{"id":668728,"date":"2026-05-27T20:28:19","date_gmt":"2026-05-27T20:28:19","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/668728\/"},"modified":"2026-05-27T20:28:19","modified_gmt":"2026-05-27T20:28:19","slug":"the-form-asked-to-share-my-health-data-then-it-wouldnt-let-me-say-no","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/668728\/","title":{"rendered":"The form asked to share my health data. Then it wouldn\u2019t let me say no."},"content":{"rendered":"

By Alex Rosenblat<\/a>, CalMatters<\/p>\n

\t\t\t\t\""Illustration\"
\n\t\t\t\tIllustration by Gabriel Hongsdusit, CalMatters<\/p>\n

This story was originally published by CalMatters<\/a>. Sign up<\/a> for their newsletters.<\/p>\n

When Paula Stannard, one of the federal government\u2019s top healthcare privacy officials, visited her eye doctor this year, she was asked to sign a form, acknowledging she\u2019d received a privacy notice about how the office would use her health data.\u00a0<\/p>\n

\u201cHad I received the notice of privacy practices? No,\u201d she told an audience at one of the nation\u2019s largest health industry conferences<\/a> in March.<\/p>\n

\u201cI did not want to tell them who I was and why they should not be doing that,\u201d said Stannard, who is director of the Office for Civil Rights at the U.S. Department of Health and Human Services. \u201cBut I did write a note that says, \u2018I have not received this. I am not acknowledging receipt.\u2019”\u00a0<\/p>\n

Had a similar experience? Tell us<\/p>\n

This story was originally published on The Markup, now a part of CalMatters.\u00a0<\/p>\n

If you\u2019ve gone to an appointment in California and have struggled with opting out of sharing your data, or if you\u2019re a doctor or patient in California who has had challenges with AI transcription, we\u2019d love to hear from you.<\/p>\n

Email Alex Rosenblat, our Director of Sociotechnical Research, at arosenblat@themarkup.org<\/a>.<\/p>\n

If you\u2019re worried about being tracked or discovered, you can send messages and files securely by using the Signal app (download it here<\/a>). Reach Alex on Signal: 530-364-1838<\/p>\n

Stannard\u2019s story is all too common.<\/p>\n

Over the last year, I\u2019ve interviewed more than 20 patients, healthcare providers, experts and advocates about the privacy forms they must sign to get care at their providers\u2019 offices.<\/p>\n

Time and again I was told the same thing: Across the country, from large hospital systems to small, private clinics, patients are being asked to sign waivers blindly without knowing exactly what they\u2019re signing.<\/p>\n

When patients ask to see more, staff usually don\u2019t have an easy way to show them. When patients do get the forms, it tells them all the ways their medical data will be shared and reused, and some of the ways patients can refuse. But electronic systems make it impossible to opt out on the spot, requiring follow up emails.<\/p>\n

Records sharing between unaffiliated providers through these networks can benefit patients by making their scattered records more visible to the provider who is treating them.\u00a0<\/p>\n

But it can also harm patients.<\/p>\n

Patients seeking an abortion may not want records to travel with them from a state where that treatment is legal to one where it is criminalized<\/a>.<\/p>\n

In other cases, companies, such as GuardDog, have admitted to accessing patient records \u201cunder the guise of treatment<\/a>\u201d and funneling them to personal injury law firms.<\/p>\n

Researchers have also found healthcare workers snooping<\/a> through electronic health records. Other dangers include data breaches<\/a> and serious potential for misuse, such as domestic abusers stalking their partners though the pediatric records of their children<\/a>.<\/p>\n

There\u2019s not much patients can do to limit the risks of their data being available across networks, except by aggressively pursuing opt-outs when providers offer them. Turns out, that can be pretty hard to do.\u00a0<\/p>\n

Gale Oleson is a retired dermatologist in Missouri who recalled visiting the emergency room after a hand injury.<\/p>\n

