Are Your MyChart Messages To Your Doctor Private?

It’s a Wednesday, and I’m sending a question to my doctor through the messaging portal they encourage us to use. I receive a response not too long after — which is fairly surprising, especially with the long wait times for doctor appointments we’ve been seeing — but it’s from an office staff member.

In other words, someone I didn’t think would have this much contact with the specifics of my medical information replied to me.

In a way, it’s not a huge deal. I mean, they have to abide by HIPAA, they walk around the office when my doctor and I are meeting, and they’re familiar with other information of mine.

At the same time, it’s not what I expected.

My situation is not unique: Your MyChart or other health care portal isn’t as private as you may think. Ahead, doctors explain who can see what, other risks, and the best way to connect with them specifically (i.e., not with a random staff member).

While information like this can be alarming — especially when we’re more worried about keeping personal information safe on the internet and protecting our phones from major security risks — doctors don’t want you to feel too alarmed.

“Any information that is shared in MyChart or any messages sent to the provider is HIPAA-protected, private information,” said Dr. Cooper Stone, a psychiatrist in Philadelphia who’s board-certified by the American Board of Psychiatry and Neurology. “In other words, the only people who should have access to the chart should be medical professionals involved in the care of the patient, and the records accessed should be done on a need-to-know basis only.”

So, the whole world isn’t able to access your medical records, but more individuals than just your primary physician can.

“The only people who can see your protected health information (PHI) in MyChart are the doctor, nurses and office staff who handle your care,” agreed Dr. Joshua Gray, an emergency medicine physician and Relias clinical consultant.

With that said, Stone has seen this privilege abused in a couple of scenarios, like staff snooping in the chart of a celebrity or prominent figure, or medical staff gaining access to an ex’s chart. (Yikes.)

For what it’s worth, there is some protection against this. According to Gray, many health systems can monitor who’s looking at your chart and alert your care team about any unusual activity. Plus, even when snooping is involved, not all information is accessible — especially with mental health providers.

“Information that is often unavailable to all, even to the patient themselves, is processing notes taken by a therapist or psychiatrist when conducting psychotherapy,” Stone said.

One other factor to be aware of is the impact of granting MyChart access to friends and family. This allows them to see test results, appointment summaries and even messages with your doctor. (This is something you might have done without thinking, or so long ago that you can’t even remember it now.)

While sharing access can be helpful, it has its downsides, too. A key example Stone mentioned is someone’s abusive partner having access to their chart (so knowing what’s been discussed, when they are at the doctor’s office, etc.).

Even if the person with access isn’t abusive, exercising some caution isn’t a bad idea. “It’s convenient, but I would only use proxy access with someone you completely trust, like a family member or caregiver,” Gray said.

So, messaging on MyChart isn’t necessarily your best option — but not only for the privacy reason mentioned above.

“Doctors are often inundated with dozens and dozens of messages daily, and they often do not have protected time to respond to each message,” Stone said. “If it’s an urgent matter, a private matter or a question or topic that requires a lengthy discussion, it’s best to reserve time with the doctor by scheduling an appointment.”

In short, MyChart is for quick, nonurgent questions.

For Gray, MyChart privacy comes down to personal responsibility. “The main concern is how you use it,” he said. “Think of MyChart like a digital waiting room: It’s secure but still connected to a larger area.”

He believes MyChart is a safe and easy option for discussing lab results, medication refills, insurance issues and quick questions, but when it comes to deeply personal concerns, he suggests scheduling a call or visit.

As you’ve read (and could probably guess), your best bet is to keep communication offline — at least when you can do so without other risks or barriers.

“The most private way to talk to your doctor is to schedule an in-person appointment with them,” Stone said. “While virtual appointments can offer some level of privacy, there’s always a possibility that somebody non-medical is within earshot and can hear in on your private conversations with your doctor.”

Gray agreed, and he still doesn’t have concerns about these portals.

“The most private conversations still happen the old-fashioned way, either in person or over the phone,” he said. “However, the MyChart function is very secure and typically only seen by your health care team.”

When it comes to MyChart (and any private information online, really), Gray wants to remind people of the importance of general web safety — for example, creating a strong password and using two-factor authentication. Steps like those provide added protection and can help keep your personal information safe across the board.

“I remind my patients that privacy is always a balance between convenience and caution,” he said.