Barbara Hynes v. VALERIE DYKE, 2018 NLSC 164

court crest IN THE SUPREME COURT OF NEWFOUNDLAND AND LABRADOR GENERAL DIVISION Citation : Hynes v. Western Regional Health Authority , 2018 NLSC 164 Date : August 6, 2018 Docket : 201204G0180 Between: Barbara Hynes AND VALERIE DYKE Plaintiffs And: Western Regional Health Authority Defendant Before: Justice William H. Goodridge Place of Hearing: Corner Brook, Newfoundland and Labrador Dates of Hearing: June 26 and 27, 2018

Summary: Each party applied to qualify an expert to provide opinion evidence to assist the trier of fact. The Plaintiffs’ proposed expert was rejected because his opinion on computer related issues was not logically relevant to an issue at trial, and because he lacked expertise to offer opinions on software for management and auditing of electronic medical information. The Defendant’s expert was qualified to give expert evidence on the standards that existed in Canada at the relevant time for protecting privacy of electronic medical records, and for monitoring access to electronic medical records. Appearances:

Bob Buckingham and Andrew W. May Appearing on behalf of Barbara Hynes and Valerie Dyke Daniel M. Boone, Q.C. Appearing on behalf of Western Regional Health Authority Authorities Cited: CASES CONSIDERED: R v. Mohan, (SCC), [1994] 2 S.C.R. 9; White Burgess Langille Inman v. Abbott andHaliburton Co., 2015 SCC 23 , 2015 S.C.C. 23; R. v. Sekhon, 2014 SCC 15 , [2014] 1 S.C.R. 272. STATUTES CONSIDERED: Personal Health Information Act, S.N.L. 2008, c. P-7.01; Class Actions Act, S.N.L. 2001, c. C-18.

REASONS FOR JUDGMENT Goodridge, J.: INTRODUCTION [1] This is a pre-trial application to decide on the admissibility of opinion evidence for a pending trial. Each party is proposingan expert witness to provide the opinion evidence, and each is objecting to the opposing side’s expert. Copies of the experts’ reports havebeen exchanged. [2] The trial is to determine liability and damages arising from a privacy breach involving the Plaintiffs’ medical records. Thematter was certified as a class action on November 24, 2016.

The common issues identified in the Certification Order includedetermination of the standard of care owed by the Defendant to the Plaintiffs in protecting the privacy of electronic medical records. [3] During oral submissions on this application, counsel were invited to more clearly define the areas for which their proposedexperts were to be qualified. [4] The Plaintiffs’ counsel replied that determining the appropriate standard of care, and assessing whether the Defendant’sconduct fell below that standard, requires an understanding of computer systems.

In that regard Plaintiffs’ counsel asked that Thomas P.Keenan be accepted as a properly qualified expert in the areas of: • computer operating systems and servers; • computer programming language; • logic and operation of a database management system; • Meditech software for storage and retrieval of electronic health records; and • Iatric Systems Inc.

Security Audit Manager (SAM) software for protecting privacy of electronic health records. [5] The Defendant’s counsel replied that determining the appropriate standard of care, and assessing whether the Defendant’sconduct fell below that standard, will require evidence on health information systems, practices, and policies in use or available at therelevant time.

In that regard Defendant’s counsel asked that Don MacPherson be accepted as a properly qualified expert in the areas of: • health information systems used in Canada at the relevant time and available safeguards within those systems for the protection ofpatient privacy; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to use, storage, access and thedisclosure of electronic health information; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to policies and procedures withrespect to privacy; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to privacy breach response;

• standard practices among health authorities and hospitals in Canada at the relevant time in relation to training and education of stafffor policies and procedures with respect to privacy and confidentiality of heath information; and • standard practice among health authorities and hospitals in Canada at the relevant time in relation to privacy audits and themonitoring the use and access of health information. ISSUE [6] The issue is whether the proposed expert opinion evidence is admissible at trial. BACKGROUND [7] The Defendant stores patient information in an electronic record system known as Meditech.

An accounting clerk employedby the Defendant, with limited access to Meditech, reviewed personal information not needed for her job specific tasks. Accessing thatdatabase was a necessary part of her job and the type of information accessed was the same type that she was authorized to access.However, the information was accessed by the accounting clerk on several occasions for ‘snooping’ purposes and not for job specifictasks. LAW [8] Expert opinion evidence is admissible if it meets the four criteria set out at paragraph 17 of R v.

Mohan, (SCC), [1994] 2 S.C.R. 9: • logically relevant; • necessary to assist the trier of fact; • absence of any exclusionary rule; and • properly qualified expert (includes requirement that the expert be impartial, independent and unbiased). [9] In White Burgess Langille Inman v. Abbott and Haliburton Co., 2015 SCC 23 , 2015 S.C.C. 23, the Supreme Courtof Canada expanded on Mohan and suggested that the admission of expert opinion evidence requires a two-step approach. At step one,the court considers the four Mohan criteria as the threshold requirements for admissibility.

