Epic is going on offense. In a lawsuit filed January 13, 2026, the EHR giant and several healthcare organizations accuse Health Gorilla and other defendants of helping turn health information exchange into a source of patient records for commercial gain, including litigation-related businesses. The allegation is that entities claimed to be treating patients when they were really after their records for other purposes.
That is a serious accusation. It also arrives at an interesting moment for Epic, which is defending itself against allegations that it uses control over health data to shut out competitors. Apparently, 2026 will not be a quiet year for interoperability lawyers.
What the complaint actually says
Epic, OCHIN, Reid Health, Trinity Health, and UMass Memorial Health Care filed the case in federal court in California. The defendants include Health Gorilla, RavillaMed, Mammoth entities, SelfRx, Unit 387, GuardDog Telehealth, and others. The complaint alleges that entities used Carequality and TEFCA connections to obtain records under false treatment claims. It describes alleged shell companies, misleading credentials, and records supplied for litigation-related purposes. It also alleges that clinically useless documents were sent back into the exchange to create the appearance of treatment. Health Gorilla is accused of enabling access and failing to act appropriately on warning signs.
The legal claims include fraud, aiding and abetting fraud, breach of contract, unfair competition, and violations of the federal Computer Fraud and Abuse Act. The plaintiffs ask the court to stop the challenged access, require deletion and an end to further use of improperly obtained records, and order disgorgement of alleged ill-gotten gains. Filing the complaint does not itself impose those restrictions.
For now, we have the plaintiffs’ version of the facts. The allegations have not been established, and the full scope of affected records, downstream recipients, and each defendant’s knowledge remains to be worked out. GuardDog is one of several accused entities; no one gets to skip from “named in a complaint” to “proven data thief.”
The chilling effect could reach much further
If the allegations are true, stopping that conduct would protect patients and the trust that exchange depends on. But the lawsuit could also make legitimate participants hesitate. A smaller data company may face uncomfortable questions from customers simply because its business involves retrieving records. A provider may slow lawful exchange while trying to decide whether an unfamiliar requester is safe. That is the chilling effect I would watch.
The legal distinctions matter. HIPAA generally permits treatment disclosures without a signed patient authorization. Obtaining records for legal work may also be lawful with a valid authorization or another proper basis. Neither point makes a false treatment claim acceptable. And violating a network rule does not automatically establish a HIPAA breach or a computer fraud claim; each has its own requirements. Likewise, “privacy” cannot be a universal excuse to stop sharing. Restrictions still need support under applicable law and network rules, including the conditions of any information blocking exception being relied on. Providers should investigate specific concerns without treating every unfamiliar connection as a suspect.
Questions worth asking now:
Who is supposed to verify the requester and its purpose, and what evidence is enough? A valid identifier does not necessarily establish a valid use.
If our records were requested, were they actually disclosed, to whom, and under what legal authority? Preserve logs and work with Epic and the relevant exchange partners to find out.
What did each participant know, when did it know it, and what could it reasonably have done? The complaint does not answer those questions for every provider.
Will access decisions follow clear, consistent rules, with a meaningful way to challenge them? Smaller participants need protection from misuse and from unsupported accusations alike.
And then there is the white knight question . . .
Last month, the Texas Attorney General sued Epic, alleging anticompetitive conduct involving its control over electronic health records, along with separate claims about parental access. Particle Health had already sued Epic in September 2024, alleging that Epic used its market power and restrictions on data access to undermine competition. A federal judge allowed Particle’s Sherman Act monopolization claims to proceed in September 2025 while dismissing other claims. That ruling was not a finding that Epic violated antitrust law.
Against that backdrop, I think it is fair to ask whether this lawsuit also serves a strategic purpose: moving the story away from Epic as the alleged information blocker and toward Epic as the white knight protecting patients from alleged nefarious data thieves. The narrative benefit is hard to miss. Epic gets to explain restrictions on access as patient protection, with healthcare organizations standing beside it. That benefit does not prove why Epic filed the case, and it does not make the privacy allegations less serious. Genuine patient protection and a useful litigation strategy can coexist. But proving misconduct by one set of companies would not resolve separate claims that Epic improperly restricted someone else’s lawful access.
My take: the complaint gives Epic a powerful opportunity to recast the debate. Whether the white knight role holds up should depend on the evidence and whether its approach protects patients while preserving lawful exchange. A cape is a nice visual. It is not a legal defense.