I used to work at Epic as a software developer. The experience with MyChart isn’t particularly surprising. I generally think that Epic is pretty genuinely well-intentioned, as companies go, but they’re not particularly incentivized to put more than the bare minimum of effort in this process, since the number of patients who want to opt out is very low, and it’s in Epic’s interest for patients to be signed up (not, I think, for nefarious reasons like selling data; Care Everywhere data is covered by HIPAA and misuse would be a serious legal liability for Epic. But having more patients lets them tout their exchange numbers, etc).

Some of this can also probably be said about the hospital itself. They probably slapped together a process needed to meet legal requirements, but don’t put much effort into it beyond that. It wouldn’t surprise me if they simply didn’t have the resources to spare for it.