AVImark
On the Saturday after Thanksgiving, clients of a clinic in East Lyme, Connecticut, received an email offering "Cyber Weekend Deals" on flea, tick and heartworm preventives and other products in the practice's online store. A second message followed two days later, offering an additional 10 percent discount.
The messages were sent by Vets First Choice, a company that provides online pharmacy services to veterinary clinics. The emails were sent purportedly on behalf of the clinic, but the practice owner said she wasn't and never has been associated with Vets First Choice.
In November, the owner of a clinic in Houston, Texas, received via email a license agreement from Henry Schein Veterinary Services for his AVImark practice-management software. A user of AVImark since 1992, he noticed that for the first time, the agreement gives Schein wide latitude to collect and use information about his individual clients.
These two seemingly disparate events involve companies that are about to unite to form a single entity that will be focused in part on collecting data for its own commercial purposes.
On Feb. 7, Henry Schein plans to complete a spin-off and merger of its animal health division with Vets First Choice. Together, they will form a business to be called Covetrus.
The new company combines Schein’s veterinary products and practice information software business, which reported $3.5 billion in sales last year and active customers comprising 75 percent of veterinarians in the U.S., with an online pharmacy, prescription management and analytics business.
Letters
When the merger was announced last year, the companies said in a joint Securities and Exchange Commission filing that they expected "accelerated revenue growth from the adoption of the Vets First Choice platform across the HSAH [Henry Schein Animal Health] customer base." Vets First Choice software already extracts data from 5,100 practices for its services. When it combines forces with HSAH, Vets First Choice could pluck information from practices on an even greater scale.
At the time of the announcement, a coterie in the profession sent up warning flares about the prospect of one conglomerate amassing veterinary practice data. They worried that allowing client information to be shared with third parties violates the confidentiality of veterinary medical records. They also worried that their practice information might be used by rival clinics, online pharmacies or others to compete against them.
More veterinarians have since joined the chorus of concern as the implications of data mining become real. Some veterinarians are so alarmed by the new license agreements for Schein's AVImark software that they've refused to renew service contracts, resigned to do without technical support or software updates from the company. Others are renewing while actively looking for replacement software with tighter controls on clinic data.
How Covetrus could amass veterinarians' and pet owners' data
Vets First Choice's Thanksgiving-weekend flub wasn't a singular event. Owners of at least three other hospitals report the company emailed clients without their approval or knowledge. These misfires illustrate what can happen when outside companies have unfettered access to a hospital's hard drive, critics say. They also strike at the heart of the Covetrus strategy of extending Vets First Choice software to the entire Henry Schein Animal Health customer base.
‘Does this make anyone nervous?’
AVImark began explicitly defining its terms for handling practice information in its license agreement sometime after October 2017, judging from a VIN News Service review of past AVImark agreements. Schein declined repeated requests by VIN News to address veterinarians' concerns and answer questions about its user agreement and data collection practices.
VIN News is part of the Veterinary Information Network, a private company that provides online community and content for the veterinary profession. One of VIN's offerings is VINx, a set of tools for client communications and practice management.
Veterinarians who said they saw Schein's data-collection terms for the first time in 2018 expressed alarm and frustration on closed AVImark user groups on Facebook, Yahoo and message boards.
The veterinarians pointed to this clause: “Individual Information [pulled from PIMS] that personally identifies clients or their pets … may be exchanged among HSVS [Henry Schein Veterinary Services], its subsidiaries, affiliates and service providers as needed for business purposes."
"Does this make anyone else as nervous as it does me?" a veterinarian who has used AVImark for more than two decades asked his colleagues.
The veterinarian, who spoke on condition of anonymity due to concerns that AVImark could create problems for his practice, was among those so disturbed by the company's information-sharing terms that he initially intended to let his service contract lapse. But he began having problems with the software, so he felt compelled to renew and accept the terms.
