Podcast: Play in new window | Download (Duration: 43:49 — 35.1MB) | Embed
Subscribe: Apple Podcasts | Spotify | Email | RSS | More
Your health data belongs to you—but how can you share it safely? Fabienne Bourgeois, MD, exposes the complex truth about privacy, permissions, and data control.
Summary
According to Fabienne Bourgeois, MD, patients want control over their health data, but privacy preferences and constant changes complicate this. The discussion is relevant to people with disabilities, caregivers, and others navigating complex health information. About 80% of people share common privacy concerns that current systems can’t address. The remaining 20% need more detailed controls and customization, though balancing autonomy with privacy remains challenging. Ownership means individuals have the right to participate in research and make informed choices. They need “digital intermediaries”— professionals who assist with data sharing—and genuinely intuitive interfaces. Privacy protections must remain a top priority as health and AI tools continue to develop.
Click here to view the printable newsletter with images. More readable than a transcript, which can also be found below.
Contents
Please comment and ask questions:
- at the comment section at the bottom of the show notes
- on LinkedIn
- via email
- YouTube channel
- DM on Instagram, TikTok to @healthhats
- Substack
- Patreon
Production Team
- Kayla Nelson: Web and Social Media Coach, Dissemination, Help Desk
- Leon van Leeuwen: editing and site management
- Oscar van Leeuwen: video editing
- Julia Higgins: Digit marketing therapy
- Steve Heatherington: Help Desk and podcast production counseling
- Joey van Leeuwen, Drummer, Composer, and Arranger, provided the music for the intro, outro, proem, and reflection
- Claude, Perplexity, Auphonic, Descript, Grammarly, DaVinci
Podcast episode on YouTube
Inspired by and Grateful to:
Alexis and Sara Snyder, Amy and Morgan Gleeson, Fatima Mohammed Ighile, Esosa Ighile, Jill Woodworth, Tomas Moran, Marianne Hudgins
Photo Credits for Videos
80/20 by Austin Distel on Unsplash
Design flaws by Getty Images on Unsplash
Privacy by Hector Reyes on Unsplash
Links and references
Fabienne Bourgeois, MD LinkedIn and Publications
National Center for Medical Legal Partnerships
Episode
Proem
The slogan, “Give Me My Damn Data,” began in 2009 with E-Patient Dave DeBronkart as a call for transparency and control: patients arguing that real involvement in their healthcare needs open access to their personal health information. But once we have our data, what will we do with it? Who will we share it with, and in what situations? What are the personal and technical challenges of managing that sharing? I know enough to be dangerous about data-sharing technology. I do understand the personal and relationship sides of data sharing, though. To learn more, I reached out to my former colleague, Fabienne Bourgeois, an Adolescent Medicine doctor and Associate Chief Medical Information Officer (ACMIO) at Boston Children’s Hospital. Fifteen years ago, we worked together, learning from emerging adults about their worries and issues with data sharing. We enjoyed catching up and reviewing the current landscape.
For my followers who prefer the written word, this transcript has been lightly edited and organized for readability.
When Life Throws Your Kid a Curveball
Health Hats: Hi. When did you first realize health was fragile?
Fabienne: Oh, that started pretty early on in medical school. I had some very transformative interactions and experiences with patients and families during my medical school rotations, particularly in pediatrics, which really led me to pursue a career in pediatrics. But there really were some extraordinary families. And it just became very apparent that things could change very quickly and that patients and parents were managing patients with really chronic conditions. Regularly, something could change—really change —and we had to be very vigilant about everything. And the families, in particular, were the most vigilant about their child’s care.
Emerging Adults Matter
Health Hats: When I met you, I think we bonded over the adolescent advisory team.
Fabienne: That’s exactly right. Yes.
