Epic says it has uncovered rot in patient record sharing. Will HHS act?

March 24, 2026 - 03:57

A recent legal filing has cast a spotlight on a concerning alleged breach of patient data privacy. According to the document, a third-party company is accused of systematically accessing sensitive medical records under false pretenses.

The allegations state that the company posed as healthcare providers to gain unauthorized entry to a major electronic health record system. This access was reportedly not for patient care, but to retrieve records for use by law firms in personal injury and medical malpractice cases. This method of obtaining data would circumvent the typical, strict patient authorization process required by federal privacy law.

The situation has ignited serious concerns about the security of digital health information and potential loopholes in current enforcement. Patient advocacy groups and some in the healthcare technology sector argue the case reveals a critical vulnerability. They are urging the Department of Health and Human Services to clarify regulations and strengthen oversight to prevent such alleged deceptive practices.

The core issue centers on whether existing rules are sufficient to protect against entities that may exploit identity and purpose to harvest medical data. As digital health records become ubiquitous, ensuring their security beyond hospital walls is an escalating challenge for regulators and providers alike.