Epic Systems sues over alleged scheme to sell medical data to plaintiffs' lawyers

By Diana Novak Jones

Jan 13 (Reuters) - Healthcare software giant Epic Systems sued several companies on Tuesday, accusing them of improperly accessing hundreds of thousands of patient medical records and selling their data, including to mass tort attorneys looking for clients.

The lawsuit, filed by Wisconsin-based Epic and several healthcare providers in Los Angeles federal court, says the companies exploited systems that allow patient medical records to be shared across healthcare providers to access more than 300,000 medical records. Epic, which provides the medical record software and is a founder of one record exchange network, said the companies relied on sham healthcare providers to request the records.

The data includes patient names, diagnoses, lab testing, medications and more, according to Epic, and it was accessed and sold without patient knowledge or consent. Epic accused the companies of violating the federal Health Insurance Portability and Accountability Act, better known as HIPAA, which governs the privacy of patient medical information.

The lawsuit described three different alleged schemes by which medical records are sold after they are accessed by a company posing as a healthcare provider.

In one scheme, according to the lawsuit, California-based Health Gorilla, a company which manages access to the medical record exchange networks, attested that a company called RavillaMed was a healthcare provider that needed records to facilitate treatment. Instead, the information passed through RavillaMed to another company, LlamaLab, which sells medical records to attorneys, the lawsuit claims. Attorneys are looking for clients with specific diagnoses for their cases, the lawsuit said.

When Epic asked Health Gorilla about unusual patterns in one company's records requests, the requests abruptly stopped, the company said in the lawsuit. But another entity affiliated with Health Gorilla would then begin making large numbers of requests, Epic said.

Epic is seeking an order barring the companies from accessing medical records in the future and directing them to destroy the records they have, plus damages. Epic claims it has suffered reputational harm from the scheme and has expended costs investigating it and developing tools to prevent future theft.

In a statement, Health Gorilla denied the allegations and said it would vigorously defend itself. Epic contacted the company about four entities' actions earlier, and Health Gorilla has been working with Epic to address those concerns, it said.

Representatives for LlamaLab and RavillaMed did not respond to requests for comment.

A spokesperson for Epic declined to comment.

The case is Epic Systems Corporation v. Health Gorilla Inc, U.S. District Court for the Central District of California, No. 2:26-cv-00321.

For Epic Systems: Marshall Baker of Akin Gump Strauss Hauer & Feld

For the defendants: Unavailable