We surveyed primary care doctors and their patients in three locations: Beth Israel Deaconess Medical Center (BIDMC), a teaching hospital of Harvard Medical School, and community practices affiliated with BIDMC in urban and suburban Boston, MA; Geisinger Health System (GHS), a rural integrated health services organization serving patients in central and northeastern Pennsylvania; and the adult medicine and HIV/AIDS clinics at Harborview Medical Center (HMC), a county hospital affiliated with the University of Washington that serves primarily safety-net populations in Seattle, WA. Each participating institution received approval for the study from its Institutional Review Board.

To be eligible for OpenNotes, patients at BIDMC and GHS had to be current users of their sites’ patient portals, through which they could message their doctors, schedule appointments, and view components of their medical records (such as medication lists and test results). OpenNotes patients at HMC gained first-time access to their hospital’s patient portal when they enrolled in the study. At all three sites, study participants gained first-time access to notes written by their doctors following the clinic visits that occurred during the intervention.

We surveyed patients both before and after the year-long OpenNotes study to gauge their attitudes toward and experiences with gaining online access to their visit notes. We used portal tracking data to confirm whether notes were generated for each participant during the intervention and whether participants chose to view notes that were available.

For this report, we examined data from patients who completed the OpenNotes intervention, responded to both the baseline and 1-year post-intervention surveys, and completed the privacy questions on the surveys. We did not include patients who were excluded from participation (ie, denied online access to notes) by their doctors, who withdrew from the study, who moved or died during the intervention, or whose portal accounts became inactive during the study period. Information about the differences among patients by participation status and site has been published previously [22-25].

As described previously [23,25], 13,564 patients who completed the study had one or more notes made available during the year-long intervention period. Among those, 41.05% (5568/13,564) submitted a post-intervention survey. Further, 28.56% (3874/13,564) submitted both a baseline and a post-intervention survey with privacy questions completed; they constitute the study sample for this analysis.

Before developing the patient surveys, we conducted focus groups and individual interviews at the study sites to ensure that the surveys encompassed the major worries, expectations, and perceived benefits of online access to visit notes. Concern for the privacy of individual information was voiced by some patients during these focus groups and was particularly prevalent among patients at HMC [26]. The concerns about “privacy” that patients identified included login security, accessing their information in a public location (eg, library or hospital resource center), privacy breaches (eg, hackers or unauthorized hospital employees reading their medical information), and provision of their medical information to external organizations such as insurance companies and governmental agencies [26].

Based on focus group findings, we included an item addressing concerns about privacy in the baseline and post-intervention surveys, with responses on a 5-point Likert scale (baseline survey question: “If I could read my doctor’s notes, I would be concerned about my privacy: Agree, Somewhat Agree, Somewhat Disagree, Disagree, Don’t Know” and post-intervention survey question: “As a result of reading/having access to my doctor’s notes, I am concerned about my privacy: Agree, Somewhat Agree, Somewhat Disagree, Disagree, Don’t Know”).

In the baseline and post-intervention surveys, we also used the validated Ambulatory Care Experiences Survey (ACES) [27] and Perceived Efficacy in Patient-Physician Interactions (PEPPI) [28] instruments to assess participants’ level of trust in and interactions with their providers. The ACES instrument addresses patients’ self-reported quality of interaction and communication with their doctors, and PEPPI addresses levels of self-efficacy in communicating with doctors. Patients were also asked in the surveys to self-report demographic information including age, sex, race/ethnicity, education level, employment status, Internet use, and health status.

In the post-intervention survey, we asked patients a series of questions about whether or not they accessed their doctors’ notes (ie, “Did you look at any of your visit notes [on the secure patient portal]?”: Yes; No; I did not have any notes to look at because I did not see my doctor since notes were made available”), whether they would like OpenNotes to continue (ie, “I would like to continue to be able to see my doctor’s notes online: Yes, No”), and whether they shared their notes with others (ie, “Did you show or discuss your visit notes with other people? Yes, No, Don’t Know/Don’t Remember”).

