If you have ever sat in a doctor’s waiting room and been handed an electronic pad to sign without a clear explanation of what you were approving, you are far from alone. What looks like a simple registration step can actually hide complicated decisions about health data sharing, advertising consent, and privacy rights.
That problem is at the center of reporting by CalMatters’ director of sociotechnical research, Alex Rosenblat, who has spoken with patients and visited clinics across the country to understand how medical offices handle paperwork, disclosures, and opt-out requests. The stories she heard revealed a system in which patients are often told they can choose, even when the design of the forms makes “no” feel nearly impossible.
How a routine appointment can become a privacy trap
During the final stretch of her own pregnancy, Rosenblat was at an OB-GYN office when she was given a form connected to Phreesia, a technology company that helps manage patient check-in. The form asked her to agree to let the company use her private health information for targeted advertising. On paper, the decision was optional. In practice, the form was marked with a red label reading “Required”, a signal that made the request feel mandatory even though it was not.
That experience raised a larger question: when health systems ask patients to make privacy decisions as part of registration, do those patients really have a meaningful choice? Rosenblat’s reporting suggests that many do not. Some offices use forms and workflows that appear to offer an opt-out, but the process is delayed, buried, or structured in a way that nudges patients toward consent before they fully understand what is happening.
Dark patterns are moving into health care
The techniques Rosenblat identified are known as dark patterns—design tricks that steer people toward a preferred outcome while making alternatives harder to notice or use. These tactics have been widely discussed in consumer protection, especially in finance and e-commerce, but her reporting indicates that healthcare privacy regulators have not focused on them with the same intensity. In other words, a tactic that has drawn attention in other industries may be operating more quietly inside medical offices, where patients are already busy, stressed, and unlikely to scrutinize every line of a form.
Experts say that gap may not last forever. As more attention is paid to how patient data moves between providers, vendors, and digital platforms, healthcare privacy oversight could become more aggressive. The concern is not limited to one company or one clinic; it is about whether patients can genuinely control how their information is used once it enters a modern healthcare system built on digital intake tools, data networks, and third-party software.
Why these choices matter beyond one office visit
These forms are not just administrative clutter. They can determine whether a patient’s information is used broadly across health networks or repurposed in ways the patient never expected. The key issue is consent: if the choice is presented in a misleading way, the legal right to decline becomes much weaker in real life. A patient may technically be allowed to say no, yet still be pushed through a process that makes refusal confusing, delayed, or socially uncomfortable.
That is why the reporting also touches on broader concerns around artificial intelligence and medical transcription. Patients and caregivers may need to negotiate whether AI tools are used to transcribe appointments, and they may later discover errors in those transcripts. Those problems are part of the same larger question: how much control do people actually have over their personal information once they arrive for care?
What CalMatters wants to hear from patients
CalMatters is asking Californians to share their experiences with health information sharing, privacy notices, and electronic forms. Have you tried to opt out of broad health data sharing? Were you asked to sign something you could not fully read or decline? Have you had to challenge the use of AI transcription or correct mistakes in a medical record? Those firsthand accounts can help show how these systems work in everyday life and whether patients are truly being given a choice.
The larger takeaway is simple: a medical office should not feel like a place where privacy decisions are hidden in plain sight. If a form is labeled optional but behaves like a requirement, patients deserve a clearer explanation. If data is being collected, shared, or used for advertising, that process should be obvious, understandable, and easy to refuse. Until that happens, the gap between what patients are told and what they can actually do will remain a serious issue in healthcare privacy.
