Keep Canada's Health Data Safe and in Canada, Experts Say

Medscape

6 hours ago

Canada must move quickly to safeguard its health data, experts say, adding that the need has become urgent in today's changing political climate.
'Health data are critical to health systems in Canada, but the potential of these data to be accessed and used by foreign entities for surveillance purposes without consent is concerning,' Michael Geist, professor of law and Canada research chair of internet and e-commerce law at the University of Ottawa, Ottawa, and coauthors wrote in a commentary published on July 28 in the Canadian Medical Association Journal.
Kumanan Wilson, MD
'Health data are going to be extremely valuable going forward, not just for the provision of care, but also for the emerging health artificial intelligence [AI] industry,' co-author Kumanan Wilson, MD, CEO of Bruyère Health Research Institute and internal medicine specialist at the Ottawa Hospital, Ottawa, told Medscape Medical News .
A Multipronged Approach
Canada's health system mostly relies on US providers to manage electronic medical record systems for hospitals. These providers store encrypted data on servers that, though in Canada, are owned by US companies. 'We need to develop a sovereign Canadian cloud server, and that will take time, because it will have to provide the same functionality as the American servers. Those companies are giants because they are very good at what they do. Our ability to meet the standards that they provide is not here now,' he added.
The US currently can use Canadian health data. 'For example, the recent US Clarifying Lawful Overseas Use of Data Act allows US law enforcement to access data held by US companies in other countries and could be a threat. We would rather see the US be unable to use our data. Canadian companies must have access in a privacy-secure way to support Canadian industry,' said Wilson.
'We also need to have AI algorithms that are based on our population. We can't be importing an algorithm built in the US and applying it to the Canadian population, because it's not the same as our population,' Wilson added.
The authors suggest the following multipronged approach to addressing these issues:
Ensure that health data are secure by requiring encryption by default.
Require health data to be hosted on Canadian soil.
Strengthen Canadian privacy laws against the disclosure of data to foreign countries without consent.
Invest in and support the creation of Canadian cloud servers to ensure that data are held in Canada by Canadian providers.
Encryption: No Panacea
Victoria Lemieux, PhD, professor of archival science at the University of British Columbia in Vancouver, agrees that Canadian health data must be protected. But she is not convinced by the solutions that the authors have proposed.
Victoria Lemieux, PhD
'Encryption does not solve the problem entirely, as we are now on the brink of quantum computing that has the potential to break standard encryption,' Lemieux told Medscape Medical News . 'Overreliance on encryption as a solution risks overlooking the need to ensure that all encryption used is quantum-safe. Rather than recommending encryption as a solution, I would prefer to see a recommendation that a range of privacy-enhancing technologies be employed to protect our health and other data,' Lemieux said.
However, she does support investment in a Canadian cloud infrastructure. 'We face the same issue that Europe does, since we have become overly reliant on US technology firms. If we don't hold and store the data in Canada on Canadian servers run by Canadian companies, then we aren't really in control,' said Lemieux. 'A partnership with European cloud providers might help us move away from our reliance on US tech and help us develop secure and scalable alternatives.'
Health data can be kept in the locations where it originates and be shared freely, when necessary, Lemieux continued. 'I have developed such technology, which currently is applied to archives and cultural heritage, but there's no reason it cannot be applied in healthcare as well.'
But focusing on cloud technology development overlooks Canada's overreliance on US tech firms for AI, Lemieux noted. 'We need to ensure that the models we are using preserve privacy, comply with our Canadian values and how we want our data to be used, and do not divulge sensitive Canadian data to unauthorized parties,' she said.
'AI bots, whether from the US, China, or elsewhere, should not be allowed to range freely over our data, extracting value and information that does not come back to benefit Canadians. We must do more to protect ourselves from these bad data practices,' Lemieux added.
More protection in Canadian privacy laws about disclosure to foreign jurisdictions is needed, said Lemieux, but these laws must be strengthened for the digital age.
'A law is only as good as a government's willingness to enforce it. If we take the recent Canadian government's bowing down to the US on the Digital Services Tax [a 3% tax on certain revenues of large digital service providers], I question whether we have the geopolitical clout to enforce such laws. But that's not an argument not to put the laws in place. We're better with them than without them.'