Epic, OCHIN, Reid Health (Richmond, Ind.), Trinity Health (Livonia, Mich.) and UMass Memorial Health (Worcester, Mass.) have filed a lawsuit accusing Health Gorilla and a network of companies and individuals of fraudulently accessing and monetizing sensitive patient medical records through national health information exchange frameworks.
The complaint, filed Jan. 13 in the U.S. District Court for the Central District of California, alleges the defendants improperly obtained tens of thousands of patient records by falsely asserting the data was needed for medical treatment. The records were then allegedly rerouted to mass tort litigation marketing services, allowing law firms to identify potential plaintiffs based on diagnoses.
The plaintiffs are seeking injunctive relief to immediately halt the alleged conduct, arguing it threatens patient privacy and undermines trust in nationwide healthcare interoperability systems.
According to the lawsuit, the defendants exploited two national interoperability frameworks — Carequality and the Trusted Exchange Framework and Common Agreement, or TEFCA — which allow healthcare providers to exchange patient records for legitimate treatment purposes. The complaint alleges that certain entities posed as medical providers to gain access to records, then used the data for non-treatment purposes without patient consent or authorization.
Health Gorilla, a health data exchange company and designated Qualified Health Information Network under TEFCA, is named as a central defendant. The complaint alleges Health Gorilla failed to uphold its contractual responsibilities to verify the legitimacy of entities before allowing access to sensitive patient data, and that it ignored red flags and concerns raised by providers and interoperability organizations.
Other defendants include RavillaMed, entities affiliated with Mammoth Health and Unit 387, among others. The lawsuit claims these groups accessed patient records in patterns inconsistent with legitimate clinical care, including irregular spikes in data queries and a lack of returned clinical documentation.
Plaintiffs allege some records were routed to companies with ties to litigation marketing firms, which used the health data to identify individuals for mass tort lawsuits. The records allegedly included protected health information and were accessed without the necessary authorization under federal and state law.
The lawsuit further alleges the defendants used shell companies, common ownership and shifting corporate structures to evade detection. In some cases, after scrutiny halted one entity’s activity, another affiliated company would resume similar behavior.
The plaintiffs argue the alleged misconduct has forced healthcare providers to devote additional resources to monitoring data exchanges, investigating suspicious activity and addressing patient privacy concerns. They warn that if such conduct continues, hospitals and health systems may be discouraged from participating in interoperability networks, which could ultimately harm patient care.
The lawsuit seeks a court order to bar the defendants from accessing national interoperability frameworks, require the return or destruction of improperly obtained records, and prohibit further use or disclosure of the data.
The plaintiffs are requesting a jury trial.
In a statement sent to Becker’s, Health Gorilla said it “vehemently” denies the allegations.
“This is yet another example of Epic’s exclusionary actions that limit competition and restrict access to health care data. These actions reflect broader, ongoing concerns raised by others in the industry and by government actors about monopolistic practices in health information exchange by Epic,” Health Gorilla said. “Health Gorilla supports efforts to promote competition, patient choice and fair access to health care data.”
The company added that because the matter involves active litigation, it cannot comment on specific allegations.
“What we can say is this: Health Gorilla denies the allegations, has acted in good faith and will vigorously defend against the claims,” the statement said.
Editor’s note: Becker’s reached out to RavillaMed, Mammoth Health and Unit 387 for comment and will update the story if more information becomes available.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
