Personal information practices considered in sale of dental practice

PIPEDA Case Summary #2006-325

(Principle 4.3; subsection 5(3))

Complaint

After reading the consent form given to him by his dentist’s office, a patient became concerned about his personal information being disclosed to potential purchasers of the dentist’s practice.  The Commissioner, however, was satisfied that the purpose for such a disclosure was appropriate in the circumstances.

The following is a detailed overview of the investigation and the Privacy Commissioner’s findings.

Summary of Investigation

In the complainant’s view, it is inappropriate for personal information, such as medical information or personal identifiers, to be disclosed to potential buyers, brokers or advisors.  He believed that only aggregate information, such as the number of patients, number of active patients, gross and net profits, and the number and types of procedures performed, should be made available to purchasers, brokers, or advisors.

The dentist’s office indicated that the purchase of a practice depends on the disclosure of certain information.  It states that due diligence dictates that:

1. The purchaser verify the number of active patients by a hand count of the patient charts.
2. The purchaser verify the number and types of procedures performed by inspection of patient files randomly selected.
3. The purchaser verify the degree of third party involvement (insurance companies) by inspecting patient financial records.
4. The purchaser reconcile the claimed revenue by inspecting bank deposit records.

All of the procedures listed above could involve consulting patients’ personal information.

Findings

Issued January 18, 2006

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate; subsection 5(3) provides that an organization may collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

In making her determinations, the Privacy Commissioner deliberated as follows:

• Although the Personal Information Protection and Electronic Documents Act (PIPEDA) does not specifically contemplate any such collection, use or disclosure of personal information as described in the consent form, she noted that it was likely that a reasonable person would consider it appropriate for a dental office to disclose patient personal information to prospective buyers in order for the buyer to evaluate the practice, as per subsection 5(3). 
• The Commissioner also noted that dentists are subject to numerous regulations concerning privacy.  Indeed, several regulations, policies, procedures, and laws apply to the disclosure of information: for example, Health Disciplines and Dentistry Acts, confidentiality agreements, and policies concerning personal information. 
• She stated that the Act also requires that personal information be safeguarded, and confidentiality agreements would meet such a requirement. 
• Given the above, the Commissioner was satisfied that the purpose, as described in the consent form, was an appropriate one.

She therefore concluded that the complaint was not well-founded.

Further Considerations

The dentist office in this case was located in Ontario. At the time the complaint was filed, Ontario’s Personal Health Information Protection Act had not yet been enacted, nor deemed substantially similar to PIPEDA.

The Commissioner noted that under Ontario’s Personal Health Information Protection Act, 2004, the collection, use, and disclosure of personal information as part of the sale of a medical practice is considered acceptable.  Specifically, subsections 42(1) and 42(2) state the following:

“42 (1)  A health information custodian may disclose personal health information about an individual to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation.  2004, c. 3, Schedule A, s. 42(1).

Transfer to successor

(2)  A health information custodian may transfer records of personal health information about an individual to the custodian’s successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records.  2004, c. 3, Schedule A, s. 42(2).”

On November 28, 2005, the Governor in Council gave Ontario’s Personal Health Information Protection Act substantially similar status.  The dentist office involved in this complaint is now subject to this legislation.  Since the events in question predated substantially similar status, and the investigation was completed, the Office issued a report of findings.