Two health workers who snooped into late mayor Rob Ford’s electronic health records have become the first in Ontario to be convicted under the province’s health privacy law, the Star has learned.

Mohammad Rahman, of Toronto, and Debbie Davison, of Pickering, both pleaded guilty under the Personal Health Information Protection Act (PHIPA) to “willfully collecting, using or disclosing personal health information,” while working at the University Health Network (UHN) Princess Margaret Cancer Centre in January 2015.

Each was fined $2,505, according to court records.

Multiple attempts by the Star to contact Davison, Rahman and their lawyers by phone, email and social media for comment were unsuccessful.

There is no evidence they used the information for anything or shared it with anyone. But under the act, looking at even a single health-care record of a patient not under one’s care is a crime.

Their convictions come as changes to Ontario’s health privacy act, passed in the legislature Thursday, make it easier to prosecute these types of cases and mandatory for hospitals to report privacy breaches to the information and privacy commissioner.

The new legislation comes on the heels of a series of Star investigations in 2015 that drew attention to a high number of unreported health privacy breaches and the absence of convictions under the act.

UHN spokesperson Gillian Howard said she could not discuss the individuals in question due to privacy concerns.

It’s not clear whether the two are still employed at Princess Margaret or faced internal discipline after the privacy breach, which took place as Ford was being treated for cancer.

In January 2015, “a high profile” patient was scheduled to begin receiving radiation treatment at Princess Margaret, an agreed statement of facts for Davison obtained by the Star shows.

According to the document, the 57-year-old radiation therapist “was curious and wanted to make sure that the patient was cared for and everything was ‘okay,’” especially given the media storm the patient had provoked when visiting nearby Mount Sinai Hospital.

As a senior member of the unit, “she felt responsibility to ensure” the patient was being properly cared for. But she was not part of his “circle of care” when she looked at his electronic chart at two points on Jan. 5, 2015, for less than two minutes in total.

The Star was not able to obtain an agreed statement of facts providing similar details about Rahman’s case.

Rahman is named as a co-author on an article in the International Journal of Radiation Oncology, which states that he was affiliated with the radiation medicine program at UHN and holds a bachelor of science degree.

Ann Cavoukian, executive director of the Privacy and Big Data Institute at Ryerson University, called the two convictions “long overdue,” and said the ruling will act as a warning to other health-care workers.

“They broke the law. If there aren’t consequences, then what’s to prevent others from doing it?” she said.

People may think looking at private records is “just snooping” and “no big deal,” said Cavoukian, Ontario’s former information and privacy commissioner.

“But it is a big deal when it’s people’s sensitive health information.”

She said she hopes the high-profile nature of the case does not send a message that “we only explore these matters legally when it involves VIPs, or high-profile individuals. Everyone’s privacy matters.”

The bill amending PHIPA, which passed Thursday, makes reporting breaches to the information commissioner and regulatory colleges mandatory, increases the range of fines and scraps the six-month time limit for beginning a prosecution.

Cavoukian applauds these changes and said the mandatory notifications will also be a deterrent to hospitals tempted to overlook breaches.

UHN spokesperson Gillian Howard said all employees sign a confidentiality letter when they join the organization and each year they get a refresher course on privacy.

Loading... Loading... Loading... Loading... Loading... Loading...

The hospital also does random audits of electronic health record access.

“We really raise the issue with the whole organization; it’s something that everybody needs to be reminded of,” said Howard.

A spokesperson for the Information and Privacy Commissioner, whose office was notified of the breach by UHN in February 2015, said the commissioner has referred a total of six people on five occasions to the Ministry of the Attorney General for prosecution under PHIPA.

Caroline Goodridge was also charged under PHIPA in relation to looking at Rob Ford's medical records, but the charges against her were withdrawn in February 2016, when the court was advised "that there was no longer a reasonable prospect of conviction," a spokesperson from the Ministry of Health and Long-Term care said in an email.

Other health-care workers whose professional regulatory body found they had committed professional misconduct by snooping into hundreds and even thousands of patient files have not been convicted under the act.

So far there have been four completed prosecutions under PHIPA, including the two that resulted in convictions and one that was withdrawn, according to an emailed statement by the Ministry of Health and Long Term Care.

The other was North Bay nurse Melissa McLellan, the first person ever charged under the act. Her charges were stayed by a judge in January 2015, effectively dismissing the case, but she was found to have committed professional misconduct by the College of Nurses of Ontario after snooping into nearly 6,000 patient files.

The College of Nurses of Ontario’s disciplinary panel also recently found registered nurse Mandy Edgerton had committed professional misconduct by looking at nearly 300 patient records at a Peterborough hospital over two years. Edgerton was not charged.

In an interview, Information and Privacy Commissioner Brian Beamish said snooping is a persistent issue, but changes to the act should be a “significant step” towards prosecuting the most serious cases.

“The electronic files can contain really sensitive information, and I know the people that have had this happen, many of them feel very violated by it,” he said, speaking generally.

“It’s not always just a stranger who’s looking in these files; it could be a neighbour, it could be an ex. It could be someone who knows who you are and is looking at your health records.”

With files from Olivia Carville

Clarification - May 10, 2016: This article was edited from a previous version to make clear that charges against Caroline Goodridge were withdrawn in February 2016.