\u201cThey hand me the signature pad,\u201d he said. \u201cThey said, you have to sign this so we can do the procedure. And I said, well, I don’t know what the heck I’m signing. Is it like you get my house today? You know, you could be taking my car, you know, signing over my life insurance. And they just laugh, you know?<\/p>\n

\u201c… In those situations, I’ve had them either turn the screen to me or I request that they print out a copy for me to review and they’ve always done it, but it’s always a \u2018I forgot how a printer works\u2019 kind of thing.\u201d<\/p>\n

Experts have a name for this practice: \u201cDark patterns<\/a>,\u201d which are manipulative design choices that steer people into doing things or making decisions they otherwise would not make. It\u2019s easier to check the box to say that you\u2019ve received the privacy notice, even if you haven\u2019t. It\u2019s easier to sign the digital signature box, even if you can\u2019t see what you\u2019re signing.<\/p>\n

The alternative \u2014 saying you didn\u2019t get the privacy notice, or asking repeatedly to see what you\u2019re signing \u2014\u00a0sounds like a simple request, but can be scary for patients. Many of the patients I\u2019ve interviewed, including a lawyer who works as a privacy advocate, told me they\u2019re afraid that speaking up or pushing back against terms they don\u2019t agree to will make health providers categorize them as inconvenient patients and make it harder to get the care they need.<\/p>\n

As a privacy researcher, I\u2019ve experienced this hesitation myself. Last year, I wrote about the epic lengths I went through to get a copy of the consent forms I signed when my toddler needed surgery. When my child was strapped to a movable bed, the surgeon standing there at the ready, I was asked to verify my signature on a consent form. When I asked if I could have a copy of it, a nurse said she wasn\u2019t allowed to give it to me \u2014 and sent me to a ghost office at another hospital to search for it. In the moment, I let it go, so I wouldn\u2019t hold up the surgery. Later, after asking multiple people for help, I was finally able to get a copy<\/a>.\u00a0<\/p>\n

To experience more of what patients have to deal with and test whether they\u2019re able to successfully get the information they need, say no, or opt-out of having their data shared, I checked out over a dozen health care systems myself by registering and going to appointments in Iowa, New Jersey, New York, Ohio, Oregon, South Carolina and Virginia.<\/p>\n

One telehealth appointment with a provider showed me how easily dark patterns force patients to share their data with big healthcare networks, even when the privacy form they\u2019re signing explicitly says they can opt-out.\u00a0<\/p>\n

In October 2025, I booked a telehealth appointment with a women\u2019s health clinic in Virginia, after a source was frustrated with the clinic\u2019s check-in process. During registration, I was asked to sign their notice of privacy practices. It\u2019s the same type of form that Stannard never got, but was asked to say she did.<\/p>\n

The notice told me<\/a> that I was giving them permission to let my physician share my health data with a health information exchange, a network that allows providers to search my medical records, like lab results or medical history, from other health organizations when they treat me. These networks can be regional, state-wide or national in reach. The privacy notice says that by signing the form, \u201cyou agree to have your medical information shared<\/a>.\u201d\u00a0<\/p>\n

It also says I have two other choices:<\/p>\n

Say no by following instructions on the opt-out form, but there\u2019s no link to the form.\u00a0<\/p>\n

Say yes now and kick off the opt-out process later by sending an email. An email address is provided.<\/p>\n

But when I got to the end of the privacy notice, I wasn\u2019t allowed to say no. I had only one choice: \u201cI accept.\u201d After that, there\u2019s a spot to type my name \u201cto accept the policy,\u201d check a box that I understand that I\u2019m electronically signing, and a big button to \u201cContinue.\u201d<\/p>\n

I ignored the accept button and tried clicking \u201cContinue.\u201d An error message told me I couldn\u2019t move forward unless I hit \u201cI accept.\u201d<\/p>\n

I was at a crossroads. The privacy notice literally describes<\/a> \u201cSay No Thanks\u201d as a choice, but doesn\u2019t let me pick it.<\/p>\n

