Epic accuses Silicon Valley-based network of allowing improper access to medical records

VERONA, Wis. -- Epic Systems is suing a Silicon Valley-based network that allegedly allowed other companies to access and monetize thousands of patient records.

The lawsuit, filed Tuesday in a federal court in California, accuses interoperability platform Health Gorilla of violating the Computer Fraud and Abuse Act. According to its website, Health Gorilla gives its customers permitted access to patient data in order to "improve outcomes, streamline workflows, and create a more equitable ecosystem."

Other health care companies including RavillaMed, LlamaLab and SelfRx were named as co-defendants in the suit.

Epic alleges that Health Gorilla and its co-defendants acted as a syndicate, with Health Gorilla facilitating access to medical records and the other companies using that information to make money. Sometimes, the other companies allegedly did not even provide actual patient treatment.

"They attempt to avoid detection by injecting clinically useless documents into interoperability frameworks to give the false impression that they are treating patients," the lawsuit alleges. "In some cases, the 'clinical' documents sent through the framework contain no clinical information."

The lawsuit claims that Health Gorilla and its co-defendants' actions have eroded health care providers' trust in interoperability, the system at the heart of Epic's Care Everywhere technology.

"These actors are putting the enormous positive patient outcomes achieved through interoperability at imminent risk," the lawsuit states. "When used appropriately, interoperability ensures that medical care is informed by a patient’s medical history, allowing healthcare providers to improve patient outcomes."

Epic alleges that almost 300,000 patient medical records were accessed improperly, with records also allegedly taken from organizations across the U.S. including the VA.

The lawsuit seeks to cut off Health Gorilla from the systems it used to access records and force the network to delete health information it improperly obtained through those systems.