{"id":647383,"date":"2026-10-15T17:46:13","date_gmt":"2026-10-15T17:46:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/il\/647383\/"},"modified":"2026-10-15T17:46:13","modified_gmt":"2026-10-15T17:46:13","slug":"mychart-and-a-major-hospital-said-i-could-opt-out-of-sharing-my-health-data-but-they-didnt-make-it-easy-lost-coast-outpost","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/il\/647383\/","title":{"rendered":"MyChart and a Major Hospital Said I Could Opt Out of Sharing My Health Data. But They Didn\u2019t Make It Easy | Lost Coast Outpost"},"content":{"rendered":"


\n
\n
\n
\n
\n
\n<\/a><\/p>\n

Illustration by Gabriel Hongsdusit, CalMatters<\/p>\n

###<\/p>\n

This story was originally published by CalMatters<\/a>. Sign up<\/a> for their newsletters.<\/p>\n

###<\/p>\n

Dr. Shira Fischer, a physician who works in health policy in Boston, sought a speech pathologist for her child in 2022, when virtual appointments became the norm because of COVID-19. <\/p>\n

\u201cI read their consent and they said they were going to record and use [our appointment] for training. And I said, no, my kid has a lisp. The last thing she wants is videos of her lisping to be used for training for who knows how long and who knows what database.\u201d <\/p>\n

Fischer said the clinic wouldn\u2019t change the consent, and wouldn\u2019t proceed with the appointment if she didn\u2019t sign it. Eventually, she found a different speech pathologist. \u201cIt ended up being better. But what is that, that they require you to allow them to record for their training?\u201d<\/p>\n

Had a similar experience? Tell us<\/p>\n

This story was originally published on The Markup, now a part of CalMatters. <\/p>\n

If you\u2019ve gone to an appointment in California and have struggled with opting out of sharing your data, or if you\u2019re a doctor or patient in California who has had challenges with AI transcription, we\u2019d love to hear from you.<\/p>\n


\nEmail Alex Rosenblat, our Director of Sociotechnical Research, at arosenblat@calmatters.org<\/a>.
\n
\n
\n
\nIf you\u2019re worried about being tracked or discovered, you can send messages and files securely by using the Signal app (download it here<\/a>). Reach Alex on Signal: 530-364-1838 <\/p>\n

Every day, doctor\u2019s offices across the country tell patients that if they want to see the doctor, they must allow their health data to be accessible by tens of thousands of hospitals and clinics. Often, doctors give out overly broad consent forms, asking patients to agree to anything from hospitals using patient files for training doctors to using patient data for training AI<\/a>.<\/p>\n

Practically speaking, when a patient doesn\u2019t agree, doctors can turn them away.<\/p>\n

Other times, doctors\u2019 offices tell patients they can opt-out of sharing their data later \u2014 by contacting an email address or mailing a physical letter \u2014 but in reality, opting out can be so difficult and confusing that it isn\u2019t really a choice at all.<\/p>\n

When I was pregnant with my child, I wondered why my gynecologists\u2019 forms asked me to let another company, Phreesia, mine my health data for marketing. The authorization form was labeled \u201cRequired\u201d even though it legally must be optional. I systematically opted out<\/a> and kept my own records of this, but when I tried to confirm my opt-outs with Phreesia, it said I did consent. After 81 days of back and forth, Phreesia admitted I had never authorized them to use my data. But it continued to use the misleading \u201cRequired\u201d label on the authorization form. Months later, after complaining to the U.S. Department of Health and Human Services, and an episode of \u201cThe Indicator from Planet Money\u201d on NPR<\/a>, Phreesia changed how it labeled its forms. I found the process galling, but it spurred my curiosity, and I\u2019ve been researching how opt-outs work ever since.<\/p>\n

In the last year, I registered as a patient at 25 clinics and hospitals across seven states and spent hundreds of hours reviewing consent forms, privacy policies and marketing forms to see whether I could actually opt out of sharing my data.<\/p>\n

