Amended Statement of Claim

SUPREME COURT OF PRINCE EDWARD ISLAND
(GENERAL SECTION)

BETWEEN:

GYORGY KISS

Plaintiff

and

 

HEALTH PEI and KEVIN J. ARSENAULT

Defendant

AMENDED STATEMENT OF CLAIM

TO THE DEFENDANT

A LEGAL PROCEEDING HAS BEEN COMMENCED AGAINST YOU by the plaintiff. The claim made against you is set out in the following pages.

IF YOU WISH TO DEFEND THIS PROCEEDING, you or a lawyer acting for you must prepare a  statement  of defence in  Form  I8A and  a  designation of address for service  (Form I6A. I), prescribed by the Rules of Civil Procedure, serve it on the plaintiff s lawyer or, where the plaintiff does not have a lawyer, serve it on the plaintiff, and file it, with proof of service, in this court office, WITHIN TWENTY DAYS after this notice of action is served on you, if you are in Prince Edward Island.

If you are served in another province or territory of Canada or in the United States of America, the period for serving and filing your statement of defence is forty days. If you are served outside Canada and the United States of America, this period is sixty days.

Instead of serving and filing a statement of defence, you may serve and file a notice of intent to defend in Form 18B prescribed by the Rules of Civil Procedure. This will entitle you to ten more days within which to serve and file your statement of defence.

IF YOU FAIL TO DEFEND THIS PROCEEDINGS, JUDGEMENT MAY BE GIVEN AGAINST YOU IN YOUR ABSENCE AND WITHOUT FURTHER NOTICE TO YOU.

 

AMENDED CLAIM

Overview

1. During a stay in hospital for COVID-19, the plaintiff’s privacy was breached when his personal health information, including his HIV status, was disclosed by Health PEI to a blogger, Kevin J. Arsenault, who then posted it publicly on social media. As a result of the widespread dissemination of this information in a small community, the plaintiff suffered social stigmatization and serious mental health injuries, including anxiety and depression.

The Claim

2. The plaintiff claims:
   1. as against Health PEI, the sum of $500,000 as damages for intrusion upon seclusion, public disclosure of private fact, breach of confidence, and negligence;
   2. special damages in an amount to be disclosed before trial;
   3. aggravated and exemplary damages in the amount of $500,000;
   4. punitive damages in the amount of $500,000;
   5. as against Kevin J. Arsenault, the sum of $50,000 as damages for public disclosure of private fact;
   6. a permanent injunction requiring Kevin J. Arsenault to remove the blog post from the public domain and not to report any of Kiss’s private health information;
   7. prejudgment interest in accordance with section 57 of the Judicature Act, RSPEI 1988, c. J-2.1 as amended;
   8. postjudgment interest in accordance with section 58 of the Judicature Act, RSPEI 1988, c. J-2.1 as amended;
   9. the costs of this proceeding, plus all applicable taxes; and
   10. such further and other relief as to this Court may seem just.
3. Gyorgy “George” Kiss is an individual now ordinarily resident in Toronto, Ontario. During the time that is relevant to the facts at issue in this claim, Kiss was a resident of Crapaud, Prince Edward Island.
4. Health PEI is a Crown corporation, established by the Health Services Act, RSPEI 1988, c. H-1.6, as amended. Health PEI is vicariously responsible at law for the acts and omissions of their employees, volunteers, and agents. Health PEI is a custodian of personal health information within the meaning of the Health Information Act, RSPEI 1988, c. H-1.41. In this statement of claim, the term “Health PEI” includes those individuals for which Health PEI is vicariously liable.

• 4A. Kevin J. Arsenault (“Arsenault”) is an individual ordinarily resident in Fort Augustus, Prince Edward Island.

5. In 2014, Kiss and his husband purchased a home in Crapaud, Prince Edward Island, a small community of between 300 and 400 people. They carried out extensive renovations to the home, converting it into their dream home. The home in Crapaud was the family’s primary residence.
6. Near the beginning of April 2021, Kiss began to feel unwell. He tested positive for COVID-19 and on April 9, 2021, Kiss was admitted to Queen Elizabeth Hospital in Charlottetown. Kiss was treated over the following weeks, spending several days in the intensive care unit. Kiss was the first person in PEI to be hospitalized for COVID-19.
7. On April 21, 2021, Kiss was advised that there had been a privacy breach and that Kiss’s medical history had been posted on Facebook by blogger Kevin J. Arsenault.
8. The nurse manager provided copies of the post. The post read,
   
   I was contacted late this afternoon by a person with information directly from a nurse caring for the person hospitalized with – allegedly – the virus causing COVID-19.

