Executive Summary: Key Legal and Evidentiary Issues

• Scope of the Information and Privacy Commissioner’s discretion to decline to undertake a review under PHIPA, particularly under s. 57(4) and s. 19(2).
• Reasonableness of the IPC analyst’s conclusion that a physician may add a progress note after a patient issues a lockbox directive, where recording of the encounter is a professional standard.
• Adequacy of reasons and whether the IPC was required to address every document, argument, and alleged inconsistency raised by the complainant.
• Evidentiary sufficiency of electronic medical record timestamps to support a finding that the progress note was created and signed on the stated date rather than back-dated.
• Characterization of alleged inaccuracies or falsifications in the progress note as issues of record accuracy subject to PHIPA’s correction mechanism, rather than a privacy breach.
• Alleged procedural unfairness, including whether the IPC needed to contact a police constable witness and whether the analyst improperly prejudged credibility before obtaining all information.

Facts and procedural background

The case arises from a dispute between the applicant, Rishi Talwar, and his former family physician, Dr. Tomas Fogl, over access to and use of Mr. Talwar’s personal health information. In December 2022, Mr. Talwar informed Dr. Fogl that he no longer wished to retain him as his doctor and at the same time issued what is commonly known as a “lockbox” directive. Through this directive, he instructed the physician not to collect, use, or disclose his personal health information any further. In subsequent telephone calls on January 18, 2023, he reiterated this lockbox instruction.
After these communications, Mr. Talwar pursued several regulatory and oversight avenues. He first filed a complaint with the Information and Privacy Commissioner of Ontario (IPC) relating to the lockbox directive. That complaint, however, was closed when he received confirmation from Dr. Fogl that the lockbox had been implemented and that his directive was being respected.
Separately, Mr. Talwar lodged a complaint with the College of Physicians and Surgeons of Ontario concerning Dr. Fogl’s conduct and later sought a review of the College’s committee decision before the Health Professions Appeal and Review Board (HPARB). When HPARB provided its record of investigation, Mr. Talwar discovered that a new entry had been added to his medical chart by Dr. Fogl on January 18, 2023, the same date as the lockbox-related phone calls.
The discovery of this note triggered a second complaint to the IPC. In this subsequent complaint, Mr. Talwar alleged that, despite his lockbox directive, Dr. Fogl had improperly accessed his health record and added new information to it. He further asserted that the date on the progress note had been falsified and that the substance of the note, including a reference to a conversation with an Ottawa Police Service officer, Constable Smith, was inaccurate and misleading.
On January 31, 2025, an IPC analyst issued a decision declining to take the complaint forward under the IPC’s complaint process. The analyst concluded that the creation of the progress note by the physician did not breach the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sch. A (PHIPA). She found no persuasive evidence that the note’s date had been falsified and indicated that, to the extent Mr. Talwar contested the accuracy of the content of the note, PHIPA set out a separate statutory mechanism for seeking corrections to health records. She further determined that Mr. Talwar’s allegations regarding the tone of the note and the conduct of the physician during the January 18, 2023 call were outside the proper scope of a privacy complaint.
Dissatisfied, Mr. Talwar brought an application for judicial review in the Ontario Superior Court of Justice, Divisional Court, challenging the IPC analyst’s decision. He argued that the decision was unreasonable and that he had been denied procedural fairness. He maintained that the IPC failed to engage with all the documentary material he had submitted and erred in not contacting Constable Smith, who he said could provide evidence contradicting the contents of the note.

