Alex Rosenblat, director of sociotechnical research at The Markup and CalMatters, has always been cautious about what information she shares in health care forms, opting out of voluntary uses of her data anytime she goes to a medical appointment.
In early April, when her toddler son underwent minor surgery at a children’s hospital in New York City, she used a screen recorder on her smartphone to film the pre-registration paperwork as she filled it out at home. But when her family arrived the morning of surgery and was given additional forms to sign — including one consent on a doctor’s phone — gaining copies proved to be a scavenger hunt.
While Rosenblat’s son was in surgery, she spent time not in the waiting room, but trying to track down a copy of the consents, as she detailed in a recent story for The Markup. Staff wouldn’t give her a copy nor allow her to use her phone to take a picture of them, instead sending her across the street to a “medical records” office that turned out not to exist. She did, eventually, prevail, but it wasn’t easy.
Rosenblat has since launched a research project exploring how new and emergent technologies like artificial intelligence are impacting patients’ health care and their privacy. She is interviewing other folks who face hidden pitfalls in registering for their appointments, like opt-out fields that are hidden by dark patterns on registration tablets, or on paperwork patients can’t even see because the screen faces the administrative staff, who describe the documents to patients and then ask them to sign blindly into a digital signature box.
In this “How I Did It,” Rosenblat talked with AHCJ about her privacy concerns, why she decided to publicize her experience, and her advice for all of us as patients.
(Responses have been lightly edited for brevity and clarity.)
Why are you cautious about sharing your information?
I’m a privacy-minded person, and so I generally like to review what permissions I’m providing. In health care, your information is especially sensitive — the context itself makes your information sensitive, and so I’m generally suspicious of requests for information that go beyond what a health care organization would need for their own operations and what they would need for my assessment, treatment and care.
Would you agree that most people sign all medical forms without thinking about them?
I think that’s true. I think even people who are quite privacy-focused, or who work as privacy professionals or in consumer protection are in a rush to get through the forms because they’re trying to get to their appointment. You may be organizing it for yourself or for somebody else, and often you’re just in a rush, especially if it diverts you from the ordinary course of your day, or because you have a greater sense of urgency in the moment.
The forms themselves, when they do ask for information that’s voluntary, are often designed in ways that look like legalese, which can confuse readers. In some cases, they’re mislabeled, and deceptively so. In a previous incident, I was opting out of a form that requested my permission to mine my health care data for targeted marketing. The form was labeled “required” in red letters, but it’s legally optional, a fact that isn’t immediately evident to a typical patient — that’s the domain of health care law experts.
The onus really shouldn’t be on patients to navigate deceptive communications, especially when they’re in a vulnerable position. Then you’re in this totally awkward position where if you do want to decline … you become an inconvenience to the people that you’re dependent on for care … Most people, when they are already struggling to seek the treatment they need, they’re going to try not to upset their health care professionals.
What prompted you to share your story?
I wrote an article for STAT News during my last pregnancy about how I had systematically opted out of a form that requested my permission to give a third-party vendor called Phreesia my consent to target me with personalized ads based on my health care information. I declined, because I sat there and I read the fine print. When I emailed their privacy inbox, they said they had my consent on file. I said, ‘Show me,’ and they said, ‘No.’ They eventually admitted that they had nothing, although they deceptively insisted for months that they had my consent. But that incident itself really made me cautious and even more vigilant than I already was.
So when I went in with my son for his appointment, I was already prepared to record what I was signing. It’s important not just to know what you signed but to know what you didn’t give permission for. How do you prove it? Often you don’t get easy access to records so you have to keep your own. Technically, they might be available to you but actually, as my piece showed, getting copies of things that you signed can be this crazy journey. It seems so unnecessary, like, ‘Here’s a document — email me a copy, or give me a photo, or something.’ But it’s never straightforward.
Part of the response I’ve had to the article has been interesting because it’s not just a challenge for patients, but also for physicians, who say they struggle to obtain some records in a timely fashion for patients they need to treat, particularly when their patients have been seen outside of their own hospital system. For them to obtain original images they need to make a further assessment of their medical treatment for their patient is, like, impossible. It’s actually really tough. I’m interested in this conundrum where on the one hand it seems like you should be able to have a copy of everything. You’re actually entitled to have a copy of almost all of your medical records. And yet, in the digital age, you’re met with constant bureaucratic obstruction.
Have you heard from other sources whether this is unusual, or something typical to hospitals?
Patients and health care providers weren’t super surprised that I had so much trouble. I think everyone was universally startled that I wouldn’t be allowed to take a photo of my own form, but they weren’t surprised with a general inaccessibility or timely accessibility of their own records. What I gathered from other patients is that they always try to obtain copies of their important test results at their appointments; they can bring that with them to a specialist. Otherwise, they go to the specialist appointment and the specialist hasn’t received their test results so the appointment isn’t very helpful.
Tell us about your research project.
Functionally, I’m acting like a sociological bug reporter. Someone brings me a bug they’ve encountered, and sometimes I try to recreate it by filling out those forms myself. More broadly, I want to understand the dynamics of why clinics choose particular vendors, how those decisions play out, how patients experience digital technologies, and how the architecture of these decisions impact health care access and privacy rights. Technologies can often make some processes more efficient, but there’s an open question about whom this is inefficient for; Where are burdens lifted, and onto whom are they offloaded? And, where do they create new benefits, too?
As an ethnographer, I’m speaking with patients and health care workers, and trying to understand their experiences. For patients, my focus is on coercive forms where they’re encouraged to give up information they may not otherwise want to give if they were better informed. In that process of looking at registration forms, I’ve encountered these other challenges where even keeping your own records of what you find and what you’ve given permission for could be really challenging. I’m doing site visits and interviewing people from across the U.S. to understand empirically what the design of check-in systems are, and how patients can or can’t opt out of voluntary uses of their data.
What will you do with the information? How will you share your results?
I’ve partnered with law professors who are experts in HIPAA or in privacy and health, and consumer protection, to understand where the forms I’ve encountered from other patients going to their health care providers are good, like what’s a model option that helps patients understand what their options are, and where are the contracts leaning towards coercive in some ways, where you bundle optional items with required items, making it very difficult for a patient to opt out of a term they don’t want. My plan with them is to understand what about this is bad, and what is illegal, and if it’s illegal, what redress is available? Can you provide copies of these to law enforcement? A federal agency? An attorney general? What can you do to try and reinforce the regimes of protections that patients should have to their medical data and their privacy?
What is your advice for journalists and other readers of this interview, on what they should do with their own forms?
Try and keep a copy of anything that you sign, or any test results you get—especially images, like a CT scan or an x-ray, which they can make for you on a CD. If you’re going to see a specialist, you’ll be prepared, and you mitigate the risk of having to get tests redone if access is an issue for your doctor or yourself. For the forms you sign for registration, a screen recorder could help if you’re filling it out on your phone. Try to take a little video if you can of the tablet you’re handed out in the doctor’s office to fill out your forms. Even though technically the forms could say something like, ‘You’re entitled to a copy of these forms at the front desk,’ you go to the front desk and they may not have it for you. They may have to contact a third-party vendor to try to obtain your copy. It may be very arduous to get anything that you don’t have in hand at the time.
