Today: 23 Years Without Medical Privacy in America

By Alexandra de Scheel, Citizens’ Council for Health Freedom

Most Americans still believe their medical records are private.

You’d be forgiven if you thought the information you shared in the exam room (or with your doctor) was just between the two of you — protected by the confidentiality that has defined medicine for centuries.

That assumption is no longer true.

Over the past two decades, federal policy quietly transformed the American health care system into a massive data collection network built around the government-mandated electronic health record (EHR). What was sold as modernization has created something very different: a system where patient data is routinely digitized, analyzed, shared, and mined far beyond the exam room.

And patients never meaningfully consent to it. Typically, there’s no choice.

As one patient reported, she went to see a chiropractor and refused to sign the HIPAA form. The nurse informed the doctor, who came out of his office and said, “It’s the law.” The patient pushed back: “So you don’t want me?” He repeated himself. The patient was turned away

The Collapse of Medical Confidentiality

For thousands of years, medicine rested on a simple principle.

Hippocrates wrote:

“Whatever I see or hear in the lives of men which ought not to be spoken of abroad, I will keep secret.”

Confidentiality wasn’t a bureaucratic formality. It was the foundation of trust between patients and physicians.

It allowed patients to speak frankly to their doctor.

Today, that trust is under threat.

Under modern federal policy, medical records are no longer simply clinical notes used by physicians. They have become data assets that can be extracted, aggregated, analyzed, and repurposed by governments, corporations, insurers, researchers, and technology companies.

The Government Electronic Health Record Mandate

The shift away from confidentiality began when Congress ended medical privacy rights with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and pushed the nationwide adoption of online-accessible electronic health records (EHRs) nearly 20 years later.

Rather than allowing medical technology to develop a privacy-centric model, the government mandated interconnected, standardized digital record systems using federal rules, incentives, and penalties. They wanted the data.

Most doctors who do not adopt and use government-certified electronic health records face financial penalties through reduced Medicare reimbursements.

These systems were designed not only for patient care but also support functions such as:

• federal reporting requirements

• performance metrics

• data collection

• research registries

• administrative monitoring of patients and doctors

Under the federal HIPAA regulation, the expansive “health care operations” definition includes activities such as quality assessment, data analysis, business planning, and administrative functions (45 C.F.R. § 164.501).

In practice, this framework connects the exam room to a broader network of entities involved in oversight, administration, and data use.

Frustrated Doctors Say the System is Hurting Care

Photo by Usman Yousaf on Unsplash

Many physicians and nurses now say the system is undermining medicine itself.

Electronic records demand constant clicking, reporting, and documentation that shifts attention away from the patient and toward the computer.

In one large health system, after implementing the Epic Systems platform, operational costs rose by approximately $400,000 per month. Nurses were spending 47 minutes per shift on duplicate documentation, while physicians received up to 240 inbox messages per day, requiring more than 2 hours daily to manage.

Medication reconciliation increased from 6 minutes to 18 minutes per patient, and physicians spent 25 minutes reviewing charts that previously took 8 minutes, as information became spread across dozens of screens and tabs.

You’ve probably experienced the doctor clicking away and never watching your face.
Instead of listening closely, clinicians must navigate software interfaces, menu options, and mandatory fields.

This digital layer:

• interrupts the natural flow of clinical thinking

• distracts physicians during examinations

• delays care

• introduces new medical errors

• erodes the personal relationship between patient and doctor

Some physicians have left traditional practice entirely rather than comply.

Patients Are Becoming Data Subjects

Photo by Chris Yang on Unsplash

The EHR system also allows patient information to be extracted and transmitted to large databases.

As standard health care consent forms often state, patient information may be used and disclosed for “treatment, payment, and health care operations,” including data analysis, quality assessment, business planning, and administrative oversight—without requiring additional patient authorization.

For example, medical specialty organizations maintain massive registries built directly from electronic health records.

One such system—the National Cardiovascular Data Registry—includes data from thousands of hospitals and outpatient providers worldwide, capturing patient demographics, procedures, clinical guidelines, risk factors, and provider performance (American College of Cardiology).

