Commercializing Personal Health Information: A Critical Qualitative Content Analysis of Documents Describing Proprietary Primary Care Databases in Canada

Document Type : Original Article


1 Department of Family and Community Medicine, University of Toronto, Toronto, ON, Canada

2 Department of Family and Community Medicine, Women’s College Hospital, Toronto, ON, Canada

3 Women’s College Research Institute, Women’s College Hospital, Toronto, ON, Canada

4 Lawrence S. Bloomberg Faculty of Nursing, University of Toronto, Toronto, ON, Canada


Commercial data brokers have amassed large collections of primary care patient data in proprietary databases. Our study objective was to critically analyze how entities involved in the collection and use of these records construct the value of these proprietary databases. We also discuss the implications of the collection and use of these databases.

We conducted a critical qualitative content analysis using publicly available documents describing the creation and use of proprietary databases containing Canadian primary care patient data. We identified relevant commercial data brokers, as well as entities involved in collecting data or in using data from these databases. We sampled documents associated with these entities that described any aspect of the collection, processing, and use of the proprietary databases. We extracted data from each document using a structured data tool. We conducted an interpretive thematic content analysis by inductively coding documents and the extracted data.

We analyzed 25 documents produced between 2013 and 2021. These documents were largely directed at the pharmaceutical industry, as well as shareholders, academics, and governments. The documents constructed the value of the proprietary databases by describing extensive, intimate, detailed patient-level data holdings. They provided examples of how the databases could be used by pharmaceutical companies for regulatory approval, marketing and understanding physician behaviour. The documents constructed the value of these data more broadly by claiming to improve health for patients, while also addressing risks to privacy. Some documents referred to the trade-offs between patient privacy and data utility, which suggests these considerations may be in tension.

Documents in our analysis positioned the proprietary databases as socially legitimate and valuable, particularly to pharmaceutical companies. The databases, however, may pose risks to patient privacy and contribute to problematic drug promotion. Solutions include expanding public data repositories with appropriate governance and external regulatory oversight.


