Case Report – Alberta OIPC issues helpful medical information management decision

On April 10th, the Alberta Office of the Information and Privacy Commissioner issued an investigation report that analyzed various information flows that employers typically use in managing employee medical issues.

The first information flow involved information transferred from a third-party Employee Assistance Program provider (EAP) to the employer’s occupational health services (OHS) department. The OIPC held the EAP improperly disclosed information to the OHS about whether the employee was complying with his treatment program. The disclosure itself was not objectionable because the employee was on leave and in receipt of short term disability benefits on the condition he obtain appropriate medical care. However, the employer and the EAP drew a distinction between voluntary entrance into the EAP and a formal referral into the EAP; voluntary care was treated as absolutely confidential while care pursuant to a referral involved a limited disclosure of information back to the OHS. The EAP argued that it had obtained oral consent for this disclosure, but the OIPC held the employee was rightly confused about the EAP’s role, partly because he had received EAP services voluntarily in the past. Hence, The OIPC held that the EAP violated its obligation to give reasonable notice of its purposes as required by the Alberta PIPA.

The second information flow involved information transferred from the employer’s OHS to a member of the employer’s human resources department (and also to the local union president). This information indicated that the employee:

  • was involved in a “voluntary drug and alcohol program,”
  • was being required by [the EAP] and apparently OHS to sign a Recovery Maintenance and Monitoring Contract,
  • would be subject to requirements of “abstinence” and “random testing for alcohol and drugs” for a 2 year period,
  • had been seeking counselling/treatment from [the EAP].

The OIPC held that it was okay for the employer’s OHS to know about the nature of the employee’s condition so it could ensure it was being properly managed, but all human resources needed to know was weather the employee had successfully completed treatment and would comply with return to work conditions.

The third information flow involved a communication sent by human resources that indicated the employee was not complying with the employer’s policies, that the OHS had given the employee notice of his requirements and the reason why the employee was not in compliance. The information was contained in a letter copied to:

  • the local union president
  • the employee’s immediate supervisor
  • the employer’s director of disability management
  • the employer’s director of operations
  • the nurse who ran the employer’s OHS
  • the employer’s site production manager
  • the manager of the employee’s department

The OIPC held that the employee’s direct supervisor and the individuals responsible for administering the employer’s short term disability program had a need to know information about the ongoing employment-related dispute, but that the other members of management copied on the letter only needed to know that the employee was not yet eligible to return to work and should not be on-site.

This report provides some useful (and in my view fair) guidance to employers on the proper scope of some of the information flows that are necessary to the management of employee medical issues. I’m most interested in the OIPC’s treatment of the first information flow because it identifies the importance of clarifying the purposes for and conditions on employer-sponsored medical services. This case is about the subtle difference between visiting an employer-sponsored care provider under an absolute condition of confidentiality and a limited disclosure condition. It is reminiscent of the similar problem that arises when an OHS department provides care (for employees’ benefit) and assesses employees (for an employer’s benefit). Whenever an employer-sponsored care provider wears more than one hat, it’s important to let employees know which hat it is wearing in each and every engagement.

Investigation Report P2008-IR-003 (10 April 2008, Alberta OIPC).

Case Report – ABCA addresses an expert witnesses’s duty of confidentiality

On May 9th, the Alberta Court of Appeal issued a split judgement that touches on the scope of confidentiality that is waived by the act of filing an expert report in court. The majority held the filing of a report only waives confidentiality as between the litigant and its expert in the content of the report itself. The minority held that a person filing an expert report waives confidentiality in all information in the custody of the expert that is relevant and material to the dispute in which the report is filed.

This was a case about an expert report written by an accounting firm for a woman engaged in a child support and custody dispute (the “complainant”). The firm traced her husband’s assets and drafted a preliminary report, which the complainant filed in court in support of her position in two proceedings. This action, which the firm claimed she did not have authorization to take, led to a series of events that culminated in complaint by the woman to the Institute of Chartered Accountants of Alberta.

