Rouge Valley Health Systems says the police have now been notified about two employees who allegedly sold patient information to multiple RESP investment companies.
David Brazeau, spokesperson for RVHS, said the hospital has asked police to review the information and determine if a crime was committed.
Both the Ontario Securities Commission and the Privacy Commissioner of Ontario have been informed of the privacy breaches, that are said to have occurred over the past two years.
Information and Privacy Commissioner of Ontario Ann Cavoukian said in a news release Wednesday that the incidents at the hospital have prompted a “major investigation.”
On Tuesday, RVHS said that as many as 8,300 mothers may have been impacted by the privacy breaches after two former employees accessed hospital computers to collect and sell patient contact information.
“So far we are satisfied that the hospital has responded to the breaches appropriately, for example, by terminating the staff involved,” Cavoukian said.
However, as we continue the investigation, we will be looking at the steps taken to ensure that this does not occur again in the future.”
Cavoukian said her office has received a number of calls from members of the public concerned that this may be occurring at other hospitals in the province.
“No others are under investigation as of yet, but we will be reaching out to the hospitals mentioned, as part of our investigation,” she said.
She said her office plans to meet with hospital staff next week.