9. Attached to the post was a screen shot of a message that had purportedly been sent to Arsenault by his source. That message read:
   
   The covid case in the hospital is a gay male in his 40, has HIV and is thereby probably auto immune. He is doing well at this time and is on oxygen […] I know many nurses from the hospital and this came from a nurse that directly cares for him. I am not allowed to tell anyone,

10. On April 17, 2021, Arsenault revised his post, adding some content but removing the screen shot, purportedly because it “was not necessary and sharing the information in point form would be sufficient.”
11. The post clearly sets out that Kiss’s personal health information came from a nurse at the hospital who, in breach of their duty to keep the personal health information of patients confidential, disclosed the information directly to Arsenault or to some other unauthorized person who then passed it on to Arsenault. Upon receiving this private information about Kiss, without Kiss’ knowledge or consent, Arsenault posted the above statements on his Facebook page. At all times, Arsenault knew or ought to have known that the information he was posting was personal health information, that no consent had been provided to post it publicly, and that the publication of his sexual orientation and HIV status would be highly offensive to Kiss.
12. As Kiss was the only person at the time in PEI to be hospitalized with COVID-19, he could easily and conclusively be connected with the subject of this public social media post (both the original and the revised versions), making the information disclosed—including his HIV status—therein personally identifiable.
13. Health PEI discovered the breach of privacy on April 19, 2021. On April 21, a representative of Health PEI advised Kiss of the breach. On April 23, Kiss was released from hospital.
14. Health PEI conducted an investigation into the privacy breach. The main focus of the investigation was an audit of access to Kiss’s chart in the hospital’s electronic records system. The investigation concluded that the information in Arsenault’s social media post was personal health information and that Kiss was identifiable as the subject of the post. The investigation report states that the nature of Kiss’s underlying condition “may have associated sensitivity and an increased expectation of confidentiality.”
15. The Health PEI investigation further found that one hospital employee who had not provided care to Kiss had accessed his personal health information. The investigation failed to find any connection between this employee and Arsenault.
16. The PEI Information and Privacy Commissioner’s office also conducted an investigation. That investigation concluded that the information that was disclosed was personal health information and because of the circumstances, was personally identifiable information.

• 16A. Around the end of April into early May 2021, Kiss took steps to have the social media post removed. Kiss contacted Facebook directly but was informed it did not violate their policies. He also filed a police report and request to have the post removed. However, when contacted by the police, Arsenault not only refused to cooperate and remove the post, but he posted a new blog on his Facebook, including the transcript of the police call.
• 16B. To date, Arsenault’s post has not been removed. Although it is unknown exactly how many times the original post was viewed, it has received 74 comments, 83 reactions, and 37 shares on Facebook. Arsenault’s second post of his phone call with the police received 91 comments and 52 shares. Given Arsenault’s position as a controversial figure in the political and religious circles in PEI, it is reasonable to assume that his posts have received more attention and circulation than is recorded on Facebook.

Aftermath

17. In the weeks and months following his discharge from hospital, news about Kiss and his personal health information and HIV status spread throughout the Crapaud community and beyond. Kiss and his family became the subject of rumour and gossip and was unable to leave his house without members of the community staring at him and talking about him.
18. As a result of this social stigmatization of him and his family, Kiss began to suffer severe anxiety and depression to a degree that it was no longer feasible for him to leave the house. Kiss’s dream of living with his family in their dram house in Prince Edward Island was destroyed.
19. Ultimately, in the interests of ensuring Kiss’s mental health, he and his husband had no choice but to sell their dream home and move away from Prince Edward Island, depriving them of their family of their quality of life and dream of living in PEI. Because of the circumstances and the need to leave PEI quickly to avoid further damaging Kiss’s mental health, Kiss and his family were forced to sell the house at a discount.