As described in previous publications, we pre-tested the survey questions with patients for clarity and incorporated changes based on the patient feedback received. We conducted additional testing of online versions of the surveys prior to administering the surveys to participating patients [25]. See Multimedia Appendices 1 and 2 for the baseline and post-intervention survey instruments.

To assess patient characteristics associated with concerns about privacy, we performed a chi-square analysis on categorical variables, with age, race/ethnicity, employment, and self-reported health variables dichotomized for analytic purposes. To evaluate perceived confidence in doctor-patient communication and trust in doctors, we report quartile scores of the ACES and PEPPI summary measures. We also performed logistic regression models to determine whether age, sex, education, race/ethnicity, frequency of Internet use, and PEPPI scores were independently associated with the likelihood of having concerns about privacy at baseline. We performed McNemar’s test for paired data to determine whether patient attitudes toward privacy changed or persisted over the course of the intervention.

We analyzed data at both aggregated binary categories (collapsed categories into “Agree/Somewhat Agree” and “Disagree/Somewhat Disagree”) and disaggregated levels (“Agree”, “Somewhat Agree”, “Somewhat Disagree”, and “Disagree”). Unless otherwise stated, “concern for privacy” is reported as an aggregated percentage of both “Agree” and “Somewhat Agree” survey responses for improved clarity, and the findings were similar. For data that yielded significantly different results in the aggregate vs disaggregate, we report the findings separately. We used a confidence interval (CI) of 95% and defined statistical significance as a P value less than .05. All statistical analyses were conducted using SAS software, version 9.3.

At baseline, about one-third of participants reported concerns about privacy related to online access to visit notes (Table 1). Compared to participants without such worries, they were more likely to be non-white, have fewer years of education (high school/GED or less), attend BIDMC, and report lower levels of trust and confidence in communication with their doctor. More modest associations were found according to age and sex (women worried more than men, under age 55 worried more than age 55 or older). We found no difference in levels of concern according to self-reported health status.

Following multivariable adjustment, differences according to gender, race/ethnicity, and confidence in communication remained significant (Table 2). Women were more likely to be concerned about privacy than men (adjusted OR 1.18, 95% CI 1.03-1.36). Non-white patients had greater concerns than white patients (adjusted OR 1.56, 95% CI 1.21-2.01). Patients who had less self-confidence about communicating with their doctors, based on their PEPPI scores, were more concerned about privacy than others who had more self-confidence about communication (adjusted OR 1.72, 95% CI 1.41-2.09 comparing lowest quartile to highest quartile of PEPPI score).

Baseline concerns about privacy were not associated with whether or not patients reported that they accessed their notes during the intervention or shared their notes with others (Table 3). Similarly, 99% of patients wanted continued access to their notes after the intervention concluded, regardless of concerns about privacy at baseline. At the end of the study, only 27 patients (1%) disagreed with the statement “having online access to my doctor’s notes is a good idea.” Among this very small subgroup, 8 patients (30%) were concerned about privacy.

We found a modest increase in reported concerns about privacy following the intervention, with 32.91% (1275/3874) of patients concerned at baseline, and 36.63% (1419/3874) concerned after the intervention (χ² _stat=436.4; P<.001; Figure 1).

For most patients, individual responses regarding privacy concern did not change over the course of the study period: 19% (750/3874) of patients reported concern at both baseline and post-intervention, and 45% (1757/3874) consistently reported none or little concern at baseline and post-intervention (Figure 2).

However, 28% (1095/3874) of patients reported changes in their level of concern from the beginning to the end of the study (see Multimedia Appendix 3 for individual patient responses at baseline versus their responses post-intervention). Patients who were concerned about privacy at baseline but not concerned post-intervention (12.73%, 493/3874) were slightly more likely to be younger or female compared to those whose level of concern remained unchanged (χ² _stat=7.50; P=.006; χ² _stat=8.63; P=.003; data not shown). In contrast, those whose attitudes shifted from being not concerned at baseline to being concerned post-intervention (15.54%, 602/3874) were slightly more likely to be older than those whose level of concern remained constant (χ² _stat=16.66; P<.001; data not shown). Other attitudes and behaviors—for example, whether or not patients read their notes, wanted continued access to their notes, thought online access was a good idea, or shared their notes with others—were not significantly associated with changes in patients’ attitudes toward privacy (data not shown).

