Ontario health agency ordered to inform patients of major data breach