OAKLAND, Calif. -- At his high-rise medical office in Oakland, orthopedic surgeon David Chang recently switched from those familiar but cumbersome paper medical files to digital records, making the change ahead of a federal requirement that goes into effect for all medical providers in 2014.

Chang now has a private company store his patients' records electronically.

"Not only was it free – which was fantastic – but it saved me time," said Chang.

That company is Practice Fusion in San Francisco. It's part of a booming industry in electronic medical records software. Its service is free to some 30,000 doctors. KTVU discovered the reason the service is free is because the company legally sells the patient medical information it collects. Buyers include drug companies, medical insurers and others. They can get it if they say it's for research.

"And see if new diagnoses or conditions are popping up within that patient because we have so much data in the system, but again it's strictly de-identified and anonymized as well," said Practice Fusion CEO Ryan Howard.

Some were opposed to such wholesale distribution of patient information.

"This is a nightmare. This is a nightmare. It's nothing we've ever seen before in medicine," said patient privacy rights advocate Dr. Deborah Peel.

Peel she said many patients and doctors don't know the federal government quietly eliminated patients' privacy rights for electronic records.

"It's a free-for-all. It's the wild west," said Peel.

"Today there are over 4 million different kinds of organizations and companies that can see and use our medical records without our knowledge, without our permission and we can't refuse," continued Peel.

You might think it's okay since for research, companies are supposed to strip off your identifiers. But critics said enough information remains to figure out who you are.

"The data truly cannot be rendered safe or anonymous through these processes they claim make it safe," said Peel.

With so much of our medical details stored electronically in so many places, some worry about hackers.

"If kids can break in, it scares me that anybody can break into those and get the information," said Dave Ahern of Pacifica.

Just this year, Walnut Creek's John Muir Hospital reported losing a computer with data on 5,400 patients. Kaiser Permanente lost information on 9,000 patients at its hospitals in the Bay Area*. And the Anthem Blue Cross website exposed tens of thousands of confidential insurance applications. No one wants public access to their medical records.

"You'd like to have some control over who does have access to them," said Lisa Mayer of San Francisco.

Practice Fusion’s Howard said his company provides bank level encryption security for patient data.

"This isn't a system where the data is on the doctor's laptop computer and that can be stolen. The data is exclusively in our web-based system which is very secure," said Howard.

Medical Technology Analyst Matthew Holt pointed to Kaiser Permanente's goal of having an electronic system in place with medical records for the past five years. A new study showed it improved monitoring cut heart attacks cut costs and reduced doctor visits.

"We tend to be concerned about the risks first and don't think too much about the advantages which are considerable," said Holt.

Patient attorney Alfredo Terrazas said he wants a choice whether his medical records are sold or shared.

"Everyone should have that choice to opt in or opt out because that way if they really have concerns they can opt out," said Terrazas.

But you don't have that choice today.

"Anything that's in there, any information that's in there, can and will be used against you in the future. It's very important to know that in the electronic health world," said Dr. Peel.

Dr. Peel said new technology, for as little as five dollars a year, could protect your privacy and allow you to opt out of research databases. Privacy advocates said concerned patients need to lobby their lawmakers now.

*After this story was published, a spokesperson for Kaiser Permanente informed KTVU that the loss of patient information was not limited to the San Francisco hospital, as previously reported, and a Sacramento-based employee was fired for violating Kaiser Permanente's data storage policies.