Health Hats: I was so impressed by the adolescents’ engagement and how many of their observations were incorporated into the process and design. I found it to be a model for me. When I went to work for Advocates, Inc. in Framingham, which supported 40,000 people with disabilities, there were a lot of similar issues in terms of a continuum of cognitive, judgment abilities, communication abilities, and styles, and the challenge of understanding their preferences and their challenges, and then hard-wiring that into real life. What you did was open my eyes to a world that I wasn’t aware of before that. I was so impressed by the adolescents’ engagement and how many of their observations
Your Medical Records Called—They’re Lost and Separated
Health Hats: Now that I’ve evolved to where I am now of the big project I’m working on is we’re developing a health data bank a receptacle for individuals to store any and all of their health slash medical data, whether it’s EHR claims PDF preferences journals so that then people could authorize the use of their data using a combination of private and public large language models to query that ever expanding and changing data set we’re in the really early stages of seed money. And I’m like, act you’re successful, right? Because when you are successful, it’s bang. It seems to me that the reason I wanted to talk to you was that I see the challenges that emerging adults face in terms of their preferences, rights, and safety as analogous — maybe not the same, but analogous — to language, relationships, and cognition, and that it’s fluid. It’s not like you set some standards. Because every situation is different at a different minute. So, I’ll shut up.
One Size Fits All? Please!
Fabienne: No, you’re exactly right. You’ve hit the nail on the head. It’s precisely what we are working on and trying to help because it’s very nuanced. And what’s very important is to understand that each patient is an individual, and each individual has particular preferences about who they want to share their information with. And that may be within their family unit or outside it. And we have to honor their privacy preferences. We discuss this particularly in the pediatric and adolescent populations because there are specific state laws and conditions under which adolescent patients can seek care without parental consent.
Spoiler: This Affects Way More People Than You’d Think
Fabienne: In those situations, we really make sure we maintain privacy in line with the individual adolescent’s preferences. But you’re absolutely right that this extends beyond the adolescent population. We see this often with patients with disabilities or with older adults who have other caregivers or other people who are proxies to their patient portal. So, they’re sharing their information with others, and there’s certain information they don’t necessarily want to share with everyone. And they entrust us with deeply personal information. And they want us to really take care of that information and keep it confidential if they choose to keep it confidential. Sometimes they really just want that conversation to be between them and their care team or their provider specifically. So you’re exactly correct. This really extends beyond the adolescent population.
Can We Teach Tech to Understand ‘It’s Complicated’?
Health Hats: When I break that down, I think the challenge of taking a pulse, meaning where do they stand at this moment? What do they understand are the nuances or the implications of their decisions? So it’s an understanding of life and self. Then there’s the technical of how. How does that get hardwired into something? And then there’s the interface, so people can go from their understanding, click a few buttons, and get what they want. And so it seems to me that you’re in the middle of all of that and that you can’t do your job if you don’t have excellent teams that can do, not necessarily everybody, but the whole team has to be able to deal with all of that.
Fabienne: Yes, you’re exactly right. And it’s tough. It’s very challenging. We’re lucky to have a very strong team in our IT department working on all of these things. But we’re also dependent on the restrictions, capabilities, and functionalities that vendors have in their electronic health records and in the health information exchanges. And I think you noted this previously as well. There’s an explosion in the interoperability space, where we’re not just talking about sharing information with patient portals and proxy-to-patient portals, but across health information exchanges. So, we’re sharing across institutions and, increasingly, with mobile health applications.
All-or-Nothing Privacy: The Sledgehammer Approach
Fabienne: And all of those have slightly different challenges in how that information is shared and safeguarded within those applications. And then also how individuals can provide preferences for which information is shared. And you’re exactly right: the technical part of this is just as complex as the nuances of the policies, the preferences, the regulations, et cetera. And in some cases, there just isn’t quite the granularity in information segmentation we need to really provide the appropriate preferences for patients and families. So sometimes it’s a very blunt object. We say this note contains confidential information, so no part of it will be shared anywhere. And we lose a lot of critical, valuable information that we would like to share with families and other providers, or that could be beneficial to an app. It’s a very complex challenge. You’re exactly right.
