The patients’ personal information was sold to private companies marketing Registered Education Savings Plans.