After viewing the report, the husband (also an accountant and familiar to the firm) then called the author of the report to complain about its quality. The author wrote an e-mail to the managing partner which stated, “If Danny feels we have slighted his reputation, we have not.” Soon after, the firm decided to withdraw the report. It took the position that withdrawal was justified because the report was filed without its authorization and the complainant’s account was unpaid. It told the husband around the same time it sent a letter to the wife, who heard about the withdrawal through the husband’s counsel before she received the letter. Later, in response to a summons issued by the husband, an accountant from the firm swore an affidavit to confirm the withdrawal.

In an award written by Picard J.A., the majority of the Court of Appeal affirmed the Institute’s findings of professional misconduct on a “reasonableness” standard of review. She first affirmed a finding that the author’s e-mail, despite being sent internally, was “false and misleading” and constituted a breach of the professional rule against making such statements. Picard J.A. read the rule broadly; since it didn’t exclude internal communications, she held that it applied to them.

Picard J.A. also affirmed breach of confidence findings that were based on the firm’s direct communications with the husband and its affidavit. She rejected the firm’s reliance on the rule governing litigation privilege that deems privilege to be waived for all information relevant and material to an expert report filed in court. She held this was a rule about litigation privilege and was not incorporated into the Institute’s confidentiality standard, so upheld the Institute’s finding that the firm acted improperly by disclosing information about the terms and reasons for the report’s withdrawal, the state of the complainant’s account and its relationship with the complainant.

Slatter J.A. wrote a very strong dissent.

He first took issue with the internal e-mail finding. He held that the Institute’s interpretation of its “false and misleading” communications standard would create a form of absolute liability for bad opinions and would also prevent firms from discussing the resolution of complaints. His reasoning speaks to a form of privilege:

The decision of the Appeal Tribunal would have a chilling effect on the ability of any firm of accountants to conduct open and frank inquiries about the conduct of its members, and the quality of the work that had been completed for any client. Any partner (like Mr. Nelson) who attempted to defend his work could be found guilty of professional misconduct if it turned out later that he was mistaken. Any partners who shared and repeated the opinion that the work had been properly done would likewise potentially be subject to discipline…

The Complaints Inquiry Committee, the Discipline Tribunal and the Appeal Tribunal all play a key role in maintaining the standards of the accounting profession. However, the first line of defence of the standards of the profession must be with the professionals themselves and with their firms. Accounting firms must be free to make inquiries about the quality of their work and the conduct of their partners, without fear that if they make statements, or express opinions, subsequently found to be inaccurate they would be subject to discipline. Penalizing a firm for such statements is counter-productive.

Slatter J.A. also objected to the confidentiality findings. He held that the Institute’s rules should not be read in conflict with an expert’s duty to the court. He held that the fact that the report had been withdrawn, the terms of the retainer, the fact that there was an alleged breach of the retainer, that the firm had ceased to act for the complainant, that it was prepared by an articling student, its belief in the suitability of the report as evidence and even the status of the complainant’s account were all material and relevant facts in the legal dispute, and therefore were the subject of an implicit waiver of confidentiality. On the timing of the disclosure to the husband, he said:

It is true that Mr. Preston disclosed this information to Mr. Dalla-Longa on the telephone prior to advising the complainant. Mr. Dalla-Longa undoubtedly caught Mr. Preston by surprise when he telephoned to inquire about the report four years after it was prepared. But when Mr. Dalla-Longa advised Mr. Preston that the report had been filed in court, the latter was entitled to proceed on the basis that confidentiality had been waived. Experts should be encouraged to make timely disclosure of the information that underlies their reports, to avoid surprise and adjournments, and to promote settlement discussions. The rules should not be construed to require a court order before an expert discloses his or her working papers, or to require or encourage experts to avoid producing information until they are actually in court, on the stand, and under cross-examination. Providing the limited information involved to Mr. Dalla-Longa was at most a breach of business etiquette that does not warrant discipline.

