The Markup, now a part of CalMatters, uses investigative reporting, data analysis, and software engineering to challenge technology to serve the public good. Sign up for Klaxon, a newsletter that delivers our stories and tools directly to your inbox.

CalMatters and The Markup’s reporting has found that opting out of data sharing is much more difficult than it needs to be because deceptive designs or “dark patterns” make it more work to say no than to say yes. Research has found that when given the choice, people prefer to have more fine-grained control over how their medical data is shared or used.

In the last year, I registered as a patient at 25 clinics and hospitals across seven states and spent hundreds of hours reviewing consent forms, privacy policies and marketing forms to see whether I could actually opt out of sharing my data. Sometimes, opting out was simple. Other times — like in our most recent reporting on MyChart and University Hospitals in Ohio — the process was extremely convoluted.

For patients that are interested in opting out, here are my best tips to get started:

• Get the forms in advance. A provider’s office will often send you a link 24 to 48 hours in advance of your appointment. Sometimes, you can download them off a hospital website. I usually search online for keywords like “consent forms + hospital name.” Getting the forms early means you can take many of the steps below at home, instead of under time pressure immediately before your appointment.
• Nice to have: Keep a dedicated phone number and email address for health visits. It’s not always possible, but if you can, get a dedicated phone number such as through Google Voice’s free plan or the paid Burner app. Set up a new email inbox just for healthcare appointments, such as with Gmail or Proton Mail. When filling out contact information for appointments or creating a patient portal account, use your dedicated phone number and email address. This step makes it easier for you to track all the forms health providers send you, and potentially, to track your data trail in the future.
• Use the screen recorder already installed on your phone, computer or tablet to record your screen as you read through the forms, so you have a copy of what you sign. Here are instructions for iPhones and tablets and Android devices. On a Mac computer, press Command + Shift + 5 and select the Record button (looks like a bullseye).
• Read or skim for specific terms like opt-out, withdraw consent, restrict, refuse, responsibility, optional, authorization.
• Read or skim the privacy policy for clues about what instructions to follow to opt out. Every healthcare provider should have a privacy policy. Sometimes, a privacy policy will give you the email address or phone number of who to contact to opt out of sharing your data. You can contact them ahead of your appointment to try and opt out.
• Arrive early to your appointment. Like 45 minutes early. Politely request paper forms. On paper workflows, you can skip ahead without being forced to engage with voluntary forms that are bundled in with required forms. Many privacy-conscious patients also try to cross out terms they disagree with, which they date and initial. But keep in mind, some forms explicitly note that changes to those forms are not binding.
• Take photos or videos of the forms you sign. And when you return the forms to a receptionist, politely ask them to provide you with a photocopy of your signed and completed forms. Keeping your own records is important, and sometimes obtaining them later can be a kafkaesque process.
• If you are struggling to get a copy of a form you filled out, or if there are terms you’d like to opt out of but you can’t figure out how, try politely asking the front desk or a provider how to proceed. If they do not know, try the following:
• If none of the above works, one more place you can try is the “medical records” department at many hospitals. That work may be outsourced to another company. Get the name and contact of the department or the company by asking at an information desk. Then ask the medical records contact how you can opt-out.
• Email me if you get stuck, or have questions. I might not know the answer, but I might be able to help you strategize to get it. Or, if you figure something out that unlocks an opt-out, I’d be glad to hear about it! arosenblat@themarkup.org
• If you think your rights have been violated, submit a complaint to the Office for Civil Rights at the U.S. Department of Health and Human Services. Peter Swire, the White House coordinator for the HIPAA privacy rule under President Bill Clinton, recommends involving HIPAA enforcers to weigh in on practices. “You can bring complaints when you’re only 80% sure. A complaint is a complaint. Then, they're supposed to look at it with their expertise,” he said. HHS can issue guidance or address enforcement concerns through their FAQ page in response.