The Quiet Commercialization of Primary Care Records

By Danyaal Raza, Sheryl Spithoff, Brigid Goulem, Gaibrie Stephen

An emerging model is quietly turning Canadian patient medical records, and patients themselves, into lucrative commercial assets – often without patients’ explicit knowledge or consent. The practice, documented in a recent Health, Tech & Society Lab analysis, raises urgent concerns about privacy, transparency and trust in our health-care system.

The sale of deidentified and anonymized personal health information isn’t new to Canada. In the conventional business model, data brokers act as middlemen, purchasing and pooling de-identified data from clinics. Brokers then conduct analytics for third parties or sell access to the data for research, marketing or product development.

A new “vertically integrated” model is expanding and changing this practice. Instead of third-party data brokers buying de-identified datasets from clinics, for-profit companies that own chains of medical clinics have become data brokers themselves, with access to identified data and closer control over clinical workflows. The value of patient data held by these chains is valued in the hundreds of millions of dollars.

Because this closer integration “internalizes” patient data within the same ownership structure, data brokers have direct access to patient data as the data custodians. When using this data to develop specialized tools – such as clinical decision support tools — for third parties, companies may avoid regulatory oversight otherwise applicable if data were shared externally.

The most financially lucrative application of this model comes from pharmaceutical companies which pay clinic-owning data brokers to develop algorithms that identify patients who may be eligible for their drugs. These algorithms, called clinical decision support tools, are then embedded into the electronic medical records systems used in broker-owned clinics, shaping how clinicians prescribe. This is occurring without the explicit consent of patients, relying instead on the permission of physicians and clinics alone. Many physicians may not fully appreciate the risks this poses.

Given the track record of pharmaceutical industry marketing leading to inappropriate prescribing, this is cause for concern. Studies consistently demonstrate that pharmaceutical industry influence over medical care results in more prescribing, less appropriate care and increased costs.

Questioning Consent & Custody

The role of physicians and clinics as data custodians is one factor that facilitates this commercialization. Physicians and clinics are responsible for making decisions about how patient data is used, including granting third-party access to patient data.

Data custodians can assume “implied consent” from patients when sharing personal health information for the primary purpose of providing health care. However, “express consent” from patients is required to disclose health data when used for secondary purposes, including commercial ones.

When used for commercial and marketing purposes, physicians are required to obtain their patients’ explicit consent. However, our research shows data brokers appear to be relying on implied consent for these commercial uses, contrary to their responsibility as data custodians. Additionally, many physicians who practice in data-broker owned clinics may not be aware that an increasing number of the clinical tools they use are sponsored by pharmaceutical companies.

There is also an issue of trust. When commercial relationships between the health technology companies and pharmaceutical companies are obfuscated, risks exist for erosion of trust for the large share of patients who are reluctant to share personal health information for commercial uses.

Learning From Hospitals

Canadian hospitals are largely insulated from this increasingly common practice in primary care and specialist community clinics. Because of the scale on which they operate, hospitals benefit from legal, regulatory and risk mitigation expertise that smaller clinics lack. Hospitals also operate on a not-for-profit basis, which does not entirely mitigate potentially problematic revenue streams but does change incentives and the dynamic between patient care and profit maximization.

Patients and clinicians in primary care and specialized community clinics are likely to benefit if they are provided the same support as hospitals. Canada Health Infoway and Supply Ontario offer nascent examples of what this could look like. Both have approved “vendor-of-record” lists for Artificial Intelligence scribes that require higher standards for patient and related data privacy.

This central procurement can be a dynamic process, introducing new standards and protections as digital health advances. For example, it could incorporate provisions or requirements to allow patients more control over the secondary use of their own data, including giving patients the choice as to whether personal health information can be used for commercial purposes. This is particularly vital for health information that is not de-identified, as in the vertically integrated model.

Importing Best Practices

Canadian laws regulating secondary use of health-care data are based on a patchwork of federal, provincial, provincial territorial and even institutional rules. At the federal level, the Personal Information Protection and Electronic Documents Act governs the collection, use and disclosure of personal information, unless provincial or territorial legislation exists that is “substantially similar.”

The result is an inconsistent regulatory landscape.

Comparatively, Europe has been a global leader in creating robust legislation. The European Union recently instituted The European Health Data Space (EHDS), a regulatory framework that focuses on health data in both its primary use (health care) and secondary use (commercial or other).

The EHDS requires that any secondary use of health data be strictly regulated. In Canada, data governance occurs through health information custodians, contracts and research ethics boards, while the EHDS has strong centralization with national Health Data Access Boards. These boards manage requests, issue permits and enforce laws. Importantly, unlike in Canada, sale of health data for commercial use such as marketing/advertising is explicitly prohibited. Pharmaceutical companies can access health data only for research, safety, public health and innovation.

Moreover, under the EHDS a “health data holder” is broadly defined as any entity in the health care or care sector that has collected or processed electronic health data with public funding or generates it through providing health-care services. This means that vertically integrated models of care would be classified as health data holders and have obligations to limit secondary use around marketing and advertising.

In some instances, there may be existing Canadian regulations that can be leveraged to accomplish these goals. For example, domestic policy exists for the disclosure of financial and business relationships with pharmaceutical companies when clinical care is implicated. The enforcement of existing regulations can ensure transparency for both clinicians and patients.

Data brokers as health-care providers and the associated business model are blurring the boundaries between care and commerce, embedding pharmaceutical marketing into clinical tools without patient consent or clear disclosure. Regulatory investigations may be warranted to determine the legality of these new data handling practices.

Without intervention, clinical workflows risk becoming marketing channels. Strong governance, transparent disclosure and patient control over secondary data use can realign digital health with the public good.

—

Previously Published on healthydebate.ca with Creative Commons License

***

–