Epic, Trinity Health, UMass Memorial Health, Reid Health and OCHIN have filed a federal lawsuit against Health Gorilla and related companies, alleging they improperly accessed and monetized approximately 300,000 patient medical records without consent.
The complaint, filed January 13, alleged that defendants set up fictitious healthcare providers, shell websites and fake provider IDs to make record requests appear legitimate for medical care. Instead, the data was allegedly diverted for non-treatment uses such as marketing to lawyers seeking potential claimants for lawsuits. When one fraudulent entity was exposed, the same actors allegedly created new companies to continue the conduct, operating “like a Hydra” according to the complaint.
The plaintiffs further alleged that the defendants inserted “junk” information into records to hide their activity and give the appearance of genuine care, which risked patient safety and wasted clinician time. The lawsuit claimed violations of HIPAA and other federal and state privacy protections, framing the scheme as threatening both patient privacy and the integrity of interoperable health data sharing systems.
The plaintiffs argued that misuse of health data undermines trust in nationwide interoperability frameworks by turning systems designed for care coordination into vehicles for data harvesting. Among the sensitive information in patient records are genetic, mental wellbeing, and reproductive data. The plaintiffs are seeking injunctive relief to immediately halt the alleged misconduct.
Health Gorilla denied the allegations, stating in a statement that the litigation is “yet another example” of Epic limiting competition and restricting data access. The company said the actions reflect broader concerns about “monopolistic practices in health information exchange by Epic” and expressed support for efforts promoting competition, patient choice, and fair access to healthcare data.
This article is an AI-assisted summary. All facts and figures are drawn from the original report: https://medcitynews.com/2026/01/epic-health-gorilla-data-privacy/