A Toronto hospital has contacted police after the patient records of more than 8,000 mothers were inappropriately accessed by two former employees.
A spokesperson at Rouge Valley Health System (RVHS) said police have been notified of the privacy breach, and that it is up to investigators to determine if a crime has been committed.
RVHS had originally said that only one former staff member had accessed the names, addresses and phone number of about 8,300 mothers who were patients at Rouge Valley Centenary, but in a statement emailed to CTV Toronto on Wednesday, the province's privacy commissioner said it now believes that two ex-staffers were responsible for the breach.
"We have launched a major investigation into the incidents involving two staff members at Rouge Valley Hospital," a statement from the Information and Privacy Commissioner of Ontario said.
The mothers were patients at the Toronto hospital between 2009 and 2013. The RVHS said their records were inappropriately accessed with the purpose of selling Registered Education Savings (RESP) investments.
Senior hospital staff will be meeting next week to discuss how the privacy breach could have occurred.
"As we continue the investigation, we will be looking at the steps taken to ensure that this does not occur again in the future," the statement said.
RVHS said the Rouge Valley Centenary has "proactively" contacted and apologized to the mothers.