Statutory and legal framework

The case turns on the application of PHIPA and the standard of review for administrative decisions. The Divisional Court confirmed that decisions of the IPC are generally reviewed on a standard of reasonableness, following the framework in Canada (Minister of Citizenship and Immigration) v. Vavilov, 2019 SCC 65, particularly where the decision involves the interpretation and application of the Commissioner’s home statute. The Court also addressed procedural fairness using the factors articulated by the Supreme Court of Canada in Baker v. Canada (Minister of Citizenship and Immigration), [1999] 1 S.C.R. 817.
PHIPA confers broad discretion on the IPC to decline to proceed with a complaint. The Court cited the Ontario Court of Appeal’s decision in Hopkins v. Kay, 2015 ONCA 112, where the appellate court described the Commissioner’s discretion as extensive and observed that challenging decisions not to review or proceed with individual complaints on judicial review would be “an expensive and uphill fight” for complainants. That guidance framed the context in which the Divisional Court evaluated the IPC analyst’s choice to end the complaint process at a preliminary stage.
A central statutory provision was PHIPA s. 19(2), which deals with the effect of “conditions” placed on consent to the collection, use, or disclosure of health information. While a patient may impose conditions through a lockbox or similar instruction, s. 19(2) explicitly limits the effectiveness of those conditions where they purport to prohibit or restrict a health information custodian from recording personal health information that is required by law, or by established professional or institutional standards. In other words, even when a patient directs that no further use or disclosure occur, the custodian is not barred from making entries in the record when professional practice requires documentation of patient encounters.
Also relevant was s. 55 of PHIPA, which sets out a statutory mechanism for individuals who believe their health records are inaccurate or incomplete. Under that section, a patient may ask the custodian to correct the record, and if the custodian refuses, the individual can then bring a complaint to the IPC. This correction regime provided the structural reason for the analyst’s conclusion that accuracy issues in the progress note properly fell outside the scope of the privacy complaint she was addressing.

Decision of the Information and Privacy Commissioner analyst

In refusing to proceed with the complaint, the IPC analyst relied on s. 19(2) of PHIPA and the role of professional standards in requiring physicians to document patient interactions. She reasoned that documenting all patient encounters is an established professional standard in medicine and therefore that creating a progress note dated January 18, 2023, reflecting contact with the patient, was permitted notwithstanding the lockbox directive. On that basis, she concluded that there was no unauthorized use of personal health information and therefore no breach of PHIPA arising from the creation of the note.
On the allegation that the note had been falsified or back-dated, the analyst relied on the electronic medical record system’s timestamps, which showed the date and time when the note had been signed. She observed that nothing in the record suggested unauthorized alterations or technical irregularities indicative of back-dating. In the absence of such evidence, and without needing expert testimony, she concluded it was open to her to accept the electronic timestamps as reliable indicators of when the note was created and finalized.
With respect to the alleged inaccuracies in the content of the note, including statements about a conversation with Constable Smith, the analyst considered that the dispute was, in substance, an accuracy-of-records issue, not a PHIPA privacy breach. She therefore pointed to the statutory correction process in s. 55 as the appropriate avenue for contesting the content of medical records. As Mr. Talwar had not pursued that route, she treated those aspects as beyond the scope of the complaint before her.
The analyst also limited her consideration of broader complaints about tone and professionalism during the January 18, 2023 telephone call. She determined that such concerns, which went to the doctor’s manner and comments rather than the handling of personal health information under PHIPA, were more appropriately addressed in other regulatory or professional forums, not in a PHIPA privacy investigation.

Grounds raised on judicial review

On judicial review, Mr. Talwar argued that the IPC decision was unreasonable for failing to grapple fully with all the documents and information he had supplied, including material from regulatory proceedings and alleged statements by a police officer. He asserted that the IPC should have contacted Constable Smith directly, because he believed the officer could clarify the timing and content of any interactions referenced in the progress note and thereby support his position that the note was inaccurate or falsified.
He also advanced a series of procedural fairness complaints. These included the claim that the IPC did not provide a fair opportunity to respond to the analyst’s concerns and that the analyst had prejudged credibility issues regarding Dr. Fogl before hearing all the evidence. In particular, he pointed to an email from the analyst to the physician’s counsel, in which she indicated that she did not “have a reason to disbelieve” the physician as to the timing of the note but was seeking more information. He characterized this as evidence of bias or a closed mind.
Mr. Talwar further argued that the IPC was obliged to provide more detailed reasons, addressing each of his arguments and evidentiary references one by one. In his view, the omission of specific mention of certain items meant that the IPC had not genuinely considered them. He also argued that the reliance on electronic timestamps without independent technical or expert verification was an evidentiary flaw that made the decision unreasonable.

