Rouge Valley Privacy Class Action
Status of Rouge Valley Class Action
A former nurse at Rouge Valley Health System, Esther Cruz, and a former RESP salesperson, Nellie Acar, have pleaded guilty and been sentenced for stealing and misusing patients’ private health information. Click here to view the Toronto Star article on the sentencing.
Certification materials for the proposed Rouge Valley class action are being prepared. No court dates are set as of yet.
Rouge Valley Health System Failed to Protect Patient Health Information Rouge Valley Health System Failed to Protect Patient Health Information TORONTO, Dec. 16, 2014 /CNW/ – A review by the Information and Privacy Commissioner of Ontario (IPC) of two significant privacy breaches involving the sale of new mothers’ personal health information for financial gain has determined that Rouge Valley Health System (hospital) failed to put in place reasonable technical and administrative safeguards to protect patient information. In an Order <http://bit.ly/1wauLng> issued today, Acting Commissioner Brian Beamish found the hospital was not in compliance with its obligations under the Personal Health Information Protection Act, 2004 (PHIPA) and ordered the hospital to implement changes to its electronic information systems, revise its privacy and audit policies, as well as deliver privacy training to all staff. Key Facts and Findings: * Both reported breaches involved allegations of clerical employees using and/or disclosing information about new mothers for financial gain, through the selling or marketing of Registered Education Saving Plans. * More than 14,000 patients were potentially affected. * Auditing access to personal health information is an essential technical safeguard for deterring and detecting unauthorized access to personal health information. There were shortcomings in the audit functionality of one of the hospital’s electronic information systems that were not fully addressed before the second breach was discovered. * The hospital’s privacy policies, training and awareness programs were insufficient. The IPC has ordered the Hospital to: * Implement measures to ensure the hospital is able to audit all instances where staff access personal health information. * Review and revise the hospital’s auditing policies to require random audits on all users’ activities on all of its electronic information systems. * Develop and implement new policies for privacy training, privacy awareness, and privacy breach management. * Immediately review and revise all privacy training tools and materials, and deliver training for all staff at the hospital. Given the increasing number of privacy breaches involving staff accessing personal health information of patients in an unauthorized manner, more needs to be done to address what appears to be a growing problem. To that end, the IPC has initiated discussions with the Ministry of Health and Long-Term Care and the Ministry of the Attorney General with a view to developing a procedure for commencing prosecutions in appropriate cases. Quote: “Over the last decade we have seen a growing number of privacy breaches involving unauthorized access to personal health information by staff within the health sector. Whether it is being done out of curiosity, or as in this case for financial gain, it is simply unacceptable. This Order should send a strong message to all health information custodians in Ontario, including hospitals, that they must implement reasonable measures and safeguards to eliminate or reduce the risks that may arise from unauthorized access. The strong message to staff is that there will be serious consequences arising from their actions.” ~ Brian Beamish, Acting Information and Privacy Commissioner of Ontario SOURCE Office of the Information and Privacy Commissioner/Ontario For further information: Media Contact: Trell Huether, Senior Communications Advisor, Desk: 416-326-3939, Toll-free: 800-387-0073, email@example.com This information is being distributed to you by CNW Group Ltd. 20 Bay Street, Suite 1500 Toronto ON M5J 2N8 www.newswire.ca<http://www.newswire.ca> Please do not reply to this email. This is an outgoing message only. If you wish to stop receiving these types of messages from us, you can unsubscribe <mailto:torfaxlist@newswire.
ca?subject=Pleaseunsubscribe me> at any time. Ces renseignements vous ont été distribués par le Groupe CNW Ltée. 20, rue Bay, Bureau 1500 Toronto, ON M5J 2N8 www.newswire.ca <http://www.newswire.ca/fr/> S’il vous plaît ne pas répondre à ce courriel. Il s’agit d’un message sortant seulement. Si vous ne souhaitez plus recevoir ce type de messages de notre part, vous pouvez vous désabonner <mailto:torfaxlist@newswire. ca?subject=Please unsubscribe me> à tout moment. © 2014 CNW Group Ltd, all rights reserved <http://www.newswire.ca/en/ policy/terms_of_use> © 2014 Groupe CNW Ltée, tous droits réservés <http://www.newswire.ca/fr/ policy/terms_of_use>
Description of Rouge Valley Class Action and How to Become Involved
The law firm of Spiteri and Ursulak LLP has commenced a proposed class action against Rouge Valley Health System and other defendants for breaches of patient privacy between 2009 and 2015. From approximately 2009 to 2015, three former employees at Rouge Valley Health System inappropriately accessed hospital computers to collect the personal information of more than 8,300 new mothers who had just given birth and their families.
The three former employees were either employed or paid by companies who sold registered education saving plan (RESP) investments to access hospital computers to steal the personal patient information. This confidential information was used by RESP salespeople to contact former patients in order to sell them RESP investments. If you or a family member were a patient at Rouge Valley Health System between 2009 and 2015 and were notified of a breach of privacy relating to your or your family’s personal information, you or your family may be entitled to compensation.
Please complete the Form below to indicate your interest in the proposed class action and to receive updates about the status of the class action, including any settlement.
The information provided will be used to notify you of important developments in the action when permitted or required to do so by the Court. You are not obligated to fill in this form. If you choose to do so, you are not retaining the law firms to act on your behalf. Your personal information will not be disclosed to a third party without your consent or unless it is required by law.
If you prefer, you may contact Michael Crystal or Norman Mizobuchi at 613-563-1010 or firstname.lastname@example.org or email@example.com.
Form to Express Interest in and Obtain Information regarding the Proposed Class Action against Rouge Valley Health System
Please be as detailed as possible in the ‘comments’ area. Please indicate whether you have received a letter from Rouge Valley Health System indicating that your information may have been wrongfully accessed and misused and include an account of any calls you may have received with regards to the sale of investments.
Michael Crystal‘s Cell: 613-794-1312
1010-141 Laurier Ave
Ottawa, ON K1P 5J3, Canada
Local Number: 613-563-1010
If you are unable to attend our office to discuss your case, an online conference via Skype might just be the solution. Skype enables you to connect directly to our office by placing a call, free of charge.
Contact Michael Crystal via Skype: