E. A hospital insurer was held to owe a duty to defend a hospital employee sued for the privacy tort of inclusion upon seclusion, as such was an "invasion or violation of privacy" or an "invasion or violation of a right of privacy, within the meaning of the policy and the employee qualified as an Additional Insured was "acting under the direction of" the Named Insured hospital and the claim was for "liability arising from the operations of the Named Insured".
Oliveira v. Aviva Canada Inc., 2017 ONSC 6161, per Koehnen, J. [4254]
I. FACTS AND ISSUES
Oliveira, a hospital employee, sought a declaration that the
hospital's insurers, Aviva Canada and Scottish & York owed
her a duty to defend an action brought against her and the hospital
by a former patient ("J.L.") based on the tort of
intrusion upon seclusion.
As this was an application to define the insurer's duty to
defend, all parties agreed that the only evidence relevant was the
Statement of Claim and the insurance policy.
J.L. was admitted to hospital and treated for postpartum psychosis.
After she returned home, the son of a neighbour began asking
"pointed questions" about her health. J.L. became
suspicious when she discovered that the neighbour was a relative of
the hospital employee Oliveira and she advised the hospital of her
concerns. After investigating, the hospital conceded to J.L. that
Oliveira had repeatedly accessed J.L.'s hospital records. At
the time, Oliveira was not involved in J.L.'s care. J.L.
alleged that this amounted to a breach of privacy (the tort of
intrusion upon seclusion), a breach of the hospital's privacy
policy, and a breach of the practice standards of the Ontario
College of Nurses.
The Court was asked to infer that the questions from the
neighbour's son arose from Oliveira's conduct, as opposed
to being the product of a nosy neighbour who simply asked how J.L.
was doing after noticing that she had been absent.
Oliveira sought a declaration that the hospital's insurers
Aviva Canada and Scottish & York owed her a duty of care with
respect to J.L.'s action.
The Aviva policy provided coverage for damages because of
"bodily injury or personal injury". The term "bodily
injury" was defined to include mental anguish, something that
J.L. was expressly claiming damages for. The term "personal
injury" was defined to include "invasion or violation of
privacy, invasion or violation of the right of privacy".
The policy defined coverage for employees of the hospital as
additional insureds:
10 The policy defines the insured as follows:
(ix) all employees of the Insured while acting under the
direction of the Named Insured;"
"The unqualified word Insured includes the Named Insured and
also includes the following additional Insured's but only in
respect of liability arising from the operations of the Named
Insured:
Aviva argued that it did not owe Oliveira a duty to defend
because she was not "acting under the direction of" the
hospital when she engaged in the conduct alleged against her
because the allegations did not "arise from the operations
of" the hospital.
II. HELD: For the insured; application granted; insurer declared to owe a duty to defend.
12 The legal principles applicable to the interpretation of the insurance policy are not in dispute. The Supreme Court of Canada has summarized them as follows:
16 As already noted, the policy specifically provides coverage for "invasion or violation of privacy" and for "invasion or violation of the right of privacy". Legal liability for invasion of privacy was examined by the Ontario Court of Appeal in Jones v. Tsige, 2012 ONCA 32 (Ont. C.A.). In doing so, the Court of Appeal quoted from a seminal article of William Prosser, "Privacy" (1960), 48 Cal. L.R. 383 in which Professor Prosser noted that the concept of legal liability for breach of privacy consisted of four separate torts: intrusion upon seclusion; public disclosure of embarrassing private facts about the plaintiff; publicity which places the plaintiff in a false light in the public eye; and appropriation of the plaintiff's name or likeness (Jones, at para. 18).
"One who intentionally intrudes, physically or otherwise, upon the seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the invasion would be highly offensive to a reasonable person." (emphasis added by the Court) 18 It is important to note in this regard that the tort of intrusion upon seclusion is founded on the act of obtaining information. It does not require that the information a defendant has obtained be disseminated in any way. 19 J.L. specifically claims damages for intrusion upon seclusion from Ms. Oliveira. That tort is part of the law of invasion of privacy which the policy specifically insures. As a result, the privacy coverage under the policy insures, to adopt the language the Second Restatement, "intentional conduct that is highly offensive to a reasonable person."
