STAT is co-publishing this investigation by CalMatters/The Markup.
Shira Fischer, a physician who works in health policy in Boston, sought a speech pathologist for her child in 2022, when virtual appointments became the norm because of Covid-19.
“I read their consent and they said they were going to record and use [our appointment] for training,” she said. “And I said, no, my kid has a lisp. The last thing she wants is videos of her lisping to be used for training for who knows how long and who knows what database.”
Fischer said the clinic wouldn’t change the consent, and wouldn’t proceed with the appointment if she didn’t sign it. Eventually, she found a different speech pathologist. “It ended up being better. But what is that, that they require you to allow them to record for their training?”
Every day, doctor’s offices across the country tell patients that if they want to see the doctor, they must allow their health data to be accessible by tens of thousands of hospitals and clinics. Often, doctors give out overly broad consent forms, asking patients to agree to anything from hospitals using patient files for training doctors to using patient data for training artificial intelligence.
Practically speaking, when a patient doesn’t agree, doctors can turn them away.
Other times, doctors’ offices tell patients they can opt out of sharing their data later — by contacting an email address or mailing a physical letter — but in reality, opting out can be so difficult and confusing that it isn’t really a choice at all.
When I was pregnant with my child, I wondered why my gynecologists’ forms asked me to let another company, Phreesia, mine my health data for marketing. The authorization form was labeled “Required” even though it legally must be optional. I systematically opted out and kept my own records of this, but when I tried to confirm my opt outs with Phreesia, it said I did consent. After 81 days of back and forth, Phreesia admitted I had never authorized them to use my data. But it continued to use the misleading “Required” label on the authorization form. Months later, after complaining to the Department of Health and Human Services, and an episode of “The Indicator from Planet Money” on NPR, Phreesia changed how it labeled its forms. I found the process galling, but it spurred my curiosity, and I’ve been researching how opt outs work ever since.
In the last year, I registered as a patient at 25 clinics and hospitals across seven states and spent hundreds of hours reviewing consent forms, privacy policies, and marketing forms to see whether I could actually opt out of sharing my data.
For one hospital in Ohio, it took me 26 steps, a notary, and a flight to Las Vegas to learn how to opt out of the hospital’s many uses of my patient records. Despite my best efforts, the hospital will not follow its own policy, which ostensibly allows patients to refuse to allow the hospital to take and own photos and recordings of them.
It started last January, when I sought a second opinion on a personal health issue with a specialist at University Hospitals in Westlake, Ohio. University Hospitals is a large, nonprofit hospital system that manages its electronic health records through MyChart, a widely used patient portal. MyChart is made by Epic Systems, a health care software company in Verona, Wis., that says it has more than 305 million patient charts, coming from patients in every state and more than a dozen countries.
As I prepared for my appointment, the hospital asked me to sign its registration forms and to sign up for MyChart. In the dense terms of service, I spotted three different ways that as a patient, my data was about to be used, accessed, or shared:
- The hospital will share my health data through Epic’s proprietary health information platform, Care Everywhere.
- The hospital will share my data with CliniSync, an Ohio-based nonprofit health information exchange that facilitates the exchange of patients’ information, like lab results, across institutions.
- The hospital will own any photos, audio, or video they take of me and may use them for any lawful purpose.
In each case, I was told that I could opt out or refuse, but the process felt like it was designed to keep me from doing so. Forms and websites lacked basic contact information; customer service didn’t respond; patients were required to find a notary, and hospital staff directly contradicted their own written policies and told me I wasn’t allowed to opt out.
So I set out to see what it would truly take to say no to sharing my data, starting with Epic.
Once a hospital makes a patient’s records available through Epic’s Care Everywhere, many clinicians who work with Epic across the country can pull up those records, with some exceptions.
The most common way doctors use health exchanges is to get up to speed on a patient who is coming to see them. Sharing patient health records through exchanges has decreased duplicative tests on patients. It also allows emergency room doctors who have never seen a patient before to immediately get their health history and allergies, which can save a patient’s life, said Saurabh Rahurkar, a former assistant professor at Ohio State University College of Medicine.
Individual hospitals can also restrict which doctors can see a patient’s files, such as by physical distance, or by adding an extra confirmation step before doctors can see the files of patients who have received psychological services.
