TORONTO – Two health workers who peered into late mayor Rob Ford’s (pictured) electronic health records without authorization have become the first in Ontario to be convicted under the province’s health privacy law.

The Toronto Star reported that Mohammad Rahman, of Toronto, and Debbie Davison, of Pickering, both pleaded guilty under the Personal Health Information Protection Act (PHIPA) to “willfully collecting, using or disclosing personal health information,” while working at the University Health Network (UHN) Princess Margaret Cancer Centre in January 2015.

Each was fined $2,505, according to court records.

Under the act, looking at even a single healthcare record of a patient not under one’s care is a crime.

Their convictions come as changes to Ontario’s health privacy act, passed in the legislature, make it easier to prosecute these types of cases and mandatory for hospitals to report privacy breaches to the information and privacy commissioner.

In January 2015, “a high profile” patient was scheduled to begin receiving radiation treatment at Princess Margaret, an agreed statement of facts for Davison obtained by the Star shows.

According to the document, the 57-year-old radiation therapist “was curious and wanted to make sure that the patient was cared for and everything was ‘okay,’” especially given the media storm the patient had provoked when visiting nearby Mount Sinai Hospital.

As a senior member of the unit, “she felt responsibility to ensure” the patient was being properly cared for. But she was not part of his “circle of care” when she looked at his electronic chart at two points on Jan. 5, 2015, for less than two minutes in total.

The Star was not able to obtain an agreed statement of facts providing similar details about Rahman’s case.

Rahman is named as a co-author on an article in the International Journal of Radiation Oncology, which states that he was affiliated with the radiation medicine program at UHN and holds a bachelor of science degree.

Ann Cavoukian, executive director of the Privacy and Big Data Institute at Ryerson University, called the two convictions “long overdue,” and said the ruling will act as a warning to other healthcare workers.

“They broke the law. If there aren’t consequences, then what’s to prevent others from doing it?” she said.

People may think looking at private records is “just snooping” and “no big deal,” said Cavoukian, Ontario’s former information and privacy commissioner. “But it is a big deal when it’s people’s sensitive health information.”

She said she hopes the high-profile nature of the case does not send a message that “we only explore these matters legally when it involves VIPs, or high-profile individuals. Everyone’s privacy matters.”