For one hospital in Ohio, it took me 26 steps, a notary, and a flight to Las Vegas to learn how to opt out of the hospital\u2019s many uses of my patient records. Despite my best efforts, the hospital will not follow its own policy, which ostensibly allows patients to refuse to allow the hospital to take and own photos and recordings of them.<\/p>\n

It started last January, when I sought a second opinion on a personal health issue with a specialist at University Hospitals in Westlake, Ohio. University Hospitals is a large, nonprofit hospital system that manages its electronic health records through MyChart, a widely used patient portal across the country. MyChart is made by Epic Systems, a healthcare software company in Verona, Wisconsin, that says<\/a> it has over 305 million patient charts, coming from patients in every state and more than a dozen countries. <\/p>\n

As I prepared for my appointment, the hospital asked me to sign its registration forms and to sign up for MyChart. In the dense terms of service, I spot three different ways that as a patient, my data is about to be used, accessed or shared:<\/p>\n


\nThe hospital will share my health data through Epic\u2019s proprietary health information platform, Care Everywhere.
\n
\n
\n
\nThe hospital will share my data with CliniSync, an Ohio-based nonprofit health information exchange that facilitates the exchange of patients\u2019 information, like lab results, across institutions.
\n
\n
\n
\nThe hospital will own any photos, audio, or video they take of me and may use them for any lawful purpose. <\/p>\n

In each case, I\u2019m told that I can opt-out or refuse, but the process felt like it was designed to keep me from doing so. Forms and websites lacked basic contact information; customer service didn\u2019t respond; patients were required to find a notary, and hospital staff directly contradicted their own written policies and told me I wasn\u2019t allowed to opt-out.<\/p>\n

So I set out to see what it would truly take to say no to sharing my data, starting with Epic.<\/p>\n

There\u2019s no button to revoke authorization everywhere<\/p>\n

Once a hospital makes a patient\u2019s records available through Epic\u2019s Care Everywhere, many clinicians who works with Epic across the country can pull up those records, with some exceptions<\/a>. <\/p>\n

The most common way doctors use health exchanges is to get up to speed on a patient who is coming to see them. Sharing patient health records through exchanges has decreased duplicative tests<\/a> on patients. It also allows emergency room doctors who have never seen a patient before to immediately get their health history and allergies, which can save a patient\u2019s life, said Saurabh Rahurkar, a former assistant professor at Ohio State University College of Medicine.<\/p>\n

Individual hospitals can also restrict which doctors can see a patient\u2019s files, such as by physical distance, or by adding an extra confirmation step before doctors can see the files of patients who have received psychological services<\/a>. <\/p>\n

\u201cIf you say to your new doctor, \u2018Please go get my records at this place that\u2019s 3,000 miles away,\u2019 Care Everywhere can do that, but not if the system has the settings to only look for records within a 50-mile radius,\u201d said Lucia Savage, former chief privacy officer at the federal health IT office. <\/p>\n

But there are clear reasons why some patients don\u2019t want their data to show up in these searches, and hospital protections, if they exist at all, are not always effective.<\/p>\n

For example, a patient who crosses state lines to seek an abortion treatment<\/a> may not want her records to be searchable by her providers in her home state where that treatment is criminalized. <\/p>\n

\u201cPeople who have had bad experiences with unauthorized access to their information and people who have sensitive health conditions and diagnoses<\/a> for very good reasons, are just mistrusting of the healthcare system,\u201d said Julia Adler-Milstein, a leading researcher in health IT policy and a professor of medicine at the University of California, San Francisco. \u201c(They) don\u2019t feel like the healthcare system has been a good steward of them and their information.\u201d <\/p>\n

For example, researchers reviewing 1,138 breach cases found<\/a> that almost 10% of patient health data breaches come from unauthorized access by health care employees who forward personally identifying information to personal accounts.<\/p>\n

