Patients navigating MyChart and electronic health systems encounter complex barriers when attempting to opt out of health data sharing, often requiring direct contact with medical records departments or individual providers. Meanwhile, Epic Systems recently paused new product development for six weeks to patch security vulnerabilities in MyChart discovered via Anthropic’s Claude Mythos AI, which could allow untraceable access to patient records.
Opting out of Epic Care Everywhere
- ▪Epic Systems added patient-facing features in MyChart under the Sharing Hub menu to allow patients to revoke authorizations for health data sharing, but only providers with updated Epic software display these buttons.
- ▪A patient seeking a second opinion at University Hospitals in Westlake, Ohio found that opting out of Epic's Care Everywhere health data sharing required calling the hospital's medical records department.
- ▪Epic Systems requires patients to explicitly opt out of its Care Everywhere platform with each health care provider individually to stop patient record sharing.
- ▪Only 112 patients completely opted out of being discoverable across hospital systems in Epic's Care Everywhere platform between August 2025 and October 2026.
Epic MyChart security vulnerabilities
- ▪Epic Systems founder and CEO Judy Faulkner stated that the company shifted software engineers away from new product development for approximately six weeks to patch MyChart security vulnerabilities.
- ▪Epic Systems chief security officer Stirling Martin participated in Anthropic's Project Glasswing program to test how attackers could utilize open-source artificial intelligence agents to access confidential health records.
- ▪Epic Systems identified software flaws in certain MyChart configurations that could allow unauthorized individuals to view patient records without appearing in audit logs, using Anthropic's Claude Mythos model.
Australian Veterans' Affairs privacy violations
- ▪A group of Australian military veterans filed a class action lawsuit against the Department of Veterans' Affairs over the unauthorized sharing of medical records with university researchers through the 20-year MATES program.
- ▪An investigation by the Office of the Australian Information Commissioner found that the Department of Veterans' Affairs violated a veteran's privacy by transmitting personal data and medication details to researchers without consent.
Mandatory patient consent forms
- ▪Doctor's offices across the United States regularly require patients to sign consent forms permitting health data access for medical training and artificial intelligence development as a condition of receiving care.
- ▪Boston physician Shira Fischer switched to a different speech pathologist in 2022 after a clinic refused to modify a consent form requiring appointment recordings for training.
Phreesia data authorization practices
- ▪Health data company Phreesia labeled an optional marketing authorization form as Required before changing the label following patient complaints to the U.S. Department of Health and Human Services and NPR reporting.
- ▪Health data company Phreesia admitted after 81 days of back-and-forth communication that a pregnant patient had never authorized the company to use her data for marketing.
Healthcare employee record snooping
- ▪Former CRISP Shared Services privacy officer Nichole Sweeney reported using monitoring software to catch healthcare providers snooping on ex-partners' medical records, leading to employee terminations.
- ▪Researchers reviewing 1,138 health data breach cases found that nearly 10 percent of breaches stemmed from unauthorized access by healthcare employees who forwarded personally identifying information to personal accounts.
Story comments
Loading comments…