Some virtual care companies putting patients' personal health data at risk, new study finds

This story is part of CBC Health's Second Opinion, a weekly analysis of health and medical science news emailed to subscribers on Saturday mornings. If you haven't subscribed yet, you can do that by clicking here.

If you visit a doctor virtually through a commercial app, the information you submit in the app could be used to promote a particular drug or service, says the leader of a new Canadian study involving industry insiders.

The industry insiders "were concerned that care might not be designed to be the best care for patients, but rather might be designed to increase uptake of the drug or vaccine to meet the pharmaceutical company objectives," said Dr. Sheryl Spithoff, a physician and scientist at Women's College Hospital in Toronto.

Virtual care took off as a convenient way to access health care during the COVID-19 pandemic, allowing patients to consult with a doctor by videoconference, phone call or text.

It's estimated that more than one in five adults in Canada —  or 6.5 million people — don't have a family physician or nurse practitioner they can see regularly, and virtual care is helping to fill the void.

But the study's researchers and others who work in the medical field have raised concerns that some virtual care companies aren't adequately protecting patients' private health information from being used by drug companies and shared with third parties that want to market products and services.

Spithoff co-authored the study in this week's BMJ Open, based on interviews with 18 individuals employed or affiliated with the Canadian virtual care industry between October 2021 and January 2022. The researchers also analyzed 31 privacy documents from the websites of more than a dozen companies.

The for-profit virtual care industry valued patient data and "appears to view data as a revenue stream," the researchers found.

One employee with a virtual care platform told the researchers that the platform, "at the behest of the pharmaceutical company, would conduct 'A/B testing' by putting out a new version of software to a percentage of patients to see if the new version improved uptake of the drug."

Matthew Herder, director of the Health Law Institute at Dalhousie University in Halifax, said he hopes the study draws the public's attention to what's behind some of these platforms.

"All of this is happening because of a business model that sees value in collecting that data and using it in a variety of ways that have little to do with patient care and more to do in building up the assets of that company," Herder said.

Other industry insiders were concerned about how data, such as browsing information, might be shared with third parties such as Google and Meta, the owner of Facebook, for marketing purposes, Spithoff said.

The study's authors said companies placed data in three categories:

Some companies considered the first two categories as assets that could be monetized, employees told the researchers.