Evidence that does not meet the thresholdshould not be admitted. At step two, the court exercises a discretionary gatekeeping function, balancing the potential risks and benefits ofadmission to decide whether the benefits justify the risk. Relevance, reliability and necessity are measured against the counterweights ofconsumption of time, prejudice and confusion. ANALYSIS Thomas P. Keenan [10] Dr. Thomas P. Keenan, B.A. (mathematics), M.Sc. (mathematical methods), M.A. (adult education), Ed.D. (adult education) isan academic who has been associated with the University of Calgary for more than 40 years.

He started as a computer systemsprogrammer and moved through the university ranks occupying various positions, including Professor Environmental Design, ProfessorContinuing Education, Adjunct Professor Computer Science, Dean Continuing Education, and Director Environmental Design PhDprogram. He is a Fellow of the Canadian Information Processing Society, a body that recommends standards and best practices for ITprofessionals. In 2003, Dr. Keenan completed the necessary exams to qualify as a Certified Information Systems Security Professional.That designation has since expired. In the past, Dr.

Keenan has been qualified by other courts as an expert in computer forensics and theworkings of the internet. Dr. Keenan has written and delivered several peer reviewed papers, including papers dealing with privacyissues in the context of computers in general and social media in particular. In 2014, he wrote a book (not peer reviewed) “Technocreep:The Surrender of Privacy and the Capitalization of Intimacy”. [11] The Court agrees that Dr. Keenan would qualify as an expert in the areas of computer operating systems, servers, programminglanguage, and logic and operation of a database management system.

However, the Court finds that expert opinion evidence in thoseareas is not logically relevant to an issue at trial. The proposed evidence does not meet the threshold requirement of relevance. This is nota case about the computer operating systems. Opinion evidence in these areas will not assist the trier of fact in determining theappropriate standard of care, or assessing whether the Defendant’s conduct fell below that standard. [12] Regarding Meditech and SAM, the Court finds that Dr. Keenan has no special expertise in those products and is not qualified togive expert opinion evidence about Meditech or SAM.

It has not been established that he has acquired special or peculiar knowledgethrough study or experience in respect of these products. Dr. Keenan’s only knowledge of these products is based on literature he hasreviewed after being retained by the Plaintiffs. [13] I find that the facts in issue will not require technical expert evidence on computer operating systems, servers, programminglanguage, and database management.

In my view, detailed and technical opinion evidence about computer systems will complicate whatis a relatively simple issue, and will waste the court’s time. [14] The facts in issue may require evidence about health information management and about available monitoring or auditsoftware. Opinion evidence in those areas is related to a fact in issue, namely the factual determination of the appropriate standard ofcare. Plaintiffs’ counsel acknowledges that Dr. Keenan is not being offered to provide opinion evidence in areas of privacy protection

practices or the existing standards within hospitals or health care institutions. Evidence in those areas is outside Dr. Keenan’s expertise. Dr. Keenan acknowledges that he has no working experience with the monitoring or audit software used by hospitals; no working experience with the software programs for management, storage and retrieval of patient data used by hospitals; no working experience dealing with hospitals’ patient records; no working experience with SAM audit program; and only limited working experience with health information management. Don MacPherson [ 15 ] Don McPherson has a B.

Sc. in Health Information Sciences from University of Victoria and is currently a partner with Deloitte LLP. He has worked for the past 15 years in Deloitte’s Risk Advisory practice, focusing on clients in the health sector. Mr. McPherson is based in Alberta but serves clients across Canada. He has worked as the lead partner within Deloitte’s health risk practice in Canada. Mr. McPherson has a Master Certification with the Canadian Institute of Access and Privacy Professionals.

That is the highest-level certification within the Institute for professionals working in the field of access to information and privacy protection. Mr. MacPherson’s résumé sets out his work experience with health authorities and health departments in privacy assessments, data management, risk mitigation, accountability and tracking. His work experience in all of these areas is extensive, and includes significant work as lead consultant advising hospitals and health authorities on safeguards and checks for protecting patient privacy.

