New Brunswick’s Ombud has rejected Vitalité Health Network’s position that a medical-file audit trail falls outside the province’s health-information access law, recommending a fresh assessment of the request and disclosure of information to which the requester is entitled.
In Vitalité Health Network (Re), 2026 NBOMBUD 3, Report of Findings 25/26-H-028, issued June 30, 2026, the Office of the Ombud for New Brunswick found that the trail was personal health information. Ombud Marie-France Pelletier concluded that Vitalité should have considered the request under subsection 7(1) of the Personal Health Information Privacy and Access Act rather than rejecting it at that threshold.
The request sought a record of access to the requester’s medical file: when access occurred, the role or identifier of whoever or whatever accessed it, the system involved and, if available, the nature or reason for the access. Vitalité refused on the basis that the trail was not personal health information. Informal resolution efforts did not resolve the resulting complaint, which proceeded to formal investigation.
The complainant argued that the law required a proper response to a request for personal health information and a more nuanced approach to records containing potentially exempt material. The complainant also pointed to the value of audit information in tracing access and argued that protected elements could be removed rather than the entire request refused.
Vitalité characterized the trail as system-generated administrative metadata, not part of the clinical file and not a description of the patient’s health or care. It said the logs served internal security and compliance purposes. It also raised concerns about disclosure of staff access practices, systems, security protocols and third-party information.
The report separates the question of what kind of record this is from the question of how much of it must be disclosed. Subsection 7(1) gives individuals access to their personal health information held by a custodian, subject to statutory exceptions. Pelletier found that Vitalité was a custodian and that the trail met the Act’s definition of personal health information.
That definition includes identifying information relating to an individual’s health or health-care history, the provision of care, or the identity of a health-care provider. Identifying information includes information that identifies someone directly or could reasonably foreseeably identify them when combined with other information.
Drawing on Ontario access decisions as useful guidance rather than controlling authority, Pelletier adopted an approach that considers the record as a whole. An audit trail’s separate data fields must be examined together because, collectively, they reveal information about the individual and the use of the medical file. She also accepted a broad reading of the connection required between information and health or care.
Applied here, the trail was directly connected to the medical file and identified the requester, either directly or by cross-reference. It documented use of a file that existed because Vitalité had provided care. It could also identify the health-care providers associated with that care. Those connections brought the record within the statutory definition even though the trail did not itself describe a medical condition.
The classification does not settle every disclosure question. Vitalité had not assessed the merits of access under subsection 7(1), because it had rejected the premise that the trail was personal health information. Pelletier recommended that it now assess the scope of the request, identify any portions that required redaction under the Act, disclose the information to which the requester was entitled and explain any partial refusal.
Under section 74, Vitalité was required to give the complainant and the Ombud written notice of its decision on the recommendations within 15 business days of receiving the report. The report does not establish what response followed.
The legal distinction is between eligibility for consideration under the access regime and an unconditional entitlement to every field in a log. The Ombud’s recommendations address the former while leaving applicable disclosure exceptions to be assessed. The report makes no finding of improper access to the medical file.