These registries are not isolated systems. They are used for quality measurement, research, and reporting, and many are integrated into federal programs administered by the Centers for Medicare & Medicaid Services (CMS), including the Merit-based Incentive Payment System (MIPS). Under these programs, data collected through EHRs and registries can be used to evaluate physician performance, determine reimbursement, and support federal oversight of health care delivery.

While patients may assume their information is anonymized, this so-called de-identified data can often still be traced back to individuals or combined with other datasets. Just as bad, it can be used to build a case against the patient or the doctor leading to denied access to care.

In effect, the medical system increasingly treats patients not only as individuals needing care but also as sources of data.

When Big Tech Came Calling

Photo by Alex Haney on Unsplash

In 2018, a revealing report highlighted how Facebook explored partnerships with major U.S. hospitals to access patient data.

The initiative, first reported by CNBC, involved combining anonymized hospital data with Facebook’s own user data to identify patients who might need additional medical care.

The project was abandoned following public scrutiny in the wake of the Cambridge Analytica scandal, which exposed how personal data could be used in ways users never anticipated.

But the episode revealed something significant.

Large technology companies increasingly view health care data as one of the most valuable datasets in the world—and have actively explored ways to access, analyze, and integrate it at scale.

The Consent Problem

Photo by Vitaly Gariev on Unsplash

One of the most troubling aspects of this system is the lack of meaningful patient consent.

Many Americans assume that privacy laws like HIPAA protect their medical information.

But HIPAA actually functions as a permissive disclosure regulation, not a privacy law. Those who have access to your medical data, like doctors, hospitals, and labs can share it if they want to. They don’t need your consent.

In fact, federal estimates indicate that up to 2.2 million entities—including approximately 1.5 million “business associates”—may have access to patient medical information under HIPAA’s framework if those who hold your data choose to share it (Federal Register, Vol. 75, No. 134, July 14, 2010, pp. 40872, 40906–40907, 40911).

The law permits broad categories of unconsented data use under “health care operations,” including quality assessment, data analysis, business planning, and administrative functions.

As a result:

• Patient data can be widely circulated within health care systems

• 1.5 million business associates could have access, per HHS

• Information can be shared across large databases, including through the eHealthExchange (ehealthexchange.org), a national data exchange system

• Data-based research on patients may occur without direct patient approval

Most patients never realize how extensively their confidential information may travel or how many people may have accessed it.

The Rise of Medical Surveillance

www.BigBrotherintheExamRoom.com

The digitization of medicine has also introduced a new form of intrusion.

Doctors are now monitored through the same systems that record patient data.

Electronic records track physician decisions, compliance metrics, and adherence to government rules and clinical guidelines. For example, federal programs administered by CMS—such as the Merit-based Incentive Payment System (MIPS)—measure whether physicians follow specific care protocols and quality measures, with payment adjustments tied directly to those scores.

These measures can include treatment decisions, documentation requirements, and other standardized criteria embedded into electronic systems.

This creates pressure for doctors to practice medicine according to checklists and system prompts rather than individualized clinical judgment.

The result is a growing system of digital surveillance in health care—not only of patients, but of physicians themselves.

A Warning from Inside Medicine

Some health care professionals see the consequences firsthand.

As one registered nurse put it: “The government electronic health record is a clinical disaster… It steals time, interrupts flow, creates a barrier, constricts thought processes, and forces eyes and hands to turn away from the patient.”

They describe exam rooms where clinicians must divide attention between the patient and the computer screen.

Where time once spent listening or observing is replaced by typing and clicking.

Where data entry takes priority over human connection.

In their view, medicine risks losing its core purpose.

Not because technology exists — but because it has been imposed in ways that serve administrative and data collection goals instead of patient care.

What Happens Next

Health care will inevitably involve digital systems. No one disputes that.

But something fundamental has changed.

For generations, the answer was clear: medical information belonged within the confidential relationship between patient and doctor. That principle protected patients and preserved physician independence.

Today, that protection has been weakened.

Who controls the data — and who benefits from it?

Is medical information primarily a clinical tool meant to serve patients?

Or is it a vast dataset for governments, corporations, and researchers to analyze and monetize, and use for purposes that may ultimately harm patients?

Until Americans fully understand how the system works, that question will continue to be answered without them.