This is the first of two parts. Read part 2.

Henry Schein Inc. knows a lot about what goes on in veterinary clinics around the country. By selling and supporting computer programs that manage practice information, Schein can accumulate details on what veterinarians test, diagnose, treat, prescribe, buy and sell, as well as pet owner demographics. With a pending merger, announced earlier this year, Schein will know even more.

The publicly traded international conglomerate is spinning off its animal health division, which reported $3.5 billion in sales last year and active customers comprising 75 percent of veterinarians in the U.S., to combine it with Vets First Choice, an online pharmacy, prescription management and analytics business serving 5,100 practices.

It's difficult to quantify the number of practices to which the new company, Vets First Corp., will have data access but it's easily a majority in this country, plus more abroad. Schein claims its practice information management systems ImproMed and AVImark are used in more than 50 percent of the market in the U.S. In addition, Schein owns several international practice software companies, including Vision, RxWorks and RoboVet.

In 2016, Schein bought a controlling interest in Vetstreet, a marketing and client-communications business that aggregates and analyzes veterinarian and pet owner data and sells reports to industry members, such as pharmaceutical companies. In 2017, Schein acquired eVetPractice. Unlike AVImark and ImproMed, which store practice data on computers at clinics, data in eVetPractice is housed in the cloud and therefore controlled by Schein.

Vets First Choice, for its part, owns VetData, which has provided veterinary data management services for a wide variety of veterinary companies, including Schein and its competitors, for at least 17 years. 

The size and scope of so much practice data in the hands of a single sprawling company worries some veterinarians.

"I don't trust them," said a Texas veterinarian who asked not to be identified over concerns about her relationship with Schein. She had a disquieting experience with the company last year after Schein bought eVetPractice, the system she uses in her clinic. After the sale, she said, Schein representatives only reluctantly admitted to her that her contract with eVetPractice allows the software owner to data mine, a practice of aggregating information to discover patterns and predict outcomes. The information gleaned by mining her data would belong to Schein.

She said she worries her practice information could be used to compete against her, although exactly how, she doesn't know. "Nobody will say how this stuff works," she said.

Her wariness mirrors concerns in the general public about the security or misuse of personal information, which are fueled by data-mining controversies at Google and Facebook.

While most veterinarians aren't spearheading a fight for greater data protection, some practice owners may be voting with their feet. Kurt Green, CEO of Vetsource, an online pharmacy, prescription management and analytics business that competes with Vets First Choice, said some in the profession have expressed concerns about being folded into a much larger company that had "all sorts of data about their practice," he said. According to Green, Schein currently has an exclusive partnership with Vetsource.

Dr. Michael Thomas, a practitioner for more than 50 years and vice president of Veterinary Study Groups, which works to support independent practice owners, has been outspoken about his concerns over what he calls "data thirsty" companies in this era of consolidation. The Henry Schein-Vets First Choice merger announcement increased his unease.

It takes veterinarians years — sometimes decades — to build up a practice and a database, and then veterinarians just give it up, he said. "They are stealing our most valuable data."

Thomas and other veterinarians have voiced concern about user agreements that allow data-collecting companies to do whatever they want with data. They worry that practice information such as client purchasing records are being sold to or shared with companies, like online pharmacies that will directly market to pet owners, effectively cutting veterinarians out of the picture. 

Building a valuable database

The majority of clinics depend on a practice information management system (PIMS). Usually, electronic patient records are at the heart of a PIMS. These include the animal's basic information, such as name, age, sex, species, breed, weight, microchip, allergies, etc.; pet owner details; and, to varying degrees, medical history, including vaccinations, treatments, diagnoses, lab work, radiology records, consultation notes, prescriptions and medications. These programs also provide tools for billing customers, scheduling appointments and sending reminders.

In general, everything in the veterinary database is entered by the veterinarian or clinic staff. Pet owners may not realize the information is apt to be shared beyond the clinic's walls.

