How I Fell Down the Medical Privacy Rabbit Hole

Medical privacy, electronic health records, AI in healthcare, and the questions patients should be asking.

Hi everybody!

So, this week I accidentally fell down a very deep Internet-security rabbit hole, and naturally, it started with my medical records.

You all know me; I’m an analyst by trade, but my passion is technology. I love technology. I love what AI can achieve when used responsibly, in the right hands, and for the right reasons.

I use AI myself, and I genuinely think it can be an incredible tool.

But there’s another side of this conversation that I think we need to be talking about:

Our privacy.

More specifically, what happens to our medical information when it moves through electronic health record systems, health information exchanges, third-party applications, AI documentation tools, and all of the other technology now sitting between patients and their healthcare providers?

And that’s where things started getting really interesting.

---

What Happens to Your Medical Records After They Leave Your Doctor’s Office?

During my own little investigation, I started looking more closely at Epic, Care Everywhere, interoperability, and the different ways medical information can be accessed and exchanged between healthcare organizations.

Then I noticed something that really bothered me.

I have been finding information in my medical record that I believe is incorrect, including dates, timelines, and other details that don’t match what actually happened.

That raised a much bigger question for me:

If incorrect information is being entered into or carried through my medical record, where did it come from—and how many people or systems are relying on it?

Because this isn’t Facebook.

This is my medical history.

If incorrect information is copied from one system into another, then potentially relied upon by another healthcare provider, that isn’t simply an annoying data-entry error.

It could change how someone understands my medical history.

And potentially, it could influence decisions about my care.

---

Then We Get to AI in Healthcare

This is where my tech brain really started spinning.

AI is increasingly being used in healthcare for things like documentation, transcription, summarization, clinical workflows, and administrative tasks.

And I’m not automatically opposed to any of that.

In fact, I think some of these technologies could make healthcare better, faster, and more accessible.

But I want to know something very basic:

What happens to my information when AI is involved?

When a doctor’s office uses an AI tool during an appointment:

• Who receives the information?
• What information is actually being transmitted?
• Is personally identifiable information included?
• Is the information stored?
• How long is it retained?
• Is it de-identified?
• Is it used to train or improve an AI model?
• Who owns or controls the resulting data?
• Which third-party companies have access to it?
• What happens to the information after the appointment ends?

These seem like pretty reasonable questions to me.

And as a patient, I want answers.

---

This Isn’t Just a Hypothetical Concern

As I started digging into this, I found something that made me stop and say, okay… so I’m definitely not the only person asking these questions.

A 2026 study published in Nature examined privacy risks associated with medical AI systems. Researchers looked at whether it was possible to determine whether an individual patient’s information had been included in the data used to train an AI model—a type of attack known as a membership inference attack.

What really caught my attention was that the researchers found that privacy risks could look relatively small when examined across an entire dataset while being much greater for individual patients.

In other words, looking at the privacy risk of a medical AI system from a big-picture perspective doesn’t necessarily tell us how vulnerable one specific patient’s information might be.

And that raises a question I can’t stop thinking about:

If my medical information is being used to develop, train, test, or operate an AI system, how would I know whether my individual information is actually protected?

That’s not an anti-AI question.

That’s a patient privacy question.

And I think patients deserve an answer.

Source: Nature, “Disparate privacy risks from medical AI” (2026).

---

The Problem: Every Healthcare Organization May Be Different

I’ve reached out to Epic multiple times this week trying to get clarification about AI, training, and how these different systems interact.

The response I’ve received so far is essentially that different healthcare organizations and offices may use different technologies and vendors.

And honestly?

That answer created more questions for me, not fewer.

Because how are patients supposed to understand what is happening to their medical information if every healthcare organization may be using different systems, different AI tools, different vendors, and different policies?

I don’t think patients should need a degree in cybersecurity, data governance, and healthcare IT just to understand who has access to their own medical records.

---

Epic Care Everywhere & Health Information Exchange

This has also sent me down a rabbit hole looking at Care Everywhere and health information exchange.

The concept itself makes sense.

If I go to a new hospital, wouldn’t it be helpful for that provider to have access to important parts of my medical history?

Absolutely.

Interoperability can potentially prevent duplicate testing, help providers understand previous diagnoses and treatments, and make healthcare more connected.

But there’s an important trade-off:

Convenience and interoperability also raise questions about privacy and control.

I want to understand:

Who can access my records?

When can they access them?

What information is being shared?

Where does that information go?

And what control do I actually have over it?

Those are questions I think every patient should be encouraged to ask.