Nichole Sweeney, who was recently the chief privacy officer and general counsel at CRISP Shared Services, which provides technology infrastructure to support health exchanges in more than 10 states, said she often encounters providers snooping in patient records<\/a> in her job as a privacy officer: \u201cSomebody, a provider in an office, looks up an ex, and we find that because we have monitoring software, and I have to call them and tell them not to do that anymore. They get fired sometimes.\u201d<\/p>\n

Cason Schmit, a health law and policy professor at Texas A&M University, warned, \u201cWe\u2019re at a place in time where data that are being collected to help people are now being used in ways that could actively and specifically harm them.\u201d He pointed to how Immigration and Customs Enforcement has used health data for immigration enforcement<\/a>. Schmit has written about the role of state policy in fostering health information exchange and its<\/a> benefits to the public, such as tracking measles outbreaks.<\/p>\n

In my attempt to opt out of Epic\u2019s Care Everywhere, I first looked for a way to do it with MyChart. I navigated through 40-plus menu items, including the \u201cSharing Hub,\u201d where I watched videos on Care Everywhere that explained its benefits but not how to restrict its uses. In the end, I found one section under \u201cAuthorize Sharing\u201d that said I could \u201crequest that your information no longer be shared\u201d by sending a message to customer service. I tried that. I got no response.<\/p>\n

Then I tried emailing and calling the hospital system\u2019s ethics and compliance department to opt out of Care Everywhere. Crickets.<\/p>\n

After weeks of dead-ends, I found something that worked. When I called MyChart\u2019s patient support number, the representative said I could opt out by contacting the hospital\u2019s medical records department. I called medical records, and they called back that day and confirmed I was opted out of Care Everywhere.<\/p>\n

But how are patients supposed to know about this process? I couldn\u2019t find \u201ccontact medical records\u201d described anywhere in MyChart or on the hospital\u2019s website.<\/p>\n

I asked Epic for an interview, and they agreed to let me speak with Matt Doyle, who leads software development for Care Everywhere. Turns out, both of us were about to be in Las Vegas, for one of the largest healthcare tradeshow conferences in the country. I arrived early at the Epic booth, which is well-appointed among its peers in the Exhibition hall with carpets and a private meeting room. Posters proudly announced that health providers exchange approximately 22 million patient records each day through Care Everywhere.<\/p>\n

Doyle walked over from a hub of Epic employees clicking through MyChart screens with conference attendees, and led me to the meeting room along with a colleague from public relations.<\/p>\n

\u201cSo when you check in for your appointment, the de facto position is you\u2019re part of Care Everywhere,\u201d Doyle confirmed, \u201cunless you explicitly opt out.\u201d <\/p>\n

I recount for him everything I tried, and how there was nothing I could click in MyChart to opt out.<\/p>\n

\u201cIt\u2019s not in the MyChart enrollment process,\u201d Doyle clarified, \u201cbut as soon as your MyChart account is set up, you can immediately go opt out.\u201d<\/p>\n

Doyle explained that there are two levels of opting out. <\/p>\n

\u201cOne is, \u2018Revoke authorization, but I still want to be discoverable,\u2019\u201d he said. \u201cAnd what that would mean is, let\u2019s say today you\u2019re in a car accident. You go to the emergency department. Your doctor\u2019s office back in Ohio doesn\u2019t have your authorization on file, but you\u2019re discoverable.\u201d Meaning, a doctor could see that a specific patient has a health record, and can ask the patient for his or her consent to access that record. <\/p>\n

The second level of opting out is to be completely undiscoverable through Care Everywhere. In this case, doctors who work in other hospital systems can\u2019t see any record of the patient in Care Everywhere. It\u2019s a choice only 112 patients have made since they rolled out the ability to opt out this way in August 2025, Doyle said.<\/p>\n

There\u2019s one extra twist. Doyle confirmed that there isn\u2019t a single place to revoke authorization everywhere. \u201cYou have to go to each custodian of your medical records,\u201d he clarified. A patient would revoke access to Care Everywhere \u201cwith each place that you receive care.\u201d<\/p>\n

