Humber River Hospital Data Breach (2010)

Humber River Hospital and North York General Hospital were required by the provincial privacy commissioner to post notices on their websites advising maternity patients that their personal information may have been provided to baby photographers. They were two of six Toronto hospitals involved in the privacy breach. The others were Rough Valley Health System, Mount Sinai Hospital, St. Joseph s Health Centre and Toronto East General Hospital. For some time, the hospitals Mother & Baby unit offered baby photography services through Just Arrived Baby Photography (the photographer), a notice posted on Humber River s website said. We have recently learned that, between January 2010 to June 2013 at the Church Street Site, and January 2010 to June 2014 at the Finch Avenue Site, instead of simply receiving the name and room number of new mothers to determine whether new mothers would like to receive the photography services offered, the photographer was provided with a list daily which contained patient name, room number, age, chart number, physician name and type of obstetrical service. North York General posted a similar message on its website, saying it also offered photography services through Just Arrived Baby Photography, We have recently learned that, between March 2013 and February 2014, instead of simply receiving the name and room number of new mothers to determine whether new mothers would like to receive the photography services offered, the photographer was provided with a list daily which contained patient name, room number, age, gender, physician name, service (obstetrics) and length of stay, the notice said. The lists were only used to approach new mothers in the hospital to offer photography services, both hospitals said was not used for any other purpose and it was not provided to any third party. At the end of the day, the list was returned to the nursing station for shredding,they both said on their websites. The hospital takes privacy protection very seriously and sincerely regrets this breach of privacy. We are conducting a review of our practices to ensure that privacy is protected.