Health Hats: Gimme an example. I’m hearing what you say. Because people often talk about everything, all, very. People tend to use superlatives. People like to talk. I don’t want anybody, and what they really mean is that I don’t want my mother to know I didn’t go to school. I don’t care about what I wore or about my friends. You know what I mean? So, it’s so that’s what you’re talking about, right? When you say ‘blunt,’ it’s like the vendor infrastructure you’re working in has blunt tools. And so then do you have to glom something onto that very technical word to be more nuanced than the source structure?
MacGyver Solutions: When Your Software Says ‘No’
Fabienne: Yeah, absolutely. Sometimes we have to work around the information to provide it in other ways, even when we can’t use the out-of-the-box functionality of a particular vendor or application. We definitely try to find different ways to communicate that information. Unfortunately, sometimes it’s not possible electronically because there’s no safe way to do so. So, there, definitely, we try; we have various mechanisms to try and work around it. Unfortunately, in some cases, there’s information we would really like to share, but we can’t because we just aren’t able to. It’s definitely a highly complex arena.
The Secret Society of People Who Actually Care
Health Hats: Boston Children’s is established in this work. They are invested in this kind of work. But if a person is becoming aware of these challenges and wants to move their organization or community toward greater sensitivity to them, how would they go about doing so? Would they partner with somebody like Boston Children’s, who has expertise? Are there consultants that specialize in this kind of stuff? Where would I send somebody?
Fabienne: Absolutely. I think that’s a great question, because it’s a very niche environment, but there’s a really great group of informaticists working on this across the pediatric field. And most of us would be willing to discuss this with anyone interested.
Health Hats: Is there a Reddit group?
Fabienne: You’re bringing up a good idea. Maybe we should have this; that’s really externally available. There are obviously collaborations working on some of this to move the policies in the right direction and establish standards around it. For instance, the Shift group is working on that, but they’re really looking ahead. And then there are all of us within the pediatric informatics community who collaborate and discuss these issues. And we are all delighted to discuss this with anyone interested. Some of this is the frame — just thinking about the framework and all the different aspects you consider when it comes to what needs to be protected from access to individual information, depending on your access policies, right? So all of those are things that we’re all willing to discuss. Usually, even the vendors can start the conversation or provide you with names of individuals who have implemented some safeguards, but there isn’t necessarily a specific community. Yeah. Or, the website or site we send people to.
Juggling Your Mom’s Meds and Your Kids’ Forms: A Sandwich Generative Nightmare
Health Hats: When my mom was sick, she was living in San Diego. I live in Boston, and I was her medical person. And so every six weeks, I would take a long weekend to go to San Diego and handle in-person stuff. She mostly trusted me. And so she was with it and not with it, but she had very strong opinions, and that I didn’t necessarily agree with. And so we started with just, gimme your password and your login, and then, by the time she didn’t care. It didn’t matter that she was on her way out. But during the period when she did care, she cared a lot. I actually saw eye to eye with her on a ton, and I was a good advocate, but she was out there sometimes, and it was my job to follow her wish. I was often at a loss. There really wasn’t anybody I could turn to. I think about that population—the sandwich generation —people who are taking care of their kids and their parents, managing all these health things, and keeping track of it. When I think about having a personal health data vault, security is undoubtedly a significant concern. There are so many things that are huge deals, but I don’t think we’re really tuned into the nuances of authorization at this point. Is that the right word to use?
Playing Gatekeeper (Because We’re Scared You’ll Overshare)
Fabienne: That’s exactly right. It’s the personal authorization to each part of the information, and you’re exactly right. And making sure it’s nuanced and applies to the individual, so each can choose which aspects to adopt. So you’re exactly right. It’s that we are not quite attuned. It’s definitely something people are thinking about, but we haven’t yet come up with reasonable technical solutions for any of those.