\u201cCan you show me how to opt out?\u201d I asked. <\/p>\n

Doyle brought me back out to Epic\u2019s booth, where employees have demos of MyChart on multiple screens. Doyle tried to find a demo where he can show me a new, patient-facing feature to revoke authorizations for data sharing. But the patient in the demo product had not signed any authorizations, so there was no way to show me how to revoke them.<\/p>\n

I asked the next public relations representative who joined us if I could see it on her MyChart. She pulled it up on her phone, went to the \u201cSharing Hub\u201d menu options, but we didn\u2019t see the \u201cRevoke authorization\u201d button. We looked at Doyle, who then explained that only organizations that have updated their Epic software would have the opt-out methods that he described. He offered to show me on a video call the following week. <\/p>\n

Until a patient\u2019s healthcare provider updates their software from Epic, Doyle confirmed that a patient\u2019s only option is to call the medical records department and tell them \u201cI would like to opt out of Care Everywhere.\u201d<\/p>\n

A week later, three Epic representatives joined my meeting with Doyle to show me how to opt out in the Sharing Hub section of MyChart. <\/p>\n

\u201cThere\u2019s two different places,\u201d explained Sean Bina, vice president of access and patient experience at Epic, as he showed me the buttons in MyChart. \u201cOne is \u2018managing my record authorizations.\u2019 And then the second is how I can prevent other organizations from requesting a record.\u201d<\/p>\n

After months of trying, I finally got to see actual buttons inside of MyChart that would let me opt out.<\/p>\n

After this interview, Epic did not respond to further questions from CalMatters and The Markup about Care Everywhere, including how many current patients have the ability to see the opt out buttons inside of MyChart.<\/p>\n

A prime example of how using health data for profit involves companies that use what expecting parents search for or watch online and what they\u2019ve shopped for<\/a>, to target them with baby ads.<\/p>\n

Mary Ebeling, a sociologist at Drexel University who wrote the book \u201cHealthcare and Big Data,<\/a>\u201d had just learned in March 2011 that her doctor could no longer detect a heartbeat in her 11th or 12th week of pregnancy. <\/p>\n

\u201cAfter learning that I lost the pregnancy, literally, I came home, and my mail carrier delivered the first issue of a year\u2019s subscription [of the now-defunct magazine American Baby] for free,\u201d she recalled. \u201cI had not signed up for it \u2014 to American Baby. And I was like I\u2019m getting angry right now about it.\u201d <\/p>\n

The unsolicited baby-themed marketing continued, and she eventually discovered that the data broker Experian was selling her information in a database of \u201cnew parents.\u201d<\/p>\n

Commercially gathered data, such as Ebeling\u2019s online search or purchasing history, doesn\u2019t have the same legal protections as health records at healthcare facilities, which are covered by the Health Insurance Portability and Accountability Act (HIPAA). But that protection isn\u2019t bulletproof. Past Markup investigations have found that HIPAA-covered hospitals were sending sensitive patient data to Facebook<\/a> through Meta\u2019s tracking pixel.<\/p>\n

Federal law also allows confidential substance use disorder treatment records to be shared in certain circumstances<\/a>, such as with probation officers.<\/p>\n

As a part of her work, Jacqueline Seitz, deputy director of health privacy at the Legal Action Center, frequently speaks with patients who use drugs, are in recovery, are living with HIV, and\/or are in treatment for substance use disorders. She also regularly speaks with the health providers who treat them.<\/p>\n

\u201cWhen I talk to providers and I ask them what they tell patients, they say, \u2018We tell patients everything is confidential.\u2019 And that is not the right thing to say. That is not true,\u201d Seitz said.<\/p>\n

For patients who are mandated into treatment in order to maintain their employment, custody access or probation, when asked, their medical records must be shared with probation officers or other legal authorities, Seitz explained. It\u2019s why she increasingly sees electronic health records as a rap sheet.<\/p>\n

\u201cI don\u2019t think people are trying to trick patients,\u201d she said, but she regularly sees examples of healthcare workers not fully understanding confidentiality rules in these cases.<\/p>\n

Opting out of CliniSync, Ohio\u2019s statewide nonprofit health information exchange<\/p>\n