  1. Ebeling MF. Healthcare and Big Data: Digital Specters and Phantom Objects. 1st ed. New York: Palgrave Macmillan; 2016.
  2. IMS Health and Quintiles are now IQVIA. Analyst and Investor Conference. 2017 Nov 8; 583 Park Avenue, NYC.
  3. Tanner A. Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records. 1st ed. Boston: Beacon Press; 2017.
  4. IMS Health. A Straightforward Way to Get Real-World Data. 2015.
  5. Cahn A, Shoshan A, Sagiv T, et al. Prediction of progression from pre-diabetes to diabetes: development and validation of a machine learning model. Diabetes Metab Res Rev. 2020;36(2):e3252. doi:1002/dmrr.3252
  6. OLD IMS Health Real-World Data A straightforward way to get real-world data. IMS Health; 2015.
  7. Privacy Analytics. IMS Health: Unlocking the Value of EMR Data for Advanced Research and Analysis, Better Health Metrics, and Product Innovation. QuintilesIMS; 2017.
  8. Gentil ML, Cuggia M, Fiquet L, et al. Factors influencing the development of primary care data collection projects from electronic health records: a systematic review of the literature. BMC Med Inform Decis Mak. 2017;17(1):139. doi:1186/s12911-017-0538-x
  9. Shi L. The impact of primary care: a focused review. Scientifica (Cairo). 2012;2012:432892. doi:6064/2012/432892
  10. Real-World Evidence: From Activity to Impact in Healthcare Decision Making. McKinsey & Company. Accessed October 2, 2020.
  11. IQVIA Longitudinal Patient Data (LPD): Real World Data Insights from UK Primary Care Electronic Medical Records. IQVIA.
  12. Electronic Medical Records (EMR) The Most Comprehensive Source of Unique Real-World Evidence (RWE) Insights on Patient-Level Data in Canada. 2017.
  13. Marks M. The Right Question to Ask About Google’s Project Nightingale. Slate Magazine; 2019. Accessed January 29, 2021.
  14. Oncology Data Network. About CODE. In: Oncology Data Network [Internet]. Accessed June 19, 2020.
  15. Hedenmalm K, Blake K, Donegan K, et al. A European multicentre drug utilisation study of the impact of regulatory measures on prescribing of codeine for pain in children. Pharmacoepidemiol Drug Saf. 2019;28(8):1086-1096. doi:1002/pds.4836
  16. Langley P, Leyshon A. Platform capitalism: the intermediation and capitalization of digital economic circulation. Finance and Society. 2017;3(1):11-31. doi:2218/finsoc.v3i1.1936
  17. Sadowski J. The internet of landlords: digital platforms and new mechanisms of rentier capitalism. Antipode. 2020;52(2):562-80. doi:1111/anti.12595
  18. Zuboff S. The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. 1st ed. New York: PublicAffairs; 2019.
  19. Christl W, Spiekermann S. Networks of Control: A Report on Corporate Surveillance, Digital Tracking, Big Data & Privacy. Facultas; 2016.
  20. Sterling B. Twenty Years of Surveillance Marketing. WIRED. Accessed January 18, 2022.
  21. Birch K, Cochrane D, Ward C. Data as asset? The measurement, governance, and valuation of digital personal data by Big Tech. Big Data Soc. 2021;8(1):20539517211017308. doi:1177/20539517211017308
  22. Beamish B. Comments of the Information and Privacy Commissioner of Ontario on Bill 138. Information and Privacy Commissioner of Ontario; 2019.
  23. Khosseim P. Ripe for Public Debate: Legal and Ethical Issues Around De-Identified Data. Information and Privacy Commissioner of Ontario; 2022. Accessed September 6, 2022.
  24. Yoo JS, Thaler A, Sweeney L, Zang J. Risks to Patient Privacy: A Re-identification of Patients in Maine and Vermont Statewide Hospital Data. Technology Science. 2018. Accessed April 12, 2019.
  25. El Emam K, Jonker E, Arbuckle L, Malin B. A systematic review of re-identification attacks on health data. PLoS One. 2011;6(12):e28071. doi:1371/journal.pone.0028071
  26. Hartman T, Howell MD, Dean J, et al. Customization scenarios for de-identification of clinical notes. BMC Med Inform Decis Mak. 2020;20(1):14. doi:1186/s12911-020-1026-2
  27. Meystre SM, Ferrández Ó, Friedlin FJ, South BR, Shen S, Samore MH. Text de-identification for privacy protection: a study of its impact on clinical text information content. J Biomed Inform. 2014;50:142-150. doi:1016/j.jbi.2014.01.011