“If you say to your new doctor, ‘Please go get my records at this place that’s 3,000 miles away,’ Care Everywhere can do that, but not if the system has the settings to only look for records within a 50-mile radius,” said Lucia Savage, former chief privacy officer at the federal health IT office.
But there are clear reasons why some patients don’t want their data to show up in these searches, and hospital protections, if they exist at all, are not always effective.
For example, a patient who crosses state lines to seek an abortion treatment may not want her records to be searchable by her providers in her home state where that treatment is criminalized.
“People who have had bad experiences with unauthorized access to their information and people who have sensitive health conditions and diagnoses, for very good reasons, are just mistrusting of the health care system,” said Julia Adler-Milstein, a leading researcher in health IT policy and a professor of medicine at the University of California San Francisco. They “don’t feel like the health care system has been a good steward of them and their information.”
For example, researchers reviewing 1,138 breach cases found that almost 10% of patient health data breaches come from unauthorized access by health care employees who forward personally identifying information to personal accounts.
Nichole Sweeney, who was recently the chief privacy officer and general counsel at CRISP Shared Services, which provides technology infrastructure to support health exchanges in more than 10 states, said she often encountered providers snooping in patient records in her job as a privacy officer: “Somebody, a provider in an office, looks up an ex, and we find that because we have monitoring software, and I have to call them and tell them not to do that anymore. They get fired sometimes.”
Cason Schmit, a health law and policy professor at Texas A&M University, warned, “We’re at a place in time where data that are being collected to help people are now being used in ways that could actively and specifically harm them.” He pointed to Immigration and Customs Enforcement use of health data for immigration enforcement. Schmit has written about the role of state policy in fostering health information exchange and its benefits to the public, such as tracking measles outbreaks.
In my attempt to opt out of Epic’s Care Everywhere, I first looked for a way to do it with MyChart. I navigated through 40-plus menu items, including the “Sharing Hub,” where I watched videos on Care Everywhere that explained its benefits but not how to restrict its uses. In the end, I found one section under “Authorize Sharing” that said I could “request that your information no longer be shared” by sending a message to customer service. I tried that. I got no response.
Then I tried emailing and calling the hospital system’s ethics and compliance department to opt out of Care Everywhere. Crickets.
After weeks of dead ends, I found something that worked. When I called MyChart’s patient support number, the representative said I could opt out by contacting the hospital’s medical records department. I called medical records, and they called back that day and confirmed I was opted out of Care Everywhere.
But how are patients supposed to know about this process? I couldn’t find “contact medical records” described anywhere in MyChart or on the hospital’s website.
I asked Epic for an interview, and they agreed to let me speak with Matt Doyle, who leads software development for Care Everywhere. Turns out, both of us were about to be in Las Vegas, for one of the largest health care tradeshow conferences in the country. I arrived early at the Epic booth, which was well-appointed among its peers in the exhibition hall with carpets and a private meeting room. Posters proudly announced that health providers exchange approximately 22 million patient records each day through Care Everywhere.
Doyle walked over from a hub of Epic employees clicking through MyChart screens with conference attendees, and led me to the meeting room along with a colleague from public relations.
“So when you check in for your appointment, the de facto position is you’re part of Care Everywhere,” Doyle confirmed, “unless you explicitly opt out.”
I recounted for him everything I tried, and how there was nothing I could click in MyChart to opt out.
“It’s not in the MyChart enrollment process,” Doyle clarified, “but as soon as your MyChart account is set up, you can immediately go opt out.”
Doyle explained that there are two levels of opting out.
“One is, ‘Revoke authorization, but I still want to be discoverable,’” he said. “And what that would mean is, let’s say today you’re in a car accident. You go to the emergency department. Your doctor’s office back in Ohio doesn’t have your authorization on file, but you’re discoverable.” Meaning, a doctor could see that a specific patient has a health record, and can ask the patient for his or her consent to access that record.
The second level of opting out is to be completely undiscoverable through Care Everywhere. In this case, doctors who work in other hospital systems can’t see any record of the patient in Care Everywhere. It’s a choice only 112 patients have made since they rolled out the ability to opt out this way in August 2025, Doyle said.
There’s one extra twist. Doyle confirmed that there isn’t a single place to revoke authorization everywhere. “You have to go to each custodian of your medical records,” he clarified. A patient would revoke access to Care Everywhere “with each place that you receive care.”
“Can you show me how to opt out?” I asked.
