Eleven thousand notices before the records could move

The situation

A retiring practitioner sold a single-site clinic — family practice plus physiotherapy and dietetics under one roof — for $4,300,000. The buyer was an established multi-site operator with a competent integration function, and the transaction had run cleanly. The buyer's records diligence had been done properly under a s.42(1) agreement, and both sides thought the privacy work was finished.

It was not. Being permitted to look at records during diligence says nothing about being permitted to take them at closing.

The problem

The closing agenda had no line for patient notice. What it had was an integration plan owned by the buyer, with a records migration workstream scheduled to begin on the Monday after completion.

The relevant provision is PHIPA s.42(2): “A health information custodian may transfer records of personal health information about an individual to the custodian's successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records.”

Three things in that sentence rearranged the timetable. The permission belongs to the custodian, which is the vendor, so this is a vendor obligation and cannot be delegated into the buyer's plan by scheduling. The trigger is the transfer of the records, not the sale, so it attaches to a physical and digital event that had been treated as an IT task. And notice is required before the transfer, with the after-the-fact limb available only where prior notice is not reasonably possible — not as an equally good option chosen for convenience.

Notice to 11,200 people is not a fortnight's work, and it cannot start at completion.

The numbers

11,200 active patients. A mailed letter to each, at print and postage rates for a run of that size, came to about $19,400, plus posted notices in the clinic, a notice on the practice website and a message through the online booking system for patients who used it.

Six weeks of lead time. 340 letters came back undeliverable, which is the cohort the second limb of s.42(2) exists for. Twelve patients responded by directing that their records go to another practitioner instead. Those twelve were dealt with individually and their records never formed part of the transfer.

Against a $4,300,000 price, roughly $19,400 and six weeks. Against a closing date already fixed with a lender, six weeks was the expensive number, not the $19,400.

The rule that decided it

The difference between s.42(1) and s.42(2) is the whole file, and it is a difference of unit. Section 42(1) permits disclosure to a potential successor for the purpose of assessing and evaluating the operations, conditional on an agreement entered into first. Section 42(2) permits transfer of records to the successor, conditional on reasonable efforts to notify the individual. Different act, different condition, different timing, and satisfying the first does nothing for the second.

Section 42(3) provides a different destination again — transfer to the Archives of Ontario, or in prescribed circumstances to a prescribed person whose functions include the collection and preservation of records of historical or archival importance, subject to that person's agreement. That is an option for records with no successor, not a substitute for notifying patients whose records are going to a live practice.

What the subsection does not do is define reasonable efforts. There is no prescribed method, no prescribed number of attempts and no prescribed medium in s.42(2) itself. That is a genuine gap rather than an oversight in this write-up, and it is why the programme was built to be evidenced: what was sent, to whom, when, what came back, and what was done about the returns. The standard is not fixed by the statute, so the record of effort is the only thing a custodian can later point to.

One provision made the vendor's principal take it seriously personally. Section 72(3): “If a corporation commits an offence under this Act, every officer, member, employee or other agent of the corporation who authorized the offence, or who had the authority to prevent the offence from being committed but knowingly refrained from doing so, is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence, whether or not the corporation has been prosecuted or convicted.” The retiring practitioner was staying on for a twelve-month transition, which meant the person with authority to prevent the failure was also the person the buyer was about to employ.

The outcome

The notice programme became a vendor covenant with a dated obligation: begin the mailing not later than six weeks before the target completion date, maintain the posted and online notices throughout, and deliver an evidence pack at closing — the mailing list, the letter template, the mail house's despatch confirmation, the returns log and the individual dispositions.

A condition precedent required the programme to have run. A $75,000 holdback, released on delivery of the evidence pack and the completion of the follow-up on the 340 returns, sat behind it — see escrow account for the mechanics. Completion moved by four weeks rather than six, because the programme had started before the parties finished negotiating the covenant.

For the general problem of records changing hands on a practice sale, see what happens to patient records when a practice is sold.

What it would have cost otherwise

The vendor would have transferred 11,200 records without the statutory condition satisfied, which is a transfer the Act did not permit. The consequences run in two directions the parties had not separated: the vendor's own exposure under the Act, and the buyer's position as the new custodian of a file it now holds and cannot un-receive.

The buyer's cost is the one that gets overlooked. Its first substantive act as custodian would have been to work out what to do about a set of records it acquired through a defective transfer, on a patient base it had just paid $4,300,000 to acquire the goodwill of.

The tell

The tell was the closing agenda. If a clinic sale's agenda has no line item for patient notice, nobody has read s.42(2) — and the absence is easy to miss precisely because the s.42(1) work was done well, which creates the impression that the privacy workstream is closed.

The second tell is a records migration scheduled for the Monday after completion. Anything scheduled after completion has, by definition, not been made a condition of it.

Takeaways

• • PHIPA s.42(1) governs looking; s.42(2) governs moving. Different conditions, different timing, and clearing the first does not clear the second.
• • The s.42(2) duty is the vendor's, because the vendor is the custodian. It belongs in the covenant package, not in the buyer's integration plan.
• • Notice is required before the transfer; the after-the-fact limb applies only where prior notice is not reasonably possible. Build in the lead time.
• • Reasonable efforts is not defined in s.42(2). Build the programme so it can be evidenced — what was sent, to whom, when, and what happened to the returns.
• • Section 72(3) makes an officer who had authority to prevent an offence and knowingly refrained a party to it. On a transition deal, that person is usually about to be the buyer's employee.

Sources

• • Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A — s.42(1) (Disclosure to successor); s.42(2) (marginal note: Transfer to successor); s.42(3) (Transfer to archives); s.72(2) and s.72(3).
• • No statute or regulation defines “reasonable efforts” for the purposes of s.42(2), and none is cited here as doing so. The standard is not fixed by the subsection; the notice programme above was designed to be evidenced rather than to meet a prescribed threshold.
• • Treadstone Law — transferring employee HR records on a business sale in Ontario — the analogous records-transfer problem for employee files. It deals with employment records under general privacy law, not personal health information under PHIPA, and carries no notice obligation of the kind s.42(2) imposes.
• • Treadstone Law — customer contract consents on an Ontario asset purchase — consent and notice mechanics on an asset purchase generally. Adjacent: it is about contractual consent to assignment, not a statutory notice condition on the movement of records.