Epic and four health care providers are suing a group of businesses for alleged misuse of sensitive patient information, which the main defendant “vehemently” denies.
The Verona health records company yesterday announced the federal lawsuit alongside OCHIN of Oregon, Indiana-based Reid Health, Michigan’s Trinity Health and UMass Memorial Health in Massachusetts.
Epic’s suit targets a health information network called Health Gorilla and more than a dozen other defendants, including several people and businesses.
It says the California company enabled other businesses to “improperly access and monetize” nearly 300,000 patient medical records from users of Epic’s medical data platform. That’s on top of “an unknown number of records” taken from other organizations around the country, including the U.S. Department of Veterans Affairs and providers using other electronic health record systems, according to Epic.
The plaintiffs say they’re filing suit to “put a stop to those who are exploiting health information exchange frameworks to fraudulently access and steal” patient data for their own gain.
“If not stopped, they will continue to inappropriately market the patient data they have already taken and will take more through their almost unfettered access to the patient records of millions of patients,” they wrote in the lawsuit.
Along with allegedly working together to monetize patient records without their knowledge or consent, the suit says defendants marketed the information to lawyers seeking claimants for class action lawsuits.
And plaintiffs say Health Gorilla and the others being sued took actions to hide their tracks, including making fake websites and “shell entities” as well as putting “junk data” into patient medical records.
In a statement on the lawsuit, Health Gorilla said “we vehemently deny the allegations” being made by Epic.
“This is yet another example of Epic’s exclusionary actions that limit competition and restrict access to healthcare data,” the company said. “These actions reflect broader, ongoing concerns raised by others in the industry and by government actors about monopolistic practices in health information exchange by Epic.”
While the company won’t comment on specific allegations due to the active litigation, the statement says it has acted in good faith and will defend against the claims being made.
Epic and other plaintiffs say the defendants “simply create new companies” when caught rather than stopping the alleged activities.
“The scheme thus operates like a Hydra: when one fraudulent entity is exposed, the bad actors birth a new one,” they wrote in the suit.
But Health Gorilla says “we acted promptly” when Epic raised related concerns three months ago, and has been working with Epic and authorities to address them.
“We intend to be part of the solution through transparency, accountability, and continued investment in privacy and safeguards,” the company said.
See the complaint.
