Barriers to Patient Agency in Health Insurer Privacy Policies: A Document Analysis of Readability, Data Sharing, and Consent Mechanics

This study examines how privacy rights are operationalized through member-facing privacy policies from five major private health insurers operating in Georgia: Anthem Blue Cross Blue Shield, UnitedHealthcare, Aetna, Cigna, and Humana. Privacy policies are approached as navigational documents across three dimensions: scope (what information is collected and shared), comprehensibility (whether members can reasonably understand those practices), and actionability (whether members can realistically exercise the rights described). A systematic document analysis was conducted across ten privacy policies. Readability was evaluated using the Flesch-Kincaid Grade Level, Flesch Reading Ease, and SMOG Index. Opt-out burden was operationalized as the number of documented actions required for a member to exercise a stated privacy right, following a step-count framework adapted from Nouwens et al. (2020). Document coding was supported using a structured codebook informed by the European Data Protection Board Guidelines 03/2022 and the FTC report Bringing Dark Patterns to Light (2022). All documents exceeded the American Medical Association's recommended readability threshold for patient-facing health materials. Member-facing privacy policies described extensive collection of clinical, behavioral, commercial, and demographic information alongside broad sharing with healthcare providers, research organizations, corporate affiliates, advertising and analytics vendors, law enforcement, and in some cases correctional institutions. Among seventeen documented opt-out pathways, five described no opt-out mechanism, six demonstrated procedural asymmetry between enrollment and withdrawal, and three required written requests that insurers explicitly reserved the right to deny. These findings suggest that administrative complexity, fragmented privacy notices, and limited transparency may shape patients' ability to understand and exercise available privacy protections. Future community-partnered research is needed to examine how these documented processes align with members' lived experiences.