Bob Clark, Information and Privacy Commissioner, publicly released Investigation Report 98-IR-001 today. The report concludes an investigation into a privacy complaint conducted under section 51(2)(e) of the Freedom of Information and Protection of Privacy Act (the “Act”).
The Complainant wrote to the Commissioner objecting to the disclosure of the Complainant’s medical test results by a hospital to the Workers’ Compensation Board (WCB). The Complainant indicated that the medical test results were disclosed without the Complainant’s consent and that the WCB had no authority to obtain this information as the information was not relevant to the Complainant’s WCB claim.
As regional health authorities are not currently under the jurisdiction of the Act, they are not subject to the disclosure provisions of the Act. However, WCB is a public body under the Act and is subject to the collection provisions of the Act.
The Complainant has an active WCB claim due to a work-related left shoulder/arm injury. As the Complainant was experiencing chest pains, the Complainant’s physician ordered cardiolite testing. The testing was conducted at a hospital.
The information contained in the cardiolite test results include: the Complainant’s name, age, sex, date of birth, health care number, type of examination, date of examination and results of examination. The information is “personal information” as defined under section 1(1)(n) of the Act.
Pursuant to section 32(a) of the Act, personal information may be collected by a public body if the collection of that information is expressly authorized by legislation. Section 31 of the Workers’ Compensation Act provides WCB with the legislative authority to collect personal information it considers necessary, that relates to the disability and compensation of that disability under the Workers’ Compensation Act. Based on the facts presented at the investigation, the Commissioner was satisfied that WCB had reasonable grounds for considering that the cardiolite test results were necessary to determine whether the Complainant’s cardiac condition was contributing to the Complainant’s inability to work. Accordingly, the Commissioner concluded WCB had the authority to collect the Complainant’s cardiolite test results.
With respect to the Complainant’s complaint that the cardiolite test results were obtained by WCB without the Complainant’s consent, the Commissioner reviewed the manner in which WCB collected the personal information.
Under section 33(1)(a)(ii) of the Act, a public body must collect personal information directly from the individual the information is about unless another source of information is authorized by other legislation. Section 29(2.1) of the Workers’ Compensation Act allows WCB to collect, from hospitals, personal information about an injured worker it considers necessary, that relates to the disability and compensation of that disability. Consent of the individual to whom the information relates is not required.
In this case, WCB requested the cardiolite test results from the hospital where the examination was conducted and the hospital provided the test results to WCB. The Commissioner ruled that WCB had the authority to collect the cardiolite test results from the hospital.