Should all information collected through virtual care count as personal health data? This study says 'yes'

Virtual care companies should treat all data collected through their platforms as confidential patient health information instead of using or modifying some of this information for commercial purposes, according to the lead author of a study published recently in BMJ Open.The qualitative study—based on interviews with 18 people affiliated with the commercial virtual care industry, and 31 documents from 14 virtual care providers—found a number of virtual care companies in Canada organize data into various categories and apply uses to certain categories that increase the risks to patients’ privacy, autonomy and health outcomes.Indeed, some use analytics—instead of a physician’s recommendations—to develop care pathways.“Participants described how analysts from the virtual care platforms would adjust things like a frequency of visits, follow up visits, the timing of lab tests, and the frequency of reminders for patients to get a vaccine or a drug,” explained lead author Dr. Sheryl Spithoff, a Toronto family medicine specialist and staff physician at Women’s College Hospital. “And then they would analyze the patient's data, the personal health information and they would determine which was most effective at increasing the uptake of the drug or vaccine, and then . . . to tweak those clinical pathways in order to optimize uptake.”Dr. Spithoff said she hopes the study findings will lead to changes in how virtual care companies use patient data.“One thing that we're advocating for is that all data collected through these platforms be treated as personal health information,” she said. “So whether it's your IP address, your name, your email address, the information that you give to a doctor or nurse when you're conversing or texting with them—all of that is treated as personal health information and that would give all that data additional protections.”Read: Can you do 1.5 million virtual appointments a year? British Columbia may have a contract for youAmong the 18 people interviewed for the study, nine were employees of companies with a direct-to-consumer virtual care platform while the remaining nine were affiliated with the industry as academics, consultants and third-party contractors.The interviews revealed some virtual care companies used patients’ health information for purposes other than providing care. Two interviewees who worked for virtual care companies said their employers used patients’ health information to adjust care pathways “with the goal of increasing uptake of a pharmaceutical product.” However, the data was provided as analytics rather than as information that could be linked to individual patients.One interviewee said his virtual care employer was paid by a pharmaceutical company to promote its product by sending patients reminders or providing more information on a particular drug. The company also ran, at the request of the phamaceutical company, "A/B testing" to compare which version of software improved uptake of the drug.The virtual care platform did not tell patients it was running these tests and analyses, said the interviewee.Other interviewees cited companies with similar practices of sharing patient health data analytics with third parties.“More companies may be seeking to follow suit,” wrote the study authors. “Jamie, an executive at a company with a virtual care platform, described how their employer, a large corporation with ‘multiple industries’ and ‘multiple platforms’, was trying to get ‘a view of the consumer’ and wondering: ‘Can we use [personal health information]?’ and ‘How do we use [personal health information]?’”The interviewees also described how the virtual care companies they’re affiliated with used patient data to improve and expand their services. One interviewee, an executive at a virtual care company, said his employer used data to identify service gaps in areas with “consumer” demand, such as marriage counselling. The executive called this use of data a “win-win” because companies increased their revenues while providing patients with better or new services.At some companies, patient data was used to market and sell other services based on patients’ profiles. For example, said one interviewee, “If you are frequently looking up dermatology terms on our app, we might offer additional services around dermatology for you.”Read: Virtual ERs are still the topic of debate, but this one saved a lifeAnother interviewee said these marketed services were often ones that would not be covered by public health and would need to be paid out-of-pocket by the patient.“Private pay services often have a higher mark-up compared with publicly funded health services and were described by (one interviewee) as ‘sell-up conversions’—purchases a patient makes beyond the initial service they were seeking,” wrote the authors.Some companies also used data to market third-party products and services. One interviewee described how this approach might work: “If an individual is coming through our service looking for mental health resources, how do we lean them into some of our partnerships with corporate counselling services? So, that’s kind of where that data is going to help [companies] build these partnerships.”These practices aren’t necessarily kept secret. One company, for example, discloses in its privacy policy that “We generally process and may disclose your personal information . . . in order to enable our advertisers to provide you with more personalised content and track the effectiveness of certain advertising campaigns.”While the interviewees generally viewed these data handling practices as “falling within industry norms,” some expressed concerns about how these practices could interfere with patients’ healthcare choices and put their privacy at risk.One interviewee noted that targeted advertising and A/B testing of patient care pathways to increase uptake of pharmaceutical product “had the ability to influence . . . the patient’s decision-making and healthcare houces, perhaps more than ideal.”Another interviewee said “I would like my care journey to be governed by what’s the best care for me, not who paid the most amount of money to get in front of me for my attention.”The use of data to promote products and services is akin to making ‘money off [patients’] backs,” said another interviewee.Read: What we can learn from the rare cases when virtual care ends in death or serious harmWhile the study cited a few companies as examples of commercial direct-to-consumer virtual care providers, it did not point to any particular company when describing the various ways patient health data is used. It also did not identify which companies its interviewees were affiliated with.When asked about the study authors’ advocacy for treating all information gathered through the platform as personal health information, Pamela Snively, chief data and trust officer at Telus Communications—owner of the Telus Health virtual care platform—said “some of our regulators . . . do distinguish between some of that demographic information (collected) when you register for an app versus information that’s collected in the course of providing virtual care services. One of them is personal information and it’s subject to all the laws that apply to personal information and the latter is personal health information and subject to different laws.”Depending on what a given app includes, it might make sense to distinguish between these two types of information, she added.“In our case, we use that sort of registration demographic information only to . . . have the registrants become aware of the services within the app . . .. We’re not we're not using it for other forms of marketing.”A spokesperson from another commercial virtual care provider, Maple, said the company uses patient data only with patients' “explicit consent” and only when it’s required for healthcare interactions between a patient and a doctor.“We do not exploit patient data for marketing or commercial gain,” the spokesperson stated in an email. “This includes sharing data with pharmaceutical companies, a practice we do not engage in.“In an emailed statement, Teladoc Health Canada said the study’s findings “are not reflective of our data handling practices. As described in our privacy notice, we collect and use patient data only to facilitate access to the services offered through Teladoc Health. We do not sell personal health information of patients.”Read: American College of Physicians concerned about new ‘direct to consumer’ site from Eli Lilly

Should all information collected through virtual care count as personal health data? This study says 'yes'

Register for free access or login.

Related Topics