Alongside healthcare providers, Epic is taking legal action to defend patient privacy

Alongside healthcare providers, Epic is taking legal action to defend patient privacy

Federal lawsuit seeks to stop improper access and monetization of sensitive medical information.

Updates from Epic

SelfRx CEO and Founder signs sworn declaration: SelfRx “requested medical records for only 21 patients” and “I do not know who took those over 100,000 patient records.”

June 3, 2026

Despite more than 100,000 patient records being taken using SelfRx’s Carequality directory entry, “SelfRx requested medical records for only 21 patients and received records for 15 of those patients, for a total record count of fewer than 100 records for these 15 patients (a single patient can have more than one record).”

Read the story →

Federal Court Enters Judgment and Issues Permanent Injunction Against GuardDog

April 2, 2026

The federal court order permanently bars GuardDog from accessing TEFCA and Carequality.

Read the story →

Defendant GuardDog Telehealth Admits to Providing Patient Records to Law Firms

March 13, 2026

In a step forward for patient privacy, GuardDog agrees to a federal court order that, if entered, would permanently bar GuardDog from accessing TEFCA and Carequality.

Read the story →

Voices from the Epic community

Reid Health
At Reid Health, our patients always come first, and that means protecting their personal and medical information at every step. We are proud to stand with Epic and other leading healthcare organizations against the unethical and illegal monetization of patient data. Patients’ trust is sacred, and we refuse to let it be exploited. This lawsuit is about doing what is right, ending deceptive practices that misuse sensitive health information, and protecting the systems that make safe, coordinated care possible. Patient data should only ever be used for one purpose: healing, not profit. Reid Health will always defend our patients’ privacy and uphold the integrity of care.
OCHIN
We are taking this action now in partnership with Epic to protect our members and their patients, while raising awareness to address a growing public threat we see for the future of national health information exchange. By standing together, we aim to preserve the trust that patients and providers have long placed in data sharing frameworks to seamlessly connect high-quality care in service of their health and well-being.

Read the full statement here →

Coverage in the news

The Washington Post

These alleged schemes reveal the hidden market for your medical records

A lawsuit claims companies masqueraded as providers and sold records for profit. Hospitals are urging stricter vetting to prevent misuse.

Read the story →

Politico

Defendant makes a deal with Epic and health system co‑plaintiffs

Epic filed a consent judgment with GuardDog a telehealth company and one of eight defendants that Epic accused of fraudulently pulling sensitive patient information from national health data networks.

Read the story →

Wisconsin Public Radio

Epic, health care providers sue over alleged misuse of patient records

Complaint: The companies improperly accessed and monetized nearly 300K patient medical records from Epic.

Read the story →

The Washington Post

Can your health records be sold for profit? A lawsuit says it’s happening.

The nation’s largest health records company alleges your sensitive data is a highly sought-after commodity by outside firms.

Read the story →

STAT

Epic sues health information network over nearly 300,000 illegally accessed records

The lawsuit raises fresh questions about how to guarantee patient records are only shared with legitimate medical providers.

Read the story →

Forbes

Your Medical Privacy Could Be At Risk, A New Lawsuit Shows

A lawsuit filed by electronic health record giant Epic could encourage reforms to a problematic system, where non-health companies can get their hands on patient records without their knowledge.

Read the story →

Heathcare IT News

Epic and health systems sue Health Gorilla and data companies

OCHIN, Reid Health, Trinity Health and UMass Memorial Health join the electronic health record vendor in a new federal lawsuit alleging improper access and monetization of 300,000 patient medical records.

Read the story →

Modern Healthcare

Epic, four health systems accuse Health Gorilla, others of fraud

Epic Systems and four health systems filed a lawsuit Tuesday accusing data broker Health Gorilla and several other companies of engaging in a fraudulent scheme to acquire patient records.

Read the story →

Reuters

Epic Systems sues over alleged scheme to sell medical data to plaintiffs' lawyers

Epic Systems sued several companies on Tuesday, accusing them of improperly accessing hundreds of thousands of patient medical records and selling their data, including to mass tort attorneys looking for clients.

Read the story →

TechTarget

Epic, health systems file lawsuit alleging HIE exploitation

The lawsuit details a scheme in which health organizations are using HIE interoperability frameworks to access and use patient health records for financial gain.

Read the story →

Becker's Hospital Review

Epic, healthcare organizations sue data exchange over alleged misuse of patient records

Epic, OCHIN, Reid Health, Trinity Health, and UMass Memorial Health have filed a lawsuit accusing Health Gorilla and a network of companies and individuals of fraudulently accessing and monetizing sensitive patient medical records through national health information exchange frameworks.

Read the story →

The Washington Post

Company admits it diverted private patient records to law firms

GuardDog Telehealth, a Texas firm, acknowledged in court documents that its business was based on mining individual health data.

Read the story →