80% We Can Solve + 20% That’s a Nightmare
Health Hats: In my work with the Patient-Centered Outcomes Research Institute (PCORI), I advocate for community research partnerships and am interested in balancing power dynamics between communities and academic medical centers. I find is that the issues and the nuances are hyperlocal, but the big things are universal. So, like, when I think about what you’re saying about being sensitive to people’s preferences, it seems —oh my God —that’s a lot of handholding. And do you feel like about 80% of it is people having common issues? I can work on designing things that get to solving relatively efficiently that 80%, but that 20% is a bitch because there are so many factors. Language, I’ll just go on and on. So, in your informatics leadership role, how do you balance your resources? Am I making sense?
Fabienne: Absolutely, no, absolutely. And I think that’s mostly what we’re doing now, because we don’t have the functionality to manage those 20% to really manage the, just that nitty gritty that is required in that 20%. So, we have specific default settings we have created, and then we allow some technical capabilities on an individual basis. So we will enable the clinician and the patient to decide whether a note becomes confidential, whether it is shared, and whether it’s shared across health information exchanges and in the portal. So there’s some granularity that we can create. We default to not sharing, for safety reasons. So a lot of our sexually transmitted illnesses, we just don’t share unless someone changes that. The default is just not sharing.
Informed Consent: What If People Actually Understood?
Fabienne: The challenge with that is that there are risks and benefits to sharing and not sharing. We are very aware of the risks we run when we don’t share specific information, as well as the importance of doing so. So, we try to discuss that with patients as much as possible. You mentioned that earlier, too. How do you educate everyone, and how do you inform them about where their information goes, where it becomes available, and what rights they have to control where that information goes and to filter it across portals, health information exchanges, and so on? And it’s a tough challenge. We try as much as possible. But I think we often end up making decisions on behalf of patients and families because that’s the only thing we can do. And we would prefer to have it entirely in the patient’s hands, but that’s not always feasible.
Needles in a Haystack: Finding Your 100 People Worldwide
Health Hats: It seems we are in a different situation, since if we set up a personal health data vault for someone, it is very clear it’s their data. We don’t have to deal with HIPAA because it’s my data. Still, the data is useless if you don’t use it. Then it’s making decisions about using it. Who can query it? Who can query it about what they want to be part of a research project? Here’s this pool of data. They could; they have a rare disease, as they mentioned on social media. They know a hundred people worldwide with this rare disease, and they could elect to pool those a hundred records, which would be a bitch to find. If you’re responsible for recruiting rare-disease patients to achieve a large n, it’s really challenging.
Plot Twist: When It’s Your Data, Everything Changes
Fabienne: What you’re doing is precisely the right thing and exactly what patients and families need, which is a way for them to control all of their data and where it goes and who accesses it. And it’s not the institution that’s making that decision on their behalf. So this is another way they can get involved — through research — or share that information with another provider, anyone they really want, another application, or anything they choose. They just have to understand what happens to that data when they share it. Yes. And what privacy protections are in place for that data when it is shared? Yes. And it’s complicated when a caregiver or parent does it on behalf of someone else. Yes. And especially because the rights or preferences of that individual may evolve. So, I think it’s crucial to take those considerations into account as you build all of this.
Training Wheels for Privacy: Teaching People to Choose
Health Hats: You’ve talked about having your pediatric informatics colleagues serve as your mastermind group. I remember one day we were coming out of one of these adolescent advisory committees and I said, “This is relevant for 10-year-olds.” They’re not so close to the age where there’s a transition, but 10-year-olds have what? And I don’t know about legal, but in my mind, as a parent, you feed choices to kids. And the trick of it, to me, was always that you give them options that either of them works. So, then they don’t choose something that you’re not ready to do anything about. But at least they made a choice. But it just made me think that it’s way bigger.
Fabienne: Absolutely.
The New Job Nobody’s Hired Yet: Your Privacy Concierge
Health Hats: So, where would somebody go? Okay, there are navigators. Suppose I can’t navigate insurance, Medicare, Medicaid —whatever. There are professional navigators. Are there professional permissioners? Obviously, those are the wrong words. I don’t even know what a business term would be.
