Private clinics in Canada are selling access to personal health data without patients’ knowledge, according to a new study that says clients in the pharmaceutical industry are paying millions for this information.

“This is not how patients want their data to be used,” lead author Dr. Sheryl Spithoff told CTV’s Your Morning on Monday. “Patients are generally fine with sharing their data if it’s going to be used for research and health system improvement... but they’re very reluctant to have their data shared or held with for-profit companies.”

Spithoff is a family physician and scientist at Women’s College Hospital in Toronto, and an assistant professor at the University of Toronto. Published in the journal JAMA Network Open early this month, the new study focused on two unnamed health data companies that each had access to between one and two million patient records.

“The entities involved in the primary care medical record industry in Canada—chains of for-profit primary care clinics, physicians, commercial data brokers, and pharmaceutical companies—work together to convert patient medical records into commercial assets,” the study explains. “These assets are largely used to further the interests of the pharmaceutical companies.”

Spithoff’s research uncovered two models for how patient data is sold. In one, private clinics sell health information to a third-party commercial data broker that removes personal information before running analytics for the pharmaceutical industry. In another, private clinics are actually owned by a health data company that uses patient information to develop algorithms for pharmaceutical companies in order to identify and target patients with drug interventions.

In both cases, data is typically used without patients’ knowledge or consent.

“According to a data broker employee, no one sought consent from patients to access and use their records,” the study claims. “Instead, companies appeared to seek out physician consent to access patient records.”

Such practices, the study adds, “could potentially generate hundreds of millions of dollars in revenue.”

Spithoff says the study identified a number of risks with the monetization and sharing of patient data.

“One is that this is likely to give the pharmaceutical industry increased control over medical practices, so we’re likely to see more of a focus on expensive new on-patent drug,” Spithoff said. “We’re also very concerned about how the data are being used—anytime data are been shared, there’s privacy risks to patients.”

A physician interviewed for the study told researchers that patient data is “snatched away.”

“It’s patient’s data but how is it that these companies even can own the data?” the physician said, according to the study. “I don’t see how it should even be legal to provide this information."