TORONTO — An Ontario woman has launched a proposed class-action lawsuit against a hospital, an ophthalmologist and his assistant — who happens to be her sister — alleging a “serious and prolonged” invasion of privacy which may have potentially impacted a number of patients.

In a statement of claim filed in a Toronto court, Katie Mallinson alleges her sister, Lisa Lyons, used her access to the Trillium Health Partners database to look at her confidential medical records, as well as the files of other patients.

The statement of claim alleges Lyons was “an electronic Peeping Tom” who accessed personal patient information for her own enjoyment.

Mallinson alleges Lyons’s employer, Dr. Tony Vettese, did not do enough to protect the privacy interests of patients. The statement of claim also alleges Trillium’s privacy policies and procedures were inadequate.

The proposed suit seeks $2 million in general damages and a further $1 million in punitive damages.

None of the allegations contained in the statement of claim have been proven in court, and Lyons and Vettese could not immediately be reached for comment.

“Lyons had no reason to access the personal information of the plaintiff and class members. She did so for her own titillation, entertainment and amusement; to give her fodder for malicious gossip,” the statement of claim alleges. “She was an electronic Peeping Tom, surreptitiously looking through a wired window into the private lives of her victims to satisfy her carnal urges.”

The claim alleges Lyons began accessing confidential personal information on Mallinson and others at least four years ago, but possibly up to a decade earlier thanks to her “unfettered access” to the files at work.

The information access by Lyons gave her a window into “the most intimate, personal, private and embarrassing aspects” of Mallinson’s and other potential class members’ lives, the statement of claim alleges.

Vettese, of Mississauga, Ont., failed to exercise “the slightest supervision” of Lyons and left her to her own devices in his office for hours at a time, “neither knowing nor caring how she spent the time,” the statement of claim alleges

“It was a combination of the defendant Vettese’s professional status and his inexcusable neglect which enabled the defendant Lyons to do what she did,” the claim alleges, adding that Trillium in turn “maintained a culture which tolerated and indeed encouraged such intrusions upon seclusion.”

The statement of claim notes that the total number of patients affected by Lyons’ alleged actions are not yet known.

It also notes that Trillium’s privacy office did not detect Lyons’ alleged misconduct and only began investigating when Mallinson reported her suspicions.

Trillium said it was committed to ensuring and protecting the privacy of our patients’ personal health information and had a “robust” education and surveillance regime over its hospital information system.

It noted that it had recently learned of someone, who was not a Trillium employee, who was improperly accessing patient records, and said it took “immediate action” and notified the Information and Privacy Commissioner.

“We take this matter extremely seriously and are taking all necessary steps to ensure a resolution that protects the interests of our patients, their families and our community,” Trillium said in a statement. “Following completion of our internal investigation, the individual’s access to our system has been permanently denied. We have notified the patients who were affected by this matter.”

Trillium added that it had increased auditing of physician offices to detect and deter unauthorized access.