Boulder Community Health (BCH) recently implemented a new Electronic Health Record (EHR) software system. The system is provided by Epic Systems.
I have decided to opt out of as much information sharing as I possibly can. In part, this is my own innate sense that privacy violations are creepy. In part, this is the software engineer in me being suspicious of large-scale software privileged with tons of private data. And in part this is sheer orneriness triggered by the David-versus-Goliath sense that someone like Epic Systems has more control over my data than I myself do. (More on Epic’s moral trustworthiness later.)
I’ll acknowledge, before I start, that you might not feel the same level of creepiness that I do when it comes to companies having your private data. And you might also have very good reasons for wanting your medical information shared as widely as possible. For example, maybe you travel often and want to be sure your medical record is widely available wherever you go. If that’s you, then go read something else.
Paper trail to digital portal
At an office visit, I got hold of a five-page handout called “Your Information. Your Rights. Our Responsibilities.” On pages 2 and 3 is a list of things I can opt out of, including “EPIC Care Everywhere, and something called CORHIO.
But let’s start by seeing if we can actually opt out of the EHR portal altogether.
They say you can’t lock the portal
BCH’s new customer-facing portal is branded “MyBCH.” I want to know if there is a way to disconnect my data from the portal entirely.
I naively asked someone behind a desk a question along these lines: “I don’t want there to be a portal account with my information.” I was reassured that by not opting in, my account would not be available to anyone.
But I realized that I didn’t ask the question the right way. What I want to know is whether I can make it so that even I cannot create a user account. I want my account completely locked. After all, someone who steals or buys my Social Security Number is not going to simply opt out on my behalf.
I found out that this is not possible. After reaching the Privacy Officer, she told me that you can’t request a lock on your account. The best I could hope for is to be “banned” from the system. I would have been willing to get myself banned, just to see how it worked…
… If only that were possible. Unfortunately, the Privacy Officer told me that they had not yet been trained on how to ban someone. So my best hope is to “plant a flag.” That is, sign up for an account before someone else does it in my name.
So I created an account.
MyBCH Security Is Hobbled
The first problem I encountered on the MyBCH portal was that my selected password (only 32 characters long) was not allowed because it was too good.
This is why I say “hobbled.” Why restrict me to a 20-character password if I am willing and interested in using something longer? What’s the point of implementing a maximum length restriction? According to a popular question on Stack Exchange, the most likely (and very sarcastic) answer has to do with monkeys, bananas, and stepladders.
The next problem that I encountered on the MyBCH portal was that my shortened password (now 19 characters long) was not allowed because it was … too long?!?
The following 19-character password, generated by a good password manager, fails with the explanation that the length must be between 8 and 20 characters.
¦à']í1¼UÁ¡½Z#µ2ø7¶/
Hmm. Do you suppose they have some other rules about password complexity that they are not telling their customers about?
After I shortened my password, then dumbed it down, I was finally allowed to create an account.
My next goal was to secure my medical records the same way I secure my banking and shopping accounts — with 2-factor authorization.
There Is no 2-Factor Authorization
There is no 2-Factor Authorization. After all, it’s only your medical records. It’s not like it’s your Amazon account or anything, you know, important.
I am guessing the lack of 2-factor authorization is a configuration choice made by BCH because I can find Epic Authenticator apps on the internet. If that’s true, then this is a big security disappointment. There may be flaws with a given 2FA systems, but security researchers will say it’s better than not having one.
Opting out: the portal won’t do it for you
Now that I had a portal account, I hoped I could use it to opt out of my information being shared.
I was out of luck. To opt out, I am told, I must use email:
I sent an e-mail address to the correct address. I got a reply after about 2 days saying that I had been opted out of Care Everywhere.
The problem with using email to opt out, instead of the portal, is that I don’t know whether they actually did it. I don’t know that they found my record and not someone else’s. Nevertheless, I feel reassured that I am probably opted out — at least from Care Everywhere.
Now to opt out of the other network.
Opting out: hire a notary
Next up: let’s see if we can opt out of CORHIO.
You can’t opt out of CORHIO without a Notary Public (unless you are at a doctor’s visit, apparently). So I’ll be skipping this step for now.
Hopefully next time I have an appointment with a medical professional, I will remember to not only ask about my health, but to also ask her to do the important job of clicking some box on a form somewhere so that I can opt out of data sharing.
Did BCH agree to any “Gag Clauses” with Epic?
You might remember I said I had an innate mistrust of Goliath-sized data aggregators. In researching Epic System’s track record, I found that several doctors have raised concerns that EPIC forces gag clauses on providers who use their portal.
The idea that you sign away your first amendment rights for the privilege of doing business with someone sounds pretty un-American to me. This is another one of those issues that raises my hackles. It gives me an immediate dislike for Epic Systems, and really makes me question their moral trustworthiness. (In fairness, some articles quote an Epic spokesperson saying they don’t have “clauses that prohibit criticism.” On the other hand, other articles say that research has documented gag clauses in Epic contracts. My instinct is to believe public-interest researchers over corporate Goliaths, but there doesn’t seem to be a definitive answer out there.)
Worse, some of the articles mention that your health safety could be at risk because of these gag clauses. One article, from 2015, is titled “Doctors barred from discussing safety glitches in U.S.-funded software“.
For the sake of my patriotism and my health, I am hoping that BCH did not go there, and that Epic Systems didn’t ask them to. But that’s just hope, for now.
In the meantime, I have asked BCH (via the portal), whether they have signed any gag clauses with Epic Systems.
I am hoping they will give me an honest answer. If such a thing is even allowed.
Partial accidental success: lock your account
As I tried to log back into my portal to see if anyone had answered my questions about 2-factor authorization and whether BCH agreed to a gag clause, I had an unexpected, ironic bit of “success,” if that’s what you can call it.
While trying to log in, and because of some apparently bad software, I managed to lock myself out.
I didn’t actually intend to, but after logging in with my name and password I was directed to a screen supposedly showing me an additional security check. Probably this was intended to show me a CAPTCHA screen. However, for whatever reason, no CAPTCHA appeared. I am guessing this is because the CAPTCHA would have been served by a third-party web site or required third-party cookies, which my browser refuses.
(I should rant here about software testing that ignores people using privacy browsers or who disable third-party cookies, but since I wasn’t watching network traffic when MyBCH failed to serve the additional security check, I can’t swear that this was the problem.)
In any case, after clicking “next” a couple of times without solving whatever additional security was supposed to be solved, my account was disabled.
The portal tells me that I need to contact BCH directly. Which is exactly what I wanted in the first place!
The only down side is that I’ll never know whether BCH answered my questions about 2-factor authorization and the gag clause.
Add those to the list of questions to ask my doctor next time. I hope we have time to get to the state of my health.