Telehealth company admits to sharing medical records with law firms as Epic’s lawsuit heats up
A telehealth company accused by Epic Systems of accessing medical records for illegitimate purposes has admitted to sharing them with law firms, the EHR vendor announced on Friday. Per the terms of a permanent injunction yet to be approved by a judge, GuardDog agreed to its being permanently barred from accessing TEFCA and Carequality, the frameworks that allow companies to access records held by Epic at a consumer’s request.
Such an interoperability framework exists to make it easier for patients to share data with new providers and services, such as telehealth applications that benefit from the knowledge of a complete medical history. However, GuardDog and other co-plaintiffs in a lawsuit filed by Epic in January were accused of taking those records under false pretenses—in this case, on behalf of law firms that paid for the data to aid in various civil litigation, such as personal injury or disability claims cases.
In its complaint, Epic accused the defendants of ostensibly selling patient data. Other defendants include care coordination company RavillaMed; medical record retrieval group LlamaLab, which caters to law firms; and another company called SelfRx.
Health Gorilla serves as the primary focus of the lawsuit, as it operates as a data exchange, retrieving records stored in Epic for its clients, one of which was GuardDog.
While Health Gorilla has denied any wrongdoing and accused Epic of restricting patient medical records to limit competition, it appears that GuardDog is ready to admit to some culpability. It admitted to sending medical records to law firms and agreed to the permanent injunction forbidding future medical record access, Epic said.
Under the terms of the agreement, GuardDog will no longer be a target of Epic’s lawsuit. The telehealth company has also agreed to delete any patient health information it obtained through Health Gorilla and other networks within a week of the court’s entry of judgment, documents filed with the U.S. District Court show.
In a statement published by Reuters, lawyers representing GuardDog said the company "has always maintained that it acted in good faith, with the goal of supporting patient care to the best of its abilities, whether its patients were involved with the justice system or not.”
It did admit to obtaining thousands of medical records for law firms since 2024 as part of its core business. GuardDog also acknowledged that it obtained many of the records by saying it did so for treatment purposes.
Multiple health systems signed on as co-plaintiffs alongside Epic, including OCHIN, Reid Health, Trinity Health and UMass Memorial Health.
Health Gorilla stays strong
Despite the admission from GuardDog, Health Gorilla maintains it did nothing wrong. In a statement of response released on LinkedIn, the company called the consent judgment “incomplete at best, misleading at worst.”
“If you read carefully, GuardDog does not state it ever informed Health Gorilla of any non-treatment use of patient information, and we are prepared to demonstrate it did not. In addition, when Health Gorilla sought to investigate GuardDog along with the interoperability networks and several major health providers, GuardDog failed to respond and refused to cooperate,” it wrote.
It said Epic’s lawsuit remains an “attack on interoperability that threatens patient safety and efficient healthcare nationwide.”
Health Gorilla specializes in the free flow of patient data, developing APIs and integrations to connect disparate systems. Given that Epic is the largest holder of medical records among any EHR company, data from its systems often contain some of the most complete histories on patients from all over the country.
This is a developing story.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.