Overview
- Commissioner Patricia Kosseim found Dr. Omar Afandi used his Windsor Regional Hospital EHR access to identify parents of newborn boys and solicit circumcisions at WE Kidz Pediatrics, a clinic he partly owns.
- Afandi was ordered to pay a $5,000 penalty under Ontario’s personal health information law, and WE Kidz was fined $7,500 for operating without a privacy management program.
- The investigation logged 146 searches that could have exposed information on up to 831 patients; Afandi says he texted 17 people, called up to 74, and performed one procedure as a result.
- Kosseim characterized the decision as a cautionary tale for health startups and emphasized deterring the use of patient data for financial gain.
- The hospital was not found in breach and had strong practices outlined, and it previously said it revoked Afandi’s privileges and notified the commissioner; WE Kidz says it is strengthening its privacy policies.