What Really Happens to Your Medical Records?

Add To Library

Have you ever wondered what happens to the information your doctor writes down during a visit? You’re not alone. A recent study published in JAMA Network Open explores how medical records from primary care visits in Canada are being collected, shared – and even sold – often without patients fully realizing it.

How Your Health Information Moves

In Canada, large companies known as data brokers are central to the handling of primary care records. These brokers access records in two main ways:

1. Buying records from for-profit clinic chains (called the “conventional model”), or
2. Owning clinics themselves and directly accessing the records through those clinics (the “vertically integrated model”).

That second model – where the same company owns both the data and the clinics – raises important questions about patient privacy, especially when care is sought through for-profit providers.

To protect identities, data brokers remove names and replace them with codes. But even “de-identified” data is highly detailed. It can still show what medications you’re on, your test results, your diagnoses and more. This information is then analyzed and packaged, most often for pharmaceutical companies. Universities and nonprofits also access the data, but they aren’t the primary customers.

While removing names helps protect privacy, a 2022 study showed that in some cases, individuals can still be identified from these data sets. Even specific physicians can sometimes be singled out, which allows drug companies to market directly to them.

Canada vs. the U.S.: Different Rules, Different Risks

In the U.S., patient data is more tightly controlled. Laws like HIPAA (Health Insurance Portability and Accountability Act) place strict limits on how medical data tied to individuals can be shared or sold. U.S. organizations must remove identifying information before using data for commercial purposes, and professional organizations like the American Medical Association emphasize that patients should know and consent to how their data is used.

In Canada, the picture is more complex. Health privacy laws vary by province. Some provinces, like Quebec, Alberta, and British Columbia, have their own rules. Others follow federal laws like PIPEDA (Personal Information Protection and Electronic Documents Act). This patchwork can lead to gaps in how consistently privacy is protected.

Who Gains – and Who Might Lose

Pharmaceutical companies benefit most from access to this data. Here’s how they use it:

• To identify how many people have a certain condition
• To see which doctors prescribe what—and why
• To justify the development and approval of new treatments

In vertically integrated systems, things go even further. Algorithms scan clinic records to find patients who may be good candidates for certain treatments. Doctors receive lists of these patients – along with suggested therapies. While the lists don’t name specific drugs, there’s often only one option that fits, and it’s usually a newer, more expensive medication.

Doctors are paid to review these lists and follow up with patients. In return, they gain access to tools that help them find patients who might benefit from new treatments. For some, this feels like a win-win: patients may get help faster, doctors receive support, and pharmaceutical companies gain market insight.

The Promise – and the Pitfalls

There are real benefits here. People might receive earlier diagnoses or discover treatment options they hadn’t considered. Doctors and clinics can earn additional income. And pharmaceutical companies can target therapies more precisely.

But it’s not without risk. Some worry that the push for profit could lead to an over-reliance on costly new drugs, even when older, affordable options might work just as well. Privacy remains a concern, too – even when names are removed.

What Can You Do?

The good news? Most people in the study said they still trust their doctors to put patient care first. That’s reassuring.

Still, as health data becomes more valuable – and more widely used – it’s worth staying informed. Ask your healthcare provider how your records are stored and used. Know your rights under your province’s privacy laws. And don’t be afraid to speak up if something doesn’t sit right with you.

You’ve probably noticed the growing number of pharmaceutical ads on TV. (And yes, the rapid-fire side effect warnings can be more entertaining than the ad itself!) But behind the marketing is a bigger truth: your medical information is powerful. It can guide care – but it can also shape industries.

Add To Library