Going to the doctor can involve sharing your most personal information, including details about your health, medical history and prescriptions.
It all ends up in your medical record — but a new study by researchers at Women’s College Hospital in Toronto found that in some cases, private companies are accessing parts of that data and selling it to pharmaceutical companies.
“This is really an area where we need transparency,” said the study’s lead author, Dr. Sheryl Spithoff.
The study, published in JAMA Network Open, examined how the medical record industry works in Canada and how patient data flows between different private entities.
Through a series of 19 interviews, the researchers concluded “chains of for-profit primary care clinics, physicians, commercial data brokers and pharmaceutical companies … work together to convert patient medical records into commercial assets.”
Those assets, the study said, are then used to “further the interests of the pharmaceutical companies.”
Spithoff and her colleagues identified two different models. In one, a private clinic sells data to an outside company, with personal information like names and birth dates removed. The company then offers to sell or analyze that de-identified information for its clients in the pharmaceutical industry.
In the other model, the clinic is a subsidiary of the company collecting the data, giving that company even more direct access to patient information.
The study said patients were not included in decisions about how their data was used.
“We need oversight,” Spithoff said in an interview.
“What we know from other surveys and interviews with patients is that this is not how they want their data handled.”
The study’s findings suggest these practices could give the pharmaceutical industry more influence over patient care in Canada.
Matthew Herder, director of the Health Justice Institute at Dalhousie University in Halifax, said while there may be potential for this kind of data-sharing to help patients, there is also a risk these models will push patient care in a direction that benefits pharmaceutical companies and drives up costs for health-care systems.
“All of these things are happening without any degree of transparency,” Herder said. “That’s why this paper is such an important paper. It’s starting to bring to light what’s really going on.”
The Office of the Privacy Commissioner of Canada declined to comment on the study itself, but said organizations subject to privacy laws must follow certain rules around safeguarding personal information.
While most provinces and territories have privacy laws specifically related to health records, Lorian Hardcastle, an assistant law professor at the University of Calgary, said they are outdated and need strengthening.
As the health-care system moves toward more electronic health records, often managed by private companies, Hardcastle said updates are needed to better protect patient information.
“Data being managed not on paper but by third-party entities really demands that policymakers rethink this legislation that was created decades ago when it was still paper records sitting in a doctor’s office.”
Some of the current laws do little to protect patient data from changing hands if personal identifiers have been removed, Hardcastle said.
“If the data has been de-identified and it’s not reasonable that re-identification would be possible, the law offers quite little protection,” she said.
“Unfortunately, though, what we thought 10 years ago was de-identified data, now we’re realizing with big data with AI can be re-identified.”
In a statement, the office of the Ontario privacy commissioner said health information custodians have to take reasonable steps to ensure data is protected and secure, and acknowledged health data has become an increasingly valuable commodity.
“There needs to be greater accountability around the use and sale of de-identified health data, and what happens to that data after it is sold,” it said.
The office is advocating for changes to Ontario’s privacy legislation to add further guardrails like risk assessments when personal health information is involved.
For patients wondering what might be happening with their health data, Hardcastle said start by asking your clinic for its privacy policy. Beyond that, she said any issues can be reported to a privacy commissioner and concerned patients can push legislators to update privacy laws.
“If they’re hearing from many members of the public that this is something they’re concerned about, that may motivate them to look into this further,” she said.
Family doctor Dr. Danyaal Raza in Toronto said the study’s “stark and dramatic” findings should encourage patients at private, for-profit clinics to ask some hard questions so they can be as informed as possible.
As past chair of Canadian Doctors for Medicare, Raza sees this as another risk that comes with private companies delivering health care. Legislative changes are part of the solution, along with further attention paid to primary care, he said.
“What we need to do to solve the primary care crisis is put forward solutions that put patients first, and not profits.”
