Insurer discloses individual’s medical information to third-party consultant based on implied consent

PIPEDA Case Summary #2009-003

[Principles 4.3, 4.3.4, 4.3.5]

During the four years following a car accident that resulted in serious injuries for the complainant, she and her insurer had been involved in several formal dispute resolution proceedings to resolve issues concerning her long-term benefit entitlement.  The complainant was seeking to be formally recognized as having a “catastrophic impairment” and was awaiting a hearing for binding arbitration, a process which she had initiated.  Before the pre-arbitration hearing with the Financial Services Commission of Ontario (FSCO), the complainant’s insurer sought the expertise of third-party medical consultants and shared with them—without the complainant’s consent—her medical brief and two previous medical assessments of her condition that were the subject of dispute.  Once aware of it, the complainant objected to the disclosure of her medical information without her express consent.

The Assistant Commissioner found that the Act allowed for the disclosure without express consent, in light of the case’s specific circumstances.  By initiating an arbitration proceeding before the FSCO in which she put her personal medical information in issue, the complainant gave her implied consent to the collection, use and disclosure of her personal information by the insurer for the limited purpose of defending itself in these particular proceedings—and subject to the type of personal information disclosed being relevant to the insurer’s defense.  It would be reasonable for an individual, in these circumstances and for this limited purpose, not to expect the insurer to seek her express consent to disclose her relevant medical information.

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant had been involved in a motor vehicle accident.  As a result of serious injuries she sustained from it, she applied for and ultimately received payment from her insurer under the Statutory Accident Benefits Schedule (SABS) of the Ontario Automobile Insurance Act.  The various benefits that the complainant received under SABS were not permanent. 

Nearly four years after the accident, the complainant applied to her insurer for the determination of catastrophic impairment, which, if conferred, would entitle her to extended benefits.   According to the SABS, to have the status conferred on her, the complainant would have to be recognized as having “… an impairment or combination of impairments that, in accordance with the American Medical Association’s Guides to the Evaluation of Permanent Impairment, 4th edition, attain certain prescribed standards.”

Pursuant to Section 42 of SABS, the complainant’s insurer requested that she be assessed to determine if her condition met the set criteria for catastrophic impairment.  The report of that independent assessment concluded that the complainant did not meet the criteria.  Subsequently, her application was rejected and the insurer denied payment of the extended benefits sought by her.

As a result of the denial, the complainant applied for mediation to the Financial Services Commission of Ontario (FSCO).  At her own expense, she obtained another medical assessment of her condition, from a professional medical assessor of her choice.  The rebuttal report from her own assessor determined that she met the criteria for catastrophic impairment.  The complainant provided her insurer with a copy of that report prior to the mediation. 

The mediation ultimately failed to resolve any of the disputed benefit issues.

The complainant subsequently filed for arbitration through the FSCO.  The determination of catastrophic impairment was cited as one of the issues in dispute, as were the conclusions of the independent assessor’s report.

The insurer then retained the services of specialized medical consultants for the purposes of obtaining their “… expert opinion in respect of the whole person impairment which would apply in respect of the injury to the complainant”,as well as obtaining the consultants’ evaluation of the approaches taken by the two previous assessors.

The insurer provided the medical consultants with a copy of the complainant’s medical brief, which included the report produced for the complainant by her own assessor.  It did not advise the complainant in advance that it would be doing so, nor did it seek or obtain her express consent.

The medical consultants concluded that the complainant did not meet the criteria for determination of catastrophic impairment.  A copy of the consultants’ report was provided to the complainant’s counsel prior to the pre-arbitration hearing.

The complainant complained to this Office that her insurer had shared her private medical records with the medical consultants without her knowledge or consent in an effort to obtain a report that would not support a determination of catastrophic impairment. 

In its representations to this Office, the insurer stated that the disclosure of the complainant’s personal information to the medical consultants was done for the purpose of arbitration proceedings that had been initiated by the complainant herself, and in order to defend itself against a report previously submitted by her. 

The insurer maintained that it had the “… right to produce documents to experts it retained in the course of the Arbitration” and that “… the privacy laws cannot be invoked once the complainant herself has put the matters in issue and commenced the relevant proceedings.”  It further contended that “… by filing for arbitration on the issue of catastrophic impairment, [the complainant] clearly put her medical condition in issue.”

Findings

Issued February 23, 2009

Application:Principle 4.3 stipulates that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Principle 4.3.4 states that the form of consent sought by an organization may vary depending on the circumstances and the type of information. Principle 4.3.5 stipulates that the reasonable expectations of the individual are relevant in determining the form of consent to be used.

In making her determinations, the Assistant Commissioner deliberated as follows:

• Although organizations should generally strive to obtain an individual’s express consent to collect, use or disclose that individual’s personal information, there are circumstances in which an individual’s consent to the collection, use or disclosure of the information may be implied.
• The information that the insurer provided to the consultants firm was limited to that information necessary for the insurer to defend itself against the complainant’s specific issues.  The information provided to the firm consisted of the complainant’s medical file—information that was already in issue.  In order to assess the complainant’s injuries and evaluate her eligibility for the determination of catastrophic impairment under the SABS, a complete assessment of her medical information would have been needed.  In addition to any post-accident medical information, the experts retained would need to review any pre-existing medical conditions to the accident in order to assess what impact these conditions have on the individual’s current status.
• The Assistant Commissioner was satisfied that the insurer did not disclose the complainant’s personal information in a reckless manner.  For example, the insurer’s stated purposes for the disclosure of information to the third party were clear, precise and fully in keeping with expected efforts that would be made by the insurer—in full anticipation of the arbitration proceedings—to resolve the conflict and to assist in the evaluation of the complainant’s claim.  Further, the Assistant Commissioner noted that the insurer disclosed the information and requested the assessment from the medical consultants clearly after the complainant had made a formal request for arbitration proceedings.
• In the Assistant Commissioner’s view, by initiating an arbitration proceeding before the FSCO in which she put her personal medical information in issue, the complainant gave her implied consent to the collection, use and disclosure of her personal information by the insurer for the limited purpose of defending itself in these particular proceedings, subject to the personal information being relevant to the insurer’s defense.  It is reasonable for an individual, in these circumstances and for this purpose, not to expect the insurer to seek her express consent to disclose her medical information. 

The Assistant Commissioner concluded that the complaint was not well-founded.