  28. Lee H, Kim S, Kim JW, Chung YD. Utility-preserving anonymization for health data publishing. BMC Med Inform Decis Mak. 2017;17(1):104. doi:1186/s12911-017-0499-0
  29. Benitez K, Malin B. Evaluating re-identification risks with respect to the HIPAA privacy rule. J Am Med Inform Assoc. 2010;17(2):169-177. doi:1136/jamia.2009.000026
  30. Janmey V, Elkin PL. Re-identification risk in HIPAA de-identified datasets: the MVA attack. AMIA Annu Symp Proc. 2018;2018:1329-1337.
  31. Zoutman DE, Ford BD, Bassili AR. The confidentiality of patient and physician information in pharmacy prescription records. CMAJ. 2004;170(5):815-816. doi:1503/cmaj.1021826
  32. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5).
  33. Spithoff S, McPhail B, Grundy Q, Vesely L, Rowe RK, Herder M, et al. Virtual Healthcare Services in Canada: Digital Trails, De-Identified Data and Privacy Implications. Toronto: Health Tech and Society Lab; 2022.
  34. Decisions PHIPA 175. Information and Privacy Commissioner of Ontario. Accessed May 20, 2022.
  35. Spithoff SM. Medical-Record Software Companies Are Selling Your Health Data. Toronto Star; 2019. Accessed September 12, 2019.
  36. James L. Race-Based COVID-19 Data May Be Used to Discriminate Against Racialized Communities. The Conversation; 2020. Accessed November 19, 2020.
  37. Tanner A. The Hidden Trade in Our Medical Data: Why We Should Worry. Scientific American; 2017. Accessed November 27, 2018.
  38. Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC). Back on the Data Trail: The Evolution of Canada’s Data Broker Industry. 2018.
  39. Mulinari S, Ozieranski P. Capitalizing on transparency: commercial surveillance and pharmaceutical marketing after the Physician Sunshine Act. Big Data Soc. 2022;9(1):20539517211069631. doi:1177/20539517211069631
  40. Miller FA, Alvarado K. Incorporating documents into qualitative nursing research. J Nurs Scholarsh. 2005;37(4):348-353. doi:1111/j.1547-5069.2005.00060.x
  41. Office of the Privacy Commissioner of Canada (OPC). Consultation on the OPC’s Proposals for Ensuring Appropriate Regulation of Artificial Intelligence. OPC; 2020. Accessed July 28, 2020.
  42. Stockdale J, Cassell J, Ford E. "Giving something back": a systematic review and ethical enquiry into public views on the use of patient data for research in the United Kingdom and the Republic of Ireland. Wellcome Open Res. 2018;3:6. doi:12688/wellcomeopenres.13531.2
  43. Paprica PA, de Melo MN, Schull MJ. Social licence and the general public's attitudes toward research based on linked administrative health data: a qualitative study. CMAJ Open. 2019;7(1):E40-E46. doi:9778/cmajo.20180099
  44. Breeze R. Legitimation in corporate discourse: oil corporations after Deepwater Horizon. Discourse Soc. 2012;23(1):3-18. doi:1177/0957926511431511
  45. Kalkman S, van Delden J, Banerjee A, Tyl B, Mostert M, van Thiel G. Patients' and public views and attitudes towards the sharing of health data for research: a narrative review of the empirical evidence. J Med Ethics. 2022;48(1):3-13. doi:1136/medethics-2019-105651
  46. Barros M. Tools of legitimacy: the case of the Petrobras corporate blog. Organ Stud. 2014;35(8):1211-1230. doi:1177/0170840614530914
  47. Vaara E, Tienar J. A discursive perspective on legitimation strategies in multinational corporations. Acad Manage Rev. 2008;33(4):985-93. doi:5465/amr.2008.34422019
  48. Suchman MC. Managing legitimacy: strategic and institutional approaches. Acad Manage Rev. 1995;20(3):571-610. doi:2307/258788
  49. Massie A. Legitimation in Corporate Discourse: The Case of Enbridge and the Northern Gateway Pipeline [dissertation]. Carleton University; 2016. doi:22215/etd/2016-11656
  50. Pollach I. Corporate self‐presentation on the WWW: strategies for enhancing usability, credibility and utility. Corp Commun. 2005;10(4):285-301. doi:1108/13563280510630098
  51. Winter S, Saunders C, Hart P. Electronic Window Dressing: Impression Management on the Internet. ICIS; 1997.
  52. Coupland C. Corporate social responsibility as argument on the web. J Bus Ethics. 2005;62(4):355-366. doi:1007/s10551-005-1953-y
