Patient Record Access: What the Epic v. Health Gorilla Lawsuit Alleges

In January 2026, Epic Systems and four health care organizations sued a health information network and a group of smaller companies, alleging that those companies posed as treating providers to pull patient records through national data exchange networks and then used the records for purposes that had nothing to do with care. The case is still in court, and the defendants deny or dispute much of it. But it puts a spotlight on a question every practice that shares records electronically should be asking: how do we know who is on the other end of a records request?

Everything below about the defendants' conduct is an allegation unless a court ruling or an admission is noted.

The case at a glance

Case: Epic Systems Corporation et al. v. Health Gorilla, Inc. et al., No. 2:26-cv-00321, U.S. District Court for the Central District of California.
Filed: January 13, 2026.
Plaintiffs: Epic, OCHIN, Reid Health, Trinity Health and UMass Memorial Health Care.
Main defendant: Health Gorilla, a health information network, along with several of its customers and related companies and individuals.
Claims: Fraud, aiding and abetting fraud, violation of California's unfair competition law, breach of contract, and violation of the federal Computer Fraud and Abuse Act.

What the complaint alleges

According to Epic's announcement and coverage by Healthcare Dive and MedCity News, the plaintiffs allege that:

Health Gorilla enabled companies including Mammoth, RavillaMed and others to access and monetize nearly 300,000 patient records from organizations that use Epic.
The requests went through the Carequality and TEFCA interoperability frameworks, which let participants request records for permitted purposes such as treatment.
The requesters claimed a treatment purpose but allegedly used the records for other things, including marketing them to lawyers looking for claimants in mass tort and class action lawsuits.
The defendants allegedly used fictitious websites, shell entities and sham National Provider Identifier numbers to make the requests look legitimate.
Junk data was allegedly inserted into medical records, which Epic says creates patient safety risk and wastes clinician time.
When one entity was exposed, the complaint alleges, the same operators formed a new one to keep going.

How the defendants have responded

Health Gorilla denies the allegations. It has called the suit an attack on interoperability and part of what it describes as Epic's efforts to limit competition. It filed a motion to dismiss in February 2026 and has argued that the plaintiffs skipped dispute resolution steps required by the exchange frameworks. LlamaLab, another company named in early coverage, told Healthcare Dive it has never sold patient data.

What has happened since filing

March 2026: GuardDog Telehealth, one of the defendants, admitted in a court filing that it presented itself as providing treatment to access records, when its business in practice was requesting and summarizing records and providing them to law firms. It agreed to a consent judgment to stop accessing records through the major interoperability frameworks and to delete data obtained that way. GuardDog has also said a data broker posed as its predecessor company to make requests without its knowledge.
March 23, 2026: STAT reported that a new Epic court filing described companies posing as providers, and highlighted the bind for providers: information blocking rules limit their ability to refuse requests, while handing records to someone without a right to them can violate HIPAA. STAT reported that HHS is being pushed to consider policy changes.
May 2026: Health Gorilla asked the Judicial Panel on Multidistrict Litigation to centralize related actions in the Southern District of Florida.
June 2026: Epic dismissed its claims against SelfRx with prejudice. SelfRx's founder stated that his company requested records for only a handful of patients and did not authorize the larger volume of requests attributed to it.

As of this update, the case remains pending and we found no ruling on the merits.

Why this matters to a practice owner

Most small practices are not Epic, and most will never be a plaintiff in a case like this. The relevance is more practical. If you share records electronically, through an EHR's exchange features, a health information exchange, or a vendor that connects to one, your patients' data may be requested by organizations you have never heard of.

Two HIPAA provisions frame the issue:

Verification before disclosure. The Privacy Rule requires a covered entity to verify the identity and authority of a person requesting protected health information when that person is not already known, and to get any documentation the disclosure depends on. It allows reasonable reliance on documentation that appears valid on its face.
Authentication in systems. The Security Rule includes a standard for person or entity authentication: procedures to verify that whoever is seeking access to electronic health information is who they claim to be.

The Epic case is about whether network-level checks on "treatment" requests were good enough. That is mostly a question for exchange operators and regulators. But practices still control their own policies, their own vendor relationships and their own audit logs.

Questions worth asking your EHR vendor and team

Businesses that want to understand their exposure often start with questions like these:

Which networks do we participate in? Ask your EHR vendor whether your practice is connected to Carequality, TEFCA or a regional exchange, and whether outbound record sharing is automatic.
Can we see who requested our records? Find out whether you can pull a report of external requesters, the purpose of use they declared, and the volume over time.
What happens when a request looks wrong? Ask your vendor how suspicious requesters are flagged, reported and blocked, and who decides.
Who on our staff reviews access logs? Someone should own a periodic look at both internal access and external requests.
Which outside tools hold patient data? List every vendor that stores or touches patient information, including scheduling, messaging, intake forms and automation tools, and confirm each has a Business Associate Agreement where one is required.
Do staff know how to verify a manual request? Phone, fax and email requests for records still happen. A short written procedure for checking identity and authority helps.

None of this replaces advice from counsel about information blocking obligations, which can cut the other way. Refusing a legitimate request can create its own problems.

If you find unauthorized access

Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of protected health information is presumed to be a breach unless a risk assessment shows a low probability that the information was compromised. That assessment looks at the type of information, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated.

If notification is required, the rule calls for notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent local media. Breaches affecting 500 or more people are reported to HHS at the same time as individual notice; smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. State laws may add their own requirements. Talk to counsel before deciding how these apply to your facts.

Where NutriCove fits

NutriCove builds AI automation for medical offices, including receptionist, missed-call text back, follow-up and booking systems. Because those tools can touch patient information, our medical page notes that GoHighLevel needs its HIPAA add-on and a signed Business Associate Agreement before any protected health information goes into it. We do not provide legal or compliance advice. If you are mapping which tools in your office touch patient data, see how we set up automation for medical offices.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.