Hospital Privacy Breach Results In OSC Laying Charges

The Ontario Securities Commission ("OSC") has announced a series of criminal and quasi-criminal charges following an investigation related to the misuse of confidential patient information from the Rouge Valley Health System and the Scarborough Hospital. The OSC charges stem from allegations that a RESP sales representative purchased stolen maternity patient labels from a hospital nurse over a two-and-a-half-year period. The health information of approximately 14,000 new mothers was allegedly compromised.

This comes 6 months after a separate review by the Information and Privacy Commissioner of Ontario ("IPC") which determined that Rouge Valley Health System failed to put in place "reasonable technical and administrative safeguards to protect patient information." In an Order issued  in December 2014, the IPC found the hospital was not in compliance with its obligations under the Personal Health Information Protection Act, 2004 ("PHIPA") and ordered the hospital to