Risk Management and Crisis Response Blog

JSOT-led Investigation Leads to Guilty Pleas and Sentences for Hospital Privacy Breach

Jun 9, 2016 4 MIN READ
Lawrence E. Ritchie

Partner, Disputes, Toronto

In a matter that sees the intersection of securities regulation and the protection of personal information, the OSC last week announced that four individuals entered guilty pleas to charges laid following investigations led by its relatively recently-created Joint Serious Offences Team (“JSOT”) The pleas reflect the successful conclusion of securities enforcement activities involving JSOT, an enforcement partnership between the OSC, the RCMP Financial Crime program and the Ontario Provincial Police Anti-Rackets Branch. The charges relate to three overlapping “referral arrangements” between employees of the Rouge Valley Health System and the Scarborough Hospital and between Registered Education Savings Plans (“RESP”) salespersons. As a part of this scheme, former hospital employees misappropriated the names and other confidential information of new parents of children born in those medical facilities and sold that information to RESP salespersons to be used as potential sale leads.

Collaboration among Regulators and Law Enforcement

JSOT’s chief objective is to assist the OSC in the protection of investors and the enhancement of confidence in Canadian capital markets, through effective enforcement activities and collaborative investigations of securities law wrongdoing. This matter’s successful conclusion showcases regulatory and enforcement authorities cooperating effectively to investigate and prosecute violations of securities laws and related wrongdoing under the Criminal Code.

JSOT was established as a partnership in 2013. The concept of collaborative investigative units specializing in financial crimes is not new to the Canadian securities enforcement landscape. In 2003, the RCMP created its Integrated Market Enforcement Team (IMET), a partnership it leads with the Justice Department, provincial police forces, and provincial securities regulators, to deter capital markets-related crimes. However, IMET has been criticized as having disappointing enforcement results during its initial years, as noted by former Superintendent of Financial Institutions Nick Le Pan. Between 2003 and 2012, IMET had only charged 47 individuals, albeit with some recent modest increases to these figures, with seven charges charged laid in 2013 and 11 in 2014.

In an effort to bolster IMET’s effectiveness in fighting white collar crime and improve collaboration between the OSC and RCMP, the Toronto division of IMET was relocated in March 2015 to the OSC’s Toronto headquarters, as we have previously discussed on this blog. IMET’s Montreal division is already housed in the same office as Quebec’s securities regulator, and the RCMP is seeking to do the same with IMET divisions in Alberta and British Columbia.

Partnerships intended to coordinate investigations between the RCMP and OSC, such as the JSOT and IMET initiatives, can also help enforcement authorities navigate unique information-sharing issues and effectively provide regulatory bodies with access to investigatory tools that are not available in most regulatory investigations governed by provincial legislation. For example, the OSC cannot generally use evidence gathered under its statutory investigation powers as evidence in criminal trials, and must cease using any statutory investigatory tools available to it (such as compelled document requests and interviews) once it has “crossed the Rubicon” by deciding to pursue the matter in the quasi-criminal sphere. Similarly, securities regulators currently lack most police investigative powers, such as the ability to obtain search warrants and wiretaps. In some ways, the collaborative undertakings such as JSOT (and the closer integration of the IMET and provincial regulators) allow regulators and law enforcement to leverage their expertise in cooperation with one another, and to more effectively pursue white collar crime impacting the capital markets.

The Guilty Pleas

The OSC announced the names of the four individuals who pleaded guilty in relation to the hospital privacy breaches, and who faced a number of charges under the Criminal Code and as a result of breaches of the Securities Act. One of the schemes stemmed from Esther Cruz, a former registered nurse in the maternity department at the Rouge Valley Hospital System and the Scarborough Hospital. She was accused of accepting so-called “secret commissions” (effectively kickbacks) in exchange for providing one of the other accuseds, Nellie Acar, with confidential patient information contrary to s. 426(1)(a) of the Criminal Code. Acar was formerly a sales representative at Global RESP Corporation.

The two other individuals, Polina Edry and Subramanian Sulur, were registered dealers under the Securities Act who admitted to using confidential patient information to target the new parents with RESP-related sales efforts. In court, Edry acknowledged that she had coordinated with Shaida Bandai, a former hospital clerk, to obtain the information. Both Edry and Sulur pleaded guilty to one count each of participating in an improper referral arrangement (contrary to NI 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations and s. 122(1) of the Securities Act).

The Ontario Court of Justice gave Cruz and Acar each six month conditional sentences, with the first three months of their sentences to be served under house arrest. The court also gave both of them two years of probation with significant community service requirements. Sulur is scheduled to appear for sentencing on June 22, 2016, while Edry’s appearance is scheduled for August 23.