At this point, most of the patients I\u2019ve interviewed would probably click \u201cI accept\u201d and move on, even if they wanted to keep their information private. But I was researching what patients have to do for healthcare systems to honor their wishes around consent and privacy, so I stopped filling out the form.<\/p>\n

Instead, I emailed the address on the privacy notice. I was surprised that an employee got back to me that day, shared the opt-out request form<\/a>, and confirmed that \u201cregistration is required to opt-in.\u201d She also told me her company, which manages this consent process for the information exchange, will process my opt-out after I sign it and they\u2019re able to process it. The risk is that they might not do it before my appointment. I emailed her back and asked what we should do about this, since the original privacy notice says, \u201cPlease note, your opt-out does not affect health information that was disclosed through HIE [health information exchanges] prior to the time that you opted out.\u201d How could we make sure none of my information is shared?\u00a0<\/p>\n

The next day, she replied that her company would proactively opt me out of the information exchange, that I should still complete the opt-out form she sent me, and that \u201cYou should now be able to complete your check-in, and the setting will remain unchanged.\u201d<\/p>\n

When I went back to check in for my appointment, I clicked \u201cI accept,\u201d because the health services company assured me nothing will change. Just to be safe, I wrote \u201cI opt out of HIE\u201d and my initials, \u201cAR\u201d into the box where I\u2019m supposed to write my name.<\/p>\n

When I wrote to a manager of the women\u2019s clinic about this, they stood by Privia\u2019s process and said that Privia makes themselves available for patients who want to opt-out.<\/p>\n

\u201cThis is a dark pattern,\u201d said Lior Strahilevitz, a legal scholar at the University of Chicago<\/a> who has published papers on privacy and dark patterns<\/a> and teaches health law. In fact, Strahilevitz sees multiple dark patterns in the patient registration process I went through.<\/p>\n

One is called an \u201cobstruction dark pattern,\u201d which means the design makes it harder for patients to make any choice except the one healthcare providers want.\u00a0<\/p>\n

Another dark pattern was \u201cvisual interference\u201d where the interface makes it hard on the patient. \u201cThe patient\u2019s going to have to face inordinate burdens in order to make an autonomous choice,\u201d he said, because they will need to go \u201coutside the user interface, outside the screens, in order to exercise your opt-out rights.\u201d<\/p>\n

Lucia Savage, former chief privacy officer at the federal health IT office, called the Office of the National Coordinator for Health IT, said that problems like this can happen when people carelessly put physical forms online. \u201cThis isn\u2019t really a design at all,\u201d she said. \u201cThis is just a bunch of paper pasted onto a web page. Could you even really call it design?\u201d<\/p>\n

So, is all of this legal?<\/p>\n

Legal experts point out that only one element of the check-in process violates the spirit of health privacy law, and it\u2019s not the part I expected.<\/p>\n

In Virginia, where I had my appointment, it\u2019s legal for providers to opt patients in at registration and give them a way to opt-out later.<\/p>\n

Some states, like Florida<\/a> and New York<\/a>, require providers to get a patient\u2019s explicit consent before they can share or access a patient\u2019s data from information exchanges. Other states, like Arizona<\/a> and Maryland<\/a> have laws that allow data-sharing through health information exchanges by default, as long as providers tell patients and give them a way to opt-out. Some states have not passed any additional regulations, which means they follow the federal baseline. Federally, under the Health Insurance Portability and Accountability Act (HIPAA), sharing a patients\u2019 data in a health exchange is legal.<\/p>\n

According to Sarah Jaromin, a health policy specialist at the National Conference of State Legislatures, in Virginia, there is no current state policy with explicit opt-in or opt-out requirements.<\/p>\n

Craig Konnoth, a law professor at the University of Virginia who specializes in health and civil rights<\/a> looked at the privacy notice I was asked to accept. \u201cYou have the choice as to whether your data is going to be used. In this particular situation, \u2018we are going to use your data until you file in the opt-out paperwork\u2019 \u2014 then that’s actually kosher,\u201d he said.\u00a0<\/p>\n

