A health information network improperly tapped into Pittsburgh-based UPMC patient records by falsely claiming authorization to do so through a national medical data exchange.
UPMC said in a March 13 news release it learned of the breach through Epic, its EHR vendor, which flagged that a network called Health Gorilla had requested patient data under the guise of coordinating care for mutual patients.
Patient Social Security numbers were not among the potentially exposed data. However, names, ages, diagnoses and medical histories may have been compromised, UPMC said in the news release.
The disclosure comes two months after Epic and several health systems filed a federal lawsuit against Health Gorilla in January accusing the company of fraudulently accessing and monetizing sensitive patient records through national health information exchange frameworks. The complaint, filed Jan. 13 in U.S. District Court for the Central District of California, alleged Health Gorilla improperly obtained tens of thousands of patient records by falsely claiming the data was needed for medical treatment and then allegedly rerouted records to mass tort litigation marketing services.
Health Gorilla has denied the allegations, calling them “yet another example of Epic’s exclusionary actions.”
Because participation in the national exchange network is mandatory for health systems such as UPMC, patient records are accessible to other providers through the platform — a requirement that in this case may have been exploited.
UPMC has since reported the matter to the HHS Office for Civil Rights.
“Health Gorilla is 100 percent committed to patient privacy. In this isolated matter, Epic knows that we acted immediately when concerns were raised and immediately suspended the connections in question,” a spokesperson for Health Gorilla told Becker’s. “Unfortunately, this is part of Epic’s ongoing efforts to inject fear, uncertainty, and doubt into the interoperability ecosystem.”
The spokesperson add that Health Gorilla will continue to prioritize patient safety and work to ensure the secure exchange of health data.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.