Background

Commercial virtual care expanded with the Covid-19 pandemic, providing rapid access to medical services. The companies providing the services gather many forms of data on patients from personal health information to user information (e.g., internet protocol (IP) addresses), which may present risks to privacy. These privacy risks include not only potential exposure of sensitive information, but also problematic data uses such as surveillance, microtargeting, and (re)production of socially oppressive algorithms.

Objectives

Our research objectives were to…

1. Identify and describe the entities involved in commercial virtual care in Canada

2. Describe collection and use of data

3. Examine privacy privacy-related ethical implications

4. Create recommendations for change
   

Methods

We conducted a theory-informed thematic analysis on the data collected from 18 semi-structured interviews with individuals working in the Canadian commercial virtual healthcare industry and from 10 relevant policy documents. We also did a primary legal research based on the federal and provincial privacy legislation relating to personal health information (PHI) and secondary legal research, analyzing relevant articles, bulletins, and interpretations of the various privacy legislations as they relate to commercial VCPs. Furthermore, we consulted provincial and federal privacy officers officers.

Key Findings

We identified 61 platforms owned by 54 companies operating in Canada. Through our analysis, we developed 4 major themes.

1. Commercial virtual care platforms were positioned as solving problems in Canadian healthcare systems.

2. Companies distinguished between different types of data collected through the platforms, enabling widespread commercial use and sharing of de-identified health data, registration information and user data.

3. For the companies, “data was the name of the game.” They used the data for business purposes such as developing new products and increasing the uptake of business partners’ products by analyzing and adjusting patient care pathways.

4. Consent processes to gain access to health data were described as problematic, particularly because patients were not able to opt-out of commercial uses of their data.

Conclusion

Commercial virtual care in Canada is likely to lead to widespread commercial use of health data, enabling surveillance, and presenting risks to privacy, autonomy and health outcomes. These risks are likely to disproportionately affect structurally marginalized groups and communities. Recommendations for change are outlined in the report.