A Toronto-area hospital said that the medical records of a second group of new mothers may have been inappropriately accessed in a major privacy breach first identified in the spring.

In May, Rouge Valley Health Services said that two former staff members had accessed names, addresses and phone numbers of approximately 8,300 mothers who were patients at Rouge Valley Centenary campus.

On Wednesday, Rouge Valley Health Services said they'd learned that information about new mothers treated at the Ajax-Pickering campus may also have been disclosed to an unidentified company, a spokesperson said Wednesday.

Mothers who had babies at Rouge Valley Centenary between July 9, 2009 and April 5, 2014 were alerted by mail that two employees inappropriately gained access to their medical files, and may have shared their information with a company that sells Registered Education Savings Plans (RESPs).

In a statement posted online on May 28, a Rouge Valley representative said that lists of information including patients' names, room numbers, doctors' names, the sex and names of the babies, length of stay and type of accommodation were inappropriately accessed. Health card numbers may also have been disclosed, though Rouge Valley said there is no evidence to suggest that they were.

A letter sent to one of the affected mothers said that the employees responsible for disclosing the information are no longer working for Rouge Valley. The employees' access to patient information has been terminated, and police have been contacted.

A month later, a proposed class-action lawsuit was filed against Rouge Valley in late June when information about the breach first surfaced, alleging the information was sold to an investment firm. The lawsuit is seeking damages of $300 million for the breaches between 2009 and 2013.

The lawsuit alleges that the employees who disclosed the information were paid in exchange for the information. The allegations have not been proven in court.

In addition to the potential sale of records, an online statement posted Aug. 8 by the hospital warned that a baby photography service operating in birthing centres at Rouge Valley Centenary and Rouge Valley Ajax and Pickering were given similar lists of patient information up until early July 2014. The lists were used to approach new mothers in the hospital to offer photography services, and were shredded by the photographers.

Upon investigation, Rouge Valley has learned that information about new mothers who had babies at Rouge Valley Ajax and Pickering between April 2014 and early July 2014 may have been compromised, Rouge Valley public affairs director David Brazeau said.

Patients with comments or concerns can contact the Rouge Valley Patient Relations office at patientrelations@rougevalley.ca or call 416-284-8131, ext. 4742.