The Divisional Court’s analysis on reasonableness

The Divisional Court first emphasized the broad statutory discretion given to the IPC to decline to review complaints and the deference owed to such decisions. Within that framework, the Court held that the analyst’s reliance on s. 19(2) of PHIPA and on medical professional standards was a logical and legally grounded basis for concluding that the creation of the progress note did not violate the statute. The Court accepted that documenting patient encounters constitutes an established standard of professional practice and that this brought the note squarely within the statutory exception that limits the effect of the lockbox directive.
Turning to the challenge that the IPC failed to consider all of the complainant’s documentation, the Court rejected the notion that administrative decision-makers must respond to every argument or line of evidence expressly in their reasons. It noted that the analyst had stated she had “thoroughly reviewed” all the submissions and that she explicitly referred to the very documents that Mr. Talwar considered most important, including statements attributed to Constable Smith and the College’s decision. The Court regarded these references, combined with the nature of the reasoning, as sufficient to demonstrate that the analyst had turned her mind to the central information, even if each piece was not discussed at length.
On the evidentiary issue of the note’s date, the Court accepted that it was open to the analyst to rely on the electronic medical record’s timestamps as evidence of the timing of the entry and signature. Given that there was no objective indication of tampering or irregularity in the system logs, and in light of the administrative nature of the proceeding, the Court concluded that the analyst did not act unreasonably in declining to infer back-dating or falsification. No expert evidence was required in the circumstances to support such a common-sense interpretation of the system-generated metadata.
The Court also upheld the analyst’s jurisdictional and scope decisions. It agreed that concerns about the accuracy of the progress note’s content were properly directed to the statutory correction process under s. 55 of PHIPA, a route which the applicant had not taken. Because PHIPA differentiates between privacy breaches and record-correction disputes, it was reasonable for the IPC to treat those issues as outside the mandate of the specific privacy complaint. Similarly, the Court endorsed the view that allegations about tone, manner, or general conduct during a telephone call were better addressed in other forums and did not need to be folded into a PHIPA privacy investigation.

The Divisional Court’s analysis on procedural fairness

On procedural fairness, the Court concluded there had been no breach. It observed that before issuing her final decision, the IPC analyst had sent Mr. Talwar a preliminary assessment letter dated December 6, 2024, setting out her initial view that the January 18, 2023 note was an authorized use of personal health information under PHIPA. She provided him an opportunity to make further submissions in response, which he did, including multiple follow-up emails. Only after receiving and considering these submissions did she issue the final decision declining to proceed with the complaint. In the Court’s view, this sequence afforded the applicant a meaningful opportunity to be heard.
Regarding the analyst’s failure to contact Constable Smith, the Court noted that the central thrust of the IPC decision was that no review would be undertaken at all because the physician’s access and note-making were justified under s. 19(2). Given that threshold decision not to commence a full review, the analyst was under no obligation to collect additional evidence or interview external witnesses. The Court held that expecting the IPC to investigate further would be inconsistent with the statutory discretion to screen out complaints at an early stage when the legal framework clearly justified the custodian’s conduct.
The Court also addressed the allegation that the analyst had prejudged credibility in favour of the physician. It examined the email where the analyst said she had no reason to disbelieve the doctor thus far but that she was seeking more information in light of Mr. Talwar’s position. The Court considered this email in context, noting that it was sent after the analyst had already received extensive submissions from the applicant, and interpreted it as evidence of an ongoing effort to verify information rather than a closed mind. Far from showing bias, the analyst’s further inquiries indicated that she remained open to being persuaded and was still testing the physician’s account.

Outcome and financial consequences

Having reviewed the decision through the lens of reasonableness and procedural fairness, the Divisional Court concluded that the IPC analyst had acted within her broad statutory discretion, had reasonably applied PHIPA—including the crucial s. 19(2) exception and the s. 55 correction process—and had afforded Mr. Talwar an adequate opportunity to participate in the process. The Court held that the analyst had properly treated the creation of the January 18, 2023 progress note as an authorized, professionally required recording of a patient encounter that was not invalidated by the lockbox directive, and that she had reasonably confined her mandate to genuine privacy issues rather than record-correction or professionalism concerns.
The application for judicial review was therefore dismissed. The respondents—the Information and Privacy Commissioner of Ontario and Dr. Tomas Fogl—were the successful parties. Neither respondent sought costs, and the Court made no order for costs or damages. As a result, the total monetary amount awarded in favour of the successful parties was zero, with no costs or other financial relief ordered.