EHR
giant
Epic,
together
with
a
handful
of
healthcare
providers,
has
filed
a
federal
lawsuit
aimed
at
stopping
what
it
calls
a
scheme
to
exploit
and
monetize
patient
medical
records
without
consent.
The
complaint,
filed
January
13,
claimed
that
certain
companies
improperly
accessed
sensitive
health
information
and
then
sold
or
marketed
that
data
for
profit,
rather
than
using
it
for
legitimate
medical
care.
The
plaintiffs
are
Epic,
Trinity
Health,
UMass
Memorial
Health,
Reid
Health
and
OCHIN.
They
alleged
that
health
data
network
Health
Gorilla
enabled
other
companies
to
inappropriately
access
and
monetize
nearly
300,000
patient
medical
records.
Health
Gorilla
is
denying
the
allegations.
The
complaint
said
that
Health
Gorilla
and
a
network
of
other
companies
set
up
fictitious
healthcare
providers,
shell
websites
and
fake
provider
IDs
to
make
it
look
like
records
requests
were
for
real
treatment
purposes.
Instead,
the
data
was
allegedly
diverted
for
non-treatment
uses
—
such
as
marketing
to
lawyers
seeking
potential
claimants
for
lawsuits.
The
lawsuit
also
claimed
that
the
defendants
inserted
“junk”
information
into
records
to
hide
their
activity
and
give
the
appearance
of
genuine
care,
which
in
turn
risked
patient
safety
and
wasted
clinician
time.
When
one
fraudulent
entity
was
exposed,
the
same
actors
allegedly
created
new
companies
to
continue
the
same
conduct,
operating
“like
a
Hydra,”
according
to
the
complaint.
The
lawsuit
alleged
violations
of
HIPAA,
as
well
as
other
federal
and
state
privacy
protections.
It
also
framed
the
scheme
as
threatening
both
patient
privacy
and
the
integrity
of
interoperable
health
data
sharing
systems.
“At
stake
are
both
the
protection
of
patient
records
that
contain
some
of
a
person’s
most
sensitive
data,
such
as
genetic,
mental
wellbeing,
and
reproductive
information,
and
the
ability
of
physicians
to
keep
their
promises
to
patients
that
their
information
will
be
kept
private,”
the
complaint
read.
The
plaintiffs
argued
that
this
kind
of
misuse
undermines
trust
in
nationwide
interoperability
frameworks
by
turning
systems
designed
for
care
coordination
into
vehicles
for
data
harvesting.
The
plaintiffs
are
seeking
injunctive
relief
to
immediately
put
an
end
to
the
alleged
misconduct.
In
a
statement
sent
to
MedCity
News,
Health
Gorilla
said
that
this
litigation
is
“yet
another
example”
of
Epic
limiting
competition
and
restricting
data
access.
“These
actions
reflect
broader,
ongoing
concerns
raised
by
others
in
the
industry
and
by
government
actors
about
monopolistic
practices
in
health
information
exchange
by
Epic.
Health
Gorilla
supports
efforts
to
promote
competition,
patient
choice,
and
fair
access
to
healthcare
data,”
the
company
stated.
Epic
is
currently
embroiled
in
a
yearslong
antitrust
lawsuit
filed
by
Particle
Health.
Photo:
deepblue4you,
Getty
Images
Editor’s
note:
This
article
was
updated
at
10:45
pm
EST
to
include
commentary
from
Health
Gorilla.