The Privacy Illusion. A Senator is grilling EHR vendors, proving patient control is still a myth


 Senator Ron Wyden (D-Ore.) has launched an inquiry into major Electronic Health Record (EHR) vendors, including Epic, Oracle Health, and Athenahealth, demanding better tools for patient data privacy. Wyden argues that despite federal mandates against "information blocking," patients still lack meaningful control over who accesses their medical history. He frames this not just as a consumer right, but as a national security issue, citing risks where widespread data sharing could expose sensitive information to bad actors or foreign adversaries.

The push is already yielding results. In response to the pressure, Epic has announced new features for its MyChart portal that will allow patients to "freeze" their records or opt out of broad data-sharing networks. However, Wyden warns that the default settings of many interoperability networks favor "open access" over privacy, often leaving sensitive data exposed to thousands of providers without explicit patient consent. The Senator’s move highlights a growing tension in digital health: the need to balance the clinical benefits of seamless data exchange with the imperative to protect patient data from unauthorized surveillance and misuse.

Read the original article at: https://www.healthcareinfosecurity.com/senator-presses-ehr-vendors-on-patient-privacy-controls-a-30323


Follow us on Instagram, Twitter, and Facebook to stay up to date with what's new in healthcare all around the world.

Comments

Post a Comment

Popular posts from this blog

South African pathology giant Lancet Laboratories fined R100,000 for failing to adequately report multiple data breaches

Image
  The Information Regulator of South Africa has issued an enforcement notice and a fine of R100,000 against Lancet Laboratories for its failure to adhere to the Protection of Personal Information Act (POPIA). The regulator cited the pathology group for neglecting to notify both the regulatory body and the affected data subjects in a timely manner following multiple security compromises. This enforcement action highlights a growing global trend where regulators are moving beyond penalizing the breach itself to strictly punishing failures in transparency and incident response protocols. For international health organizations operating in multi-jurisdictional environments, this serves as a reminder of the strict liability associated with breach notification timelines. The regulator explicitly criticized Lancet’s lack of urgency, noting that the delay in notification denied patients the opportunity to take protective measures against identity fraud. The penalty underscores that effecti...
Read more

Clinicians using public AI tools without approval—cyber risks ahead

Image
A growing trend reveals that clinicians are turning to readily available, public-facing AI tools and Large Language Models (LLMs) (such as general-purpose chatbots) for clinical assistance without formal institutional approval. This phenomenon, known as "Shadow AI," poses immediate and severe cybersecurity and compliance risks . When patient data is copied or pasted into a public LLM, that data is transferred to a third-party server that is not covered by a Business Associate Agreement (BAA) and is not HIPAA-compliant. This practice results in an instant HIPAA violation and leads to accidental data exposure without triggering firewalls or alerts. Experts warn that Shadow AI has quickly become the most overlooked threat in digital health. Health systems must urgently implement clear governance policies to restrict the use of non-approved AI tools and instead offer validated, secure, and institutionally monitored LLM resources. The solution lies not in banning AI, but in i...
Read more

Cybersecurity in Healthcare insights: 27th Nov- 3rd Dec 2025

Image
  New US federal security standards prompt healthcare cybersecurity overhaul Proposed updates to federal healthcare cybersecurity standards, introduced in late 2024, represent the first major overhaul of the HIPAA Security Rule in decades. These changes, aimed at addressing modern threats like AI and quantum computing, mandate that HIPAA-covered entities implement rigorous measures such as data encryption, multifactor authentication, and regular security audits. Crucially, they also require written procedures to restore critical systems within 72 hours of an incident. While necessary, compliance comes with a steep price tag, HHS estimates first-year costs at approximately $9 billion. This financial burden poses a significant challenge for smaller hospitals lacking the resources of large health systems. To bridge this gap, experts suggest leveraging staff augmentation through managed service providers (MSPs) and adopting AI-driven threat detection tools to enhance security without e...
Read more