What experts say violates the spirit of the law, however, is requiring that patients sign the privacy notice itself.\u00a0<\/p>\n

When I was checking in, the privacy notice forced me to add my signature and click \u201cI accept\u201d before I could click \u201cContinue.\u201d<\/p>\n

\u201cWhat becomes problematic for me is that you can’t actually proceed. The design forces you to do something that the HIPAA privacy rule does not require you to do,\u201d said Stacey Tovino, a professor who teaches HIPAA privacy law at the University of Oklahoma College of Law. (Full disclosure: As a part of my role as Director of Sociotechnical Research at The Markup and CalMatters, I am combining a broader journalistic investigation with a small ethnographic research studying on digital patient intake procedures, The Markup paid Tovino to consult on the HIPAA implications of my findings, but she did not participate in data-collection or editorial decision-making.)<\/p>\n

\u201cNothing in HIPAA<\/a> requires them to make you sign the notice,\u201d said Tovino. \u201cIf they don\u2019t obtain the signature they simply have to document why they didn\u2019t get it.\u201d<\/p>\n

There\u2019s an important nuance here. At a doctor\u2019s office, patients usually have to sign and give consent to treatment and financial responsibility policies before they can actually get medical care. But when it comes to privacy notices, HIPAA only requires healthcare providers to ask that patients acknowledge receiving it. Patients should be able to ignore it.\u00a0<\/p>\n

Many of the privacy-focused patients I interviewed, including those who also work as doctors and nurses, deliberately decline to sign a notice of privacy practices if it contains terms they disagree with. But when modern check-in technology refuses to let a patient move forward without agreeing to the notice of privacy practices, is that legal?<\/p>\n

Emily Hilliard, press secretary at the U.S. Department of Health and Human Services (HHS), confirmed that the HIPAA privacy rule does not require providers to get a patient\u2019s consent to their privacy notice, but it also does not \u201cprohibit covered entities from requiring individuals to acknowledge, or agree to the terms of, an NPP.\u201d<\/p>\n

In other words, requiring patients to agree to a privacy notice before getting treatment is legal.<\/p>\n

\u201cLikely because HHS never envisioned this happening, HIPAA does not explicitly prohibit a covered entity from requiring an acknowledgement of receipt of the notice of privacy practices as a condition of treatment,\u201d said Adam Greene, a partner at the law firm Davis Wright Tremaine who focuses on health information, privacy and security.<\/p>\n

\u201cHHS has heard about widespread problems with the acknowledgment of receipt of the notice of privacy practices becoming an obstacle to patient care and a cause of confusion,\u201d he said. \u201cIn 2021, they issued a proposed rule that, amongst other things, proposed deleting the requirement for an acknowledgment of receipt of the notice of privacy practices.\u201d The rule was never finalized<\/a>, but it is back on the agenda this year.\u00a0<\/p>\n

Stannard confirmed that at HHS, \u201cwe are in the process of finalizing the rule which includes some additional requirements for the notice of privacy practices.\u201d<\/p>\n

The current proposed rule<\/a> includes, \u201cEliminating the requirement to obtain an individual’s written acknowledgment of receipt of a direct treatment provider’s Notice of Privacy Practices.\u201d<\/p>\n

Experts say patients should be able to opt out immediately \u2014\u00a0not eventually<\/p>\n

Legal experts say that regulators can fix this problem with one fell swoop: make it a rule that companies must let patients opt-out right away, at the same moment they\u2019re notified that they can.<\/p>\n

\u201cAmend these [federal] regulations to say covered entities shall not impose an undue burden on people trying to opt out. Covered entities shall not make it functionally problematic. Covered entities shall not, in registration documents, force people to proceed, thus waiving their right to opt out at the earliest possible time,\u201d Tovino said.<\/p>\n

