Epic Lawsuit Targets Alleged ‘Sham’ Providers in Data HIE

Electronic health records giant Epic Systems is accusing a corporate rival of enabling a slew of companies masquerading as healthcare providers to improperly access digital patient records from national health data exchanges.

See Also: Demonstrating HIPAA Compliance

Epic accuses Health Gorilla of allowing sham medical practices access to its network, and those fake practices of marketing access to lawyers searching for plaintiffs in class action lawsuits. The complaint names several co-defendants, including Mammoth and RavillaMed.

Epic and four health organizations alleged in a lawsuit filed Tuesday in Los Angeles federal court that Florida-based Health Gorilla enabled several companies to “exploit” nationwide health information exchange frameworks by improperly providing the “fraudsters” with access to nearly 300,000 patient medical records under the guise of the treating the individuals.

“These bad actors have accessed and monetized many thousands of patient records,” Epic alleges in the lawsuit it filed along with health IT consultancy OCHIN and three healthcare provider organizations. The healthcare providers – UMass Memorial Health Care in Massachusetts, Trinity Health and Reid Hospital and Health Care Services, claim their patients’ data was among the improperly accessed records facilitated by Health Gorilla.

“The implementers of these frameworks, like defendant Health Gorilla, control who can enter the frameworks and thus who will have unfettered access to sensitive clinical patient records,” the lawsuit alleges.

“As such, they have the corresponding important obligation to ensure that their participants are accessing the framework for legitimate purposes of providing clinical treatment to patients before they are onboarded.”

Health Gorilla provides an interoperability platform and is a Qualified Health Information Network under the federally sponsored Trusted Exchange Framework and Common Agreement to facilitate nationwide health data exchange.

The much larger and older Wisconsin-based Epic also connects its vast network of healthcare systems and EHR users to TEFCA through Epic Nexus, a subsidiary launched as one of the nation’s first QHINs.

Health Gorilla in a statement “vehemently” denied Epic’ allegations, alleging the EHR giant is attempting to squash competition.

“These actions reflect broader, ongoing concerns raised by others in the industry and by government actors about monopolistic practices in health information exchange by Epic. Health Gorilla supports efforts to promote competition, patient choice and fair access to healthcare data,” it said.

Governance Weaknesses

Some experts said the allegations shine an unflattering spotlight on risks involving health data interoperability and exchange networks.

“This case is an example of an insider threat when a participant breaches trust,” said attorney Lee Kim, founder of consulting firm Keytera, and a former longtime privacy and security adviser for the Health Information Management and Systems Society.

“Trust is the foundation of privacy, security and patient goodwill. Effective governance mechanisms must address insider threat detection and mitigation.”

Health data exchange participants should be vetted through a formal governance process. Unless this function is delegated, the entity that owns the risk should be responsible for vetting participants and granting access, Kim said.

“Just because an organization can technically access health information doesn’t automatically mean that access aligns with the original, intended purpose,” said former healthcare CISO Jackie Mattingly, senior director of consulting services at privacy and security consultancy Clearwater.

“Interoperability has done a lot of good for patient care, but once data moves beyond the EHR, the guardrails have to move with it,” she said.

Purpose-based access can’t stop at the point of entry – it requires ongoing oversight and enforcement throughout the lifecycle of how that data is used, Mattingly said.

“These frameworks were built to support treatment, payment, and healthcare operations, not secondary or commercial uses that fall outside those boundaries. Without clear governance and active monitoring, accountability becomes much harder once data leaves the originating system.”