Privacy-breach lawsuit could have sweeping implications

The legal community is carefully watching to see the outcome of a privacy-breach lawsuit in Peterborough that could have widespread implications for all Ontario hospitals, Toronto health lawyer Elyse Sunshine tells the Toronto Star.

The class-action suit against Peterborough Regional Health Centre is expected to determine whether a patient can sue a hospital for invasion of privacy, reports the newspaper.

The Peterborough case, Hopkins v. Kay (2014 ONSC 321 CanLII) deals with the issue of whether patients whose privacy has been breached can sue the hospital directly. The hospital has admitted the medical records were improperly accessed, apologized to the affected patients and fired the seven employees allegedly responsible, says The Star.

"In its amended notice of appeal, the hospital argues the Superior Court has no jurisdiction to hear the lawsuit because under the province’s Personal Health Information Protection Act (PHIPA), personal health information privacy violations are solely the domain of the Ontario privacy commissioner," says the newspaper.

The case comes just two years after the ability to sue someone for breach of privacy was established in Ontario.

In Jones v. Tsige>2012 ONCA 32 CanLII), a landmark case, an employee at the Bank of Montreal sued a co-worker — her ex-husband’s new wife — for invading her privacy by repeatedly accessing her personal bank account information, reports the newspaper. The Court of Appeal ruled the plaintiff’s privacy had been breached and awarded $10,000 in damages, says The Star.

Sunshine, partner at Rosen Sunshine LLP, says in the article that the question in Hopkins is whether the precedent in Jones, which created the new common-law tort of “intrusion upon seclusion," applies even though PHIPA provides a remedy to privacy breaches.

“I think that’s why everybody is watching this so closely. If this case turns out like Jones, then it opens the door for claimants to bring privacy-breach claims,” she says in the article.

One of the key differences between the two is how damages are defined, says the newspaper.

"PHIPA requires evidence of 'actual harm' and limits damages to $10,000 for mental anguish. It does not allow for punitive or aggravated damages," says The Star.

Under common law, the plaintiffs likely would not have to prove any tangible or economic harm, Sunshine says in the newspaper.

The issue is of particular interest to hundreds of patients who are looking for answers after a slew of piracy breaches at hospitals in the Toronto area in recent months.

A separate lawsuit has also been launched on behalf of 14,450 patients of Rouge Valley Health System. In that case, two staffers allegedly sold patient information to private companies. It remains on hold until a Court of Appeal ruling on whether the Peterborough case can go ahead, reports The Star.

To Read More Elyse Sunshine Posts Click Here