Also of interest, the majority and minority concluded that a different standard of review applied based on the standard of review analysis recently endorsed by the Supreme Court of Canada in its landmark Dunsmuir decision. The majority supported a reasonableness standard and the minority one of correctness.

Deloitte & Touche LLP v. Institute of Chartered Accountants of Alberta (Complaints Inquiry Committee), 2008 ABCA 162.

The perils of online employee communication and another nugget or two

I spoke at our Toronto client conference on Monday on two topics. The first was on a topic we called, “The limits of the application game: why employee privacy matters.” It’s on our “patchwork” of employment privacy regulation and the state of the privacy tort. I wrote a paper that should be available for public consumption later, at which point I’ll link to it from here. I also spoke on “The perils of online communication” together with my colleague Mark Mason. We laid out the relevant legal issues, made some policy prescriptions and also discussed some of tactical considerations in responding harmful employee and student communication. I don’t have a full set of notes to publish, but here’s one idea we expressed on the dangers of over-reaching:

You’ll also likely send a cease and desist letter directly to the individual. Here’s the word of warning. Before you send a cease and desist you have to reckon with the risk of a backlash. There’s a community of people who use the internet who value it as a free speech medium. If you send an aggressive letter that targets communication that is lawful, you risk a severe backlash from that community. You could find your cease and desist letter posted online, you could be blogged about and you could have your minor communication issue become magnified 1,000 times over. And that’s not even an exaggeration!

So you have to create a cease and desist that is both firm on the law and demonstrative of a reasonable and measured approach – it has to be consistent with how your organization presents itself to the public so you can be proud of it and stand behind it to the very end. If you don’t have a solid legal claim that supports this approach and you still need to take action, send a different letter. Use a carrot and not a stick. Tell the person you’d be glad to discuss their concern or collaborate in some way but that they have to take down their communication first. It’s not as strong, and you have to be wary of setting a pay-out precedent, but with some creative thinking you may find an out without suffering a backlash because you over-reached. You shouldn’t be intimidated by the masses, but understand that its hard to bluff them with a bogus claim.

Finally, my colleague Catherine Peters and I published a follow-up on managing student violence in response to the recent Kajouji suicide case. It’s available here.

Information Roundup – May 11, 2008

Today was a windsurfing day in Toronto.  Philip Soltysiak was out at Cherry Beach, and I tailed him around watching for a while.  It seems like Philip went from being a ten year old that came up to my waist to to an absolute super-ripper overnight.  He’s competing on the freestyle world tour this year and will no doubt do Canada proud.

Here are my most notable reads of the week:

  • Sam Bayard, “Crazy Legal Battle Between Newspapers Settles, But Leaves Worrisome Fair Use Decision Intact.”  A report on a now-settled departing employee and free speech case rolled into one.  It details a November 2007 California decision no a summary judgement motion that dealt with whether an article written by a departed journalist and not published his newspaper could be fairly used by another newspaper in reporting on the journalist’s departure.  (Citizen Media Law Project)
  • Ralph Losey, “The Days of the Bates Stamp Are Numbered.”  This picks up on an great law review article Mr. Losey wrote last fall and some recent commentary on Law.com, both about the use of hash values in e-discovery.  (E-Discovery Team)
  • Peter Applebome, “Trying to Flesh Out the History of a Family That Was Minus One.”  This probes at an FOI policy issue that has recently been addressed in our Ontario FOI legislation with the addition of a new “compassionate reasons” exception  – the right of an individual to seek personal information about a deceased relative. (See here for more on the exception.) Our health privacy legislation also has a slightly narrower exception to permit (but not necessarily require) health information custodians to disclose the circumstances surrounding the death of an individual.  (New York Times)

Enjoy!