Some practice information management systems, including Schein-owned ImproMed and AVImark, house data on clinic computers. That data can be extracted by the PIMS company via syncing programs installed with the PIMS, or later, for system support, data back up and communicating with clients. 

Schein responded to the VIN News Service's general questions about the company and the merger but did not address questions about its data-collecting and data-sharing practices.

The AVImark and ImproMed terms of service state: Schein "may access electronic records regarding the Customer's clients and their pets ('Individual Information') from Customer's locally installed Software and the database maintained in connection with such Software."

In addition, veterinarians often subscribe to add-on programs to manage inventory; run communication campaigns to clients; provide portals for pet owners to interact with the clinic; support a branded online pharmacy; and other services.

These add-on programs use information in the PIMS. Many rely on data management companies, such as VetData, to extract it. The data management companies have created software that pulls the information from the clinic-based PIMS in some cases without the express permission or cooperation of the PIMS companies. Veterinarians agree to have that information extracted for their benefit when they sign up for the third-party program.

One hazard of this arrangement is that veterinarians can lose track of what's being pulled from their database. "I've been on servers where programs were still running and syncing after cancellation. The veterinarians had no idea," said John Dean, co-founder of VINx. Owned by Veterinary Information Network, the parent of VIN News, VINx is an example of a third-party software provider. It offers cloud-based tools for client communications and practice management.

The data companies standardize, combine and analyze medical, revenue, inventory, operations and pet owner demographic data for the benefit of subscriber veterinarians and, in many cases, they repackage this information into reports and analyses for other companies. 

The value in the data is what can be learned from it, said Dr. Jon Lustgarten, a veterinarian and president of the Association for Veterinary Informatics (AVI), a nonprofit organization that aims to expand the use of clinical information to improve the quality and safety of patient care.

Good informatics can be a boon to practice owners. They can provide a picture of a practice's financial performance over time and as compared with other clinics, or reveal ways to save money or generate additional income, Lustgarten said. For example, crunching the numbers might enable an owner to find wasted time in schedules that can be put to better use; or create reminders to encourage pet owners to renew prescriptions on time; or offer discounts on inventory that is close to expiring; or determine whether sending emails is effective; and so on.

"For clinicians, good informatics can also provide real-time systems to assist them with detection of events, such as vaccine reactions or disease outbreaks," Lustgarten said.

Busy veterinarians with little background in data-crunching rely on third parties with access to large pools of comparable data to provide these analytics. These companies, in turn, find other opportunities to "derive value" — in other words, profit from — clinic data.

"Some of the value might be realized by third parties, who buy the insights derived from your data," Lustgarten said. Those insights might include what drugs are being prescribed, which lab tests are being ordered, how many pets are insured — information pharmaceutical, laboratory and insurance representatives can use to target their sales efforts. 

For Schein, with its large veterinary distribution business, PIMS data is "incredibly valuable," he added. Collecting information on all the transactions for its PIMS customers means Schein "knows demand in real time" for products sold by its distribution division and its competitors. This allows Schein to predict clinic purchases and target them with sales deals just as they are most likely to seek those products, Lustgarten said.

How practice data can be deployed and its tremendous worth to companies is hinted at in a lawsuit brought by Idexx Laboratories against Vets First Choice and two former employees. A leading veterinary diagnostics company, Idexx increasingly is a technology company, as well. The suit alleges breach of contract and misappropriation of trade secrets by the two former Idexx employees who now work for Vets First Choice.

Like its competitor Schein, Idexx owns widely used practice information management software — namely, Cornerstone and DVMAX. Idexx also owns at least seven cloud-based practice services. Two of these it acquired within the past year: rVetLink, a program to manage referrals between general practice clinics and specialty hospitals, and Smart Flow, a system for managing clinic workflow.

Using its "customized software," the suit explains, "IDEXX is able to aggregate large swaths of data pertaining to buying trends, purchasing history, treatment history, and customer engagement with various product manufacturers and product types."