Overall, approximately one-third of patients at baseline reported concerns about privacy when considering gaining online access to their doctors’ visit notes. Nevertheless, this did not deter patients from accessing their notes and other medical information. Rather, nearly all patients wanted access to continue after the intervention despite the fact that nearly a third continued to worry about privacy. These findings are consistent with prior literature suggesting that patients want easy online access to their health information, despite concerns that might accompany such access [1,11,15,17,29].

The advancement of technologies such as patient portals carries the potential for a digital divide [30-36]. In our study sample that largely comprised experienced portal users, baseline concerns about privacy were more likely among individuals of non-white race/ethnicity, people reporting lower levels of self-confidence in communication, and those with less trust in their doctors. Lower education levels were also modestly associated with concerns about privacy. These associations are consistent with prior literature indicating that patients in these sociodemographic groups are, on the whole, less likely to enroll in patient portals and share personal health information [1,16,20,30-32,37,38]. Future research should consider whether worries regarding privacy might increase barriers to enrollment in patient portals among vulnerable populations, what factors associated with these sociodemographic groups contribute to privacy concerns, and how such concerns can be addressed.

Our study describes patients’ attitudes toward privacy before and after gaining online access to their doctors’ notes; however, it does not explore the reasons behind their concerns. The word “privacy” in itself carries different meanings for different people, and it may matter more to those who feel well than to individuals who are chronically or emergently ill [3,11]. But why did some patients become more concerned about privacy after a year’s experience with OpenNotes, while others became less concerned? Did their mode of access (eg, home computer, mobile device, shared computer in a library or other public space) influence levels of concern about privacy? As patient portals become more prevalent, doctors’ notes may become a common record component included in the information available to patients online. As such, how can doctors, administrators, and policy makers better address the future portal needs of patients, and how can they ensure that patients feel safe and secure logging on to read what the doctor has written?

While this research study gathered perspectives from 3874 patients at three diverse sites and included highly vulnerable patients, several limitations should be highlighted. First, participants at two sites (BIDMC and GHS) had been using patient portals before the study began and may be considered early and experienced adopters of such technology. Other literature demonstrates that individuals who use patient portals are typically less worried about privacy than nonusers [6,10], suggesting that the levels of concern reported by a substantial proportion of our respondents may not represent the general population. Nonetheless, while HMC patients received access to online health records for the first time through OpenNotes, they reported levels of concern on par with the average level of concern of registered portal users across study sites (approximately 33%; see Table 1).

In addition, the percentage of participants responding to both the pre- and post-intervention surveys was low, albeit consistent with other Internet-based surveys of patients [3]. And finally, while the topic of privacy was addressed in focus groups with patients before developing our survey [26] (a finding consistent with other focus group research on patient portals [39]) and the survey questions were vetted prior to administration, it is important to reiterate that the phrasing of the privacy question was used for the first time in the OpenNotes survey. Patients may not distinguish between the privacy risks of digitizing their health records (eg, hospital breaches of data security) and the risks of accessing those records online (eg, forgetting to log off a public computer, printing sensitive information). As a result, self-reported concerns about privacy may reflect diverse interpretations of potential associated risks.

As patient portals and shared medical records proliferate, health professionals need to be aware of patients’ feelings about privacy. Our findings suggest that concerns about privacy among portal users do not deter them from accessing their visit notes and health information online. However, our findings also highlight the need to identify and address such concerns among specific demographic groups, particularly racial and ethnic minorities, patients with lower levels of education, and those with less trust in their doctors and lower confidence in their ability to communicate with them. If efforts to involve patients more actively in their care through Internet-based technologies are to move ahead, we need a far deeper understanding of the complex nature of “privacy” and how it interacts with the transparency that open visit notes represent.