Rouge Valley Health System says over the past two years, two former employees at the hospital inappropriately accessed patient information for the purpose of selling Registered Education Savings Plan (RESP) investments.
The hospital confirmed that the former staff members used hospital computers to access the names, addresses and phone numbers of mothers who had been patients at Rouge Valley Centenary between 2009 and 2013, officials with the facility confirmed.
According to the hospital, the breaches were discovered on two separate occassions, once in October 2013 and again, in March 2014. The hospital confirms the employees no longer work at the facility and the hospital has “proactively” contacted and apologized to 8,300 mothers who may have been impacted by the breach.
“We don’t know how many of those records were contacted by the RESP salesperson,” RVHS spokesperson David Brazeau said.
“To be on the safe side, we contacted all of the people who may (be affected).”
The hospital says it is conducting an audit to determine whether other breaches have occurred and has contacted the Information and Privacy Commissioner and the Ontario Securities Commission.
"We want to see as much investigation and consequence on this as possible," Brazeau said.
The hospital said that after consulting with their lawyers, staff decided not to take their concerns to Toronto police.
Brazeau said the staff members were allegedly being paid by multiple private companies to hand over patient information.
Former patient Crystal Bark told CP24 Tuesday that she first received a call about RESPs shortly after she gave birth to her son 18 months ago.
"You have these follow up calls... I thought just maybe this is part of the way it works," she said.
Bark said she did receive a letter about the breach from the hospital after the first phone call but was not contacted after she received the second call a few months ago.
"I would like to know what is going on," she said.
"Obviously nothing is being done if she is just continuing to do this."