Fabienne: No, it’s excellent, it’s a great question in terms of how, like consent and all of that. I think we should have that. Obviously, there is the evolving role of the digital navigator who helps with digital applications and understanding how to find your information. Even more basic is how to use your portal. How do you know? But I think that role will evolve to include some of these additional features; it’s really in its infancy; the kinds of roles for digital navigators are just starting. But I think you’re exactly right. I think we need to incorporate into that a way to really inform patients about privacy and confidentiality, and how to control their own data and health information, which very much belongs to them.
Can We Build This So My Oma Can Use It?
Health Hats: At this stage of our personal health data vault project, we’re concerned about how to make it simple. What about the interface? What’s the built-in education within the application or the vault? I notice that many apps aren’t intuitive, and the help desk isn’t very good. If a person owns something, we’re even more obligated to make it intuitive and easy to learn. Thoughts.
Fabienne: I think you’re exactly right. You have to build these in databases or applications that are very user-friendly, so that anyone, regardless of language or health literacy, can navigate and understand what is happening. And I think that’s very achievable. Not saying it’s simple, but it is feasible. We’re not there yet. Not everyone is building these applications or databases with that in mind; they’re not thinking about all these nuances as you are.
Health Hats: What should we have talked about that we haven’t in this topic?
Tech’s Outrunning Privacy (And We’re All Just Watching)
Fabienne: I think we’ve talked about. I think the key really is the explosion of where data is going. And this is happening very quickly, and I think the privacy protections. These considerations are lagging a bit behind the applications now available and the explosion of health mobile apps and AI tools emerging. And I think you are doing precisely the right thing by thinking about this now. And to incorporate this into the design of your project from the very beginning. I don’t think everyone is thinking about it in the same way you are.
Health Hats: Thank you. Yeah, this has been great. We will talk again.
Fabienne: Yes, let’s do that. I would love to hear more. I’ll for sure. Okay, I’ll do that. Bye all. So lovely to see you, Danny. Yeah.
Reflection
Patients want control over their health data, but the reality is complicated. Privacy preferences are deeply personal and constantly changing—there’s no universal solution. This affects everyone, not just emerging adults. The conversation is relevant to anyone with disabilities, caregivers managing a parent’s health, proxies accessing patient portals, and older adults navigating multiple providers. Healthcare vendors offer blunt tools—often it’s “share everything” or “share nothing.” There’s rarely granular control to say “yes, my care team can see this, but not my mother, and definitely not the insurance company.” About 80% of people share common privacy concerns and could benefit from standardized solutions. The remaining 20%—driven by language, cognition, family dynamics, legal status—requires customization that current systems can’t handle. Workarounds aren’t solutions, but they highlight problems and challenges. Fabienne’s team regularly builds manual workarounds because the software can’t do what’s needed. Sometimes it’s impossible to share critical information safely.
Ownership Changes the Game: When individuals own their data rather than institutions controlling it, they gain autonomy. This unlocks potential for research participation, especially in rare disease networks. We need “digital permissioners” — professionals who help people make informed decisions about their data, similar to insurance navigators. And the interfaces must be genuinely intuitive for people with different backgrounds and language abilities. Privacy protections lag dangerously behind the explosion of health apps and AI tools.
Thanks for engaging with me. See you soon.
Related episodes from Health Hats
Artificial Intelligence in Podcast Production
Health Hats, the Podcast, utilizes AI tools for production tasks such as editing, transcription, and content suggestions. While AI assists with various aspects, including image creation, most AI suggestions are modified. All creative decisions remain my own, with AI sources referenced as usual. Questions are welcome.
Creative Commons Licensing
This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms. CC BY-NC-SA includes the following elements:
BY: credit must be given to the creator. NC: Only noncommercial uses of the work are permitted.
SA: Adaptations must be shared under the same terms.
Please let me know. danny@health-hats.com. Material on this site created by others is theirs, and use follows their guidelines.
Disclaimer
The views and opinions presented in this podcast and publication are solely my responsibility and do not necessarily represent the views of the Patient-Centered Outcomes Research Institute® (PCORI®), its Board of Governors, or Methodology Committee. Danny van Leeuwen (Health Hats)
