Information and privacy commissioner Ann Cavoukian confirmed to CityNews on Thursday that she is expanding her investigation to include other hospitals after more viewers emailed saying their personal information was leaked.

The complaints poured in from viewers after CityNews first reported about a massive privacy breach at Rouge Valley Centenary hospital earlier this week.

Since that news report complaints have come from new mothers who gave birth at hospitals  across Toronto, Newmarket, Ajax, Brampton and beyond.

“One of the things that concerns me is that this may be more systemic a problem than first anticipated,” said Cavoukian, adding it could take months to complete her investigation.

Her office as well as the Ontario Securities Commission (OSC) launched separate investigations this week after a Rouge Valley hospital staff member allegedly accessed patient files belonging to new moms and women who were expecting, as part of a scheme to sell them Registered Education Savings Plans from July 2009 to August 2013.

CityNews has also learned two low-level clerks were fired from Rouge Valley Centenary hospital following two separate breaches there. Their names have since been passed on to Toronto police.

The penalty for breaking provincial privacy laws is steep. For an individual, it’s a fine of $50,000. For a corporation, it’s five times that not to mention potential for criminal charges.