She suggested that when a company notifies someone of their right to opt out, the next sentence should include a link to do so.<\/p>\n

Savage agreed that this change would \u201cabsolutely\u201d be a substantial intervention. \u201cI believe that’s something OCR [Office of Civil Rights at HHS] could do in regulations.\u201d<\/p>\n

At the same event where Stannard shared that her eye doctor asked her to acknowledge a privacy notice she never got, I asked her, \u201cWould updating the privacy rule to require a live link when patients make a choice to opt out or into sharing their information be empowering to Americans as individual patients?\u201d She\u2019d just spoken about U.S. Health Secretary Robert F. Kennedy Jr.\u2019 s agenda \u201cto empower individuals with their own health information.\u201d<\/p>\n

“That’s an interesting idea,\u201d Stannard responded. \u201cI don’t remember if we’ve considered it before. It’s certainly something that we could consider going forward.”\u00a0<\/p>\n

One registration form, but a cocktail of technology companies<\/p>\n

Navigating the dark patterns in the check-in process was difficult. What I\u2019ve learned however, is that it\u2019s hard to know who picked that interface to use with patients. Did it come from the clinic or the sprawl of vendors that health facilities have come to rely on?\u00a0<\/p>\n

Private clinics often partner with multiple outside companies (vendors covered by HIPAA) to get technology and administrative support. My appointment involved three different companies:\u00a0<\/p>\n

The mobile link I received to check-in for my appointment comes from a company named Phreesia, which handles patient-facing software, like consents, medical screening surveys and payment. When a patient clicks through those consent forms in the U.S., it goes through Phreesia every 1 in 6 patient visits<\/a>.<\/p>\n

The clinic had joined Privia Health, which handles management services for nearly 5,000 providers across 15 states, which affect 5.2 millions patients, according to a 2025 press release<\/a>. The privacy notice I struggled with sent me to Privia\u2019s medical records office to opt out. Phreesia\u2019s logo was also on the copy of my forms that the clinic emailed me.\u00a0<\/p>\n

Finally, for my second telehealth appointment six months later, the clinic sent me a link with the name of another vendor, \u201cathenahealth<\/a>,\u201d in it. The clinic had replaced Phreesia with athenahealth entirely.<\/p>\n

\u201cUnless you’re a really giant system,\u201d said Savage, “you don’t have internal expertise on how to do this. So you buy it. You buy what’s plug-and-play and what’s affordable.\u201d\u00a0<\/p>\n

The Markup and CalMatters asked all three companies who was responsible for the design of the patient registration interface, and no company gave us a clear answer.<\/p>\n

Privia: \u201cPrivia is committed to the privacy and security rights of our patients\u2019 information and to ensuring we comply with all regulatory requirements regarding our use of that information,\u201d said Robert Borchert, senior vice president of investor and corporate communications at Privia Health.<\/p>\n

athenahealth: \u201cathenahealth provides technology that healthcare providers use to manage patient registration and clinical workflows \u2026 configured according to each provider’s requirements and applicable law,\u201d read a statement from athenahealth, provided by Nikki D\u2019Addario, senior public relations manager.<\/p>\n

Phreesia: \u201cIt is the provider\u2019s form and they determine the content and interface options,\u201d said Dori Zweig Young, Phreesia spokesperson.<\/p>\n

None of the companies responded to detailed written questions about how much control clinics have over the interface.<\/p>\n

A blindspot for regulators and how it can be fixed<\/p>\n

Outside of healthcare, regulators, like the Federal Trade Commission<\/a> (FTC), the Consumer Financial Protection Bureau (CFPB) and multiple<\/a> state attorneys general and agencies, have called dark patterns manipulative<\/a> or abusive<\/a> tactics that confuse consumers about their privacy choices<\/a> or lock consumers into paying for services (like the famous Amazon Prime<\/a> case). Researchers consistently find that people want more control over the context<\/a> of how their data is shared, and that patients are least comfortable<\/a> handing over blanket access with broad, open consents, even if they are largely willing to share it for specific uses.<\/p>\n

