Opinion: MyChart said I could opt out of sharing my health data. Figuring out how was maddening — SkimNews
Get the Health newsletter
Daily health & science — research, biotech, public health, the studies worth knowing. Free.
- Epic's MyChart has no in-app button to revoke Care Everywhere authorization, and the author's multi-week attempt to opt out succeeded only after contacting a hospital's medical-records department — a path not advertised anywhere in the portal or website.
- University Hospitals in Westlake, Ohio told the author her data would flow through three channels (Epic's Care Everywhere, the CliniSync HIE, and the hospital's own photo/audio/video ownership), each with an opt-out process the author describes as 'designed to keep me from doing so.'
- Epic's Matt Doyle confirmed to the author that the 'de facto position is you're part of Care Everywhere unless you explicitly opt out,' while conference materials touted roughly 22 million patient records exchanged daily through the platform.
- The author registered as a patient at 25 clinics and hospitals across seven states and spent hundreds of hours testing consent and opt-out procedures, in one case needing 26 steps, a notary, and a Las Vegas flight — only for the hospital to still not follow its own opt-out policy.
- Phreesia, a patient-intake company, labeled a legally optional data-authorization form 'Required' and initially insisted the author had consented; after 81 days of dispute and an HHS complaint, the company changed its labeling.
- A review of 1,138 breach cases found nearly 10% of patient health data breaches stem from unauthorized access by healthcare employees forwarding PHI to personal accounts, a risk experts flagged as growing.
Why it matters: More than 305 million patients sit inside Epic's systems and roughly 22 million of their records flow daily through Care Everywhere — yet the only proven opt-out route the author found required contacting a department not advertised in MyChart. For patients with sensitive conditions, immigration concerns, or reproductive-care histories (e.g., crossing state lines after *Dobbs*), that gap turns 'you can opt out' from a stated promise into an unfunded burden, and breach data (~10% of incidents from insider snooping) shows the underlying risk isn't theoretical.
Ask SkimNews
