Rouge Valley Health System privacy breaches lead to 19 charges

A massive privacy breach at a Toronto hospital has led to 19 more charges, including six criminal counts against a nurse accused of selling the confidential records of new mothers as part of a scheme to peddle RESP investments.

Registered nurse Esther Cruz worked in the maternity department at Toronto's Rouge Valley Health System, which revealed last year that the private information of more than 8,000 patients at its Scarborough site was apparently stolen and sold to financial firms.

• Personal data of 8,300 new moms sold to financial firm

Authorities from the Ontario Securities Commission announced Tuesday that Cruz has been charged with six Criminal Code offences:

• 2 counts of accepting a secret commission.
• 2 counts of breach of trust by a public officer.
• 2 counts of theft under $5,000.

Criminal charges have also been laid against investment seller Nellie Acar, the OSC said, who allegedly purchased maternity patient labels from Cruz over a 2-year period. Acar faces two counts each of giving a secret commission, forgery, uttering a forged document and possession of property obtained by crime.

Acar is alleged to have used the confidential information on new mothers to try to sell them registered education savings plans, or RESPs, a form of tax-sheltered savings to pay for children's post-secondary education.

When the privacy breaches at the Rouge Valley Health System were first revealed, some new mothers who gave birth at the hospital told CBC News they had been getting phone calls from RESP sales firms. The salespeople often knew their newborn's first and last name and date of birth.

3 others charged

The OSC also laid what it termed "quasi-criminal" Securities Act charges against personnel from two other firms that sell RESP investments.

Former Knowledge First Financial Inc. branch manager Poly Edry has been charged with failing to act fairly, honestly and in good faith with clients, as well as participating in an unlawful referral arrangement.

Former C.S.T. Consultants Inc. assistant branch manager Subramaniam Sulur is charged with the same offences.

It is alleged they both bought confidential information on births from a former clerk at Rouge Valley Health System, Shaida Bandali, who was charged last November as part of the OSC investigation.

Edry's spouse, Gavriel Edry, has also been charged. He faces a Securities Act count of unregistered trading.

Hospital reprimanded

In all, the personal health information of nearly14,000 maternity patients at Rouge Valley Health System may have been stolen and sold, including the more than8,000 patients from its Scarborough site and a further 6,000 at its Ajax hospital.

Ontario's information and privacy commissioner reported in December that the hospitals had "failed to comply" with their legal obligations to protect personal health information.

The commissioner ordered Rouge Valley Health to restrict the kinds of searches staff can perform on its database of health records and,among other things,to immediately conduct privacy training for all clerks.