In addition to being asked to sign up for MyChart when I registered for my appointment at the University Hospitals in Westlake, Ohio, I was also asked to acknowledge my participation in CliniSync.<\/p>\n

CliniSync, Ohio\u2019s statewide nonprofit health information exchange, facilitates the exchange of patients\u2019 information, like lab results, across institutions. CliniSync is operated by the Ohio Health Information Partnership, an independent private nonprofit founded in 2009. Ohio\u2019s governor designated the partnership to develop the statewide exchange.<\/p>\n

The hospital system posts many of its forms online, so I had time to research the General Consent to treatment form in advance. That alerted me to how patients are defaulted into sharing their data with CliniSync. <\/p>\n

A quick online search for \u201cUH privacy policy\u201d (UH stands for University Hospitals) brought me to the hospital system\u2019s HIPAA Notice of Privacy Practices<\/a>. It says I can opt out of CliniSync if I contact their privacy officer over the phone, and it gives me an email and phone number. I emailed right away. I didn\u2019t hear back before my appointment four days later.<\/p>\n

I also know that CliniSync likely has its own policy, separate from the hospital system\u2019s, so I also searched for its opt-out policy online<\/a>. The instructions are simple but surprised me: CliniSync asks patients to notarize its opt-out form.<\/p>\n

\u201cIt\u2019s a big time suck for people. They\u2019re going to have to spend a lot of time finding a notary. They\u2019re going to have to pay that notary, almost certainly, unless they happen to have a friend or family member who\u2019s a notary public,\u201d said Lior Strahilevitz, a legal scholar at the University of Chicago<\/a> who writes about privacy<\/a> and teaches health law. Not only is requiring a notary burdensome, it\u2019s also legally questionable<\/a>. General guidance from the federal government states that HIPAA authorizations do not need to be notarized.<\/p>\n

Still, I paid the $15 at UPS to get the form notarized and mailed it out.<\/p>\n

The Ohio Health Information Partnership, which operates CliniSync, declined to respond to questions about why it requires patients to get their opt-out requests notarized.<\/p>\n

Finally, on the day of my appointment, I tried what should have been the easiest method for patients: Asking the hospital to opt-me out in-person.<\/p>\n

When I asked the receptionist at my appointment how I could opt out of CliniSync, she said she didn\u2019t know, but she\u2019d run my request up the chain while I was with the doctor. When I came back, she had an answer: Patients can\u2019t opt-out. A colleague at the hospital told her through email that CliniSync \u201censures that providers across various hospital organizations are able to request and access patient medical records, as it relates to medical need and treatment. This is not feasible to be \u2018removed\u2019 from clinisync.\u201d<\/p>\n

CliniSync does, in fact, have a form to let patients opt out. And clinic staff can sign the form so that patients don\u2019t have to find a notary instead. It says so right on the CliniSync opt-out form.<\/a><\/p>\n

But in my research into how difficult it is for patients to opt out of processes like this, multiple hospital staff have given me inaccurate information. I wasn\u2019t surprised.<\/p>\n

Strahilevitz described this as a common problem in any bureaucracy, a phenomenon known as \u201cdesk clerk law.\u201d <\/p>\n

\u201cBasically, there\u2019s what the law is, and then there\u2019s what the person at the DMV who\u2019s actually interfacing with the consumer thinks the law is or what the person at the Secretary of State\u2019s office is,\u201d Strahilevitz said. \u201cAnd so I would regard your experience with the receptionist as a classic instance of desk clerk law.\u201d<\/p>\n

University Hospitals declined to respond to questions about whether its patients can opt out of CliniSync, and did not have an expert available for an interview. <\/p>\n

After my appointment, I called the hospital\u2019s compliance office and a few days later, I got a voicemail asking for more information over email, or for me to call them back. Since I know that Ohio law requires requests to opt out be written<\/a>, I emailed the hospital with what they ask for. When no one responded, I called and emailed again.<\/p>\n