  53. Short KG. Critical content analysis as a research methodology. In: Johnson H, Mathis J, Short KG, ed. Critical Content Analysis of Children’s and Young Adult Literature: Reframing Perspective. New York, NY: Routledge; 2016. p. 1-15.
  54. Utt J, Short KG. Critical content analysis: a flexible method for thinking with theory. Understanding and Dismantling Privilege. 2018;8(2):1-7.
  55. Grundy Q, Cussen C, Dale C. Constructing a problem and marketing solutions: a critical content analysis of the nature and function of industry-authored oral health educational materials. J Clin Nurs. 2020;29(23-24):4697-4707. doi:1111/jocn.15510
  56. Green J, Thorogood N. Qualitative Methods for Health Research. 3rd ed. Los Angeles: SAGE Publications; 2013.
  57. Harvey L. Critical Social Research. London, Sydney: Unwin Hyman; 1990.
  58. Utt J. Dysconscious policing: a critical content analysis of school resource officer training materials. Understanding and Dismantling Privilege. 2018;8(2):71-89.
  59. Webster F, Rice K, Sud A. A critical content analysis of media reporting on opioids: the social construction of an epidemic. Soc Sci Med. 2020;244:112642. doi:1016/j.socscimed.2019.112642
  60. Richards Z, Thomas SL, Randle M, Pettigrew S. Corporate social responsibility programs of big food in Australia: a content analysis of industry documents. Aust N Z J Public Health. 2015;39(6):550-556. doi:1111/1753-6405.12429
  61. O'Brien BC, Harris IB, Beckman TJ, Reed DA, Cook DA. Standards for reporting qualitative research: a synthesis of recommendations. Acad Med. 2014;89(9):1245-1251. doi:1097/acm.0000000000000388
  62. Patton MQ. Qualitative Research & Evaluation Methods: Integrating Theory and Practice. 4th ed. Thousand Oaks, CA: SAGE Publications; 2014.
  63. Spithoff S, Stockdale J, Rowe R, McPhail B, Persaud N. The commercialization of patient data in Canada: ethics, privacy and policy. CMAJ. 2022;194(3):E95-E97. doi:1503/cmaj.210455
  64. Husereau D, Goodfield J, Leigh R, Borrelli R, Cloutier M, Gendron A. Severe, eosinophilic asthma in primary care in Canada: a longitudinal study of the clinical burden and economic impact based on linked electronic medical record data. Allergy Asthma Clin Immunol. 2018;14:15. doi:1186/s13223-018-0241-1
  65. MCI Onehealth Technologies Inc. MCI Onehealth: Empowering Patients and Doctors with Advanced Technologies to Increase Access, Improve Quality, and Reduce the Costs of Healthcare. MCI Onehealth Technologies Inc; 2020.
  66. Canadian Healthcare Technology. MCI Onehealth Raises $30 Million Going Public. Canadian Healthcare Technology. Accessed January 30, 2021.
  67. Williams DM, Cowan C, Gendron A, et al. The burden of gout in a Canadian primary care population. Value Health. 2015;18(3):A274. doi:1016/j.jval.2015.03.1599
  68. Gerega S, Millson B, Charland K, et al. Characteristics of Patients with Mild to Severe Asthma in Canada (IMSQuintiles and Asthma Canada). Montreal: Canadian Respiratory Conference (CRC); 2017.
  69. Information and Privacy Commissioner of Ontario, CHEO Research Institute, University of Ottawa. Dispelling the Myths Surrounding De-identification: Anonymization Remains a Strong Tool for Protecting Privacy. 2011.
  70. Raphael MJ, Gyawali B, Booth CM. Real-world evidence and regulatory drug approval. Nat Rev Clin Oncol. 2020;17(5):271-272. doi:1038/s41571-020-0345-7
  71. United States Food and Drug Administration (FDA). Framework for FDA's Real-World Evidence Program. 2018.
  72. Benson K, Hartz AJ. A comparison of observational studies and randomized, controlled trials. N Engl J Med. 2000;342(25):1878-1886. doi:1056/nejm200006223422506
  73. Kumar A, Guss ZD, Courtney PT, et al. Evaluation of the use of cancer registry data for comparative effectiveness research. JAMA Netw Open. 2020;3(7):e2011985. doi:1001/jamanetworkopen.2020.11985
  74. Klonoff DC, Gutierrez A, Fleming A, Kerr D. Real-world evidence should be used in regulatory decisions about new pharmaceutical and medical device products for diabetes. J Diabetes Sci Technol. 2019;13(6):995-1000. doi:1177/1932296819839996
  75. Beaulieu-Jones BK, Finlayson SG, Yuan W, et al. Examining the use of real-world evidence in the regulatory process. Clin Pharmacol Ther. 2020;107(4):843-852. doi:1002/cpt.1658