Doyle brought me back out to Epic’s booth, where employees have demos of MyChart on multiple screens. Doyle tried to find a demo where he could show me a new, patient-facing feature to revoke authorizations for data sharing. But the patient in the demo product had not signed any authorizations, so there was no way to show me how to revoke them.
I asked the next public relations representative who joined us if I could see it on her MyChart. She pulled it up on her phone, went to the “Sharing Hub” menu options, but we didn’t see the “Revoke authorization” button. We looked at Doyle, who then explained that only organizations that have updated their Epic software would have the opt-out methods that he described. He offered to show me on a video call the following week.
Until a patient’s health care provider updates their software from Epic, Doyle confirmed that a patient’s only option is to call the medical records department and tell them “I would like to opt out of Care Everywhere.”
A week later, three Epic representatives joined my meeting with Doyle to show me how to opt out in the Sharing Hub section of MyChart.
“There’s two different places,” explained Sean Bina, vice president of access and patient experience at Epic, as he showed me the buttons in MyChart. “One is ‘managing my record authorizations.’ And then the second is how I can prevent other organizations from requesting a record.”
After months of trying, I finally got to see actual buttons inside of MyChart that would let me opt out.
After this interview, Epic did not respond to further questions from CalMatters and The Markup about Care Everywhere, including how many current patients have the ability to see the opt out buttons inside of MyChart.
A prime example of using health data for profit involves companies that use what expecting parents search for or watch online and what they’ve shopped for to target them with baby ads.
Mary Ebeling, a sociologist at Drexel University who wrote the book “Healthcare and Big Data,” had just learned in March 2011 that her doctor could no longer detect a heartbeat in her 11th or 12th week of pregnancy.
“After learning that I lost the pregnancy, literally, I came home, and my mail carrier delivered the first issue of a year’s subscription [of the now-defunct magazine American Baby] for free,” she recalled. “I had not signed up for it — to American Baby. And I was like ‘I’m getting angry right now about it.’”
The unsolicited baby-themed marketing continued, and she eventually discovered that the data broker Experian was selling her information in a database of “new parents.”
Commercially gathered data, such as Ebeling’s online search or purchasing history, doesn’t have the same legal protections as health records at health care facilities, which are covered by HIPAA. But that protection isn’t bulletproof. Past Markup investigations have found that HIPAA-covered hospitals were sending sensitive patient data to Facebook through Meta’s tracking pixel.
Federal law also allows confidential substance use disorder treatment records to be shared in certain circumstances, such as with probation officers.
As a part of her work, Jacqueline Seitz, deputy director of health privacy at the Legal Action Center, frequently speaks with patients who use drugs, are in recovery, are living with HIV, or are in treatment for substance use disorders. She also regularly speaks with the health providers who treat them.
“When I talk to providers and I ask them what they tell patients, they say, ‘We tell patients everything is confidential.’ And that is not the right thing to say. That is not true,” Seitz said.
For patients who are mandated into treatment in order to maintain their employment, custody access, or probation, when asked, their medical records must be shared with probation officers or other legal authorities, Seitz explained. It’s why she increasingly sees electronic health records as a rap sheet.
“I don’t think people are trying to trick patients,” she said, but she regularly sees examples of health care workers not fully understanding confidentiality rules in these cases.
In addition to being asked to sign up for MyChart when I registered for my appointment at the University Hospitals, I was also asked to acknowledge my participation in CliniSync.
CliniSync, Ohio’s statewide nonprofit health information exchange, facilitates the exchange of patients’ information, like lab results, across institutions. CliniSync is operated by the Ohio Health Information Partnership, an independent private nonprofit founded in 2009. Ohio’s governor designated the partnership to develop the statewide exchange.
The hospital system posts many of its forms online, so I had time to research the general consent to treatment form in advance. That alerted me to how patients are defaulted into sharing their data with CliniSync.
A quick online search for “UH privacy policy” (UH stands for University Hospitals) brought me to the hospital system’s HIPAA Notice of Privacy Practices. It said I can opt out of CliniSync if I contact their privacy officer over the phone, and it gave me an email and phone number. I emailed right away. I didn’t hear back before my appointment four days later.
I also knew that CliniSync likely has its own policy, separate from the hospital system’s, so I also searched for its opt-out policy online. The instructions are simple but surprised me: CliniSync asks patients to notarize its opt-out form.