Case Report – Arbitrator says what PI is necessary to assess a job competition

British Columbia arbitrator James Dorsey recently considered what personal information needs to be disclosed to fulfil the purpose of a collective agreement clause that gives a union access to information to assess the propriety of a job competition.

This award follows a 2005 judgement by the British Columbia Court of Appeal in which it held that the purpose for disclosing bargaining unit members’ personal information to the union as contemplated by the clause was consistent with the purpose for which it was collected and therefore permitted under the British Columbia Freedom of Information and Protection of Privacy Act. The Court of Appeal also held that only what is necessary to the purpose should be disclosed to the union, and perhaps unfortunately, said that “personal identifiers” should be redacted from the disclosure.

Following the Court of Appeal’s judgement, the employer applied a very literal and narrow view of the union’s right to “applications” and a very literal and broad view of the Court’s comment on redacting personal identifiers. Arbitrator Dorsey held the employer’s position was improper given the purpose of the access to information clause.

He held that the union’s right to “applications” gave it an entitlement to resumes, interview questions and responses, score sheets, and essentially all other records collected and used in the application process except reference information. He also held that the Court of Appeal’s suggestion to redact personal identifiers did not allow the employer to redact all information that would tend to identify individuals. Instead, he said:

When using the term “personal identifiers” in this context, the Court of Appeal meant information that is specific to a unique individual. This includes names and contact information, such as postal, email and other addresses and telephone numbers; passwords, social insurance, drivers licence, care card and financial numbers; and, in the current world, biometrics. This is information that is often guarded by individuals to avoid identify theft.

Ontario employers have generally been unsuccessful in resisting disclosures required by labour law on the basis of employee privacy rights.

Re Canadian Office and Professional Employees Union and Coast Mountain Bus Co. (7 September 2007, Dorsey).

[I picked this case up from a Lancaster House bulletin. Lancaster House is a publishing and conference company that heavily focuses on labour law. Thanks!]

Ontario and B.C. privacy commissioners issue joint statement on the privacy and safety balance

The Ontario and British Columbia Privacy Commissioners issued a joint statement today in which they commit to issuing a joint publication aimed at clarifying the role that privacy laws play in managing health and safety risks. Mr. Loukidelis says, “Individual cases can be fuzzy, but if someone uses common sense and in good faith discloses information, my office is not going to come down on them.” The focus of this positive initiative seems broader than campus safety, but the statement does mention Virginia Tech and the recent suicide at Carleton University. For my coverage of this issue, see here.

Case Report – OCA interprets MFIPPA application provision broadly

In a judgement released today, the Ontario Court of Appeal interpreted the section 2(3) application provision of the Municipal Freedom of Information and Protection of Privacy Act and held that the City of Toronto Economic Development Corporation is deemed to be part of the City of Toronto for the purposes of the Act.

TEDCO is an OBCA corporation that is wholly owned by the City.  The City appoints all TEDCO directors, who in turn elect or appoint all TEDCO officers pursuant to a by-law.  The Court held that all of TEDCO’s officers are “appointed or chosen by or under the authority” of the City as contemplated by section 2(3).  It based its decision on the ordinary meaning of the word “authority,” the purpose of access to information legislation and the non-technical character of the language used in section 2(3) – marked by the phrase “appointed or chosen.”

While the judgement is confined in its significance, the Court’s reasoning on non-technical language supporting a non-technical interpretation of other proximate language seems worth a note to self.

City of Toronto Economic Development Corporation v. Information and Privacy Commissioner/Ontario, 2008 ONCA 366.

Information Roundup – May 4, 2008

Here are a couple links for this week.  The second article is a must-read for those who are interested in the privacy issues raised by Web 2.0.

