A reporter needed 26 steps and a notary to learn how to opt out of one hospital's data uses
One reporter who registered at 25 clinics and hospitals in seven states says an Ohio hospital will not follow its own policy on recordings. The essay says patients who refuse broad consent can be turned away, and later opt-out routes can be too confusing to use.
The Scientist · Science desk
Key figures: 81 days of back and forth before Phreesia admitted the author had never authorized it to use her data; 25 clinics and hospitals across seven states where she registered as a patient in the last year; more than 305 million patient charts, per Epic Systems, maker of MyChart.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Days before Phreesia admitted she never authorized it | 81 days | 17 | |
| Clinics and hospitals she registered at | 25 providers | across seven states, in the last year | 1 |
| Patient charts Epic says it has, more than | 305,000,000 charts | per Epic Systems, maker of MyChart | 3 |
What happened
- According to the author, doctors' offices tell patients that seeing the doctor means letting tens of thousands of hospitals and clinics access their health data.
- Some consent forms ask patients to agree to uses as different as hospitals training doctors on patient files and training artificial intelligence on patient data.
- University Hospitals' terms listed three uses: sharing through Epic's Care Everywhere, sharing with the CliniSync exchange, and hospital ownership of photos, audio and video of the patient.
- The author lists what she met when trying to opt out: missing contact information, unanswered customer service, a notary requirement, and staff who contradicted written policy.
- A Phreesia authorization form was labeled "Required" though it legally must be optional, and the company took 81 days to admit the author had never authorized it.
Why it matters
- cost Refusing broad consent means finding another provider, as Fischer did. A patient with fewer options than a Boston physician in health policy would have less room to say no.
- contradiction Reading the written policy does not settle whether an opt-out will be honored: the author says staff contradicted written policies, and the Ohio hospital still does not follow its own.
- precedent The one documented fix, Phreesia's relabeled forms, came months after a complaint to HHS and a radio segment, routes most patients do not have.
Phreesia is the one case in the essay with a ground truth. The author had opted out of the marketing authorization on her gynecologists' forms and kept her own records of doing so. When she asked Phreesia to confirm, the company said she had consented [19]. A patient without those records would have had only the vendor's database to argue against, in our view. Phreesia took 81 days of back and forth, nearly 12 weeks, to admit she had never authorized it [17][20].
Shira Fischer, a physician who works in health policy in Boston, hit the sign-or-leave problem in 2022 when she sought a speech pathologist for her child [5]. Fischer said she read the consent, and it said the clinic was going to record and use the appointment for training [6]. Fischer said the clinic would not change the consent and would not proceed with the appointment unless she signed [7]. She found a different speech pathologist. "It ended up being better. But what is that, that they require you to allow them to record for their training?" she said [8].
The thing this doesn't tell you is the rate. The author registered at 25 clinics and hospitals in seven states and spent hundreds of hours reviewing consent forms, privacy policies and marketing forms [1]. The text STAT co-published from CalMatters/The Markup does not say how many of those sites made opting out hard [9]. For the Ohio hospital she reports 26 steps, a notary and a flight to Las Vegas, and the hospital still will not follow its policy on photos and recordings [14][15]. Taken at the author's word, that is one documented failure at one hospital.
The hospital is University Hospitals in Westlake, which runs its records on MyChart [2]. MyChart is made by Epic Systems, which says it holds more than 305 million patient charts [3].
What to watch
- Whether the full CalMatters/The Markup investigation reports how many of the 25 sites made opting out hard, which would give the essay a failure rate.
- Whether University Hospitals changes how it handles patient requests to refuse photo and recording ownership.
- Whether other form vendors drop "Required" labels from authorizations that must be optional, as Phreesia did.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In the last year the author registered as a patient at 25 clinics and hospitals across seven states and spent hundreds of hours reviewing consent forms, privacy policies and marketing forms to see whether she could opt out of sharing her data.
- [2]
University Hospitals, in Westlake, Ohio, is a large nonprofit hospital system that manages its electronic health records through MyChart, a widely used patient portal.
- [3]
MyChart is made by Epic Systems, a health care software company in Verona, Wis., which says it has more than 305 million patient charts, from patients in every state and more than a dozen countries.
- [4]
In University Hospitals' terms of service the author found three uses of her data: sharing through Epic's Care Everywhere platform, sharing with the Ohio nonprofit health information exchange CliniSync, and hospital ownership of any photos, audio or video of her for any lawful purpose.
- [5]
Shira Fischer, a physician who works in health policy in Boston, sought a speech pathologist for her child in 2022.
- [6]
"I read their consent and they said they were going to record and use [our appointment] for training," she said.
- [7]
Fischer said the clinic would not change the consent and would not proceed with the appointment if she did not sign it; eventually she found a different speech pathologist.
- [8]
"It ended up being better. But what is that, that they require you to allow them to record for their training?" Fischer said.
- [9]
STAT is co-publishing this investigation by CalMatters/The Markup.
- [10]
The author writes that doctors' offices across the country tell patients that if they want to see the doctor, they must allow their health data to be accessible by tens of thousands of hospitals and clinics.
- [11]
Doctors often give out overly broad consent forms asking patients to agree to anything from hospitals using patient files for training doctors to using patient data for training artificial intelligence.
- [12]
Practically speaking, when a patient does not agree to the broad consent, doctors can turn them away.
- [13]
Other times, doctors' offices tell patients they can opt out of sharing their data later by contacting an email address or mailing a physical letter, but opting out can be so difficult and confusing that it is not really a choice.
- [14]
For one hospital in Ohio, it took the author 26 steps, a notary and a flight to Las Vegas to learn how to opt out of the hospital's many uses of her patient records.
- [15]
Despite the author's efforts, the Ohio hospital will not follow its own policy, which ostensibly allows patients to refuse to allow the hospital to take and own photos and recordings of them.
- [16]
The author says forms and websites lacked basic contact information, customer service did not respond, patients were required to find a notary, and hospital staff directly contradicted their own written policies and told her she was not allowed to opt out.
- [17]
The author says an authorization form from Phreesia was labeled "Required" even though it legally must be optional, and that after 81 days of back and forth Phreesia admitted she had never authorized it to use her data.
- [18]
Months later, after the author complained to the Department of Health and Human Services and an episode of NPR's "The Indicator from Planet Money" aired, Phreesia changed how it labeled its forms.
- [19]
The author's gynecologists' forms asked her to let Phreesia mine her health data for marketing; she opted out and kept her own records, but when she tried to confirm with Phreesia, it said she did consent.
- [20]
81 days is about 11.6 weeks, or nearly 12 weeks.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- statnews.comOpinion: MyChart said I could opt out of sharing my health data. Figuring out how was maddening
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.