Soon after my appointment, I got a hand-addressed letter from CliniSync confirming my opt-out and saying they processed it shortly after they received my notarized letter. I\u2019m pleasantly surprised, because I\u2019ve followed many opt-out processes in the last year, and it\u2019s uncommon to get verification like this.<\/p>\n

Two weeks after I saw the doctor, the hospital\u2019s compliance office confirmed my opt-out from CliniSync over email.<\/p>\n

Because CliniSync records a patient\u2019s opt-out centrally, one request blocks other providers from seeing a patient\u2019s records through CliniSync\u2019s network, but for many health exchanges, including Epic\u2019s Care Everywhere, patients would have to discover and follow an opt-out process at each new provider. <\/p>\n

Sweeney, who was the chief privacy officer and general counsel at a company that supported health exchanges in more than 10 states<\/a>, estimated that a typical patient might have to opt out of data-sharing at as many as 10 different places \u2014 wherever they seek care \u2014 for their opt-out to be meaningful. <\/p>\n

In most states, she said, \u201cthe place to cut off the data exchange is at the provider because that\u2019s where it starts.\u201d <\/p>\n

In some rare cases, patients do not need to go through this complicated opt-out process, because their clinic refuses to share any patient data with health databases or platforms, simply because patients haven\u2019t explicitly consented.<\/p>\n

Dr. Keith Smith runs the Surgery Center of Oklahoma, which markets transparent pricing and cash payment. The center does not accept insurance or Medicare, and it has tried to refuse<\/a> government agencies\u2019 requests for patient data, such as from the state health department. <\/p>\n

\u201cThere\u2019s no shortage of people that will claim that they have a legal right to see how many patients operated on at Surgery Center of Oklahoma had breast cancer or had inguinal hernia repairs,\u201d he said. \u201cAnd the patients haven\u2019t consented to the release of their records.\u201d<\/p>\n

Because Smith\u2019s surgery center does not accept federal dollars, he isn\u2019t obligated to report as much information to the government. \u201cWe treat patients here as individuals. And I don\u2019t think it\u2019s right to violate the rights of an individual for the greater good,\u201d he said. \u201cAll the individual cares about is that their rights have been violated.\u201d<\/p>\n

Refusing to let the hospital own my photos, videos or recordings<\/p>\n

In addition to asking me to share my patient records with multiple health exchanges in order to see my doctor, University Hospitals also required me to give it complete ownership over any photos, audio or videos it takes of me. Its consent form states, \u201cUH may, unless otherwise refused, photograph and\/or audio or video record me or the Services I receive, including those in which I am identifiable. UH will own such images or recordings and may use them for any lawful purpose.\u201d<\/p>\n

I have rarely pondered the possibilities: If the doctor takes a picture of a rash on my child\u2019s body for diagnostic purposes, would I want the hospital to claim ownership over or have broad rights to use that photo?<\/p>\n

The consent form says I can refuse, but when I asked the hospital\u2019s compliance and ethics office, they wouldn\u2019t let me. <\/p>\n

\u201c\u2026we are not able to accept modifications or partial withdrawals of specific provisions within the General Consent for Treatment itself,\u201d said the hospital\u2019s email. \u201cThis includes provisions related to incidental recording that may occur as part of delivering or documenting care.\u201d<\/p>\n

That surprised me. In hospital systems, the compliance office is usually where staff have privacy expertise. The hospital refused to follow its own policy.<\/p>\n

University Hospitals declined to respond to questions about whether its patients can refuse giving the hospital ownership over images and recordings it takes of patients.<\/p>\n

\u201cIt\u2019s misrepresentation,\u201d said Strahilevitz, the University of Chicago expert. \u201cSo I think that\u2019s just fraud to tell you you have a right and then telling you, \u2018No, we were wrong. You don\u2019t, in fact, have that right. And now your photograph and\/or audio and\/or video is going to be used.\u2019\u201d<\/p>\n

Fischer, who refused to see a speech pathologist because the doctor\u2019s office insisted on a right to record her child\u2019s lisp treatment, said she sees health providers requiring parents to agree to clauses like this all the time.<\/p>\n