  • Floyd Abrams, “Foreign Law and the First Amendment.” An op-ed on how the British law of defamation values free expression less than American law and supportive of current American legislative initiatives to give courts the jurisdiction to grant declarations that certain speech is protected under American law.  Our own law on this question is arguably in flux after the Ontario Court of Appeal’s decision in Cusson v. Quan, on which leave to appeal to the Supreme Court of Canada was granted in early April.  (Wall Street Journal)
  • Hal Niedzviecki, “The Spy Who Blogged Me.”  This is an excellent article from this month’s edition of The Walrus.  Mr. Niedzviecki argues that we don’t balk at surveillance because it is now “woven into the fabric of our culture,” a phenomenon he says is partly due to what television has told us about a the benefits of a new type of celebrity that is accessible to the average Joe and Jane.  He speaks with our federal Privacy Commissioner Jennifer Stoddart about self-surveillance and peer surveillance, and through the dialogue you get the impression that Ms. Stoddart’s significant tool – the Personal Information Protection and Electronic Documents Act – misses the most complex and significant privacy challenges that we face today.  As Mr. Niedzviecki says, “The rules don’t apply to the multitudes of cellphone-camera-pointing bloggers, social networkers, YouTube uploaders, and nanny cam enthusiasts – you have to sue.”  (The Walrus)

What a great weekend here.  Even the rain on  Saturday made for a cozy afternoon.  Possibly even better because I decided to purge the backlog of materials in my RSS reader.  Kind of liberating eh?

Enjoy!

“Lessons to learn” on student-university duty of care

The Ottawa Citizen published an article today called “Lessons to learn” on the student-university duty of care as a follow-up to the Nadia Kajouji suicide at Carleton University.  Pauline Tam does a very good job of going deep into some of the complexities, and even received some input from American expert Peter Lake.  I’m also quoted on the duty of care issue and the limits of privacy law.  

As Anne Cavoukian has recently written in response to some commentary on the Carleton suicide, privacy law is not absolute. From how I was quoted it’s not exactly clear what the precise standard for disclosure is and, in fact, there are two standards for “health and safety” disclosures under Ontario law.  Under FIPPA – which governs personal information a university or college manages in its ordinary administration – there is a “compelling circumstances” standard. Under PHIPA – which governs health care relationships, including health care services provided by universities and colleges – the standard is higher, essentially a “serious and imminent” harm standard.  

One of the things that has been lost in some of the recent commentary is that there are two different standards, the latter standard creating a special and important “zone of privacy” within which a health care relationship is situated.  There’s very good reason for this. After all, we want students at risk and others who need care to seek treatment, and a strong guarantee of confidentiality is a necessary, indeed fundamental, part of making treatment accessible.  Outside of health care (think of information known by a residence don, faculty members or members of the administration) the standard for disclosing information to prevent harm should be taken seriously, but is lower and should be lower.  

I’ve spoken and written recently about the need for objective threat assessment procedures to balance the duty to provide a safe campus environment against the duty to protect individual privacy.  For more on my view see this post here and its attachments.

Two in-depth comments on the sniffer dog cases worth reading

Case analysis takes time, and my aim with this blog is typically to limited to posting case reports as timely and accurate news, and in a way that situates cases in their practical context. I also write predominantly for our base of institutional clients, who tend to want the bottom line and (surprise) represent institutional interests.

I blogged about the basic meaning of the Supreme Court of Canada’s sniffer dog cases last week. While I met my measure of success, two superior comments have been published this week by academics that you should read if you’re interested in going deeper into their subject matter.

James Stribopolous, an Osgoode Hall professor, situates the case in the context of the evolving law on ancillary police powers. Ian Kerr, who holds the Canada Research Chair in Ethics, Law and Technology, focuses on the other key aspect of the judgements – the search aspect. He’s critical of the outcome of the cases for their “reductionist” approach to assigning value to the information captured by a dog sniff – an approach which led the majority to a lesser standard for legality than “reasonable cause” and an approach that Mr. Kerr feels raises the spectre of increased surveillance by law enforcement based on new technologies.

Enjoy!