Negligence

20. Health PEI’s actions and omissions fell below the standard of care required of a healthcare provider, employer, and custodian of personal health information. Among other breaches of the duties of care which they owed to Kiss, Health PEI:
    1. Failed to have adequate technological measures in place to ensure that patients’ personal health information was secure and only that information required for the care of the patient was available to those providing care;
    2. Failed to maintain the controls and safeguards on personal health information as required by the Health Information Act;
    3. Failed to adequately train its employees, volunteers, and others in privacy matters, including the necessity of keeping patients’ personal health information secure and confidential and not disclosing it to anyone not directly involved with patient care;
    4. Failed to adequately supervise its employees and their access to and use of patients’ personal health information;
    5. Failed to conduct a full and proper investigation into the breach of privacy at issue in this matter by (among other failures):
       1. Focusing the investigation primarily or solely on audit reports of electronic access to Kiss’s personal health information;
       2. Focusing on the one employee who accessed Kiss’s personal health information who was not directly involved in his care; and
       3. Failing to interview all employees who had access to Kiss’s personal health information to determine their actions and connections to Arsenault.
    6. Failed to take all reasonable measures to contain the privacy breach and to mitigate the damage done by the unauthorized disclosure of Kiss’s personal health information.
21. As a direct, foreseeable, and proximate result of the negligence of Health PEI, Kiss suffered damages.

Breach of Confidence

22. All of Kiss’s personal health information that was provided to Health PEI was delivered in confidence, particularly his HIV status. This information was provided to Health PEI in the expectation that it would be kept confidential by Health PEI, that it would not be disclosed to anyone other than those who required knowledge of the information to deliver care.
23. The unauthorized disclosure of that information—either to Arsenault directly or to some other unauthorized person who then disclosed it to Arsenault—was a flagrant breach of that confidence. The disclosure was a direct, foreseeable, and proximate cause of the damages suffered by Kiss.

Invasion of Privacy

24. Access to and use of personal health information in a hospital setting must be related to the delivery of health care services. Access to or use of the information for any other reason is unauthorized.
25. Whether an employee accesses a patient’s personal health information without authority or uses or discloses a patient’s personal health information other than in the delivery of patient care (for instance by telling a friend, family member, or social media blogger), the access, use, or disclosure is also unauthorized.
26. Whatever the circumstances, the unauthorized disclosure of Kiss’s personal health information to unauthorized persons (whether to Arsenault or someone else) was intentional and without lawful justification. In these circumstances, a reasonable person would regard this invasion of privacy as highly offensive causing distress, humiliation, or anguish.
27. Any disclosure of personal health information beyond those directly involved in patient care constitutes a public disclosure of that personal health information. In this case, the public disclosure of Kiss’s personal health information was accomplished both by Health PEI disclosing Kiss’s personal health information to Arsenault or to someone else who disclosed it to Arsenault.
28. At all times, Health PEI knew that the information being disclosed was personally identifiable and could be connected to Kiss due to the circumstances of the case.

• 28A. The subsequent publication by Arsenault of an aspect of Kiss’s private life attracted unwelcome attention and gossip around his sexual orientation and HIV status.
• 28B. The information was an aspect of Kiss’s private life, which Arsenault publicized without Kiss’s consent. Publication of Kiss’s sexual orientation and HIV status was of no legitimate concern to the public, and the publication of this private information would be highly offensive to a reasonable person.
• 28C. Arsenault’s publication of this private information was done with blatant disregard for Kiss’s dignity and privacy and for the potential and actual consequences and damages he experienced.

29. The matter publicized is of a kind that would be highly offensive to a reasonable person and is not of legitimate concern to the public. Although the fact of someone being hospitalized for COVID-19 may have been of concern to the public during the pandemic, Kiss’s sexual orientation and HIV status was not of any legitimate concern to the public.
30. As such, the actions of Health PEI constituted an intrusion upon seclusion and those a public disclosure of private fact.

• 30A. The actions of Arsenault constitute a public disclosure of private. The blog post continues to be available on Arsenault’s Facebook, and such, continues to cause damage to Kiss.

Damages

31. Kiss suffered injury and damages, including the infliction of mental and emotional distress, anxiety, and depression and other physical and psychological conditions as a direct result of the negligence and breach of privacy committed by Health PEI and Arsenault.
32. The actions and omissions of Health PEI caused Kiss to have to pay out-of-pocket expenses, including moving expenses and legal fees in respect of matters other than this proceeding. The House was sold at a discount because of the circumstances created by Health PEI’s actions and negligence.
33. The conduct of Health PEI and Arsenault was highly reprehensible and shocking such that an award of aggravated, exemplary, and punitive damages is appropriate in the circumstances.
34. Kiss pleads and relies on the provisions of the Contributory Negligence Act, RSPEI 1988, c.C-21, the Health Services Act, RSPEI 1988, and the Health Information Act, RSPEI 1988, c.P-5.2, among other statutes.
35. The plaintiff proposes that this action be tried at Charlottetown.

(date of issue)