Epic, provider groups sue companies over alleged scheme to sell patient data
Epic Systems has joined with multiple healthcare provider groups as plaintiffs in a lawsuit, filed against a group of companies in California who stand accused of fraudulently accessing sensitive patient data, including medical records.
The lawsuit was filed in a Los Angeles federal court, where Health Gorilla, a healthcare data exchange company, was named as the primary defendant. It and three others are accused of posing as medical providers to gain access to patient records stored on the Epic platform.
In total, it’s alleged that nearly 300,000 records were taken, which the defendants stripped for financial gain. The files are said to contain patient names, medical diagnoses, lab and test results, lists of medications and more, the lawsuit contends. Further, Epic said this data was all obtained without the knowledge or consent of patients, constituting a violation of federal law—mainly the Health Insurance Portability and Accountability Act (HIPAA).
Other defendants include care coordination company RavillaMed; medical record retrieval group LlamaLab, which caters to law firms; and another company called SelfRx.
It’s alleged the lot—mainly Health Gorilla—used two national health data exchange networks meant to share information between provider groups to illegally gain access, posing as sham patient care entities.
The four defendants are accused of using the information for their own business purposes, but also selling the data—including a claim that the patient information was used by law firms, seeking clients for upcoming litigation.
Health Gorilla would allegedly pass the records onto other defendants as part of the scheme. Epic said it asked the company to explain some of its medical record withdrawals, which then stopped. Shortly after, another group affiliated with Health Gorilla would make a large number of similar requests, the lawsuit alleges.
Beyond Epic, the full list of plaintiffs includes Oregon-based health IT company OCHIN, Reid Health of Indiana, Michigan-based Trinity Health & Wellness Medical Group, and UMass Memorial Health.
They are seeking an immediate injunction to halt further incidents of medical record gathering, citing any further actions from the defendants as a risk to patient privacy and safety.
Health Gorilla fires back
In a statement to multiple media outlets, Health Gorilla “vehemently” denied the allegations laid out in Epic’s complaint, accusing the EHR giant of attempting to limit access to necessary health data in an effort to stifle competition.
“This is yet another example of Epic’s exclusionary actions that limit competition and restrict access to health care data,” a spokesperson wrote. “These actions reflect broader, ongoing concerns raised by others in the industry and by government actors about monopolistic practices in health information exchange by Epic.”
Health Gorilla added that it was working with Epic to address its concerns over some of the incidents, before the lawsuit was filed.
It’s unclear if and when the case will advance. This is a developing story.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.