Privacy Commissioner to Launch Investigation Into Sale of “Anonymized” Health Data

On February 20, 2019, the Toronto Star (“Star”) reported that the Office of the Information and Privacy Commissioner of Ontario is launching an investigation into the sale of anonymized health data to IQVIA, a US based health data company.  IQVIA has a data-sharing arrangement with an electronic medical record software company that enables IQVIA to obtain de-identified patient records from primary care practices in the province.

Patient records that are sufficiently de-identified, such that they are considered anonymous, are no longer considered to be personally identifiable information and are generally considered to fall outside of the scope of privacy legislation.  Once “anonymized”, these records may then be disclosed without patient consent. However, the sale of de-identified health data raises the important concern of re-identification, particularly when data sets are being linked together. 

According to the Star, US health data giant IQVIA says it has the potential to access the health records of five million Ontarians and that the company regularly anonymizes and sells one million of the records.  IQVIA’s main customers are in the pharmaceutical industry, where it is industry practice to use anonymized data to track use of their drugs, identify untapped markets and plot marketing strategies.

The Office of the Privacy Commissioner said that it is launching a “review of the circumstances described” by the Star story. For more information, please see the full report here.

E-TIPS® newsletter will continue to follow this investigation and update readers with any developments.

Summary By: Jae Morris