Dive Brief:
Epic, one of the nation’s largest electronic health record vendors, and a group of health systems are suing Health Gorilla and several of its clients for allegedly illegally accessing patients’ medical records and using them for financial gain.
The suit, filed Tuesday in a California district court, alleges Health Gorilla, a health information exchange, allowed health tech firms like MammothRx, RavillaMed and LlamaLab to retrieve nearly 300,000 patient records and monetize them, including to collect potential claimants for lawyers assembling class action lawsuits.
Health Gorilla denied the accusations. “This is yet another example of Epic’s exclusionary actions that limit competition and restrict access to healthcare data,” the company said in a statement.
Dive Insight:
Providers participate in interoperability frameworks, like Carequality and the Trusted Exchange Framework and Common Agreement, that set rules for the exchange of medical data and allow clinicians to access medical records for patients who received care from other providers.
Health data can be sensitive and information exchanges, like Health Gorilla, vet participants looking to retrieve patient records for treatment purposes.
Instead, interoperability frameworks are being exploited by companies looking to monetize medical records without patients’ or providers’ knowledge, according to the suit, which was filed by Epic, health IT provider and consultancy OCHIN and health systems Reid Health, Trinity Health and UMass Memorial Health Care.
Companies like those named in the suit sometimes claim to be providers to access patient records, but then use that data for other reasons, like sharing data with lawyers who are looking for patients with specific diagnoses for class action lawsuits, according to the complaint.
For example, the plaintiffs claim chronic condition management firm RavillaMed shared far fewer medical records with other providers than it retrieved, and the data shared by the company with Epic’s provider customers included no evidence of treatment by a clinician. Instead, records incorporated previous diagnoses that are frequently involved in litigation.
The lawsuit alleges that companies found improperly retrieving patient data often create new firms when their access to medical records is cut off.
The lawsuit cites Integritort, a firm that was banned from Carequality for a year in October 2024 after Epic filed a dispute that it was using records for non-treatment purposes. The same month the firm was banned, Mammoth, co-founded by the former CEO of Integritort, began accessing patient records though Health Gorilla, according to the complaint.
Integritort was a client of Particle Health, a health data startup that filed an antitrust lawsuit against Epic in September 2024. That suit alleged the EHR vendor had denied record access to dozens of its customers in a bid to limit competition.
Epic has faced other accusations that it prevents the free flow of health data. In December, Texas Attorney General Ken Paxton sued the EHR vendor, arguing the company wields monopolistic control over the medical records market by delaying or denying access to patient records by providers using other systems.
In a Tuesday statement, Health Gorilla said the lawsuit was an attempt by Epic to limit the exchange of health data.
“These actions reflect broader, ongoing concerns raised by others in the industry and by government actors about monopolistic practices in health information exchange by Epic. Health Gorilla supports efforts to promote competition, patient choice, and fair access to healthcare data,” the health exchange said.
In its lawsuit, Epic and the other plaintiffs said claims of information blocking were part of an “intimidation campaign” among bad actors.
“Bad actors like Defendants have falsely framed Epic and providers’ efforts to safeguard patients’ private medical information as information blocking that is harmful to patients and as unlawful obstruction,” they said in the suit. “This intimidation campaign is designed to chill scrutiny and preserve the unscrupulous actors’ access to patient records so they can monetize them, including by selling them to mass tort law firms.”
Other defendants named in the lawsuit didn’t respond to requests for comment by press time.
