The confidential information of more than 8,000 mothers who were patients at a Toronto hospital may have been breached after a former staff member accessed their records.
A spokesperson at Rouge Valley Health System (RVHS) said the names, addresses and phone numbers of about 8,300 mothers who were patients at Rouge Valley Centenary between 2009 and 2013 were inappropriately accessed by a former employee using hospital computers.
The staff member -- who is no longer employed at the hospital -- accessed the patients' information with the purpose of selling Registered Education Savings (RESP) investments, RVHS said.
In a statement on the RVHS website, the hospital said it has "proactively" contacted and apologized to the mothers.
"We don’t know how many of those records were contacted by the RESP salesperson," RVHS spokesperson David Brazeau told CP24 on Tuesday.
"To be on the safe side, we contacted all of the people who may (be affected)."
The hospital has launched an audit to determine if there were other breaches, and has contacted the Information and Privacy Commissioner and the Ontario Securities Commission.
"The hospital regrets that this breach occurred and has used it to further tighter its information security controls," a statement on the RVHS website said.
As a result of the breach, Brazeau said that hospital employees don’t have as "broad" of access to patient information. He added that employee access to information will now be tracked.
With files from CP24
