Rouge Valley Health System says more new moms may be affected by a major privacy breach that was first identified earlier this year.
RVHS spokesperson David Brazeau told CP24 in June that as many as 8,300 patients were affected by a privacy breach at its Scarborough location when two employees sold patient information to multiple Registered Education Savings Plan companies.
On Wednesday, Brazeau confirmed that the breach may extend to patients at its Ajax-Pickering site as well.
“Through our ongoing investigation we have determined that the information of some new mothers, who had a baby at our Ajax-Pickering site between July 9, 2009 and April 5, 2014, may have also been inappropriately accessed and possibly disclosed for the purpose of selling RESPs,” Brazeau told CP24 in an emailed statement.
The hospital previously told CP24 that the breaches at the Scarborough location were discovered on two separate occasions, once in October 2013 and again, in March 2014. The hospital said that the employees believed to be responsible for the breach no longer work at the facility and affected patients were contacted by the hospital.
Both the Ontario Securities Commission and the Privacy Commissioner of Ontario were notified of the incident.
The hospital has not released the number of women who may have been impacted by the breach at the Ajax-Pickering location but said that all affected patients have been notified with a letter.
One of the mothers who received a letter from RVHS told CP24 that the incident was very concerning.
"I’m just very nervous about the whole thing and a letter is not very comforting," Mandi Medland said.
It is unclear whether the breach at Ajax-Pickering involves the same two employees associated with the breach in Scarborough.
Calls made to RVHS on Wednesday have not yet been returned but in an emailed statement, Brazeau said the hospital would have no further comment on the issue.
In late June, a $412-million class action lawsuit was launched against RVHS on behalf of the affected patients in Scarborough.
Michael Crystal, one of the lawyers behind the lawsuit, previously told CP24 that the firm is seeking damages of approximately $49,000 per person.
