On January 23, Global News published an article detailing a privacy complaint submitted by a group of doctors against a U of T research network. The complaint, which triggered an ongoing investigation by Ontario’s privacy commissioner, alleges that the University of Toronto Practice-Based Research Network (UTOPIAN) violated Ontario privacy law when it collected more than 600,000 patient records without patients’ consent. However, Bernard Dickens, a bioethics and legal expert, explained that the rules governing privacy in research are far less stringent than those that govern the doctor-patient relationship. 

The database

Established in 2013, UTOPIAN is one of the largest primary care research networks in North America, according to a spokesperson from the Temerty Faculty of Medicine (TFM). A 2019 report from the network noted that the UTOPIAN database includes patient records from more than 500 Ontario family physicians, with 390 participating sites located within the GTA. At the time of the report, the project included records from approximately 186,000 patients between the ages of 17 and 40, as well as 90,000 records from patients younger than 17. According to the spokesperson, U of T’s Health and Wellness Centres do not contribute data to the project. 

The UTOPIAN database does not display patients’ names but details patient information including family medical history, demographics such as education and ethnicity, health conditions, medications, allergies, and age. 

Researchers interested in using the database must submit their clinical research proposals to UTOPIAN for approval from the network’s Scientific Advisory Committee (SAC). SAC members include 14 representatives from the sites participating in UTOPIAN, individuals associated with U of T’s Department of Family and Community Medicine (DFCM), and three patient and community representatives, which the network added in 2016. 

Researchers have used UTOPIAN data in large-scale projects researching diabetes, depression, and treatments for Alzheimer’s disease. According to the UTOPIAN website, researchers could also use these data to identify patients who may be eligible to participate in clinical trials. To maintain privacy, a UTOPIAN analyst uses a list of traits identified by the researchers to identify potential candidates, then contacts the family physicians associated with those records. The physician then contacts patients, asking if they’d like to receive information about the trial.

UTOPIAN contributed data to the Primary Care Ontario Practice-based Learning and Research Network (POPLAR), a dataset containing almost two million patient records from six university research networks across the province and the Alliance for Healthier Communities. The network also shared data with two national networks: the Diabetes Action Canada Data Repository, which aims to improve outcomes for patients living with diabetes, and the Canadian Primary Care Sentinel Surveillance Network, which collects data for research on a variety of conditions. 

After Global News reached out to U of T with questions about the network, UTOPIAN paused data collection and transfer. Currently, the network is not approving new projects. In an email to The Varsity, the TFM spokesperson wrote that UTOPIAN paused data collection and transfer after the most recent UTOPIAN research protocol ended because the network is currently developing a new protocol in preparation for its integration into POPLAR.

Legal issues

In summer 2022, a group of GTA doctors submitted a complaint to the Information and Privacy Commissioner of Ontario (IPC) against UTOPIAN. The doctors allege that, by failing to obtain patient consent, the network broke patients’ trust as well as Ontario privacy law. In an interview with Global News, one of the doctors who helped file the complaint also claimed that they did not receive adequate explanation of UTOPIAN’s process before agreeing to sign over patient data. 

In an interview with The Varsity, Bernard Dickens — professor emeritus of Health Law and Policy in the Faculty of Law, the Faculty of Medicine, and the Joint Centre for Bioethics at the University of Toronto — noted the differences between doctor-patient confidentiality followed by family doctors and privacy laws governing health research. According to a document from the IPC, the Personal Health Information Protection Act (PHIPA), which governs patient privacy in Ontario, “permits the collection, use or disclosure of personal health information for research purposes without an individual’s consent” due to the “importance of health research.” 

Dickens echoed the importance of large databases of patient charts and noted the difficulty of obtaining patient consent for inclusion in such databases, particularly when the data collected may be used for a variety of different projects. “The public health system depends on mining aggregate data,” he said. According to Dickens, requiring researchers to obtain consent from hundreds of thousands and even millions of patients would “make it prohibitively expensive to get the information that can be health preserving and even life saving.”

Although the PHIPA allows researchers to collect data without patient consent, their research must meet certain guidelines. Researchers must submit proposals to a research ethics board, which must consider whether the research requires the use of patient data, is in the public interest, and includes adequate safeguards to protect patients’ privacy. The ethics board must also consider “whether obtaining consent is impractical,” according to the IPC. Researchers can disclose data to other researchers provided that the disclosure is part of a research project approved by a research ethics board. 

According to Global News, which obtained a copy of the complaint, the doctors alleged that UTOPIAN did not meet the guidelines necessary to circumvent obtaining patient consent. The complaint argues that “Taking private and confidential medical data to simply populate another corporate entity’s privately-owned database is not research.” 

The complaint also alleges that UTOPIAN collected patients’ credit card information, which is often used to pay for services not covered under Ontario Health Insurance Plan. “Many, if not the majority, of patients, would be outraged if they found out that this [project] has happened,” reads the complaint, as relayed by Global News.

In a statement to The Varsity, the spokesperson for TFM wrote, “Like similar research networks across Canada, UTOPIAN adheres to the highest standards of data collection, storage and use to ensure the security and privacy of individual patient information.” According to the spokesperson, the faculty is working with the Information and Privacy Commissioner of Ontario to address any questions arising from the complaint.

The Ontario privacy commissioner’s investigation is ongoing.