The suit goes on to explain: "With this information, IDEXX, through its business analysts … [is] able to thereafter create customized eCoupon programs for certain pharmaceutical and pet food/pet healthcare product manufacturers."

Whose data is it?

Paper Medical Records

VIN News Service photo

Some practices use paper medical records as a backup to electronic systems. Paper-only may be the only way to really guarantee clinic data stays on the premises.

The European Union recently enacted General Data Protection Regulation (GDPR) that takes the side of the consumer, instituting rules that give individuals greater control over how their digital information is collected and stored. These sweeping regulations, which went into effect in May, require those handling personal information to lay out in clear language how it will be used and obtain consent for that use. They also must erase an individual's information upon request.

The California Consumer Privacy Act of 2018, which is similar to GDPR, also aims to increase consumer control. Passed in June and effectively starting in 2020, the legislation gives Californians the right to see what information has been collected, what types of companies have bought it and the ability to request information be erased and/or not sold.

Practice information is a different animal because pet owners aren't inputting their information directly, or downloading apps or accepting cookies that track or collect data. Information in the clinical record is mostly added by veterinarians and their staffs, for the most part. For that reason, Thomas said, he believes practice data belongs to practices. He also thinks veterinarians should be compensated for the use of that data and that privacy policies and user agreements should limit what companies do with the data.

The control of data also is shifting with changes in technology. Veterinarians exercise control over their clinic data when they decide to use this or that software, which will extract data from their PIMS. But PIMS vendors have been modifying the architecture of their software to make it more challenging for third parties to extract clinic data on their own, Lustgarten said. In addition, cloud-based practice information management systems give the PIMS company greater control over the data. With some exceptions, third parties must coordinate with the PIMS company to extract data that the veterinarian wants to share.

Dr. Stephen Pittenger, a veterinarian in Houston and former president of the Association for Veterinary Informatics, worries about data harvested for marketing and sales purposes and sold to entities over which the veterinarian has no control. "When the data is sold to a data broker, advertising company or any monetization-related service, the horse is out of the barn," Pittenger said.

Data brokers, in particular, have wide latitude in how they handle data. In 2014, the Federal Trade Commission issued a report that determined the data-broker industry operates with "a fundamental lack of transparency." The commission asked Congress to make data-broker practices more visible and to give consumers greater control over their data. None of its recommendations has become law.

User agreements for ImproMed and AVImark promise to safeguard unauthorized disclosure of individual information but then generally leave the door open to unlimited aggregating, sharing, exchanging and selling of data.

The AVImark license agreement states that Henry Schein Veterinary Services (HSVS) can "access, analyze and aggregate Customer Data … that it gathers … and may provide such Customer Data and other information to third parties on a non-personally identifiable (aggregated) basis."

It goes on to say, "Individual Information that personally identifies clients or their pets … will not be exchanged or sold," with the caveat that such information "may be exchanged among HSVS, its subsidiaries, affiliates and service providers as needed for business purposes…" or for "joint marketing partners to present certain offers."

The AVImark agreement also lists four reasons it may disclose individual information including "as reasonably necessary to provide the services Customer has requested."

Raphael Moore, general counsel for VIN, reviewed the license agreement and described these permissions as "very broad and sweeping."

"Practically speaking, my information will be shared with anyone HSVS wants to market with," Moore said. "I have no control who that is, what they in turn do with my data, how it is protected, etc."

Not only do HSVS agreements give data companies enormous freedom, they put unrealistic and possibly not fully appreciated responsibilities on the veterinarian.

For example, the terms and conditions for Vetstreet, the communications service controlled by Schein, covers much of the same ground as the AVImark and ImproMed license terms regarding sharing customer information.

Thirteen hundred words into the document, it states: "Customer [the veterinarian] is solely responsible for obtaining and maintaining or verifying that it or its organization has obtained and is maintaining all Client consents and other legally necessary consents and permissions required or advisable for Vetstreet to send communications to clients on Customer's behalf and to perform the Service(s) hereunder."

