MyChart

Is MyChart safe?

Yes, for most people MyChart is a safe way to read test results, message doctors and pay bills. Epic, the Wisconsin company that makes it, says it does not sell your information and does not keep copies of the health data you send through the app. The app asks for a second login step by default, and Have I Been Pwned lists no breach of Epic itself. We score it 74/100, ahead of Google Drive (70) and the period tracker Flo (66).

The catch is that MyChart is not one service. It is a front door to the records of whichever hospital or clinic you use, and each of them decides which features to switch on, who can see what, and how its website is built. Most of the real risk sits there, and in phishing emails that borrow MyChart's look.

Who actually holds your MyChart data?

Your health system does. Epic's policy for its patient apps says the app connects to "servers and systems operated and maintained by healthcare organizations that use Epic", and that Epic does not receive or store copies of health or fitness data you send through it. Epic keeps only limited technical data, such as your device model, app version and error codes. If you use the newer MyChart Central login, Epic also stores your name, date of birth and contact details on its own US servers to link your accounts.

That matters for the law. Your hospital is a covered entity under HIPAA, so your records are protected health information and the hospital must secure them. HIPAA also lets it share records without asking you for treatment, payment and its own operations. Requests to see, correct or delete your data go to the hospital, not to Epic.

HIPAA stops at the point where you send your records elsewhere. MyChart lets you link outside apps and share your record. The Department of Health and Human Services says that once records reach an app you chose, which is not working for your provider, "the information is no longer subject to the protections of the HIPAA Rules". Read the privacy policy of any app you connect.

Apple's privacy label for the app has no "Data Used to Track You" section. It lists health, financial, contact and identifier data as linked to you, which reflects what the app shows you rather than what Epic keeps.

The hospital website problem

The biggest privacy failures linked to MyChart came from hospitals, not from Epic. In October 2022 Advocate Aurora Health, which runs 17 hospitals in Wisconsin and Illinois, reported to HHS that Meta Pixel and Google tools on its website, MyChart portal and scheduling app had sent patient information to those companies, affecting up to 3 million people. It removed the tools and agreed a $12.225 million class settlement, and HHS later said such trackers on patient portals can break HIPAA. This was the hospital's choice of web tools, but it shows that two people using the same MyChart app can get different levels of privacy.

Phishing that copies MyChart

Because millions of people expect MyChart emails, scammers copy them. Reported lures include "new test result" links that open a fake login page, alerts about urgent blood work, unpaid balances, locked accounts and a "2026 Medicare Health Kit". The goal is your password, personal details or a malware download. Gizmodo obtained 166 FTC complaints about MyChart over five years through a records request, though not all were about phishing.

The defence is simple. Never log in from a link in an email or text. Open the app, or type your health system's MyChart address, and check there.

Proxy access for parents and teenagers

MyChart lets you give a family member or carer "proxy" access to your account, and lets parents manage a child's care. For teenagers, the rules change with age and state law. MaineHealth, for example, gives parents full access until a child's 12th birthday, then a limited view until 18 that hides health history, medications and most lab results; care a minor can consent to alone, such as sexual health, mental health and substance use treatment, falls under adult confidentiality. Rules differ between health systems and states, so ask yours what a parent can see.

How to use MyChart safely

1. Keep two-step login on, and set up a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary if your health system offers one.
2. Reach MyChart only through the app or a bookmarked address, never through email links.
3. Review who has proxy access to your account once a year, and remove anyone who no longer needs it.
4. Before you link an outside app to your record, read its privacy policy; HIPAA will not cover it.
5. Lock your phone. MyChart can remember your username, and notifications may show that a result is ready.

How we scored it

Regulatory record (86) is the strongest factor: we found no fine against Epic over MyChart, but no regulator has reviewed the app itself, and the hospital pixel cases take two points off. Scams and harmful content (80) is high because there are no strangers on the app, with phishing as the main threat. Privacy (72) and security (72) reflect Epic's no-sale policy and default two-step login, held back because each hospital controls the data, the servers and its own web trackers. Transparency and control (70) loses points because deletion and correction depend on the hospital.