and with the preparation
                                              3

of these reports. If a physician has failed to provide a report or the Public Body is seeking
information regarding the worker’s medical history, a request will be made from the Public
Body to the physician for the required information. As well, if a claim has been closed for
a period of time and the worker has filed due to a recurrence of a previous injury, the Public
Body may seek previous medical information from the worker’s physician. If the worker is
under the care of other health professionals such as a physiotherapist or chiropractor because
of a workplace injury, these reports also will be provided to and/or requested by the Public
Body.


This complaint arose when the Public Body obtained the Complainant’s complete medical
file, in the form of clinical notes from her family physician, which file contained information
which she states is unrelated to her workplace injury. In February of 2003, the Public Body
requested clinical notes relating to the Complainant’s injury from her family physician for
the time period of two years prior to the initiation of her claim. In response to this request,
the physician provided the Complainant’s complete clinical history. The Public Body states
that this information was sent to the Public Body’s medical advisor, who severed any
information which was not considered to be relevant to the adjudication process and which
was sensitive in nature, prior to the information being placed in the Complainant’s file.


The Public Body has also collected medical information directly from the Complainant
regarding the injuries she sustained as a result of her accident and her ongoing physical
condition. Medical and physiotherapy reports and test results have been provided to or
collected by the Public Body.


The Public Body states that section 32 of the Worker’s Compensation Act (the “W.C. Act”)
gives the Public Body exclusive jurisdiction to examine into all matters and questions arising
under that legislation. The specific provisions of the W.C. Act relating to collection of
                                               4

medical information are found at subsections 6(12), 18(9), 59(1) and 59(2).


The Public Body advises that workers applying for workers compensation benefits are
required to complete and file with the Public Body a worker’s report of accident (Form 6).
In the form, the worker provides basic personal information as well as information relating
to her employment and injury. Under paragraph 2 of the Declaration section of this form,
the worker acknowledges that the Public Body is authorized to obtain information from any
source whatsoever, including medical information from physicians, practitioners and
hospitals. The Public Body points out that Form 6 is reviewed with staff during their
orientation process and staff of client services are able to address any questions from workers
relating to its contents.


The Public Body states that medical information is used to assist in adjudicating the claim
of a worker (i.e. whether a claim for benefits will be accepted) and to determine a worker’s
ongoing entitlement to benefits under the W.C. Act. During the course of the claim, the
Public Body may collect information from the worker and medical professionals regarding
the worker’s medical status.


The Public Body submits that the collection of the complainant’s personal health information
in this case is authorized by two subsections of the Act: subsection 32(1)(a)(ii) and subsection
32(1)(g).


B.     Disclosure


The Public Body has disclosed MRI and CT films of the Complainant to a radiologist at the
QEII Health Sciences Center for review.
                                              5

The Public Body describes other types of potential disclosure of a worker’s medical records.
It states that medical records could be disclosed to the Workers Compensation Appeal
Tribunal and to the Supreme Court if a worker appeals to those bodies. If a case is appealed,
the employer also receives a copy of the record filed with either of the above noted bodies.
Under section 83 of the W.C. Act, an employer may request access to a worker’s file where
there is a bona fide issue in dispute with respect to the compensation of the worker.


The Public Body states that the disclosure in this case is consistent with the original purpose
for collection which is to determine a worker’s entitlement to compensation benefits.


The Public Body brought my attention to a 2000 decision of the Prince Edward Island Court
of Appeal in Simons et al. v. Workers’ Compensation Public Body (P.E.I.). In that case, the
Public Body sent files to a physician specializing in occupational medicine for assessment
without the knowledge or consent of the respondents. In its decision, the court stated as
follows at paragraph 5:


              It is plain from reading ss. 6(12), 18(9), 18(12) and 59(2) of the
              Workers Compensation Act that the legislation contemplates the
              appellant, in the course of carrying out its duties, will consult
              physicians and receive medical reports and assessments
              respecting claimants. Indeed, it would not be possible for the
              appellant to properly carry out its functions if it did not do so
              because the members of the appellant are not medical experts.
              That being the case, it would make little sense to provide the
              appellant with medical reports if it could not engage consultants
              to review them and to help it interpret and assess them. Anyone
              who applies for benefits under the Workers Compensation Act
              must therefore know the appellant, in the course of carrying out
              its duties, may submit the material in its file to a medical
              consultant for assessment. There is nothing in the Workers
              Compensation Act which indicates that the appellant has to
              inform or have the consent of the claimant before it can engage
              a consultant to review and provide it with an assessment of the
                                                6

              information in his or her file.

