SCARBOROUGH, Ontario, Canada—As many as 8,300 new mothers who had delivered babies at Rouge Valley Health System may have had their personal information given to private companies wanting to sell them Registered Education Savings Plans (RESPs).
Ontario’s privacy commissioner is investigating the allegations after it was discovered that two Rouge Valley Centenary hospital employees inappropriately accessed the patient information for the purpose of selling the data to vendors, reports CP24.com. Both staff members used hospital computers to access the names, addresses and phone numbers of women who had given birth at the hospital between 2009 and 2013.
The vendors then called the former patients or their family members asking, “‘Do you have children? Do you want an RESP?'” the husband of a woman who gave birth to three children between 2010 and 2013 told TheStar.com. He says he continues to receive many calls from the telemarketers.
The breach was discovered twice: in October 2013 and March 2014. Both of the employees who provided the information to the companies are no longer employed by the hospital, and Rouge Valley contacted all of the individuals possibly affected. The hospital is also conducting an internal audit and is now tracking who has access to patient scheduling information.
Additionally, Canada’s Office of the Information and Privacy Commissioner and the Ontario Securities Commission are investigating the matter.
Photo via Wikimedia by Jason T. Poplin
