Six GTA hospitals compromised their patients’ personal health data by routinely handing it over to baby photographers who paid for access to maternity wards — breaches revealed by extra scrutiny following a major breach at Rouge Valley Health System.

As far back as 2009, Mount Sinai, North York General, St. Joseph’s Health Centre, Humber River, Toronto East General and Rouge Valley Health System hospitals inappropriately gave up the information of tens of thousands of new mothers.

In some cases, the records included the patients’ name, age, length of hospital stay, attending physician, type of diet, reason for admission to hospital, type of delivery and baby’s birth date.

“It wasn’t the proper process. We should have simply been providing the name and room number,” said Elizabeth McCarthy, a spokesperson for North York General.

McCarthy estimated more than 5,000 patients at North York General alone may have been affected between March 2013 and February 2014.

MORE AT THESTAR.COM:

• Feds divulge details of dozens of privacy breaches

The six hospitals independently reported the breaches to Ontario’s privacy watchdog in June and July after internal reviews triggered by news that two former employees at Rouge Valley had allegedly sold the personal information of 14,450 patients to private RESP companies.

RELATED:

• Rouge Valley faces $400M lawsuit over privacy breach

Unlike that incident, the privacy watchdog says the patient records given to the photographers were not turned over to any third party.

“We have found no evidence to suggest that this information ever left hospital property or was used by the photographer for any other purpose,” said Trell Huether, a spokesperson for the Office of the Information and Privacy Commissioner, in an email.

The privacy breaches all involve Just Arrived Baby Photography Inc., a company contracted by the hospitals to provide photography services to new mothers.

Todd Jaspar, the general manager of Just Arrived, described the breach as a “communication breakdown.”

“Our contract stated that we would be provided with a census list to visit the families. But I guess there wasn’t clarification as to what would be provided on that census list,” Jaspar said.

He would not say how much the photography company paid the hospitals through the contracts.

Up until February 2014, Just Arrived had a working relationship with Heritage Education Funds, a company which sells RESP investments, Jaspar said.

Patients who purchased photos from Just Arrived had an option on the photo consent form to request to be contacted about RESPs, Jaspar said.

Loading... Loading... Loading... Loading... Loading... Loading...

“Only then would only the name and number be passed on to Heritage,” he said.

Jason Maguire, the president of Heritage Education Funds, said the company did not redistribute the names and phone numbers to any other companies.

“We always have a consent option for any program we are in, where people have to actually consent by giving us the opportunity to contact them,” Maguire said.

The six hospitals informed patients of the breach by posting a statement on their websites for 30 days.

Just Arrived continues to provide photography services at Mount Sinai and Humber River’s Finch Ave. location, Jaspar said.

“Each hospital has either terminated the contract with this company or changed their policy to limit the information being given to the photographer,” Huether said in an email.

North York General no longer provides any list to photography companies, McCarthy said.

Sharon Navarro, a spokesperson for Toronto East General, said in an email that the privacy breach was a result of “an unauthorized process (that) developed” and it was not possible to determine how many patients were affected.

“Since we learned of this breach, we have changed our practice — the photographer is no longer provided any patient information,” said Sylvia Sharp, a spokesperson for Mount Sinai, in an email.

Spokespeople for St. Joseph’s Health Centre and Humber River declined to comment beyond the statements already posted online. A spokesperson for Rouge Valley did not respond to several requests for comment.