In interviews detailing his experience, he said his service renewal with AVImark used to come by postal mail and did not request a signature. Then last year, for the first time in his memory, he received the notification and license agreement by email, along with a request to sign to accept the terms. That prompted him to do what most people don't: He read the entire 1,113-word agreement.
What he found dismayed him. He interprets the terms as allowing Schein to access all the information in his database and share it — including identifiable data — with third parties.
He specifically is concerned that Vets First Choice will use his data "to pinpoint market to my clients." He imagines a scenario in which Schein drills into his practice information to identify all feline patients that are on a flea preventive, and what they pay for the preventive; then Vets First Choice contacts those clients directly to make them a better offer.
"In my mind this is like the old analogy of shooting fish in the barrel," he wrote in a post. "Except in this case, I am the fish in the barrel and I own the gun, but (by agreeing to this document) I give the gun to Henry Schein to start shooting."
The veterinarian said he relayed his concerns to his AVImark representative, who told him he hadn’t seen the language before and that it might have something to do with the merger. According to the veterinarian, the agent checked with his superiors and Schein’s attorneys, and confirmed that practice information, including information that identifies individual clients, could be shared within the company, which soon will include Vets First Choice. He said he was also told that the company would not change the language of the agreement.
"What kicks me in the teeth is, I am writing them a check and they are getting all my data," he told VIN News. He and other veterinarians said they pay between $900 and $1,300 annually for technical support.
"It makes me wish in some ways I would have continued the old paper record way," he said.
A South Carolina veterinarian, who also didn’t want to be identified because he’s currently an AVImark and Vets First Choice customer, had similar concerns. "They could circumvent our entire pharmacy using our data," he said. In a few months, he plans to switch his practice software to ezyVet and his online store to Midwest Veterinary Supply, both of which are much smaller. He believes their privacy policies will do more to protect his practice data.
Dr. Greg Upton, the veterinarian in Houston and AVImark user since 1992, also has decided to let his technical support lapse over concerns that Schein is taking advantage of veterinarians.
"There's no way I would have allowed them to do that," he said, referring to collecting and sharing his client data as outlined in the license agreement. "It's a huge thing to me."
There is no evidence to date that Schein has done anything to hurt veterinarians with data extracted from AVImark users. The AVImark Professional Service Agreements from 2016 and 2017, copies of which Upton provided to VIN News, make no reference to electronic records. VIN News could not ascertain whether Schein had separate agreements pertaining to data in place at that time.
A few months after Upton declined to renew his service contract, he received a two-page document from Henry Schein that outlines its "philosophy on data." The statement defines what practice data Schein maintains and how it uses it. It also explains that the way to withdraw consent from Schein's use of the data is to unsubscribe from Schein services that use data.
None of the three AVImark customers VIN News interviewed has received information about what the merger means for their service or their practice data. It’s possible Covetrus will issue its own license terms and data privacy statement in coming weeks.
‘The legal landscape is constantly changing’
Upton’s main concern is the privacy of his clients. He worries that in allowing Schein access to client data, veterinarians might be in violation of some state practice acts. If after the merger, for example, Vets First Choice sent coupons to his clients based on information in his database, he said, "I have just violated my clients’ confidentiality big time."
And whether it's allowed by law or not, Upton added, "Ethically, it just doesn’t seem right."
Legally, the situation is complicated. Unlike in human medicine, which has the Health Insurance Portability and Accountability Act (HIPAA), no federal law regulates the protection and use of veterinary medical health information. However, 32 states require in their practice acts client authorization to release patient records with some exceptions, according to research by the American Veterinary Medical Association. The majority call for some degree of confidentiality.
Section 801.353 of the Texas Occupations Code states, "A veterinarian may not violate the confidential relationship between the veterinarian and the veterinarian’s client … [and] a veterinarian may not be required to release information concerning the veterinarian’s care of an animal" except with a client's authorization, a court order or court subpoena, to verify rabies vaccination or for other public health purposes.
