Are Your Health Records Quietly Being Used for Commercial Purposes? | The Tyee

An emerging model is quietly turning Canadian patient medical records, and patients themselves, into lucrative commercial assets — often without patients’ explicit knowledge or consent. The practice, documented in a recent Health, Tech & Society Lab analysis, urgent concerns about privacy, transparency and trust in our health-care system.

The sale of de-identified and anonymized personal health information isn’t new to Canada. In the conventional business model, data brokers act as middlemen, purchasing and pooling de-identified data from clinics. Brokers then conduct analytics for third parties or sell access to the data for research, marketing or product development.

A new “vertically integrated” model is expanding and changing this practice.

Instead of third-party data brokers buying de-identified datasets from clinics, for-profit companies that own chains of medical clinics have become data brokers themselves, with access to identified data and closer control over clinical workflows. The value of patient data held by these chains is valued in the hundreds of millions of dollars.

Because this closer integration “internalizes” patient data within the same ownership structure, data brokers have direct access to patient data as the data custodians. When using this data to develop specialized tools — such as clinical decision support tools — for third parties, companies may avoid regulatory oversight otherwise applicable if data were shared externally.

The most financially lucrative application of this model comes from pharmaceutical companies which pay clinic-owning data brokers to develop algorithms that identify patients who may be eligible for their drugs. These algorithms, called clinical decision support tools, are then embedded into the electronic medical records systems used in broker-owned clinics, shaping how clinicians prescribe. This is occurring without the explicit consent of patients, relying instead on the permission of physicians and clinics alone. Many physicians may not fully appreciate the risks this poses.