\u201cI can\u2019t get a link to telehealth appointments for my kids without signing agreements that include things like \u2018authorize the use of photos, videos, and\/or recordings\u2019 and \u2018give permission for staff (including students) to participate and\/or watch for training purposes\u2019 or other things I don\u2019t want to agree to,\u201d she said. \u201cBut there is no option to not sign.\u201d<\/p>\n

Experts say there are practical design and regulatory solutions<\/p>\n

Colin Gray, an assistant professor at Indiana University Bloomington and a leading expert on manipulative designs<\/a> said, \u201cYou start from the position of defeat rather than starting from the position where you\u2019re making a rational choice \u2026 the attitude is, \u2018Well, if you really cared about your data, then you would go through the extra steps to turn it off.\u2019 And in this case, it\u2019s like, \u2018That\u2019s an hour of my time or 26 steps or whatever it is that I don\u2019t have.\u2019 And so it looks so onerous from the beginning, like, why would you even try?\u201d<\/p>\n

Experts like Stacey Tovino, a professor who teaches HIPAA privacy law at the University of Oklahoma College of Law, say there\u2019s a clear and practical solution<\/a>: \u201cAmend these [federal] regulations to say covered entities shall not impose an undue burden on people trying to opt out.\u201d Tovino suggested that when patients see that they can opt out in a form, the next sentence should include a link to do so.<\/p>\n

Some states have laws that require this type of solution. Under New York law<\/a>, for example, providers need explicit consent from patients to access their data from health information exchanges. I saw it firsthand when I registered my son for an appointment in upstate New York. The check-in screens showed me a form labelled \u201cHealth Exchange,\u201d and asked for my consent for the physician group to access all of the patient\u2019s medical records through Healthix, a health exchange. When I clicked \u201cNo,\u201d the next form showed the detailed consent form with \u201cI DENY CONSENT\u201d selected as one of my two choices. But when a provider in Virginia, which doesn\u2019t have a state law with explicit opt-in or opt-out requirements, informed me I had the choice to opt out, it refused to let me<\/a>. My only option was to click \u201cI accept\u201d and to follow an opt-out process after the fact. <\/p>\n

According to Seitz, the health privacy director who works with patients going through mandated treatment, one major challenge in privacy law is that it\u2019s difficult to put a dollar amount on the type of harm people experience, such as when intimate details about their lives are stored in recorded therapy sessions on an unsecured database<\/a>, like Confidant Health did in 2024. Individuals can\u2019t file a civil lawsuit or sue their doctor for violating HIPAA, which means that only the federal government or state attorney generals can enforce it. As a result, Seitz said that the attitude in healthcare around data breaches is: \u201cYeah, I\u2019m breaking the law. What are you going to do about it?\u201d <\/p>\n

To make privacy violations actionable, Seitz said, \u201cI would want statutory damages. Like, every corporate defense attorney\u2019s nightmare where it says, \u2018Every breach equals $2,000,\u2019 and then all the client has to do is show the breach, and then it\u2019s money.\u201d<\/p>\n

At the end of the day, experts said one of the most important parts of the health data ecosystem is trust.<\/p>\n

\u201cEvery single health data custodian that exists should be doing everything that we can to nurture and protect and foster the trust of those whose data we protect,\u201d said Schmit, the health law and policy professor who wrote about how health exchanges can benefit the public. \u201cAnd one thing that will absolutely undermine that trust are structures and processes that are opaque and difficult to follow, that make patients feel like they aren\u2019t cared for.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":" Illustration by Gabriel Hongsdusit, CalMatters ### This story was originally published by…\n","protected":false},"author":2,"featured_media":647384,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[163,521,85,46],"class_list":["post-647383","post","type-post","status-publish","format-standard","has-post-thumbnail","category-healthcare","tag-health","tag-healthcare","tag-il","tag-israel"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/647383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=647383"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/647383\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/647384"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=647383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=647383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=647383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}