A Windsor doctor is being fined after a privacy investigation confirmed that he had inappropriately accessed patient health information to offer circumcisions at his private clinic. 

An investigation by Ontario’s Information and Privacy Commissioner (IPC) was launched against Dr. Omar Afandi in March after Windsor Regional Hospital found out he was searching health records for newborn baby boys through a system shared by several southwestern Ontario hospitals. After looking up this information, Afandi then contacted parents to offer circumcision services through a clinic he partially owns, WE-Kidz Pediatrics. 

In a decision published Wednesday, the IPC commissioner fined Afandi $5,000 and WE-Kidz Pediatrics $7,500 for violating parts of the Personal Health Information Protection Act (PHIPA). 

Afandi and the clinic have also been ordered to get rid of all the records they obtained with personal health information that were used to offer services. The commissioner also made recommendations to Windsor Regional Hospital, where Afandi had privileges, and to WE Kidz Pediatrics to strengthen their record-keeping and privacy procedures. 

After this breach was discovered last year, Afandi’s hospital privileges had been revoked. He is still listed as part of the team on the WE Kidz Pediatrics website. 

On behalf of Dr. Ofandi, public relations firm SWON Public Affairs told CBC News in an email that the doctor didn’t intend to breach patient privacy. 

“While his intent was never to compromise the privacy or trust of his patients, he accepts that he should have sought clarification from hospital administration, legal advisors, or the ethics committee before proceeding in the manner that he did. He deeply regrets this oversight and the concern it has caused,” reads part of the statement. 

A man wearing a checkered shirt smiles in a headshot photo.Dr. Omar Afandi co-owns WE Kidz Pediatrics in Windsor. His privileges at Windsor Regional Hospital have been revoked as of May 2024. (WE Kidz Pediatrics website)Dozens of new parents received calls offering circumcision services

In April 2024, a patient contacted Chatham-Kent Health Alliance’s Women’s & Children’s program “regarding unauthorized use of her personal health information,” according to the IPC investigation. 

The patient delivered a baby at the Chatham hospital the day before and, while still at the hospital, received a call from WE Kidz “asking if she would be interested in having her newborn circumcised.” 

The patient asked the hospital whether it shares information with outside clinics, but the hospital said it didn’t do that without patient consent and that patients usually ask for services like circumcision. 

When the patient called WE Kidz back and asked how they got her information, they were told that the clinic’s doctor had access to hospital records “where he could look up male newborns and relevant contact information.”

Once the Chatham hospital heard about this, its privacy office started an investigation. 

In May, the hospital received a similar report from another patient. This time, when the patient pressed the person on the phone with WE Kidz Pediatrics for more details on how it got her information, “the physician ended the call.” 

After hospitals narrowed their search to Afandi and asked him about this, the IPC report says he confirmed that he accessed lists of hospital patients, that he searched patients for their date of birth and sex and that he also contacted patients directly to offer them services. 

Windsor Regional Hospital told Afandi to stop his hospital practice and that he would no longer hold privileges as of the end of May 2024.

Afandi accessed records between April 20, 2024, and May 7, 2024. While he admitted to doing it and acknowledging it was wrong under the health information act, he said that he only learned that after speaking to Windsor Regional Hospital. 

He also said that he didn’t keep any personal health information, other than messages and telephone numbers from people he contacted. 

Afandi claims that he possibly contacted around 91 people, though some of these people were already patients of his. Meanwhile, WE Kidz estimates that Afandi could have earned $700 from this and that the clinic itself would have made $70 from it. 

Investigation recommends Windsor hospital boost some privacy practices

The IPC commissioner made several recommendations to Windsor Regional Hospital, including: 

Keeping a record of annual training requirements, including when staff completed the training.  Show that staff do renew their confidentiality commitments on a regular basis.  Update its bylaws to explicitly say that staff must abide by the hospital’s privacy policy.

And when it comes to the WE Kidz, the commissioner recommended that it strengthen its privacy policies and have staff “undergo further privacy training.” 

In an emailed statement, WE Kidz Pediatrics said it knows families place their trust in them to safeguard their children’s health. Following the investigation, it said it’s boosting its internal privacy policies and “ensuring they are fully aligned with all current regulations.” 

It added that it will “continue to enhance our safeguards, strengthen community trust, and uphold the highest standards of pediatric care.” 

SWON Public Affairs also told CBC News that Afandi “remains deeply committed to his patients, his practice, and to the Windsor-Essex community.”

“Patient confidentiality is, and will remain, a core value of his practice, and he takes full responsibility for ensuring that such a mistake will not happen again.” 

In an email, a spokesperson for Chatham-Kent Health Alliance told CBC News that it is still reviewing the report and can’t comment at this time. 

Windsor Regional Hospital did not respond to a request for comment. 

An investigation by the College of Physicians and Surgeons Ontario is still ongoing.Â