Some virtual care companies putting patient data at risk, new study finds

This story is part of CBC Health's Second Opinion, a weeklyanalysis of health and medical science news emailed to subscribers on Saturday mornings. If you haven't subscribed yet, you can do that byclicking here.

If you visit a doctor virtually through a commercial app, the information you submit in the app could be used to promote a particular drug or service, says the leader of a new Canadian study involving industry insiders.

The industry insiders "were concerned that care might not be designed to be the best care for patients, but rather might be designed to increase uptake of the drug or vaccine to meet the pharmaceutical company objectives," said Dr. Sheryl Spithoff, a physician and scientist at Women's College Hospital in Toronto.

Virtual care took off as a convenient way to access health care during the COVID-19 pandemic, allowing patients to consult with a doctor by videoconference, phone callor text.

It's estimated that morethan one in five adults in Canada or 6.5 million people don't have a family physician or nurse practitioner they can see regularly, and virtual care is helping to fill the void.

But the study's researchers and others who work in the medical field have raised concerns that some virtual care companies aren't adequately protectingpatients' privatehealth information from being used by drug companies and shared with third partiesthat want to market products and services.

Spithoffco-authored the study in this week's BMJ Open, based on interviews with 18 individuals employed or affiliated with the Canadian virtual care industry between October 2021 and January 2022. The researchers also analyzed 31 privacy documents from the websites of more than a dozen companies.

The for-profit virtual care industry valued patient data and "appears to view data as a revenue stream," the researchers found.

One employee with a virtual care platform told the researchers that the platform, "at the behest of the pharmaceutical company, would conduct 'A/B testing' by putting out a new version of software to a percentage of patients to see if the new version improved uptake of the drug."

WATCH | New research finds many virtual care apps sell personal data:

Many virtual care apps pushing products, selling personal data, research finds

8 months ago

Duration 1:59

New research has found for-profit companies behind many virtual care apps are working with pharmaceutical companies to sell products and even selling patient data. Experts say data collected through such apps should be considered personal health info, which would allow patients to opt out.Note: This story has been updated to remove a line identifying some Canadian virtual care companies and some associated imagery.

Concerns about how data might be shared

Matthew Herder, director of the Health LawInstitute at Dalhousie University in Halifax, said he hopes the study draws the public's attention to what's behind some of these platforms.

"All of this is happening because of a business model that sees value in collecting that data and using it in a variety of ways that have little to do with patient care and more to do in building up the assets of that company," Herder said.

Other industry insiders were concerned about how data, such as browsing information, might be shared with third parties such as Google and Meta, the owner ofFacebook, for marketing purposes, Spithoff said.

The study's authors said companies placed data in three categories:

• Registration data, such as name, email address and date of birth.

• User data, such as how, when and where you use the website, on what deviceand your internet protocol or IP address.

• De-identified personal health information, such as removing the name and date of birth and modifying the postal code.

Some companies considered the first two categories as assets that could be monetized, employees told the researchers.

Not all of the companies treated thethird categorythe same way. Some used personal health information only for the primary purpose of a patient's virtual exchange with a physician, while others used it for commercial reasons, sharing analytics or de-identified information with third parties.

The study's authors said while each individual data point may not provide much information, advertisers and data analytic companies amalgamate data from browsing history and social media accounts to provide insights into an individual's mental health status, for example.

One study participant described how a partnership for targeted ads might work: "If an individual is coming through our service looking for mental health resources, how can we lean them into some of our partnerships with corporate counselling services?"

WATCH | Virtual care a step toward privatization of health care, nurses' union says:

Nurses union says virtual care is a move toward privatization of health care

11 months ago

Duration 0:43

The president of the Registered Nurses Union of Newfoundland and Labrador says the provincial governments $22-million deal with a private company to provide a phone or video call for medical services is not reassuring for a strong publicly funded health-care system. Yvette Coffey says it should be considered a stop-gap measure, which is in stark contrast to the government's message that virtual care is part of the future of medicine.

Conflict-of-interest questions

Lorian Hardcastle, an associate professor of law and medicine at the University of Calgary, studieduptake of virtual care in 2020. She highlighted issues of continuity of care, privacy legislation and consent policies.

Since then, shesaid, uptake in virtual care accelerated during the COVID-19 pandemic.

"I think that the commercialization of the health-care system raises concerns around conflicts of interest between what is best for patients on the one hand and then on the other hand, what has the best return for shareholders," said Hardcastle, who was not involved in the BMJ Open study.

Hardcastle said it is helpful to have industry insiders acknowledge problems that health professionals and academics have expressed about commercialization.

The Officeof the Privacy Commissioner of Canada, which funded the study, said in an email that privately funded health professionals are generally considered to be conducting commercial activities.

Hospitals, long-term care facilities and home care services that are publicly funded are not considered to be engaged in commercial activities and are covered byprovincial privacy legislation, the office said.Health information falls into many categories and may be subject to different privacy laws across various jurisdictions.

Hardcastle also suggested that self-regulatory bodies, such as provincial colleges of physicians and surgeons, may need to revisit policies around relationships between health providers and industry.

Virtual care industry responds

CBC News heard from some Canadian virtual care companies thatsaid they take the privacy of individuals seriously.

"Patient data is only used with patients' explicit consent and only when it's required for health-care interactions between a patient and a doctor," a spokesperson for virtual care platform Maple said. "We do not exploit patient data for marketing or commercial gain."

In a statement, Rocket Doctorsaid it is important to note that the company "does not do any of the things listed by the researchers as common in the telehealth industry."

Telus said that allof the data collected from its virtual care service is treated as personal health information.

"Telus Health doesn't receive any funds from pharmaceutical companies for our virtual care service and we do not sell any patient data collected," saidPamela Snively, the company's chief data and trust officer.

Source of information hard to pin down

Hardcastlesaid it may be difficult for some people to distinguish between receivingreliable and accurate information from a health-care provider on an app andgetting services marketed to them that the health provider may or may not find useful.

"Your family doctor isn't trying to collect superfluous information in order to market services to you," shesaid.

Someprovinces and territories pay for the virtual services.In other cases, patients pay themselves or are covered by employer or private insurance.

Nova Scotia's government, for example, has a contract with Maple to provide residents without a primary care provider with unlimited virtual visits. Those who do have a regular provider canhave two visits per year paid for by the province.

Tara Sampalli, senior scientific director at Nova Scotia Health Innovation Hub, said the province's contract with Maple means residents' data can't be used in other ways, such as by third-party providers.

The provincedoesn't have that level of control over other providers of virtual care, saidSampalli,who holds a PhD in health informatics.

Calls for an opt-out choice

Herder, of Dalhousie University, said users should be able to easily opt out of having their data used for commercial purposes. He also said that if the data doesn't represent the full diversity of Canada, algorithms shaping clinical decision-making could be racially biased.

Spithoff said while patient awareness is important, patients aren't in a position to fix this problem.

"We need better legislation, regulation, and we need better funding for primary care," shesaid. "Or people can get virtual care integrated into their offline care."

Spithoff and her co-authors said self-regulation by the industry is unlikely to lead to change.

The researchers acknowledged they were limited to publicly available documents and that they did not interview those affiliated with the third-party advertisers.

WATCH | Canadian Medical Association says country needs more family doctors:

Canadian Medical Association calls for health-care system overhaul

9 months ago

Duration 0:01

With hospitals well over capacity across Canada, the Canadian Medical Association president says emergency rooms are standing in for primary care and that the country needs more family doctors.