Psychologist’s anonymized peer review notes are the personal information of the patient

PIPEDA Case Summary #2009-018

[Section 2; Principles 4.9 and 4.9.1]

A dispute between a patient and her psychologist resulted in the patient requesting access to the personal information held by that psychologist. Suspecting that information was missing, the patient filed a complaint.  The results of the investigation led the Assistant Privacy Commissioner to contemplate the question of what qualifies as truly anonymous data and what can be linked back to an identifiable individual.

Our Office recommended that the psychologist give the complainant access to the following personal information contained in her peer review notes. Included were:

• the facts that she provided to her psychologist about herself;
• the interpretation of these facts by her psychologist;
• the views and opinions expressed by the psychologist and her peers about the complainant’s conduct; and
• the names of the peers, even though those portions of the notes also constituted personal information of the psychologists.

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The investigation established that a psychologist had not given the complainant access to her “peer review” notes.  These notes, which the psychologist used to consult with her peers (she was seeking advice on dealing with the patient), did not name the complainant but did concern the particulars of her case.  The psychologist was of the view that the notes did not contain sufficient information to identify the complainant to anyone receiving the information.  As the psychologist considered them “anonymized”, she believed that the notes were not the complainant’s personal information and that the complainant had no right of access to them.

Findings

Issued February 23, 2009

Application: Section 2 and Principles 4.9 and 4.9.1.  Section 2 defines personal information as “information about an identifiable individual.”  Principle 4.9 stipulates that, upon request, an individual shall be informed of the existence, use, and the disclosure of his or her personal information and shall be given access to that information.  Principle 4.9.1 allows an organization to choose to make sensitive medical information available through a medical practitioner.

In making her determinations, the Assistant Commissioner deliberated as follows:

Access to Personal Information

• The central question in this case was whether the notes at issue were truly anonymous information and therefore not the complainant’s personal information or whether they in fact did meet the definition of personal information as being “about an identifiable individual.”

• In formulating a test to determine whether information is information about an identifiable individual, the Assistant Commissioner was mindful of what was at stake.  She noted that the definition of personal information serves as the critical gateway that allows or disallows an individual to invoke her or his right of privacy in the first place.  Thus, in her view, a broad interpretation of the definition of personal information was justified.
• Information will be about an identifiable individual if there is a serious possibility that someone could identify the available information.  It is not necessary, she commented, to demonstrate that someone would necessarily go to all lengths to actually do so.  Consequently, de-identified data will not constitute “truly anonymous information” when it is possible to subsequently link the de-identified data back to an identifiable individual.
• The peer review notes were about an identifiable individual because it was possible to link the de-identified data back to the complainant.  The conclusion was reached on the basis that both the psychologist and the complainant knew who the notes were about.  The notes clearly related to the complainant’s treatment and relationship with the psychologist.  They described details of conversations between the individual and her psychologist, including personal information about her that she had shared with the psychologist, and the psychologist’s and her peers’ views about the individual and her conduct.  The fact that the complainant’s name had been removed and that she may not have been identifiable vis a vis the outside world did not take away from the fact that the psychologist could still readily link the information to the individual and the individual could still recognize her own personal information on the very face of the notes.  The Assistant Commissioner believed that to permit otherwise would absolve organizations of their obligation to provide individuals with a right of access to their own personal information, simply by removing the name from otherwise intimate details about them.
• As a result, if a health professional’s notes contained personal information about an individual complainant, that complainant has a right to access her or his personal information.  Consequently, as it was possible to link the psychologist’s peer review notes back to the complainant, they qualified as information about her and were her personal information, in keeping with the definition.
• As the notes in question were her personal information, the complainant had a right of access to them.

Private and Public Interest

• While not expressly mentioned by the complainant, it was important to consider the issues of private and public interest in the context of this complaint.  With respect to the private interest of the patient versus the private interest of the psychologists, the private interest of the individual complainant to obtain access to her personal information contained in the psychologist’s notes was far more compelling than the private interest of the psychologists.  The psychologists’ interest to withhold their identity and their views about the complainant appeared to be of little significance.  They had been consulted in their capacity as professionals and provided professional advice as they are regularly called upon to do.  Providing such advice is part of their professional responsibility, which they are required to carry out as an obligation to their patients and to their professional licensing body.

Summary

• As the notes in question were her personal information, the complainant had a right to access them.  It was recommended that the psychologist provide the complainant with access to the peer review notes.  In particular, she determined the access should include:
  • The facts that the complainant had provided to her psychologist about herself;
  • The interpretation of these facts by her psychologist;
  • The views and opinions expressed by the psychologist and her peers about the complainant’s conduct; and
  • The names of these peers
• It was suggested to the psychologist that she consider allowing the complainant access to the notes through the complainant’s medical practitioner as provided under Principle 4.9.1
• A caution was noted that the complainant should not be given access to those portions of the notes that purely reflected the process by which the psychologists arrived at their views or opinion.  Also, the complainant should not be given access to those portions of the notes that reflected discussions taken in anticipation of possible litigation.

Conclusion

The Assistant Commissioner concluded that the complaint was well-founded.

Summary of Court Activity

The Privacy Commissioner filed a Notice of Application in the Federal Court under section 15 of the Act in which she sought, in part, a declaration from the Court that the respondent’s peer review file notes contain the complainant’s personal information and an order requiring the respondent to provide the complainant with access to her personal information.

Prior to the matter reaching a hearing, the respondent released to the complainant all of the personal information to which she was entitled under the Act.  Accordingly, the Privacy Commissioner discontinued her Application against the respondent.