Ontario’s privacy commissioner is calling for the two health professionals who allegedly snooped into former mayor Rob Ford (open Rob Ford's policard)’s medical records to face prosecution.

If the duo is convicted, this would mark the first successful prosecution under the province’s health privacy law, which came into force more than a decade ago.

The only other health privacy breach case to have reached the courts in Ontario’s history was effectively dismissed recently, after a judge ruled the delay getting to trial was unacceptable for the accused.

On Tuesday, the Office of the Information and Privacy Commissioner told the Star it had referred two individuals to Ontario’s Attorney General for prosecution for inappropriately accessing Ford’s medical file at the University Health Network (UHN) in January.

The Ministry of the Attorney General, the sole authority with the power to launch a prosecution under the Personal Health Information Protection Act (PHIPA), said the government would not comment “unless and until a charge has been laid.”

If the two snooping health professionals are found guilty, they could be fined up to $50,000 each.

Ann Cavoukian, who served as Ontario’s privacy commissioner for 17 years, said it was “a big day” for privacy in Ontario — a province that was once a leader in health privacy laws, but now appears to be trailing behind other jurisdictions in this area.

The commissioner’s request for action sends a clear message to all health care professionals that it is not acceptable to “rifle through someone’s medical file just because you’re curious,” she said.

Ford’s health records have been breached on four separate occasions in at least three Toronto hospitals since his shock cancer diagnosis last September.

Privacy commissioner Brian Beamish is not considering asking the Attorney General to prosecute any other individuals involved in the earlier breaches of Ford’s records, according to a spokesperson from his office.

“We reviewed all the information we were given and referred two individuals to the Attorney General. We cannot provide any further details,” the spokesperson said in a statement.

In the world of data, health records are considered to be “the most sensitive type of information out there,” said Cavoukian, now executive director of the Privacy and Big Data Institute at Ryerson University.

“The fact that this happened on more than one occasion to the former mayor means it absolutely should result in prosecution. I applaud the commissioner in bringing forward this recommendation for prosecution.”

A spokesperson for Ford said the ex-mayor — now a city councillor — was aware the commissioner was pushing forward with a prosecution over the latest breach of his records. He trusted the commissioner and the Attorney General would “deal with the matter appropriately,” the spokesperson said.

Cavoukian and privacy lawyer Michael Crystal both hope the Attorney General will answer the commissioner’s call.

Crystal, who has active privacy class actions against five major Ontario hospitals, said the referral for prosecution was “a significant milestone.”

“If there are more vigorous prosecutions it will act as a strong deterrent factor to other curious health professionals,” he said.

Loading... Loading... Loading... Loading... Loading... Loading...

Wilful, intentional and disturbing breaches of patient information have been noticeably increasing over the last few years, with privacy commissioners from across the country raising red flags and calling for legislation changes to tighten health privacy laws.

The only prosecution ever to be launched under health privacy laws in Ontario was in 2013. Nurse Melissa McLellan was charged with nine counts under PHIPA after she was fired from North Bay Regional Health Centre for snooping into more than 5,800 patient records. McLellan inappropriately opened up to 53 medical records a day while she was employed at the hospital.

The privacy commissioner’s office said a judge recently stayed the case against McLellan — effectively ending the matter — because the delay reaching trial was deemed unacceptable.

The Star has previously reported the zero successful prosecutions under Ontario’s health privacy legislation could be blamed on confusion over which government ministry is responsible for launching charges under the act, and because the Attorney General Madeleine Meilleur’s office does not believe the privacy commissioner’s recommendation to prosecute is enough to act upon alone.

The legislation has also recently come under fire for lagging behind other jurisdictions because it does not enforce mandatory reporting of breaches to the privacy office.

Health Minister Dr. Eric Hoskins refused to answer questions about whether he would call for a review of the health privacy act on Tuesday.

The ministry is working closely with the privacy commissioner to identify opportunities to improve and strengthen legislation to better protect the privacy of Ontario patients, he said in a written statement.

A bill Hoskins plans to reintroduce this year, called the Electronic Personal Health Information Act, would include amendments to PHIPA, such as doubling the fine for individuals and corporations found guilty of health-related privacy breaches, he said.

The minister would not comment on the possible prosecution of the individuals involved in the Ford privacy breach. UHN also refused to comment.

“Our understanding is that the matter is with the Attorney General now, which makes it a formal legal proceeding and we do not comment on matters before the court,” UHN spokesperson Gillian Howard said.