Michelle Griffin, general counsel for the Texas Board of Veterinary Regulators, told VIN News she was not familiar with the data-sharing terms in the AVImark agreement and declined to comment on whether veterinarians allowing AVImark to share data as outlined in the agreement violates state rules.
Dr. Lance Roasa, a practicing attorney and veterinarian in Nebraska who teaches veterinary students around the country about veterinary practice acts, believes that under a strict interpretation of the Texas state practice act and rules, a veterinarian in that state sharing information through AVImark could be in violation. Furthermore, he said, the code is so general about confidentiality that its restrictions could encompass even aggregated or anonymized data.
Roasa believes that in states such as Texas with confidentiality rules, AVImark users should obtain their clients’ written consent to share their data. He suggested including in new-client information forms language similar to that found in the AVImark contract. "The legal landscape is constantly changing, and this is one of the things that needs to be updated," he said.
Roasa co-owns four practices in Nebraska, of which two use AVImark. What annoys him about Schein’s data collection is its surreptitious approach. "I would have no problem with it if it were in full transparency — if a company comes out and says, ‘We’re going to do this, and this is why,’ " he said. "It's the whole secretive nature that probably bothers me the most."
As a lawyer acutely aware of the implications of data sharing, Roasa avoids using software that automatically pulls records, especially Schein-owned programs such as Rapport, a communications and reminder service, as well as Vets First Choice. That is one way, he said, that AVImark users can at least impede the ease with which Schein extracts data. Clinics that want to use a reminder service, online pharmacy or other services that interface with the practice database should consider using non-Schein services, Roasa recommended.
That said, Roasa believes Schein deliberately makes it hard to integrate with non-Schein providers "because they want to push people to their own reminder system, and their own, now, pharmacy system," he said. He added, "My fear is that everything is under one roof, that could mean large-scale data aggregation."
The degree to which Vets First Choice and Rapport push for integration, he believes, is a sign of how much Schein wants access to practice data. "The salesforce in Vets First Choice are so pushy about allowing Vets First Choice to access AVImark data; it's almost their number one thing," he said.
Other veterinarians concurred, relating experiences suggesting that Vets First Choice sales representatives were aggressive not just in selling the service but in getting their software onto practice hard drives, if only for trial periods.
'It's making me lose my trust'
VFC HQ
Vets First Choice/Business Wire
The proposed new corporate headquarters for Vets First Choice in Portland, Maine, will also serve as the home base for Covetrus, after the company's merger with Henry Schein Animal Health.
Four practice owners told VIN News that during the past six months, Vets First Choice had emailed offers to their client list without the veterinarians’ knowledge or authorization. They said the error cost them money in having to honor discounts offered in the practice's name, and time spent tracking down the source of the emails. They fear the mailings also might have hurt their reputations with some clients.
VIN News contacted Vets First Choice to ask about the cases. Company CEO Ben Shaw was not available for an interview. In lieu of responses to specific questions, Kini Schoop, director of public relations, offered a copy of the company’s Data Privacy Values and the following statement:
"Acting with integrity, including protection of intellectual property, data privacy and information security, is a core value at Vets First Choice. We operate at best practices and in accordance with state and federal laws. We ensure explicit permission from veterinarians for all actions, and practices have full control of the platform."
Schoop added that after this article is published, the company might respond in a letter to the editor.
The instances of apparent privacy breach affected veterinarians who were willing participants with Vets First Choice and veterinarians who were not.
Dr. Stacey Kimball was a veterinarian who initially willingly worked with Vets First Choice. The new owner of a single-doctor practice in the Florida Keys, Kimball liked the idea of an online store. "I thought it would be a good option for my clients to purchase pet foods I did not have room to stock," she wrote in an email to VIN News. "I was told I would have final approval of my online store and could sell the products I wanted to sell at the price I wanted to list and could change anything at any time."
But she ended up with an online store carrying products that she'd never sell, such as rope toys. It also carried medications that she stocks for sale in her brick-and-mortar location, which made no sense to her. "Vets First Choice [was] competing directly with me in my own store!"
