As a file clerk from May 1995 to April 2014, Shaida Bandali had access to a confidential patient data base that included information on maternity patients, contact information details and health insurance numbers.Getty Images/iStockphoto
A former Toronto-area hospital employee who was accused of selling stolen confidential maternity ward records to investment brokers pleaded guilty Monday to unregistered trading.
Shaida Bandali, a former file clerk at the Rouge Valley Centenary Hospital was barely audible as she whispered her guilty plea in an Old City Hall courtroom before Justice Kathleen Caldwell in Toronto.
Ms. Bandali was the first person charged by the Ontario Securities Commission (OSC) last fall in a case that exposed a massive privacy breach at the hospital, which saw as many as 8,300 patients' confidential information sold to private companies selling registered education savings plans (RESP). The province's financial markets regulator laid charges against Ms. Bandali when new mothers were mysteriously contacted by RESP salespeople after bringing their new babies home.
As a file clerk from May, 1995, to April, 2014, Ms. Bandali had access to a confidential patient database that included information on maternity patients, contact information details and health insurance numbers.
Ms. Bandali said that between Jan. 1, 2010, and March 31, 2014, she repeatedly breached the confidential policies of her employer by accessing, copying and distributing personal data of maternity patients and selling it to RESP dealer representatives.
Ms. Bandali also said that she created investor lists from unauthorized access to the confidential information, and received money for that information without disclosing her conduct to her employer or the patients involved.
Ms. Bandali was caught when another employee found information stored in the memory of a photocopier and printed a hard copy.
The printouts contained newborn maternity patients names, phone numbers and health insurance numbers. The fact that the printouts were found in the cardiac unit was considered unusual since that unit dealt with adults and teens, not infants. The pages had Ms. Bandali's login information as well as the date and time she accessed the database, which she had no work-related reason to do.
After being discovered, Ms. Bandali admitted that she sold confidential information to Poly Edry, a former branch manager with Knowledge First Financial Inc. At the time, she said she was paid $1 per name and estimated that she made $3,000 over the course of four to five years for selling the lists. However, information obtained through search warrants, interviews with staff and statements from Ms. Edry contradict this. Evidence presented by the OSC suggests Ms. Bandali received around $12,600.
Ms. Edry said in her previous statements she paid between $2.50 and $2.75 per name. Ms. Edry is also facing charges under Ontario's Securities Act for purchasing the information, along with her spouse Gavriel Edry, whose bank accounts were used for direct deposits to Ms. Bandali. Neither of these allegations have been proven in court.
The OSC's lawyer, Cameron Watson, attempted to paint a picture in court of a woman who consciously knew what she was doing and "consistently attempted to minimize her actions and significantly understate the payments she received."
Mr. Watson said Ms. Edry's contact with Ms. Bandali ended in April 2014, when she received a text that read "I'm caught."
Phone records showed that on June 30, 2014, a nine-minute phone call from Ms. Bandali to Ms. Edry was made. It coincided with a Rouge Valley news release regarding privacy breaches.
As a result of Ms. Bandali's conduct, three other people have been charged with quasi-criminal charges, two for criminal charges. There has also been a $350-million class-action lawsuit filed against Ms. Bandali and others.
The OSC can lay quasi-criminal charges under the Securities Act before a court, as opposed to the OSC's own tribunal. This allows the regulator to seek jail terms of up to five years and fines of up to $5-million.
Ms. Bandali's next court appearance will be Oct. 13 for sentencing.