He accessed records of newborns, called mothers to offer circumcision services, says report
An Ontario paediatrician has been fined and ordered to destroy patient records which he improperly accessed at a hospital, according to a report.
Dr. Omar Afandi accessed records of newborn boys through a hospital system shared by several southwestern Ontario hospitals, an investigation by the Information and Privacy Commissioner (IPC) of Ontario determined, CBC reported.
Afandi then contacted parents to offer circumcision procedures at WE-Kidz Pediatrics, a clinic he partially owns.
The privacy breach was discovered in April 2024, when a new mother at Chatham-Kent Health Alliance’s Women & Children’s program reported receiving a call from WE-Kidz Pediatrics offering circumcision for her newborn son, just one day after giving birth, according to the CBC report.
The hospital said it does not share patient information with outside clinics without consent. Additional complaints led to an internal investigation, which identified Afandi as the source of the unauthorised access.
Search of hospital records
Meanwhile, Afandi admitted to searching hospital records for newborn boys’ dates of birth and sex, and contacting parents directly. He estimated that he may have contacted up to 91 families, though some were already his patients.
On behalf of Dr. Afandi, public relations firm SWON Public Affairs said that he did not intend to breach patient privacy.
"While his intent was never to compromise the privacy or trust of his patients, he accepts that he should have sought clarification from hospital administration, legal advisors, or the ethics committee before proceeding in the manner that he did. He deeply regrets this oversight and the concern it has caused," said the PR firm, according to CBC.
Previously, the Northwest Territories Health and Social Services Authority (NTHSSA) fired one worker for improperly accessing a patient’s medical record.
Violating privacy of health records
The IPC fined Afandi $5,000 and WE-Kidz Pediatrics $7,500 for violating the Personal Health Information Protection Act (PHIPA). Both Afandi and the clinic were ordered to destroy all personal health information obtained for this purpose.
The IPC commissioner made several recommendations to Windsor Regional Hospital, including:
-
Keeping a record of annual training requirements, including when staff completed the training.
-
Showing that staff do renew their confidentiality commitments on a regular basis.
-
Updating its bylaws to explicitly state that staff must abide by the hospital's privacy policy.
The commissioner also recommended WE Kidz to strengthen its privacy policies and have staff "undergo further privacy training."
Previously, The Hamilton Health Sciences (HHS) in Ontario has fired eight employees for their role in a privacy breach at the city’s health care system. The workers inappropriately accessed the personal health information of roughly 4,000 patients, according to HHS.
