EHR giant Epic, together with a handful of healthcare providers, has filed a federal lawsuit aimed at stopping what it calls a scheme to exploit and monetize patient medical records without consent.
The complaint, filed January 13, claimed that certain companies improperly accessed sensitive health information and then sold or marketed that data for profit, rather than using it for legitimate medical care.
The plaintiffs are Epic, Trinity Health, UMass Memorial Health, Reid Health and OCHIN. They alleged that health data network Health Gorilla enabled other companies to inappropriately access and monetize nearly 300,000 patient medical records. Health Gorilla is denying the allegations.
The complaint said that Health Gorilla and a network of other companies set up fictitious healthcare providers, shell websites and fake provider IDs to make it look like records requests were for real treatment purposes. Instead, the data was allegedly diverted for non-treatment uses — such as marketing to lawyers seeking potential claimants for lawsuits.
The lawsuit also claimed that the defendants inserted “junk” information into records to hide their activity and give the appearance of genuine care, which in turn risked patient safety and wasted clinician time.
When one fraudulent entity was exposed, the same actors allegedly created new companies to continue the same conduct, operating “like a Hydra,” according to the complaint.
The lawsuit alleged violations of HIPAA, as well as other federal and state privacy protections. It also framed the scheme as threatening both patient privacy and the integrity of interoperable health data sharing systems.
“At stake are both the protection of patient records that contain some of a person’s most sensitive data, such as genetic, mental wellbeing, and reproductive information, and the ability of physicians to keep their promises to patients that their information will be kept private,” the complaint read.
The plaintiffs argued that this kind of misuse undermines trust in nationwide interoperability frameworks by turning systems designed for care coordination into vehicles for data harvesting.
The plaintiffs are seeking injunctive relief to immediately put an end to the alleged misconduct.
In a statement sent to MedCity News, Health Gorilla said that this litigation is “yet another example” of Epic limiting competition and restricting data access.
“These actions reflect broader, ongoing concerns raised by others in the industry and by government actors about monopolistic practices in health information exchange by Epic. Health Gorilla supports efforts to promote competition, patient choice, and fair access to healthcare data,” the company stated.
Epic is currently embroiled in a yearslong antitrust lawsuit filed by Particle Health.
Photo: deepblue4you, Getty Images
Editor’s note: This article was updated at 10:45 pm EST to include commentary from Health Gorilla.