“It’s a big time suck for people. They’re going to have to spend a lot of time finding a notary. They’re going to have to pay that notary, almost certainly, unless they happen to have a friend or family member who’s a notary public,” said Lior Strahilevitz, a legal scholar at the University of Chicago who writes about privacy and teaches health law. Not only is requiring a notary burdensome, it’s also legally questionable. General guidance from the federal government states that HIPAA authorizations do not need to be notarized.
Still, I paid the $15 at UPS to get the form notarized and mailed it out.
The Ohio Health Information Partnership, which operates CliniSync, declined to respond to questions about why it requires patients to get their opt-out requests notarized.
Finally, on the day of my appointment, I tried what should have been the easiest method for patients: Asking the hospital to opt me out in-person.
When I asked the receptionist at my appointment how I could opt out of CliniSync, she said she didn’t know, but she’d run my request up the chain while I was with the doctor. When I came back, she had an answer: Patients can’t opt out. A colleague at the hospital told her through email that CliniSync “ensures that providers across various hospital organizations are able to request and access patient medical records, as it relates to medical need and treatment. This is not feasible to be ‘removed’ from clinisync.”
CliniSync does, in fact, have a form to let patients opt out. And clinic staff can sign the form so that patients don’t have to find a notary instead. It says so right on the CliniSync opt-out form.
But in my research into how difficult it is for patients to opt out of processes like this, multiple hospital staff have given me inaccurate information. I wasn’t surprised.
Strahilevitz described this as a common problem in any bureaucracy, a phenomenon known as “desk clerk law.”
“Basically, there’s what the law is, and then there’s what the person at the DMV who’s actually interfacing with the consumer thinks the law is or what the person at the Secretary of State’s office is,” Strahilevitz said. “And so I would regard your experience with the receptionist as a classic instance of ‘desk clerk law.’”
University Hospitals declined to respond to questions about whether its patients can opt out of CliniSync, and said it did not have an expert available for an interview.
After my appointment, I called the hospital’s compliance office and a few days later, I got a voicemail asking for more information over email, or for me to call them back. Since I know that Ohio law requires requests to opt out be written, I emailed the hospital with what they ask for. When no one responded, I called and emailed again.
Soon after my appointment, I got a hand addressed letter from CliniSync confirming my opt out and saying they processed it shortly after they received my notarized letter. I was pleasantly surprised, because I’ve followed many opt-out processes in the last year, and it’s uncommon to get verification like this.
Two weeks after I saw the doctor, the hospital’s compliance office confirmed my opt out from CliniSync over email.
Because CliniSync records a patient’s opt out centrally, one request blocks other providers from seeing a patient’s records through CliniSync’s network, but for many health exchanges, including Epic’s Care Everywhere, patients would have to discover and follow an opt-out process at each new provider.
Sweeney, who was the chief privacy officer and general counsel at a company that supported health exchanges in more than 10 states, estimated that a typical patient might have to opt out of data-sharing at as many as 10 different places — wherever they seek care — for their opt out to be meaningful.
In most states, she said, “the place to cut off the data exchange is at the provider because that’s where it starts.”
In some rare cases, patients do not need to go through this complicated opt-out process, because their clinic refuses to share any patient data with health databases or platforms, simply because patients haven’t explicitly consented.
Keith Smith runs the Surgery Center of Oklahoma, which markets transparent pricing and cash payment. The center does not accept insurance or Medicare, and it has tried to refuse government agencies’ requests for patient data, such as from the state health department.
“There’s no shortage of people that will claim that they have a legal right to see how many patients operated on at Surgery Center of Oklahoma had breast cancer or had inguinal hernia repairs,” he said. “And the patients haven’t consented to the release of their records.”
Because Smith’s surgery center does not accept federal dollars, he isn’t obligated to report as much information to the government. “We treat patients here as individuals. And I don’t think it’s right to violate the rights of an individual for the greater good,” he said. “All the individual cares about is that their rights have been violated.”
Refusing to let the hospital own my photos, videos, or recordings
In addition to asking me to share my patient records with multiple health exchanges in order to see my doctor, University Hospitals also required me to give it complete ownership over any photos, audio, or videos it takes of me. Its consent form states, “UH may, unless otherwise refused, photograph and/or audio or video record me or the Services I receive, including those in which I am identifiable. UH will own such images or recordings and may use them for any lawful purpose.”