Soon after, she said, the company emailed her clients three times within two weeks without her permission. The first message announced the new store, but another practitioner's logo was attached to the email. The second message offered $100 off a one-year supply of Trifexis, one of the medications Kimball stocks in her clinic. The third message offered a 30 percent discount on everything in her store, an offer she neither requested nor authorized.
Vets First Choice told her the errors were unprecedented, she said. Kimball was in no mood to forgive. She told Vets First Choice to close the store. That took three calls to accomplish. Disenchanted, Kimball contacted VIN News hoping to alert other veterinarians about the problems she experienced.
If that was the first time Vets First Choice sent an unauthorized email blast, it wasn’t the last. On the Monday after Thanksgiving, three veterinarians in three different states found themselves fielding requests for discounts on medications and other products offered in emails sent to their clients by Vets First Choice. In each case, the emails sported the clinic's name and logo but had not been authorized by the clinic, according to interviews with the practice owners.
New Hampshire veterinarian Dr. Chris Baker had an experience similar to Kimball's. Around Thanksgiving, he was in the early stages of developing a store with Vets First Choice, a process that gives the company access to the practice database. After unauthorized cyber-deal emails went out, he was surprised by calls from clients hoping to purchase discounted products. Baker alerted the company to the error and canceled his plans with them.
Even veterinarians who don't do business with Vets First Choice have been affected by unauthorized email blasts. Dr. Geoffrey Adams, for example, at one time considered using Vets First Choice at his Florida practice, but decided against it. Two years later, all of his clients received emails offering special deals on pet medications.
When his practice manager called Vets First Choice, she learned that the company had set up an account and store for the hospital years earlier, when the hospital and the company were in talks.
As Adams explained in November on a message board at the Veterinary Information Network, an online community for the profession and parent of VIN News: "Sometime recently, someone at VFC decided to do an email blast to the clients of their lowest performing practices. Our practice has done exactly zero business with VFC, so it was flagged as being an underproducing hospital. Apparently, an email was sent to these hospitals explaining they could opt out of the marketing plan, but because we don’t work with VFC, we didn’t get the email."
If Adams’ experience with Vets First Choice was disconcerting, Dr. Jennifer Dinwoodie’s was even more so. Dinwoodie is the owner of Goodfriends Veterinary Clinic in Connecticut, the one whose clients received "Cyber Weekend Deals" emails after Thanksgiving. Dinwoodie bought the practice last August and never set up a Vets First Choice account nor opened an online store.
She called the company to report the problem and ask how they obtained her client list. She was told, she said, that Goodfriends' previous owner had enlisted a company called VetCentric to send clients appointment reminders. Vets First Choice bought VetCentric in 2012, and as a result, the clinic "had an open account with Vets First Choice," Dinwoodie recounted.
Dinwoodie is dubious of the explanation. She told VIN News the previous owner had stopped using VetCentric for reminders years ago. She also said that the client data Vets First Choice tapped had to have been pulled recently because her father received the emails, and he's been a client of Goodfriends only since she became the owner. As an AVImark program user, Dinwoodie suspects that Vets First Choice extracted the information from her AVImark database through software installed without her knowledge — either as part of VetCentric or some other program.
As a result of the email blast, 20 clients placed orders with the online store Dinwoodie didn't know she had. She intends to honor the discount. Vets First Choice has not offered to compensate for the error, which she estimates has cost the practice more than $1,600. "All that revenue went out the window," she said.
The company told her the account is now closed but, she said, there's no way she can be sure.
Suspecting that her AVImark system, which she took over from the previous owner, might have had a role in the mistake, she contacted Schein about the email blast. She was told that it had nothing to do with them. "They told me, 'We haven't even merged,' " she said.
That hasn't quieted her suspicions. Quite the opposite. "It's making me lose my trust in Schein," she said.
Editor's note: This story has been changed from the original to correct an unintentional failure to disclose VIN News Service's relationship to VIN and VINx.