Rouge Valley Privacy Class Action

Status of Rouge Valley Class Action

A former nurse at Rouge Valley Health System, Esther Cruz, and a former RESP salesperson, Nellie Acar, have pleaded guilty and been sentenced for stealing and misusing patients’ private health information.  Click here to view the Toronto Star article on the sentencing.

Certification materials for the proposed Rouge Valley class action are being prepared.  No court dates are set as of yet.

Press Release

Rouge Valley Health System Failed to Protect Patient Health Information Rouge Valley Health System Failed to Protect Patient Health Information TORONTO, Dec. 16, 2014 /CNW/ – A review by the Information and Privacy Commissioner of Ontario (IPC) of two significant privacy breaches involving the sale of new mothers’ personal health information for financial gain has determined that Rouge Valley Health System (hospital) failed to put in place reasonable technical and administrative safeguards to protect patient information. In an Order <> issued today, Acting Commissioner Brian Beamish found the hospital was not in compliance with its obligations under the Personal Health Information Protection Act, 2004 (PHIPA) and ordered the hospital to implement changes to its electronic information systems, revise its privacy and audit policies, as well as deliver privacy training to all staff. Key Facts and Findings: *   Both reported breaches involved allegations of clerical employees using and/or disclosing information about new mothers for financial gain, through the selling or marketing of Registered Education Saving Plans. *   More than 14,000 patients were potentially affected. *   Auditing access to personal health information is an essential technical safeguard for deterring and detecting unauthorized access to personal health information. There were shortcomings in the audit functionality of one of the hospital’s electronic information systems that were not fully addressed before the second breach was discovered. *   The hospital’s privacy policies, training and awareness programs were insufficient. The IPC has ordered the Hospital to: *   Implement measures to ensure the hospital is able to audit all instances where staff access personal health information. *   Review and revise the hospital’s auditing policies to require random audits on all users’ activities on all of its electronic information systems. *   Develop and implement new policies for privacy training, privacy awareness, and privacy breach management. *   Immediately review and revise all privacy training tools and materials, and deliver training for all staff at the hospital. Given the increasing number of privacy breaches involving staff accessing personal health information of patients in an unauthorized manner, more needs to be done to address what appears to be a growing problem. To that end, the IPC has initiated discussions with the Ministry of Health and Long-Term Care and the Ministry of the Attorney General with a view to developing a procedure for commencing prosecutions in appropriate cases. Quote: “Over the last decade we have seen a growing number of privacy breaches involving unauthorized access to personal health information by staff within the health sector. Whether it is being done out of curiosity, or as in this case for financial gain, it is simply unacceptable. This Order should send a strong message to all health information custodians in Ontario, including hospitals, that they must implement reasonable measures and safeguards to eliminate or reduce the risks that may arise from unauthorized access. The strong message to staff is that there will be serious consequences arising from their actions.” ~ Brian Beamish, Acting Information and Privacy Commissioner of Ontario SOURCE Office of the Information and Privacy Commissioner/Ontario For further information: Media Contact: Trell Huether, Senior Communications Advisor, Desk: 416-326-3939, Toll-free: This information is being distributed to you by CNW Group Ltd. 20 Bay Street, Suite 1500 Toronto ON M5J 2N8<> Please do not reply to this email. This is an outgoing message only. If you wish to stop receiving these types of messages from us, you can unsubscribe < me>  at any time. Ces renseignements vous ont été distribués par le Groupe CNW Ltée. 20, rue Bay, Bureau 1500 Toronto, ON M5J 2N8 <> S’il vous plaît ne pas répondre à ce courriel. Il s’agit d’un message sortant seulement. Si vous ne souhaitez plus recevoir ce type de messages de notre part, vous pouvez vous désabonner < unsubscribe me>  à tout moment. © 2014 CNW Group Ltd, all rights reserved <> © 2014 Groupe CNW Ltée, tous droits réservés <>


Description of Rouge Valley Class Action and How to Become Involved

The law firm of Spiteri and Ursulak LLP has commenced a proposed class action against Rouge Valley Health System and other defendants for breaches of patient privacy between 2009 and 2015. From approximately 2009 to 2015, three former employees at Rouge Valley Health System inappropriately accessed hospital computers to collect the personal information of more than 8,300 new mothers who had just given birth and their families.

The three former employees were either employed or paid by companies who sold registered education saving plan (RESP) investments to access hospital computers to steal the personal patient information. This confidential information was used by RESP salespeople to contact former patients in order to sell them RESP investments. If you or a family member were a patient at Rouge Valley Health System between 2009 and 2015 and were notified of a breach of privacy relating to your or your family’s personal information, you or your family  may be entitled to compensation.

Please complete the Form below to indicate your interest in the proposed class action and to receive updates about the status of the class action, including any settlement.

The information provided will be used to notify you of important developments in the action when permitted or required to do so by the Court. You are not obligated to fill in this form.  If you choose to do so, you are not retaining the law firms to act on your behalf. Your personal information will not be disclosed to a third party without your consent or unless it is required by law.

If you prefer, you may contact Michael Crystal or Norman Mizobuchi at 613-563-1010 or or


Form to Express Interest in and Obtain Information regarding the Proposed Class Action against Rouge Valley Health System

Please be as detailed as possible in the ‘comments’ area.  Please indicate whether you have received a letter from Rouge Valley Health System indicating that your information may have been wrongfully accessed and misused and include an account of any calls you may have received with regards to the sale of investments.

First name (required)

Last name (required)

Email (required)

Primary phone (required)

Secondary phone (include area code)



Postal Code



Accessing or using this website or the Information Form does not create a lawyer-client relationship. Providing the information requested or communicating with lawyers by e-mail, telephone, or otherwise does not make you a client of any of the law firms.  This website provides general information to potential class members on a proposed class action and should not be relied upon as legal advice in respect of your individual situation, nor use it as a substitute legal advice.  The law firms do not guarantee the security or confidentiality of any communications made by submitting information via the Information Form, e-mail, or otherwise through this website.