This language is "throwing the customer under the bus," Moore said. "Few [veterinarians] have 'obtained and [are] maintaining all Client consents … required or advisable.' Practically speaking, that just does not happen. So, while the vendor may be reducing their own culpability, they are essentially dumping it on the unwitting practice owner."

The veterinarians' responsibility is reinforced by the European Union's new rules. These cover any company holding personal data for individuals residing in the EU, regardless of the company's location. For a clinic, Moore said, that "personal data" could be as simple as a communication with a pet owner traveling in Europe and checking on a pet that's boarding with the veterinarian.

While the GDPR requires veterinarians who collect personal data to disclose and get consent, data processors (such as PIMS companies), must comply as well. "For example, since the clinic needs to promise their client the ability to forget them under GDPR, Schein must have a mechanism to carry out the erasure process on behalf of the clinic; otherwise, the clinic will not be able to be in compliance," Moore said. "Similarly, if Schein shares all of the client information, the clinic must disclose that as part of their consent process."

Unlike in human medicine, which has the Health Insurance Portability and Accountability Act (HIPAA), there is no federal legislation regulating the protection and use of veterinary medical health information. However, 35 states address the "release of veterinary records" in their practice acts, according to research by the American Veterinary Medical Association last year. The majority call for some degree of confidentiality and/or require client consent for releasing records. Fifteen states have no such provision in their practice acts.

Moore said it's possible that PIMS usage of client data may violate confidentiality requirements in some veterinary state practice acts. Again, PIMS vendors do not take any responsibility for that. The terms and conditions leave it to clinics to make sure they comply with their individual state regulations.

Concerns range widely

Promises that data will not be personally identifiable — if they are even made — are hard to enforce.

Keeping data anonymized isn't easy, Pittenger said. "It all depends on what data is pulled in the beginning — who makes it anonymous? If I pull all your practice data and THEN promise to strip out addresses and names and only keep the ZIP code for general regional data analysis purposes, how do you know that I actually did that?" he asked. "What if I [promise] to do that for a single application, but then sell the whole data set to someone for a different project, which wasn't covered in our agreement?"

The FTC, which is responsible for stopping deceptive and unfair practices in the marketplace, intervenes when companies fail to live up to promises about how they will handle personal information.

"Since 2001, the Commission has taken enforcement action and obtain[ed] settlements in approximately 60 cases against businesses in a wide range of industries that it charged with failing to provide reasonable and appropriate protections for consumers' personal information," said Juliana Gruenwald, an FTC spokesperson.

The worry that practice data might be used by competitors isn't hypothetical. There was a time, for example, when veterinarians did not want to share rabies vaccination records with local government. "Before that information submitted to governments was classed as protected, people could actually obtain it … and then go solicit those clients for veterinary services," Pittenger said. "Unfortunately, some veterinarians did just that."

Practice data can also move between businesses and end up in a competitor's hands. The Vets First Choice privacy policy lays out that data can be sold like any other business asset. It states: "In the event of a corporate sale, merger, reorganization, dissolution or similar event, your information may be part of the transferred assets."

That sort of data transfer happened in 2011 with the sale of Vetstreet to VCA Antech, which moved control of clinic information for nearly 5,000 veterinary practices to the owner of the nation's largest chain of stand-alone veterinary hospitals, VCA. Although VCA claimed that practice information would be stripped of identifying details and protected by strong privacy agreements, some veterinarians told VIN News those assurances weren't enough.

"VCA purchasing Vetstreet is a conflict of my interest to keep corporate veterinary hospitals out of my business," Dr. Barbara Kempf, who was running a solo practice in Florida, said at the time. "As quickly as possible we will be dropping the previously awesome Vetstreet."

