Privacy & Security
Two convicted of passing patient info for money
June 8, 2016
TORONTO – After pleading guilty to leaking the private information of patients at the Rouge Valley Health System and The Scarborough Hospital, a former maternity ward nurse and an RESP broker face three months of house arrest, two years’ probation and 340 hours of community service.
Esther Cruz, a former maternity ward nurse at Rouge Valley and Scarborough Hospitals, and Nellie Acar, a former broker with Global RESP Corporation, pleaded guilty to criminal charges stemming from a scheme to peddle Registered Education Savings Plans (RESPs) to new parents.
Michael Crystal, a lawyer representing victims in a $412-million class-action lawsuit over the breaches, called the sentences major. “We have this notion of invasion of privacy as a reason for a civil suit,” he said, but this sentence “changes the equation.”
“This is certainly an indication that what happened here was very, very grave and requires the most significant and substantial penalty that the criminal court can impose, and that is incarceration,” he told the Toronto Star.
Rouge Valley Health System contacted 14,450 mothers to inform them their records may have been stolen from its hospitals between 2009 and 2013. The sentences come two years after the breach was discovered.
Between January 2012 and April 2014, Acar paid Cruz to hand over patient information, exchanging less than $5,000 over that time, according to documents filed in court.
Cruz pleaded guilty to two counts of secret commissions, one for each hospital. She is also now facing a disciplinary hearing at the College of Nurses of Ontario for professional misconduct and failing to disclose the charges.
Acar pleaded guilty to one count of using a forged document and one count of secret commissions. Additional criminal charges were withdrawn.
In an emailed statement, a spokesperson for Rouge Valley Health System said it took immediate action upon hearing about the breach and Cruz is no longer employed there.
“The protection of personal health information continues to be a priority for our organization,” the statement read.
The Scarborough Hospital called the breach “most regrettable” and not indicative of the hospital’s commitment to patient privacy.
“The resolution of this case through the courts sends a strong message to all healthcare staff of their professional obligations,” a hospital spokesperson said in an emailed statement.
In total, the Ontario Securities Commission had laid 12 charges in connection with the schemes.
In November, former Rouge Valley hospital clerk Shaida Bandali was fined $36,000 and sentenced to two years’ probation and 300 hours of community service for her role.
After more than a decade, charges under the Personal Health Information Protection Act failed to result in any prosecutions.
On May 5, Ontario passed new health privacy legislation, which increases fines for violating PHIPA, eliminates the six-month time limit to start prosecution and makes it mandatory to report privacy breaches to the Information and Privacy Commissioner and regulatory colleges where relevant.
Two healthcare workers who snooped into late mayor Rob Ford’s electronic hospital records were the first to be convicted under PHIPA. The pair pleaded guilty and were each fined $2,505.