Ontario’s information and privacy commissioner has ordered a Windsor doctor and his private clinic to pay thousands of dollars in fines for privacy breaches in a case she calls a “cautionary tale” for other health startups.
Commissioner Patricia Kosseim wrote in a recent decision that a doctor with privileges at Windsor Regional Hospital used his electronic health record access there to look for parents of newborn boys and contact them to offer circumcisions at a clinic he partly owns.
Kosseim writes that Dr. Omar Afandi has acknowledged his wrongdoing and is remorseful, but his breach was serious and he should pay a $5,000 penalty under Ontario’s personal health information law.
As well, she found that the WE Kidz Pediatrics clinic was operating without any privacy management program and should pay $7,500.
WE Kidz says in a statement that it is strengthening its internal privacy policies and ensuring they are fully aligned with all current regulations.
Kosseim says these are the first administrative monetary penalties issued by a privacy commissioner in Canada, and were done under new powers her office was granted last year.
This report by The Canadian Press was first published Sept. 3, 2025.
