Up For Sale: Your Secret Health Files

Companies Buy Medical Histories From Mds, Nurses

By Tyler Hamilton
TECHNOLOGY REPORTER
Monday, January 8, 2001, Toronto Star.

Dr. James Sears calls himself North America’s top medical investigator. So if you’ve got any skeletons in your closet, watch out: Prying eyes may be watching.

Two years ago, Sears decided to launch a service that performs medical background checks for companies wanting to verify the health history of job candidates.

The idea was to sniff out records - increasingly in electronic format - that reveal undisclosed medical conditions that could result in numerous sick days and low productivity somewhere down the road.

“We do something nobody else in Canada does,” says Sears, founder of The Second Opinion, a Toronto-based business. “In five years, we feel it will be as commonplace as checking references on a résumé.”

To date, his clients have included Canadian Tire and the Toronto Transit Commission.

Sears says he doesn’t need access to the Internet to carry out his investigations. Rather, his methods are much more simple: Make phone calls to doctors’ offices and hospitals, and request data from receptionists, nurses and administrators who generally have access to computer medical records.

Most times he has permission to carry out his checks through consent provisions on job applications. “If you don't, then you have to do a lot of hunting and digging. And we have our ways of doing that,” he says.

As a special report on privacy in today’s @Biz section shows, it has never been easier to collect personal health, financial and consumer information in this age of electronic government and online commerce.

It’s no secret that computers hold massive amounts of data on us, organized and analyzed through sophisticated software. But as the tentacles of the Internet and other technologies penetrate more and more areas of our lives, protecting our privacy from unwanted breaches becomes more difficult.

Personal health data, perhaps the most sensitive of all information, continues to be stockpiled at an alarming rate. Pharmacies, hospitals and doctors’ offices keep detailed computer records of the drugs we buy and the medical attention we receive.

Increasingly, Internet and wireless technologies are linking this information and making it more mobile. But the information gathering doesn’t stop there. Consider the following:

• A recent study by market research firm Ipsos-Reid found that more than half of all Canadians have visited health-related Web sites, many of which conduct online surveys or track the type of information visitors view.
• The Canadian Institute of Health Information, a non-profit spinoff from Statistics Canada, has so far created 18 massive databases that offer everything from who’s had abortions in Canada to profiles of the mentally ill.
• IMS Health Canada, a for-profit gatherer of health statistics, processes over 15 million health transactions related to anything from drug purchases to the diagnosis of illnesses.
• The Ontario government is eager to roll out “smart cards” with computer chips inside that store information about your health history.

Privacy advocates say the time has come to take a serious look at who’s collecting this data, where it’s going and how it will ultimately be used.

“Medical information is flowing everywhere,” says Stephanie Perrin, former director of privacy policy for Industry Canada’s Electronic Commerce Task Force.

Perrin became Canada’s first chief privacy officer when she joined Montreal software firm Zero-Knowledge Systems Inc. last year.

“You would think intuitively that medical data is the first type of data to be protected in Canada,” she says. “But you would be wrong.”

Most of this information is collected with good intentions. And indeed, collecting medical information on Canadians is generally thought to be crucial in formulating health policy and conducting research into new drugs and technologies.

Often, says Perrin, the concern is not why this information is collected but who, along the data trail, has access to it.

Jean Pruneau, Health Canada’s senior policy adviser, says the federal department is in the midst of conducting privacy impact assessments on its own systems. Over-all, he’s comfortable that organizations in the health sector are taking privacy seriously.

But some things continue to irk him. “What I’m concerned about is the fact that when I go to my family doctor, the secretary there is not bound by any code of professional conduct and has free access to all my information,” he says.

Last week, new private-sector privacy legislation came into force in Canada that gives consumers more control over their personal information, and holds organizations more accountable for how they collect and protect data.

But health information won’t be covered by the law for another year, and it's still unclear what organizations will be affected when it does.

“There's this huge fight in the privacy community over whether Bill C-6 (the new privacy legislation) was too weak with respect to medical data,” says Perrin.

At the heart of the debate is whether organizations such as the Canadian Institute of Health Information are using health information for commercial activity, a condition that would make it subject to the new law.

“I’m not absolutely sure we’re captured by Bill C-6,” says Michael Decter, chairman of the institute. “We will comply with it, but it was more intended for people in the business of gathering health data to sell it.”

Decter also says most of the data collected and shared is not personally identifiable. Still, observers such as Valerie Steeves, a law professor at Carleton University who specializes in privacy issues, are skeptical.

“The doublespeak of the whole issue is that the information is valuable because it’s linkable,” she says. “If you truly (make it anonymous), the value is dramatically decreased.”

Meanwhile, the Ontario government recently tabled health privacy legislation that has drawn criticism from many privacy advocates. Critics charge that the draft bill gives government departments and law enforcement agencies too many exemptions for gaining access to private medical information on citizens.

As a result, opposition politicians are calling the proposed legislation the “Big Brother Bill.”