And, at paragraph 7, the court said the following:

              Section 18(9) of the Workers Compensation Act contemplates
              and recognizes the appellant will have to consult physicians
              respecting claimants from time to time in the course of carrying
              out its duties under s. 32. There is nothing in the statute that
              requires the appellant to have the consent of the claimant before
              it can reveal the contents of his or her file to a medical
              consultant it retains to assess it.


C.      Security of Personal Information


The Public Body advises that electronic records are stored on a secure file server located
within the Public Body’s office building. The entire system is backed up each night and at
year end. Tapes are stored in a secure area. Paper originals are kept at the Public Body’s
office for seven months, following which they are transferred to a secure, off-site storage
area.


The Public Body has no policies or procedures relating to the destruction of medical records,
except with regard to the severing of irrelevant clinical notes, as described above. All files
are maintained as described above. Files are retained in the event that a worker’s claim is
reopened at a later date or to assist the Public Body in the adjudication of a new claim, where
it is related to the same body area of the worker.


The Public Body advises that only staff directly involved in the Complainant’s file have the
right to access her file, including medical records located on file. The Complainant’s
medical records are to be accessed only by Public Body members who are directly involved
in making decisions on the file.
                                              7

The Public Body has a policy regarding the access of the Complainant’s file by employees
of the Public Body. As noted above, for the most part the Public Body relies on medical
providers to submit reports related to services provided to the Complainant in relation to her
workplace injury. If other medical information is requested, the Public Body endeavours
to specify that it is seeking information only in relation to that injury. This was done in the
case of the request to the physician for the Complainant’s clinical notes. If a medical opinion
is needed, only the portion of the Complainant’s file relevant to the requested opinion is
disclosed.


V.     Findings


A.     Is the information at issue “personal information”?
Personal information is defined in section 1(i) of the Act as follows:


              1. In this Act
                 ...
              (i) “personal information” means recorded information about an
              identifiable individual, including
                   (i) the individual’s name, home or business address or home
              or business telephone number;
                 (ii) the individual’s race, national or ethnic origin, colour or
              religious or political beliefs or associations,
                (iii) the individual’s age, sex, marital status or family status,
                (iv) an identifying number, symbol or other particular assigned
              to the individual,
                 (v) the individual’s fingerprints, blood type or inheritable
              characteristics,
                 (vi) information about the individual’s health and health care
              history, including information about a physical or mental
              disability,
                 (vii) information about the individual’s educational, financial,
              employment or criminal history, including criminal records
              where a pardon has been given,
                 (viii) anyone else’s opinion about the individual, and
                                               8

                (ix) the individual’s personal views or opinions, except if they
              are about someone else;

The information at issue in this case is past medical information of the Complainant. The
parties agree that it contains highly sensitive information. Based on the definition of personal
information set out above, I find that this information is health and health care history of an
identifiable individual, in accordance with the ordinary meaning of those terms. More
particularly, the information falls under subsection 1(i)(vi).


B.     Section 32(1)(a)(ii) - Collection of Personal Information


This subsection states as follows:


              32. (1) A public body shall collect personal information directly
              from the individual the information is about unless
                 (a) another method of collection is authorized by
                  ...
                  (ii) another Act or a regulation under another Act;

The Public Body points out that the W.C. Act authorizes the collection of the Complainant’s
personal information. The sections of the W.C. Act relied on by the Public Body are as
follows:


              6(12) Every worker applying for or receiving compensation
              payments of any kind shall provide to the Board such
              information as may be considered necessary by the Board for
              the carrying out this Part; and if, in the opinion of the Board, the
              worker fails to provide the information or otherwise fails to co-
              operate in obtaining the information, the Board may withhold all
              or part of the compensation payments.

              18(9) Every physician, surgeon and hospital official or other
              person attending, consulted respecting, or having the care of,
                                               9

              any worker, shall furnish to the Board such reports as may be
              required by the Board in respect of the worker.

              59(1) Where any worker or dependant is entitled to
              compensation under this Act, he or she shall forthwith notify his
              or her employer and shall file with the Board an application for
              compensation, together with the certificate of the attending
              physician, if any, and such further proofs of his or her claim as
              may be required by the Board.

              (2) Every physician, hospital, nurse, dentist, chiropractor,
              chiropodist, optometrist, physiotherapist, psychologist,
              occupational therapist or osteopath attending or consulted upon
              any case of injury to any worker shall furnish or cause to be
              furnished such reports, in such form, as may be required by the
              Board, in respect of injury; every physician in attendance upon
              any injured worker shall give all reasonable and necessary
              information, advice and assistance to enable the worker or his
              dependants to make application for compensation, and to furnish
              such proofs as may be required by the Board.