Examples of relevant work experience include: • Development of information governance model for British Columbia Ministry of Health for medical data organization and for establishment of controls to protect data privacy; • Development of a risk mitigation process, which included accountability and tracking of access to electronic medical records, for e- Health Ontario; • Development of program to monitor and audit access to electronic medical records for e-Health Ontario; • Development of privacy, security and information governance proposal for Canadian Health Infoway; • Assessment of privacy program, including control for patient privacy of electronic medical records, for the University Health Network (five larger hospitals operating in Toronto); • Assessment of privacy threats for Newfoundland and Labrador Center for Health Information (relating to its clinical safety reporting and the provincial pharmacy network); • Prepared a report, “Canadian Electronic Health Record Governance Models”, for the Ontario Ministry of Health (the report included a privacy requirements reference guide, and procedures for auditing access to electronic medical records); • Provided advice on information security, following a privacy breach, to Ontario Hospital for Sick Children; • Completed a privacy impact assessment, at request of Alberta Health Services, for the electronic medical record systems used in Calgary and Edmonton; • Assessment of data risk documents, against Canadian best practices, for e-Health Ontario; and • Conducted a medical data protection and controls review for Canadian Blood Services. [ 16 ] His academic background and his work experience have combined to give him a body of knowledge that qualifies him to offer expert opinion evidence in the areas referenced in paragraph 5 above. [ 17 ] The Plaintiffs, in both written and oral submissions, argued that Mr.

MacPherson’s report did not meet the Mohan criteria for admission of expert opinion. At paragraphs 70 to 72 of their written brief, the Plaintiffs state that Mr. MacPherson’s report is not logically relevant, not necessary to assist the trier of fact, and not the product of a properly qualified expert. [ 18 ] On the criterion of logical relevance, the Plaintiffs say at paragraph 88 that industry standards regarding privacy safeguards for electronic health records are irrelevant.

I agree that the appropriate standard of care will be determined by the Court alone; I do not agree that expert opinions on the existing industry standards are irrelevant. Information about the existing industry standards, such as privacy safeguards in use by other hospitals, or available in Canada at the time, is relevant in deciding on the appropriate standard of care. [ 19 ] On the criterion of necessity, I find that the matters for which Mr.

MacPherson is being qualified are all outside the experience and knowledge of ordinary people, and almost certainly outside the experience and knowledge of any trier of fact. The type of evidence being offered by Mr. MacPherson is a necessity in understanding the available options for protecting privacy of electronic medical records and in understanding options to monitor access.

This may not be highly technical or scientific type opinion evidence, but it is a subject matter for which ordinary people are unlikely to form a correct judgment, if unassisted by persons with special knowledge. [ 20 ] On the criterion of “properly qualified expert”, the Plaintiffs argue that Mr. MacPherson’s written report exposes a bias or lack of independence; that his academic background in weak; that his work related experience has been superficial (lead role but very limited). As an example of bias, the Plaintiffs claim that Mr.

MacPherson exaggerated the time required for implementation of the SAM audit software. In my view, that will be a matter for cross-examination and argument that may lower the weight placed on Mr. MacPherson’s opinion. It does not reveal any bias, and it does not affect admissibility. There are other valid points raised by the Plaintiffs in their written brief that may impact the weight placed on Mr. MacPherson’s opinion, however, none of the points cause the Court to doubt his impartiality or independence, or his overall expertise. Mr.

MacPherson has acquired the necessary knowledge, both from studies at the University of Victoria and subsequent work experience, in respect of the matters for which his opinions are being offered. I agree with the Plaintiffs that Mr. MacPherson has not acquired the necessary knowledge to interpret statutes or regulations. He is not being qualified in those areas and his opinions on those matters will be given no weight. However, the references made in Mr. MacPherson’s report to

various legislative obligations are more in the nature of observations, and not

interpretations of ambiguous language. To the extent thatany parts of Mr. MacPherson’s commentary on legislative obligations is interpretive, then (as suggested in R. v. Sekhon, 2014 SCC 15, [2014] 1 S.C.R. 272 at paragraph 48) those parts will be treated as inadmissible and not given any weight. DISPOSITION [21] I find that Dr. Keenan may not provide expert testimony in any of the five areas for which the Plaintiffs sought to have himqualified.

I find that opinion evidence on computer operating systems and servers, computer programming language, and thelogic/operation of a database management system are not logically relevant to an issue at trial. I find that Dr. Keenan is not qualified togive expert evidence in relation to Meditech software or SAM module. The written report from Dr. Keenan is therefore inadmissible. [22] I find that Mr.

MacPherson may provide expert testimony in the following areas: • health information systems used in Canada at the relevant time and available safeguards within those systems for the protection ofpatient privacy; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to use, storage, access and thedisclosure of electronic health information; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to policies and procedures withrespect to privacy; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to privacy breach response; • standard practices among health authorities and hospitals in Canada at the relevant time in relation to training and education of stafffor policies and procedures with respect to privacy and confidentiality of heath information; and • standard practice among health authorities and hospitals in Canada at the relevant time in relation to privacy audits and themonitoring the use and access of health information. [23] The written report from Mr.

MacPherson is admissible. COSTS [24] Consistent with section 37(1) of the Class Actions Act, S.N.L. 2001, c. C-18, there will be no award of costs. _____________________________ William H. Goodridge Justice