A Canadian hospital record clerk who sold confidential maternity records to salespeople peddling "registered education savings plans" (RESP) has dodged jail, but has been hit with a hefty C$36,000 ($27,000) fine and two years of probation.

The clerk, Shaida Bandali, had already pleaded guilty earlier this year to selling securities without a license. She sold at least 14,450 records of mothers for between C$1 (.75) and C$2.50 ($1.87) a pop, over the course of her employment at Rouge Valley hospital from 1995 to 2014, according to news reports and an Ontario Securities Commission press release.

“Ms. Bandali essentially trafficked in the identities of these patients for one reason and one reason only: for her own selfish, financial gain,” OSC prosecutor Cameron Watson told the court in October, according to the Toronto Star. “She didn’t make hundreds of thousands of dollars, but she made just shy of C$15,000 ($11,230) and she did that on the back of patients and hospitals.”

The charge is not criminal, but she could have spent five years in the slammer and caught a fine of up to C$5 (374.3) million for unregistered trading — a breach of the Securities Act.

The Ontario Securities Commission argued that she should get a 90-day jail sentence. Her lawyer argued for just a C$20,000 ($15,000) fine.

“She can never undo the fact that these people were phoned and bothered, but she can give back to society,” Sheard told the judge, according to The Star. “Ms. Bandali is contrite and sincere and has taken responsibility for her actions.”

In her ruling, Ontario Court Justice Kathleen Caldwell stated, “I find jail too harsh, but a C$20,000 ($15,000) fine too lenient.”

The only reason Bandali could be prosecuted was because patient names were used by financial companies as “customer lists” to market RESPs. The Securities Act defines any act “in furtherance of a trade” as a trade, so the clerk could be accused of selling securities without a license.

This is not the end of the security breach issue faced by Rouge Valley, according to The Star. The institution is now dealing with a C$412 ($308.4) million class action suit by thousands of the patients whose records were purloined.

The paper stated that in the claim, defendants are liable for “damages for breach of contract, breach of warranty, breach of confidence, intrusion upon seclusion, negligence, and conspiracy,” to the tune of $332 (248.5) million. On top of that there are $80 (59.9) million in punitive damages, as well as any expenses former patients may face in order to deal with identity theft, mental distress, frustration and anxiety.

“You’re vulnerable,” plaintiff Meagan Ware, who gave birth at the hospital in 2010, told the paper. And that's a "vulnerability that you feel when you don’t really know where your information — my information, as well as my child’s information — has ended up,” she said.

Health IT Homepage