I have rarely pondered the possibilities: If the doctor takes a picture of a rash on my child’s body for diagnostic purposes, would I want the hospital to claim ownership over or have broad rights to use that photo?
The consent form says I can refuse, but when I asked the hospital’s compliance and ethics office, they wouldn’t let me. “We are not able to accept modifications or partial withdrawals of specific provisions within the General Consent for Treatment itself,” said the hospital’s email. “This includes provisions related to incidental recording that may occur as part of delivering or documenting care.”
That surprised me. In hospital systems, the compliance office is usually where staff have privacy expertise. The hospital refused to follow its own policy.
University Hospitals declined to respond to questions about whether its patients can refuse giving the hospital ownership over images and recordings it takes of patients.
“It’s misrepresentation,” said Strahilevitz, the University of Chicago expert. “So I think that’s just fraud to tell you you have a right and then telling you, ‘No, we were wrong. You don’t, in fact, have that right. And now your photograph and/or audio and/or video is going to be used.’”
Fischer, who refused to see a speech pathologist because the doctor’s office insisted on a right to record her child’s lisp treatment, said she sees health providers requiring parents to agree to clauses like this all the time.
“I can’t get a link to telehealth appointments for my kids without signing agreements that include things like ‘authorize the use of photos, videos, and/or recordings’ and ‘give permission for staff (including students) to participate and/or watch for training purposes’ or other things I don’t want to agree to,” she said. “But there is no option to not sign.”
Experts say there are practical design and regulatory solutions
Colin Gray, an assistant professor at Indiana University Bloomington and a leading expert on manipulative design said, “You start from the position of defeat rather than starting from the position where you’re making a rational choice … the attitude is, ‘Well, if you really cared about your data, then you would go through the extra steps to turn it off.’ And in this case, it’s like, ‘That’s an hour of my time or 26 steps or whatever it is that I don’t have.’ And so it looks so onerous from the beginning, like, why would you even try?”
Experts like Stacey Tovino, a professor who teaches HIPAA privacy law at the University of Oklahoma College of Law, say there’s a clear and practical solution: “Amend these [federal] regulations to say covered entities shall not impose an undue burden on people trying to opt out.” Tovino suggested that when patients see that they can opt out in a form, the next sentence should include a link to do so.
Some states have laws that require this type of solution. Under New York law, for example, providers need explicit consent from patients to access their data from health information exchanges. I saw it firsthand when I registered my son for an appointment in upstate New York. The check-in screens showed me a form labelled “Health Exchange,” and asked for my consent for the physician group to access all of the patient’s medical records through Healthix, a health exchange. When I clicked “No,” the next form showed the detailed consent form with “I DENY CONSENT” selected as one of my two choices. But when a provider in Virginia, which doesn’t have a state law with explicit opt-in or opt-out requirements, informed me I had the choice to opt out, it refused to let me. My only option was to click “I accept” and to follow an opt-out process after the fact.
According to Seitz, the health privacy director who works with patients going through mandated treatment, one major challenge in privacy law is that it’s difficult to put a dollar amount on the type of harm people experience, such as when intimate details about their lives are stored in recorded therapy sessions on an unsecured database, like Confidant Health did in 2024. Individuals can’t file a civil lawsuit or sue their doctor for violating HIPAA, which means that only the federal government or state attorneys general can enforce it. As a result, Seitz said that the attitude in health care around data breaches is: “Yeah, I’m breaking the law. What are you going to do about it?”
To make privacy violations actionable, Seitz said, “I would want statutory damages. Like, every corporate defense attorney’s nightmare where it says, ‘Every breach equals $2,000,’ and then all the client has to do is show the breach, and then it’s money.”
At the end of the day, experts said one of the most important parts of the health data ecosystem is trust.
“Every single health data custodian that exists should be doing everything that we can to nurture and protect and foster the trust of those whose data we protect,” said Schmit, the health law and policy professor who wrote about how health exchanges can benefit the public. “And one thing that will absolutely undermine that trust are structures and processes that are opaque and difficult to follow, that make patients feel like they aren’t cared for.”
Alex Rosenbat is the director of sociotechnical research at CalMatters and The Markup. As a researcher and reporter, she writes about dark patterns, privacy, and product design in U.S. health care. She is the author of “Uberland: How Algorithms Are Rewriting the Rules of Work.” Read her tips for opting out of sharing your health data.
