MyChart and a major hospital said I could opt out of sharing my health data

Alex Rosenblat recounts a months‑long investigation into how hard hospitals and vendor platforms make it for patients to actually opt out of sharing electronic health data. After testing registration at 25 clinics across seven states and spending hundreds of hours on consent forms and privacy policies, Rosenblat documents tangled processes, misleading language, and broken customer support. Specific cases include a pregnancy clinic using Phreesia with an authorization labeled “Required” despite being optional, and University Hospitals in Ohio linking records to Epic’s MyChart/Care Everywhere, CliniSync, and claiming ownership of photos and recordings. In one case she says it took 26 steps, a notary and even travel to learn how to refuse uses of her records, yet the hospital still refused to honor its own written policy.

The piece argues that opt‑out is often illusory: systems bury or contradict opt‑out mechanisms, staff give wrong information, and vendors don’t respond to requests. It notes legitimate clinical benefits of health exchanges - reducing duplicate tests and aiding emergency care - while documenting concrete privacy risks, such as employee snooping, state‑crossing sensitivity (for example abortion care), and misuse by law enforcement. Rosenblat shows how dark patterns and operational failures shift control away from patients and leave formal options unusable in practice.