Ontario’s information and privacy commissioner has ordered a Windsor doctor and his private clinic to pay thousands of dollars in fines for privacy breaches in a case she calls a “cautionary tale” for other health startups.

Commissioner Patricia Kosseim wrote in a recent decision that a doctor with privileges at Windsor Regional Hospital used his electronic health record access there to look for parents of newborn boys and contact them to offer circumcisions at a clinic he partly owns.

Kosseim writes that Dr. Omar Afandi has acknowledged his wrongdoing and is remorseful, but his breach was serious and he should pay a $5,000 penalty under Ontario’s personal health information law.

As well, she found that the WE Kidz Pediatrics clinic was operating without any privacy management program and should pay $7,500.

WE Kidz says in a statement that it is strengthening its internal privacy policies and ensuring they are fully aligned with all current regulations.

Kosseim says these are the first administrative monetary penalties issued by a privacy commissioner in Canada, and were done under new powers her office was granted last year.

This report by The Canadian Press was first published Sept. 3, 2025.

Allison Jones, The Canadian Press