A former clerk at a Toronto-area hospital is facing quasi-criminal charges from Ontario's financial markets regulator after allegedly taking lists of names from confidential maternity ward records and selling them to investment dealers peddling registered education savings plans.
The Ontario Securities Commission announced on Monday that it had charged Shaida Bandali of Pickering, Ont., east of Toronto, with unregistered trading, after an investigation by the OSC's Joint Serious Offences Team. The charge has not been proved in court, and Ms. Bandali is scheduled to make her first appearance at Old City Hall on Dec. 12.
The privacy breach at the Rouge Valley Centenary hospital in east Toronto saw an unknown number of new mothers mysteriously contacted by RESP salesmen after bringing their babies home. It also prompted an investigation by the province's privacy commissioner.
The OSC alleges that between January 2010 and March 2014, Ms. Bandali "engaged in the business of trading securities without being registered to do so" by "repeatedly breaching the confidentiality policies of her employer" and "distributing confidential data of maternity patients" to at least one representative of an RESP dealer.
The OSC alleges that Ms. Bandali secretly created "investor lists" and sold them to one or more RESP dealer representatives.
The regulator declined to comment further on the case, saying its investigation is continuing "on a priority basis."
Ms. Bandali could not be reached for comment.
The hospital sent out letters to thousands of former maternity ward patients last year, and again to another group earlier this year, apologizing for the breaches. The hospital said in a statement in August that two employees had engaged in the activity, and that the pair no longer worked at the hospital. The hospital said it did not know precisely how many records had been compromised, and that it was reviewing its procedures to better protect patient information.
The OSC can lay quasi-criminal charges under the Ontario Securities Act before a court, as opposed to the OSC's own tribunal. Doing so allows the regulator to seek jail terms of up to five years and fines of up to $5-million.
The OSC's Joint Serious Offences Team is a partnership between the OSC, the RCMP financial crime unit and the Ontario Provincial Police anti-rackets branch.
The hospital is also facing a proposed class-action lawsuit over the privacy breach, launched on behalf of former patients demanding more than $400-million in damages.