Canadian Lawyer

w w w . C A N A D I A N L a w y e r m a g . c o m F E B R U A R Y 2 0 1 6 39 n late November 2015, Rouge Valley Hospital clerk Shaida Bandali was sentenced to two years probation and fined $36,000 for selling patient record information from the Toronto- area hospital. The 62-year-old woman was a bit player in a scheme that involved the selling of thousands of maternity patient records to Regis- tered Education Savings Plan com- panies. The Ontario Securities Com- mission prosecutor had sought a 90-day jail sentence, while Bandali's lawyer had asked for a $20,000 fine. The judge felt jail was too harsh for someone with no prior record, but the suggested fine wasn't tough enough. In total, with a 25-per-cent surcharge, Bandali will end up having to pay $45,000. She earned about $12,000 selling the records over the course of four years. Take a step back for a look at the broad- er picture and the numbers get bigger — a $412-million class action was launched against Rouge Valley Hospital by plaintiffs whose private information was accessed and distributed. It's just one of several cases moving through the legal system involving the invasion of private patient data. It's all happening at the same time various privacy commissions across the country are reassessing how breaches of personal health information are dealt with under the law and how to send the message it is a serious issue that can be pursued and prosecuted from many angles. "This is a widespread issue and we have had lawsuits commenced in almost every jurisdiction," says Kathryn Frelick, co-chairwoman of Miller Thomson LLP's national health industry group. "We are dealing particularly with personal health information breaches, with the provin- cial privacy commissioners coming down hard on health organizations about their practices." But Frelick says the real litmus test will be when these cases go through the courts as to whether or not defendants can use due diligence as a defence and whether or not damages or other findings will be made. "The system is moving to accountability and there is a recognition that violations of privacy in the personal health information sphere are substan- tial," says Michael Crystal, a partner with Spiteri & Ursulak LLP in Ottawa. Crystal is representing plaintiffs in the Rouge Valley class action case. "Even the deci- sion to place Bandali on probation for two years and give her the $36,000 fine — that's substantial." The fine in the Rouge Valley case "underscores the seriousness" of the issue, says Brian Beamish, commissioner of the Information and Privacy Commissioner's L E G A L R E P O RT \ I T / P R I VA C Y L AW MAT DALEY A new prescription for health-care privacy As cases spread through the courts like a virus, health-care organizations are seeing real potential for increased class actions. By Jennifer Brown I

• Cover