Strahilevitz explained, however, that agencies like the FTC and CFPB, which have been the most active on regulating dark patterns, regulate privacy within their zones, and only occasionally take on boundary cases.<\/p>\n

\u201cHealth privacy, for the most part, is going to be primarily addressed by HIPAA and Health and Human Services rather than the FTC Act and the Federal Trade Commission,\u201d she said.
\u201cThere are limits on [the commissions] ability to protect patient privacy because that’s basically another entity’s job.\u201d<\/p>\n

Greene and Savage both agreed that the Federal Trade Commission has jurisdiction to enforce against dark patterns as unfair or deceptive practices in for-profit healthcare entities. The clinic I went to, like hundreds of thousands across the country, is for-profit.\u00a0<\/p>\n

But HHS has a broader mandate to regulate healthcare organizations, including non-profit hospitals.\u00a0<\/p>\n

For example, Strahilevitz said, in consumer finance, regulators at the Consumer Financial Protection Bureau treat a practice as unfair or deceptive when a consumer cannot reasonably avoid the resulting injury<\/a>. Just as hard-to-cancel online subscriptions force people to pay more, maze-like opt-out structures force patients to pay with their data by default.<\/p>\n

Strahilevitz said this provides a framework for thinking about privacy injuries in healthcare. An information exchange could serve as a clearing house for information about a patient\u2019s abortion, which has a clear potential for injury if that information becomes known in a state where abortion treatments are criminalized.<\/p>\n

\u201cIn other privacy contexts, the courts have said where it’s literally possible to opt out of something but, practically quite difficult, unduly onerous, then we’re not going to treat that as creating an opt-out right,\u201d he said.\u00a0<\/p>\n

Savage sees more opportunities in carrots than sticks to get to best practices. She argued that the government could invest in good interface design that\u2019s open source and available for anyone to use, and the federal health IT office, where she used to work, could create competitions focused on improving the technical tools that providers buy and use.<\/p>\n

If the big technology vendors that independent clinics are already using make these changes, it could affect millions of patients.<\/p>\n

State regulation is another possible solution. Strahilevitz said that scrutiny of dark patterns is spreading as states, like California, and regulatory agencies, like the FTC, seek to reign in unfair or deceptive practices through the simple intervention that it should be as easy to cancel as it is to subscribe, with one click.<\/p>\n

\u201cI hope that at some point, we’ll get to a point where symmetry of choice is the law of the land, not only with respect to consumer privacy in some states, but to these kinds of medical privacy or financial privacy or other contexts,\u201d he said.<\/p>\n

How we reported this story<\/p>\n

Over the last year, we interviewed more than 20 patients, healthcare providers, experts and advocates about the privacy forms they must sign to get care at their providers\u2019 offices. Our reporter then replicated individual patient experiences by signing up for appointments at multiple clinics and documenting her own experience, which includes reading every word of all registration paperwork given to her as a patient.\u00a0<\/p>\n

This article also draws from a small ethnographic study<\/a>, which was reviewed by an institutional review board. An IRB is a committee that has reviewed this research study to help ensure that the rights and welfare of all research participants are protected and that the research study is carried out in an ethical manner.<\/p>\n

This article was originally published on CalMatters<\/a> and was republished under the Creative Commons Attribution-NonCommercial-NoDerivatives<\/a> license.<\/p>\n","protected":false},"excerpt":{"rendered":"By Alex Rosenblat, CalMatters Illustration by Gabriel Hongsdusit, CalMatters This story was originally published by CalMatters. Sign up…\n","protected":false},"author":2,"featured_media":668729,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[97,252,253,514],"class_list":["post-668728","post","type-post","status-publish","format-standard","has-post-thumbnail","category-health-care","tag-health","tag-health-care","tag-healthcare","tag-privacy"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/668728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=668728"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/668728\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/668729"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=668728"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=668728"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=668728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}