  76. Baumfeld Andre E, Reynolds R, Caubel P, Azoulay L, Dreyer NA. Trial designs using real-world data: the changing landscape of the regulatory approval process. Pharmacoepidemiol Drug Saf. 2020;29(10):1201-1212. doi:1002/pds.4932
  77. Feinberg BA, Gajra A, Zettler ME, Phillips TD, Phillips EG Jr, Kish JK. Use of real-world evidence to support FDA approval of oncology drugs. Value Health. 2020;23(10):1358-1365. doi:1016/j.jval.2020.06.006
  78. Wu J, Wang C, Toh S, Pisa FE, Bauer L. Use of real-world evidence in regulatory decisions for rare diseases in the United States-current status and future directions. Pharmacoepidemiol Drug Saf. 2020;29(10):1213-1218. doi:1002/pds.4962
  79. Mahendraratnam N, Mercon K, Gill M, Benzing L, McClellan MB. Understanding use of real-world data and real-world evidence to support regulatory decisions on medical product effectiveness. Clin Pharmacol Ther. 2022;111(1):150-154. doi:1002/cpt.2272
  80. Health Canada. Optimizing the Use of Real World Evidence to Inform Regulatory Decision-Making. Health Canada; 2019. Accessed September 14, 2021.
  81. Cave A, Kurz X, Arlett P. Real-world data for regulatory decision making: challenges and possible solutions for Europe. Clin Pharmacol Ther. 2019;106(1):36-39. doi:1002/cpt.1426
  82. Li M, Chen S, Lai Y, et al. Integrating real-world evidence in the regulatory decision-making process: a systematic analysis of experiences in the US, EU, and China using a logic model. Front Med (Lausanne). 2021;8:669509. doi:3389/fmed.2021.669509
  83. Health Canada. Strengthening the Use of Real World Evidence for Drugs. Health Canada; 2018. Accessed September 14, 2021.
  84. Marks M. Emergent Medical Data: Health Information Inferred by Artificial Intelligence. Rochester, NY: Social Science Research Network; 2020.
  85. Wetsman N. Hospitals Are Selling Treasure Troves of Medical Data—What Could Go Wrong? The Verge; 2021. Accessed September 24, 2021.
  86. Mandl KD, Perakslis ED. HIPAA and the leak of "deidentified" EHR data. N Engl J Med. 2021;384(23):2171-2173. doi:1056/NEJMp2102616
  87. Narayanan A, Huey J, Felten EW. A precautionary approach to big data privacy. In: Gutwirth S, Leenes R, De Hert P, eds. Data Protection on the Move: Current Developments in ICT and Privacy/Data Protection. Dordrecht: Springer; 2016. p. 357-385. doi:1007/978-94-017-7376-8_13
  88. Grassley C. S.301 - 111th Congress (2009-2010): Physician Payments Sunshine Act of 2009. January 22, 2009.
  89. Fickweiler F, Fickweiler W, Urbach E. Interactions between physicians and the pharmaceutical industry generally and sales representatives specifically and their association with physicians' attitudes and prescribing habits: a systematic review. BMJ Open. 2017;7(9):e016408. doi:1136/bmjopen-2017-016408
  90. Regan PM, Jesse J. Ethical challenges of edtech, big data and personalized learning: twenty-first century student sorting and tracking. Ethics Inf Technol. 2019;21(3):167-179. doi:1007/s10676-018-9492-2
  91. Black Health Equity Working Group. Engagement, Governance, Access, and Protection. (EGAP): A Data Governance Framework for Health Data Collected from Black Communities in Ontario. 2021.
  92. The First Nations Information Governance Centre (FNIGC). Ownership, Control, Access and Possession (OCAP™): The Path to First Nations Information Governance. Ottawa: FNIGC; 2014.
  93. The First Nations Information Governance Centre (FNIGC). Introducing A First Nations Data Governance Strategy. FNIGC; 2020.
  94. Carroll SR, Garba I, Figueroa-Rodríguez OL, et al. The CARE principles for indigenous data governance. Data Sci J. 2020;19(43):1-12. doi:5334/dsj-2020-043
  95. Willison DJ, Trowbridge J, Greiver M, Keshavjee K, Mumford D, Sullivan F. Participatory governance over research in an academic research network: the case of Diabetes Action Canada. BMJ Open. 2019;9(4):e026828. doi:1136/bmjopen-2018-026828
  96. Regan PM. Privacy as a common good in the digital world. Inf Commun Soc. 2002;5(3):382-405. doi:10.1080/13691180210159328
  • Receive Date: 12 November 2021
  • Revise Date: 04 November 2022
  • Accept Date: 03 April 2023
  • First Publish Date: 04 April 2023