Commissioner considers access, correction, and inappropriate disclosure allegations against insurance company

PIPEDA Case Summary #2005-293

(Principle 4.3, 4.9, 4.9.5, and 4.9.6 of Schedule 1)

Complaint

An individual alleged that an insurance company denied him access to some of the personal information to which he was entitled, specifically, certain correspondence and records of voice mails. He also complained that the company had refused to amend its record of his earnings, and had disclosed his personal information to his employer without his consent.

Summary of Investigation

The complainant is an employee of a company that has a group policy with the insurance company in question. He had been absent from work for medical reasons for some time and was receiving long-term disability benefits. He wrote to the insurance company, requesting a complete copy of his file. The company responded 22 days later, enclosing a package of documentation. The letter also advised the complainant that it was terminating his claim for long-term disability benefits.

The information the complainant received was organized into three sections: a medical claims file, a disability management consultant's file, and computer activity notes. Our Office reviewed the company's file, comprising several hundred pages of material. Included in these documents was a log of voice mail messages. The complainant cited examples of messages that he believed should have been logged. The company, however, indicated that there is no requirement to create a log for every voice message received. If a case manager determines that a particular message does not warrant the creation of a log, he or she has the discretion to not create one. We spoke to the complainant's case manager, who denied deleting any part of or altering his records.

As for correspondence, there was no evidence that there was any additional correspondence that was not disclosed to the complainant.

With respect to the allegation that the company had refused to correct information about the complainant, the response that was sent to the complainant, along with the documentation he requested, described the insurance company's rationale for relying on his employer's pay information to calculate his benefits. The complainant believed that his employer had reported inaccurate information to the insurance company. The insurance company discussed his concerns with the employer and was not convinced that the records were inaccurate. The employer clarified that certain types of pay were not included in the calculation of regular income — a provision that is set out in the benefits handbook the complainant would have received. Although the insurance company was not convinced that the information was inaccurate and refused to amend the information, it included a record of the dispute in the complainant's file.

Regarding the alleged disclosure, the complainant had objected to the fact that the insurance company had copied a benefits specialist with his employer on the letter it sent to him. The letter in question did not contain any sensitive health information about the complainant, but described alternative occupations that the insurance company suggested as suitable for the complainant.

The insurance company claimed it had the complainant's express consent to share information regarding the assessment of his claim with his employer. As evidence, it provided a copy of the claim form for disability benefits, signed by the complainant, which contained an authorization statement, permitting an exchange of information between the employer and insurance company for the purpose of assessing the claim and providing rehabilitation assistance. Other medical assessment forms signed by the complainant allowed the insurance company or one of its agents to provide the employer with information on fitness to work and functional abilities. The forms noted that medical information is confidential. The complainant nonetheless believed that the only information the insurance company is entitled to disclose to his employer is whether or not he is fit to work.

Findings

Issued March 17, 2005

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information; Principle 4.9 stipulates that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Principle 4.9.5 indicates that when an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Principle 4.9.6 indicates that when a challenge is not resolved to the satisfaction of the individual, the substance of the unresolved challenge shall be recorded by the organization. When appropriate, the existence of the unresolved challenge shall be transmitted to third parties having access to the information in question.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• With respect to the denial of access complaint, the Assistant Commissioner determined, based on a review of the file maintained by the insurance company, that the complainant received all of the information to which he was entitled, and that the company did not contravene Principle 4.9.
• She was also satisfied that the complainant had not demonstrated that the company held inaccurate information about him, and that the company was therefore not compelled to amend the information in question. She noted that, in keeping with the requirements of Principle 4.9.6, the insurance company recorded his challenge on his file.

The Assistant Commissioner concluded that the access and accuracy complaint was not well-founded.

• Regarding the disclosure complaint, the evidence showed that the complainant had provided his consent for the insurance company to share information about the assessment of his claim, his fitness to work, and his functional abilities, to his employer. She therefore found that the insurance company did not contravene the requirement for consent outlined in Principle 4.3.

The Assistant Commissioner concluded that the disclosure complaint was not well-founded.