An investigation by CalMatters and The Markup, co-published by STAT, found that patients who try to opt out of sharing their health data through systems like Epic's MyChart face a maze of obstacles. The author registered as a patient at 25 clinics and hospitals across seven states, spending hundreds of hours reviewing consent forms and privacy policies. In one Ohio hospital, it took 26 steps, a notary, and a flight to Las Vegas just to learn how to opt out of the hospital's many uses of patient records.
The investigation also highlights how consent forms are often misleading. One form from a company called Phreesia was labeled 'Required' even though it legally must be optional; after an 81-day dispute, the company admitted the author had never authorized data use but kept the label for months. In another case, a physician seeking a speech pathologist for her child was told the clinic would not proceed unless she signed a consent allowing the appointment to be recorded for training. She found a different provider.
The piece argues that while hospitals and software vendors claim patients can refuse data sharing, the practical process is so confusing and contradictory that it amounts to no real choice. Staff sometimes contradicted their own written policies, and customer service often failed to respond. The investigation is a single account, but it raises serious questions about whether patient consent is meaningful in the current health data ecosystem.