The company said it was setting up internal auditing procedures to provide for third-party reviews of its privacy policies. Vetstreet did not respond to VIN News requests to find out what happened with the auditing process. VCA sold its controlling interest in Vetstreet to Schein in 2015.

Along similar lines, some practitioners are concerned that data amassed in the Vets First Choice-Henry Schein merger may be used to cut them out of prescription sales.

Despite the fact that the Vets First Choice business model is built around the veterinarian, practitioners including Thomas suspect that Vets First Choice aims to take its home-delivery business direct to pet owners — using clinic-supplied practice data — leaving veterinarians to simply write prescriptions.

In response to these concerns, a Vets First Choice spokesperson Laura Duncan reiterated that "neither Vets First Choice nor the Henry Schein animal health division engages in direct-to-consumer sales." In addition, she said Vets First Choice CEO Ben Shaw preemptively addressed these concerns during an April 23 investor call by stating that "the mission of Vets First Corp. will be to help empower veterinarians with greater insight into gaps in patient care, and to help drive better health and financial outcomes via both online and in-office channels."

Alexander Kates, co-founder of Vetcove, a Kayak-style shopping site for veterinary practice supplies and pharmaceuticals, is concerned about practice information management systems collecting clinics' dispensing information. "If somebody knows what products a pet owner is buying, what ailments their pets have, do you still need the veterinarian beyond the script they write?" he asked. "Can corporate entities target pet owners with services and products, and not necessarily have the veterinarian included? That's the part that I think practice owners overlook."

Launched in 2015 and now serving 5,500 clinics, Vetcove competes with Vets First Choice in some categories. Vetcove promises not to sell clinic data. "It's harder than it has ever been to run an independently-owned vet hospital," Kates said. "If veterinarians lose the ability to sell products to pet owners, their already dire financial positioning will become much worse."

What are the alternatives?

The sale of Vetstreet prompted some veterinarians to quit the service over concerns about their data under new ownership. But avoiding all software and web-based programs that reserve the right to share or sell practice data in some form or other probably is not realistic, since it means forgoing benefits veterinarians use to grow their businesses, such as communications and marketing programs.

"The [only] way to fight back is by not using programs that people want or need to use," said Dr. Don Woodman, a practice owner and AVImark customer in Florida. "This is like telling consumers not to use Instagram and Facebook."

Woodman believes mom-and-pop veterinary hospitals, in particular, are at a big disadvantage. "We have no negotiating power, little formal business knowledge and there is an asymmetry of knowledge in so much, as we don't really know who is taking our data, what they are taking it for and how its use benefits or harms us," he said.

Veterinarians who find alternative services that keep tight controls over practice information and are willing to undergo the hassles of switching from one program to another, face yet another potential problem.

If these programs attract customers, succeed and grab market share, Woodman asked: "What is to stop that program from being acquired by Schein or Idexx … or some other company?"

Veterinarians and data experts cite one other stumbling block to the effort to rein in the widespread collecting and selling of practice data: indifference. Concern over the potential consequences of companies amassing practice data may bother some, but not all, veterinarians.

When Dean co-founded VetVision, the precursor to VINx, back in 2006, he conceived it as "a safe haven that would not use veterinarians' data against them and would protect them." Like third-party data management companies, VINx extracts practice information directly from the PIMS for its practice tools. Unlike those companies, the VINx software license promises users that their data "may not be shared, sold, rented or otherwise disclosed by [VINx] or by VIN, irrespective of whether or not it identifies individual Clients."

After 12 years of developing this alternative who worry about their PIMS data, Dean has a clear takeaway.

"For many users, they don't care," he said. "They don't think about it."

Correction: This story has been changed to correct the description of Vetsource partnerships. The story originally stated that Vetsource has an exclusive partnership with Schein. It is the inverse that is true, according to Green: Schein has an exclusive partnership with Vetsource. For its part, Vetsource also has partnerships with MWI and Patterson.

Part 2: Practice records hold big promise for veterinary research