20 Aviva's argument limits employees acting
under the direction of the Hospital to those within the
patient's circle of care. This, in effect, nullifies coverage
for intrusion upon seclusion. It would rarely, if ever, be
"highly offensive" for a medical worker within a
patient's circle of care to access medical records. It is more
likely to be highly offensive for a Hospital employee outside of
the circle of care to access a patient's medical records. By
offering coverage for breach of privacy, Aviva was offering
coverage for intrusion upon seclusion and was, by definition,
offering coverage for highly offensive conduct. That must by
definition cover access to records by Hospital employees outside of
the circle of care.
41 The cases examining causation do not do so in the abstract. They do so to determine whether allegations in a statement of claim trigger a duty to defend under an insurance policy. In other words, the real question they ask is whether particular allegations fall within the ambit of the contract of insurance. This, in turn, is a question of contractual interpretation: Collier v. Insurance Corp. of British Columbia, [1995] B.C.J. No. 18 (B.C. C.A.) at para. 59; Cowichan Valley School District No. 79 v. Underwriters & Members of Lloyd's, London, 2003 BCSC 1303 (B.C. S.C. [In Chambers]) at para. 10. Put another way: are the allegations in the claim the sort of risks that the insurer agreed to insure (and defend) against. 42 Aviva's position might have more force if J.L.'s claim were not so clearly associated with the very activity that Aviva agreed to insure against. 43 As already noted, the policy provides coverage for invasion of privacy which includes intrusion upon seclusion. This, by definition involves accessing information in an offensive manner. For an employee within the circle of care to access health information is not an invasion of privacy and not offensive. The invasion of privacy occurs because the individual accessing the information is not authorized to do so. That is what Aviva agreed to insure against and that is what Aviva should be held to. 44 In a hospital setting, intrusion upon seclusion captures inappropriate access to medical records. Aviva seeks to use the very act they agreed to insure against, as an excuse to deny a duty to defend. To accept Aviva's argument would nullify a significant portion of the privacy coverage the policy purports to afford (at least insofar as the privacy coverage relates to intrusion upon seclusion). Courts should not interpret policies in a way that results in nullification of a significant portion of coverage: Consolidated Bathurst at para. 27. 45 The cases to which the parties have referred me are consistent with the principle that causation analysis for purposes of determining whether the insurer owes a duty to defend is an exercise of contractual interpretation aimed at determining whether the contract of insurance was intended to cover the conduct alleged. Some cases expressly articulate the issue in this way: Collier at para. 59; Cowichan Valley at para. 10. In others it is implicit in the analysis.
51 Aviva argues that the "operations" of a hospital constitute delivery of medical care which would exclude Ms. Oliveira because she was not delivering medical care to J.L. 52 In my view, neither the language of the policy nor case law supports such a narrow interpretation of the concept of operations. 53 With respect to the language of the policy, it should be noted that the privacy coverage under the policy is not limited to the provision of medical care. It refers only to operations which is a concept broader than medical care. In my view the operations of a hospital are not strictly limited to the provision of medical care. There are numerous ancillary activities that a hospital is required to carry out in order to provide medical care that are part of its operations. These would include the collection, creation and maintenance of medical records. 54 Here too we should remind ourselves that the "operations" language is contained in a portion of the policy that affords insurance coverage which should be read broadly. 55 The Personal Health Information Protection Act, 2004, S.O. 2004, c 3, Sch. A implicitly includes the collection and maintenance of medical records as part of the statutorily mandated operation of public hospitals in Ontario. Section 3(1) of that statute defines as a "health information custodian", a person:
Paragraph 3(1).4 expressly includes public hospitals within the definition of health information custodian. Implicit in this is a recognition that hospitals have custody of health records as part of their duties. The collection and maintenance of health care data therefore part of the falls within the operation of a hospital.
"In my view "operations" is a word of sufficiently broad meaning as to include the creation of a situation, or circumstance, that is connected in some way to the alleged liability. It does not necessarily imply an active role by the named insured in creation of the liability event. Operations can include the occupation and use of premises or other "passive" conduct that might not be included within the meaning of the word "activities" ..."
57 Given the policy's coverage for intrusion upon seclusion, which by definition includes unauthorized access to private information, the use of the broader term operations rather than medical care in the policy and judicial treatment of the terms operations, I conclude that the allegations against Ms. Oliveira do arise out of the operations of the Hospital and that Aviva is not relieved of its duty to defend based on the "arising from the operations" language of the policy. |
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.