Privacy and virtual healthcare: report launch

September 13, 2022–CCLA is delighted to launch the report Virtual Healthcare Services in Canada: Digital Trails, De-Identified Data and Privacy Implications. Written by a team led by principal investigator Dr. Sheryl Spithoff (Women’s College Hospital), and including CCLA’s Privacy Director Brenda McPhail, this report is a qualitative study of the rapidly-expanding virtual healthcare industry in Canada.

This study, funded by the Contributions Grant Program of the Privacy Commissioner of Canada , examined the privacy landscape on virtual healthcare platforms through a series of qualitative interviews with employees of companies with virtual care platforms, along with academics, consultants or third-party contractors within the industry, and a detailed analysis of the relevant privacy laws that apply to computer-mediated healthcare visits on commercial platforms.
Key findings include:
• Many Virtual Care Platform (VCP) companies appear to engage in widespread collection, commercial use and, in some cases, sharing of sign-up/registration information (e.g., names, email addresses) and other identifying information (e.g., IP addresses) collected as patients interact with the commercial VCP.
• These data practices may be particularly problematic if the commercial VCPs only provide one type of health service (e.g., psychiatric services or HIV prevention services) as the information can reveal the nature of a patient’s health concern.
• Some VCP companies also create, use, and share de-identified health information. Research shows these data practices may expose patients to harm from privacy loss, micro-targeting for commercial gain, and discrimination against marginalized individuals and communities. However, federal and provincial legislation provide few protections for de-identified data.
• VCP company privacy policies and terms of service documents are confusing, vague and do not adequately convey how data might be used internally or by third parties.
• Many commercial VCPs appear to require patients to agree to commercial uses of their data prior to accessing health services. Due to jurisdictional complexity, and a lack of guidance, it is unclear if this practice is within the letter of the law, but it is ethically questionable given the sensitivity of a patient/health care system interaction.
• Some VCP companies use data to influence patient health care journeys, with the goal of optimizing uptake of a business partner’s products (e.g., medications or vaccinations). This may affect quality of care and cause harms to patients.
• As VCP companies view patient data as a proprietary asset, data may not be available to public and non-profit entities for research and health system improvement.

Read the full report
See the project website