When is a custodian not a custodian?

• Author: Rossall, Jonathan P.
• Position: Canada

Introduction

How physicians may collect, use, and disclose a patient's personal health information is an issue which has plagued legislatures and the justice system for decades. While it cannot be denied that the disclosure of such health information, when done properly, enhances the care and management provided by the health care system, a sensitive balance must be maintained which recognizes the patient's legitimate concerns regarding privacy, confidentiality, and human dignity.

At the forefront of this precarious balancing act is the nature of the relationship between the physician and the patient. In 1992, this issue came better the Supreme Court of Canada in McInerney v. MacDonald (1) La Forest J. delivered the Court's unanimous decision and found that while the physician may own the chart within which the patient's information resides, the information itself is owned by the patient. The relationship between the physician and the patient, in relation to that information, is described as a fiduciary one:

As discussed earlier, information about oneself revealed to a doctor acting in a professional capacity remains, in a fundamental sense, one's own. The doctor's position is one of trust and confidence. The information conveyed is held in a fashion somewhat akin to a trust. While the doctor is the owner of the actual record, the information is to be used by the physician for the benefit of the patient. The confiding of the information to the physician for medical purposes gives rise to an expectation that the patient's interest in and control of the information will continue. (2) The McInerney decision was rendered at a time when a patient's health information was still recorded on paper charts. However, the Court recognized the increasing complexity of medical treatment, and the scope of health care professionals involved in a patient's care at any given time:

Medical records continue to grow in importance as the health care field becomes more and more specialized. As L. E. Rozovsky and F. A. Rozovsky put it in The Canadian Law of Patient Records (1984), at pp. 73-74:

The twentieth century has seen a vast expansion of the health care services. Rather than relying on one individual, a physician, the patient now looks directly and indirectly to dozens and sometimes hundreds of individuals to provide him with the services he requires. He is cared for not simply by his own physician but by a veritable army of nurses, numerous consulting physicians, technologists and technicians, other allied health personnel and administrative personnel. While a patient may, in the past, have relied primarily upon one personal physician, the trend now tends to favour referrals to a number of professionals. Each of the pieces of information provided by this "army" of health care workers joins with the other pieces to form the complete picture. (3)

The complexity surrounding the collection, use, and disclosure of health information has only increased as the medical field has transitioned into the electronic age. A patient's health information may now be instantaneously collected, accessed, and transmitted through a few simple key strokes. Due to this growing concern, the Alberta legislature enacted the Alberta Health Information Act (4) in 1999, a mere seven years after the release of the McInerney decision. In the course of drafting the legislation, the patient's "ownership" of his or her health information took a back seat to the role which health service providers, such as physicians, who are defined as "custodians under the HIA, play in relation to that information.

It is the authors' thesis that in spite of the lack of clear reference in the HIA to the patient's inherent interest in the health information being collected, used, and disclosed, the fiduciary relationship referenced in McInerney continues to be a guiding principle in determining the duties and responsibilities of physicians under the HIA. In this paper, we will attempt to more accurately define the role of custodian and distinguish it from the concurrent role of affiliate.

HIA Background

The fiduciary relationship that arises between a physician and their patient relative to the latter's health information is subject to legislative guidance. However, this is not to subvert the legal principles governing the physician's duties. As Justice La Forest stated in McInerney:

I find it unnecessary to rectify the patient's interest in his or her medical records and, in particular, I am not inclined to go so far as to say that a doctor is merely a "custodian" of medical information. The fiduciary duty I have described is sufficient to protect the interest of the patient. (5) The use of the word "custodian" in the above reference is Ironic, given the HIA's focus on the health service providers' gathering, use, and disclosure of health information. In retrospect, it may have been wiser to entitle the legislation the "Custody of Health Information Act," as the HIA deals largely with concepts of collection, use, and disclosure and, more importantly, who can perform these actions. Under the HIA, the individuals or bodies performing these actions are characterized as either "custodians" of health information, or "affiliates" of those custodians.

Affiliates are, essentially, individuals or bodies who have a relationship with a custodian, whereby the affiliate provides services for or on behalf of that custodian. Affiliates must not use or disclose health information except in accordance with the affiliate's duties to the custodian. (6) Given this, it is clear that pursuant to the HIA, it is the role of the custodian that is of paramount importance.

This of course begs one to ask the question, what exactly is a custodian?

One would think that a piece of legislation that focuses on the duties and responsibilities of custodians would clearly define that term. Although the HIA purports to define "custodian," more accurately, it tells you who a custodian is by listing such entities al length. Included in the definition is a reference to those "health service providers designated in the regulations as a custodian. (7) The regulations, however, designate a lengthy list of health service providers, which includes over twenty different Colleges, Associations, panels, committees, and boards. (8) From the above list, one is presumably supposed to glean what characteristics a custodian should have.

Along the same vein, the HIA also tells you what relationships lead to the characterization of "affiliate" without actually telling you what an affiliate is, or what characteristics they should hold. (9)

Despite the onerous restrictions and responsibilities leveled on custodians, nowhere in the HIA is there a precise definition telling the reader what a custodian is, or what characteristics or attributes make one a custodian. Compounding the problem, neither our courts nor the Office of the...