---

This Isn’t About Being Anti-AI

Let me make something very clear:

I am not anti-AI.

Quite the opposite.

I love AI.

I use AI.

I think AI can be an incredible tool when it’s used responsibly.

But loving technology doesn’t mean we should blindly hand over our most sensitive information without asking questions.

We can be excited about technological innovation and demand strong privacy protections.

Those two things aren’t mutually exclusive.

---

The Part That Concerns Me Most: Incorrect Medical Information

For me, this isn’t just an abstract privacy debate.

It’s personal.

I’ve been watching my medical records closely, and I’ve noticed information that doesn’t appear to be correct.

That makes me wonder:

Where did that information originate?

Was it entered manually?

Was it copied from another record?

Was it imported from another healthcare system?

Was it generated or summarized by a software tool?

Was it pulled from another source?

And once incorrect information enters a medical record, how does it get corrected everywhere else it may have traveled?

That’s the part I really want to understand.

Because our medical records don’t just contain our names and addresses.

They can contain our diagnoses, medications, procedures, imaging, laboratory results, family history, genetic information, mental health information, reproductive history, and incredibly personal details about our lives.

That information deserves to be treated accordingly.

What Happens When AI Gets the Medical Record?

As I kept digging into this, I found a 2026 JAMA Viewpoint that made me stop and think about this issue from a completely different angle.

In “When Patients Share Everything With an AI Chatbot: Risks and Opportunities of Large Language Models,” authors Ifeoma Ajunwa, Ravi B. Parikh, and I. Glenn Cohen examine what happens when patients provide an AI system with their electronic health records.

And one of the points that really stood out to me was this:

Our medical records aren’t necessarily perfect.

They can contain incomplete histories, diagnostic errors, stigmatizing language, institutional biases, and information written by multiple healthcare professionals over many years.

Now imagine taking that entire record and giving it to an AI system.

The AI isn’t necessarily starting with a clean, perfectly accurate representation of the patient.

It’s starting with the medical record as it exists.

That distinction matters.

Because if incorrect or biased information is already sitting inside a medical record, what happens when that information is summarized, analyzed, reproduced, or incorporated into another system?

The authors specifically identify concerns surrounding privacy, discrimination, and the potential worsening of health disparities when electronic health records are uploaded to large language models without careful curation.

That brought me right back to the questions I’ve been asking about my own records.

If I find information in my medical history that I believe is incorrect, I don’t just want to know who entered it.

I want to know:

Where did it go? Who else received it? Was it copied into another system? Was it summarized or transformed by an automated tool? Could an AI system be relying on it?

And perhaps the biggest question of all:

If incorrect information becomes part of an AI-assisted healthcare workflow, how do we make sure the error doesn’t become more difficult to find and correct?

I don’t think these are unreasonable questions.

And I don’t think asking them means we’re anti-AI.

I think it means we’re asking for something very simple:

Transparency.

Patients should be able to understand what information is being collected, where it goes, who has access to it, and how it is being used.

Source.Read the article on JAMA Network

---

So What Can Patients Do?

I’m still researching this myself, but I think there are some important questions we can all start asking our healthcare providers.

Ask your doctor’s office:

1. Do you use an AI medical scribe or AI documentation tool?

2. What company provides it?

3. Is my appointment audio or other information transmitted to a third party?

4. Is my identifiable information included?

5. Is the information stored?

6. How long is it retained?

7. Is my information used to train or improve an AI model?

8. Who can access the information?

9. What happens to the information after my appointment?

10. What options do I have if I don’t want to participate?

And perhaps most importantly:

Ask how information is shared between healthcare systems.

If you have records in multiple healthcare networks, ask what information may be available through interoperability or health information exchange.

You have every right to understand how your information is being handled, I have opted out of all shared information untill Epic and Cerner reply to my privacy questions.

---

Now I Want to Hear From You

This is where I need your help.

Have you ever found incorrect information in your medical record?

Have you noticed errors appearing after information was exchanged between different healthcare systems?

Have you noticed discrepancies in Epic, Care Everywhere, Cerner, MyChart, or another electronic health record system?

Do you know whether your doctor uses an AI medical scribe or another AI-powered healthcare tool?

If they do, have you asked what happens to your information?

And if you’ve investigated this yourself…

What did you find?

I want to hear your experiences—not just with Epic, but with Cerner, health information exchanges, electronic medical records, and AI tools being used in healthcare.

Because this rabbit hole has officially gotten WAY too deep.

Drop your experiences, concerns, questions, or things you’ve discovered in the comments.

Let’s figure this out together.

And yes…

I’m still digging.