Based on my reading of the above noted provisions, I agree with the Public Body that it is
authorized by the W.C. Act, and therefore authorized by subsection 32(1)(a)(ii) of the
Freedom of Information and Protection of Privacy Act, to collect the Complainant’s personal
information from third parties for the purpose of adjudicating the Complainant’s claim only.


C.     Section 32(1)(g) - Collection of Personal Information


This subsection states as follows:


              32. (1) A public body shall collect personal information directly
              from the individual the information is about unless
              ...
              (g) the information is necessary
                  (i) to determine the eligibility of an individual to participate
                                             10

              in a program of or receive a benefit, product or service from the
              Government of Prince Edward Island or a public body and is
              collected in the course of processing an application made by or
              on behalf of the individual the information is about, or
                    (ii) to verify the eligibility of an individual who is
              participating in a program of or receiving a benefit, product or
              service from the Government of Prince Edward Island or a
              public body and is collected for that purpose;
              ...


Again, I agree with the Public Body that the collection of personal health information from
sources other than the Complainant is necessary to determine the Complainant’s ongoing
eligibility to receive Workers Compensation benefits, in accordance with subsection 32(1)(g)
set out above. Although the general rule is to collect personal information directly from the
individual, with medical information the Public Body must seek the information from third
party professionals who are knowledgeable about the injury claimed.


D.     Section 37(1)(b) - Disclosure


The Public Body relies on section 37(1)(b) as authorization to disclose the Complainant’s
medical information to third party medical professionals for assessment. Section 37(1)(b)
states as follows:


              37. (1) A public body may disclose personal information only
              ...
              (b) for the purpose for which the information was collected or
              compiled or for a use consistent with that purpose;


The Public Body also relies on a decision of our Appeal Court in the Simons case.


The Simons case was determined prior to the proclamation of the Freedom of Information
                                              11

and Protection of Privacy Act in this province. It interprets the W.C. Act as it relates to
authorization to disclose a worker’s medical information without the worker’s express
consent. If I find that the cited sections of the W.C. Act are inconsistent with the provisions
of the Freedom of Information and Protection of Privacy Act, then I will need to look at
issues of paramountcy. As is set out below, I find no inconsistency, and therefore, that next
step is not necessary.


I have already concluded that the medical information of the Complainant was collected in
order to properly adjudicate her claim. I agree with the Public Body that disclosing the
medical information in order to obtain an independent medical opinion is consistent with that
original purpose of collection, in accordance with subsection 37(1)(b) set out above. As the
Prince Edward Island Court of Appeal pointed out in Simons, supra, “It would not be
possible for the [Public Body] to properly carry out its functions if it did not do so because
the members of the [Public Body] are not medical experts.”


VI.    Order


No order will result from this Review, as I have determined that the Public Body did not
contravene Part II of the Act in the circumstances before me. As I concluded above, the
Public Body is legally authorized to collect an injured worker’s medical information in
circumstances such as these, and to disclose the personal information in the limited
circumstances noted above.


I am also mindful of how the Complainant described her concerns in this case. The
Complainant stated that she requires assurances that (1) her medical files are secure; (2) her
medical files are not available for general perusal by employees of the Public Body; and (3)
her medical files will not be disclosed to any third party.
                                                12

I would like to point out to the Complainant that the authority of the Public Body to collect
and/or disclose her personal health information is limited to the ongoing adjudication of her
claim only. Only those employees of the Public Body directly involved in a worker’s claim
may access her personal information. The Public Body can only collect, use or disclose her
information for its legitimate purposes relating to her claim.


VII.   Recommendations


I do have two recommendations to the Public Body to ensure informed privacy protection
for clients of the Public Body in the future:


1.     That the Public Body conduct regular audits of its privacy policies, in particular, to
       ensure that no employee of the Public Body has unauthorized access to clients’
       personal information. Although the policy is in place, it would be prudent to assure
       workers that regular audits are conducted to confirm the policy is being followed.


2.     When the Public Body plans to request a physician’s clinical notes relating to a
       worker, that the worker be notified beforehand. Although the worker has already
       consented to such collection of information in signing Form 6, this additional
       notification would further define the consent and keep the worker informed of the
       progress of her file.


I thank the Public Body and the Complainant for their submissions and their cooperative
participation throughout the review process.

                                           Karen A. Rose
                                           Information & Privacy Commissioner