Consent provided extends to third-party doctor hired to evaluate accident insurance claim
PIPEDA Case Summary #2017-004
January 11, 2017
Lessons Learned:
- Organizations can only use personal information for the purposes identified before or at the time of collection, unless the organization seeks further consent from the individual for additional purposes or can rely on an exemption to consent listed in PIPEDA.
- In some cases, a consent form may include consent for the collection and use of personal information by a specified third party for the purposes identified in the form.
- Given that health information may be subject to different privacy laws across various jurisdictions in Canada, please refer to our office’s guidance entitled Who to contact with concerns about the protection of your personal health information.
Complaint
An individual made several allegations against a doctor in a complaint filed with our office. One of these allegations was that the doctor collected, used, and disclosed his personal information without consent.
Summary of Investigation
The complainant was in a car accident and submitted a claim for accident benefits to his insurance company, including a determination of catastrophic impairment. The insurance company asked an independent medical evaluation (IME) firm to evaluate the complainant’s claim of catastrophic impairment. The IME firm, in turn, hired several doctors to complete the evaluation.
The doctor who was the subject of the complaint to our office was hired by the IME firm to write a summary report, which pulled together the assessments of various doctors and specialists involved in evaluating the complainant’s claim.
The complainant believed the doctor did not have consent to collect, use and disclose his personal information. While the complainant had given consent to the other doctors involved in the claim, the complainant asserted the doctor preparing the summary report was not among them.
The doctor believed the complainant had, in fact, provided consent, having received two standard benefit forms (OCF-1 and OCF-19) previously signed by the complainant. The doctor believed these forms amounted to the necessary consent to prepare the summary report.
Outcome
In this case, the doctor could rely on the consent the complainant provided when he signed the accident benefit application forms.
Our investigation confirmed that the complainant signed OCF-1, which included a consent provision with explicit language allowing the insurance company and other parties, including health professionals, to collect, use and disclose personal information for the purposes of investigating and processing his insurance claim and verifying information relating to the complainant’s claim in order to determine entitlement and assess payment.
The complainant also signed OCF-19, which included a consent provision allowing the treating physician to share the complainant’s personal information for the purpose of determining whether the threshold of a catastrophic impairment had been met.
Our Office did not receive any evidence to suggest that the doctor’s collection, use or disclosure of the complainant’s personal information served any other purposes than those stated in the OCF-1.
Our Office determined that in the circumstances the complainant had provided consent for the doctor to collect, use or disclose his personal information for the specific purposes described in the forms. Therefore, the doctor did not contravene the consent provisions of PIPEDA.
Accordingly, our Office concluded that this aspect of the complaint was not well-founded.
- Date modified: