BC Court finds that former employer is primarily responsible for patient records, not the departing therapist

In an interesting case from British Columbia (Synergy Counselling v. Dunvegan Enterprises, 2013 BCPC 101 (CanLII)) involving a dispute between a therapist and her employer, the Provincial Court had an opportunity to consider who has primary responsibility under the Personal Information Protection Act for patient files.

The therapist was an employee of the company and asserted she had primary responsibility for the patient files due to the patient-therapist relationship. The Court took a different view, which generally affirms the prevailing view that when a person is employed to provide healthcare services to others, the employer is the primary custodian of the resulting records:

[104] The Defendant expressed the view that the Claimant took the files for an improper purpose and that it was part of the Claimant’s attempt to “steal” a counselling practice from the Defendant.

[105] Both parties asserted a primary responsibility for the protection of personal information contained in the files under the provisions of the Personal Information Protection Act, [SBC 2003] Ch. 63. Both parties referred to provisions in the Act.

[106] The purpose of the Act is found in s. 2:

2 The purpose of this Act is to govern the collection, use and disclosure of personal information by organizations in a manner that recognizes both the right of individuals to protect their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

[107] Sections 4 and 34 provide as follows:

4 (1) In meeting its responsibilities under this Act, an organization must consider what a reasonable person would consider appropriate in the circumstances.

(2) An organization is responsible for personal information under its control, including personal information that is not in the custody of the organization. ….

34 An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.

[108] The Act requires that organizations exercise reasonable care in fulfilling their obligations with respect to the protection of personal information under their control. The Act, however, does not assist in determining who, in these circumstances, should exercise that control.

[109] In McInerney v. MacDonald 1992 CanLII 57 (SCC), [1992] 2 S.C.R. 138 the Supreme Court of Canada affirmed the common law position that although a medical file itself may be owned by a physician, the patient has a continuing equitable interest in the medical information contained within it. A patient, as a general rule, is entitled to access the medical information in her records and to inspect and copy that information. This broad principle will have application to other clinical records, such as the counselling records concerned here.

[110] It seems clear that clients who attended the KCT offices to obtain counselling services, signed KCT file opening documents, paid accounts rendered to them by KCT and received KCT receipts, no doubt understood themselves to be clients of KCT rather than of the particular counsellor they saw. These clients would reasonably have expected that their files would remain within the KCT offices or otherwise under KCT control unless other arrangements had been agreed.

[111] I’m satisfied that these client files properly belonged to KCT and not to the individual therapist, notwithstanding the therapist’s obligation to hold information in confidence. That personal undertaking did not by itself confer ownership or a right to permanent possession of the file by the therapist concerned.

[112] As for the requirements of the Personal Information Protection Act, there is no suggestion that the Defendant was not meeting its obligations under the Act. On the assumption that the Claimant and Ms. Schell also had obligations under the Act, those obligations would have been reasonably discharged by leaving the KCT files in the custody and control of their owner, the Defendant.

[113] In the absence of any agreement between the parties or their clients regarding file storage, there will be an order that all files removed from KCT offices by the Claimant shall be returned to KCT, provided that the Claimant may retain the files of those KCT clients who have since become clients of Synergy or who have otherwise requested in writing that Synergy maintain their records.