Health Gorilla is pushing back against a lawsuit filed by Epic and several healthcare providers, calling the allegations baseless and saying it is prepared to vigorously defend itself.
Epic, OCHIN, Reid Health (Richmond, Ind.), Trinity Health (Livonia, Mich.) and UMass Memorial Health (Worcester, Mass.) filed the lawsuit Jan. 13 in the U.S. District Court for the Central District of California. The complaint accuses Health Gorilla and a network of companies and individuals of fraudulently accessing and monetizing sensitive patient medical records through national health information exchange frameworks.
The lawsuit alleges the defendants improperly obtained tens of thousands of patient records by falsely asserting the data was needed for medical treatment, then rerouted the information to mass tort litigation marketing services. The plaintiffs argue the data was used to identify potential plaintiffs based on medical diagnoses and that the alleged conduct threatens patient privacy and undermines trust in nationwide interoperability systems.
According to the complaint, the defendants exploited two national interoperability frameworks, Carequality and the Trusted Exchange Framework and Common Agreement, or TEFCA, which are intended to allow healthcare providers to exchange patient records for legitimate treatment purposes. The plaintiffs allege certain entities posed as medical providers to gain access to records and then used the data for non-treatment purposes without patient consent or authorization.
Health Gorilla, a designated Qualified Health Information Network under TEFCA, is named as a central defendant. The lawsuit alleges the company failed to adequately verify entities seeking access to patient data and ignored warning signs, including irregular data access patterns and concerns raised by providers and interoperability organizations. Other defendants named include RavillaMed and entities affiliated with Mammoth Health and Unit 387.
The plaintiffs are seeking injunctive relief to halt the alleged conduct, bar the defendants from accessing national interoperability frameworks, and require the return or destruction of improperly obtained records. The lawsuit also requests a jury trial.
In a statement released Jan. 27, Health Gorilla said Epic’s complaint presents “unfounded and wholly misleading allegations” about the company’s role in facilitating access to healthcare data. Bob Watson, CEO and executive chair of Health Gorilla, said the company has operated in compliance with applicable laws, governance requirements and industry norms.
Health Gorilla said that after learning of the allegations, it immediately suspended the connections at issue and began investigating their use of healthcare data. The company said the investigation is ongoing and the connections remain suspended.
Mr. Watson criticized Epic’s use of litigation, saying the lawsuit fails to present all the facts and reflects an irresponsible approach to resolving disputes. He also said the case carries broader implications as the industry transitions to a TEFCA-enabled ecosystem, arguing that interoperability depends on good-faith participation and fair access to data.
Health Gorilla said it has retained Quinn Emanuel Urquhart & Sullivan to represent the company. The firm has experience handling complex technology disputes, including other litigation involving Epic, according to the statement.
Previously, Health Gorilla told Becker’s it “vehemently” denies the allegations and said it cannot comment on specific claims because the matter involves active litigation. The company said it has acted in good faith and will vigorously defend against the lawsuit.
“Health Gorilla enabled their customers to sell identifiable patient medical records to class-action law firms without patients’ consent or health systems’ knowledge. They had an obligation to protect patients’ intimate health information. Instead, they violated the privacy of hundreds of thousands of people,” an Epic spokesperson told Becker’s in an emailed statement. “Epic and health systems together filed this lawsuit to hold Health Gorilla and other bad actors accountable and to stop further abuse and misuse of patients’ sensitive information.”
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.