MyChart Has No Opt-Out Button for Health Data Sharing — SkimNews
Get the Health newsletter
Daily health & science — research, biotech, public health, the studies worth knowing. Free.
- Epic Systems' Matt Doyle confirmed patients are "de facto" part of Care Everywhere unless they explicitly opt out, though no opt-out button exists in MyChart's enrollment process — only an undocumented path through customer service to medical records.
- The author registered at 25 clinics across 7 states over hundreds of hours; at University Hospitals in Ohio, fully opting out required 26 steps, a notary, and flying to Las Vegas to learn the hospital's own policy.
- Phreesia labeled patient data-sharing authorizations as "Required" despite their optional legal status, and only admitted after 81 days of back-and-forth (plus an NPR episode and HHS complaint) that the author had never actually consented.
- Care Everywhere moves roughly 22 million patient records daily across Epic's network of more than 305 million patient charts, with hospitals able to restrict access by physical distance but not required to.
- Researchers reviewing 1,138 breach cases found nearly 10% of patient health data breaches stem from healthcare employees unauthorizedly forwarding PII to personal accounts, according to the investigation.
- Privacy officers described routine provider snooping — including staff looking up ex-partners in patient records — caught by monitoring software, with some employees fired when flagged.
Why it matters: Patients seeking abortion care across state lines, immigration-sensitive treatment, or those with sensitive diagnoses have no documented mechanism to keep records out of cross-institution searches; Epic confirmed the default is sharing until patients navigate an opaque process. With nearly 10% of health data breaches already tied to internal snooping and HHS complaints the proven path for accountability, the gap between legal opt-out rights and usable opt-out design puts the burden entirely on patients.
Ask SkimNews
