On March 20, a federal judge entered an agreed judgment permanently barring GuardDog from requesting patient records through Carequality or TEFCA and from further using or sharing records obtained through those frameworks. That is a meaningful win for Epic and the healthcare organizations that sued alongside it. It also leaves other providers with a practical question: what happened to our patients’ records?
If your organization’s patient records may have traveled through the connections described in the lawsuit, the court order does not dispose of the matter. You still need to establish what was disclosed, whether it was permitted, and what your organization must do about it. That will likely require cooperation with Epic and other exchange partners, along with your own legal analysis. GuardDog may have been made to heel, but the legal issues are very much still roaming.
What the January lawsuit alleges
On January 13, Epic, OCHIN, Reid Health, Trinity Health, and UMass Memorial Health Care sued Health Gorilla and several other companies and individuals in federal court in California. Their central allegation is straightforward: entities obtained patient records by claiming they needed them for treatment, while actually pursuing other business purposes, including supplying records to law firms.
The complaint describes different entities and access routes, including GuardDog, RavillaMed, Mammoth, SelfRx, and Unit 387. It alleges misuse involving both Carequality and TEFCA and faults Health Gorilla for connecting and overseeing participants. These remain disputed allegations, involving different companies, records, and exchange routes. Health Gorilla denies the claims.
Also, “records pulled through Epic” is useful shorthand, but the details matter. Epic software, providers’ records, Health Gorilla’s services, and the exchange frameworks each play different roles. The alleged problem involves requests made through established connections using a treatment purpose that the plaintiffs say was false. Think misuse of the exchange process, rather than someone breaking into one giant Epic database. In additio, sending records to an attorney is not inherently unlawful. A valid patient authorization or another lawful basis may permit it. But providing records for legal work does not, by itself, turn that work into treatment or make a treatment attestation accurate. HIPAA permission and compliance with network rules must each be examined.
What Epic secured against GuardDog
The parties submitted their stipulation on March 13, and the court entered the judgment on March 20. The deletion deadline ran from that March 20 order. GuardDog admitted that its intended chronic care management and remote monitoring business never materialized. Instead, it requested, reviewed, and summarized medical records and provided them to law firms. It also admitted obtaining records through Carequality in 2024 by asserting a treatment purpose to carry out that business. The admissions concern Carequality; the injunction reaches both Carequality and TEFCA.
GuardDog’s predecessor, Critical Care Nurse Consulting LLC, did similar law firm work between 2022 and 2024 and accessed Carequality indirectly through Unit 387. GuardDog later contracted directly with Health Gorilla in 2024. Keep that history in mind when setting the investigation’s lookback period. January 2026 is the filing date, not the start of the conduct under review.
Paragraph 17 of the March 20 judgment requires three things:
- No more requests through either framework. The ban also covers the affiliates and successor entities described in the order that carry on GuardDog’s business.
- Deletion of patient information and records obtained through those frameworks within one week of entry, March 27, with an exception for documentation necessary for this litigation.
- No further use or dissemination of patient information or records obtained through those frameworks.
The judgment resolves the fraud, aiding and abetting fraud, unfair competition, and federal computer fraud claims against GuardDog. The plaintiffs agreed not to seek money from GuardDog, and the court retained authority to enforce the order.
There are important limits.
Under paragraphs 3 and 4, GuardDog otherwise neither admits nor denies the allegations, and the stipulated facts are limited to supporting jurisdiction, entry, and enforcement of this judgment in this case. GuardDog also said it believed Health Gorilla knew about its business and considered the access permissible. Those statements do not establish that Health Gorilla actually knew or approved unlawful conduct.
An order to delete also does not prove that deletion happened, identify every affected patient, or establish that every downstream recipient surrendered every copy. The litigation preservation exception matters, too. The named plaintiffs’ release of GuardDog does not purport to release independent patient or provider claims, and the other defendants’ positions remain preserved.
Health Gorilla is still contesting the case
Health Gorilla’s February 26 motion asks the court to dismiss the case. It argues that the plaintiffs skipped required network dispute procedures, have not adequately alleged fraud or injury, and cannot enforce certain contracts as claimed. It also disputes the leap from alleged failures in vetting to knowing participation in fraud. These are defense arguments, not court rulings. Other defendants also sought dismissal, and one motion sought to separate claims. The plaintiffs filed oppositions on March 26; more dismissal motions followed on March 30. The GuardDog judgment does not resolve the claims against Health Gorilla or the remaining defendants.
For providers, those disputes leave open who knew what, which contractual duties applied, and who may ultimately bear the costs. They do not stop the need to complete incident or breach assessment or notification duties.
The patient lawsuits are already here
Here is the part that should send a chill down every privacy officer’s spine: Reid Health and UMass are plaintiffs alongside Epic in the January case, and defendants alongside Epic in separate patient suits filed in March. Being deceived does not keep an organization from facing claims that it failed to protect its patients. The March filings include:
-
Lott v. Health Gorilla, filed March 12 in the Southern District of Florida. The proposed class action alleges negligence, invasion of privacy, and unjust enrichment. Lott reports receiving a provider notice in February. A March 27 motion sought consolidation and appointment of interim class counsel; the motion itself was not a consolidation order.
-
Fox v. Epic and Reid Health, Beaudreau v. Epic and UMass, and Banh v. Epic and UCSF Health Community Hospitals, all filed March 13 in the Western District of Wisconsin. They allege failures involving protection of records, exchange oversight, and notice. The complaints include negligence, implied contract, and unjust enrichment claims; Banh also asserts California statutory claims.
Other related patient actions include Patterson against UVA Health and others on February 23; Jackson against Trinity Health and Health Gorilla on March 20; Hughes against Health Gorilla and Pabon against Trinity Health and Health Gorilla on March 24; and Delis against Health Gorilla and Trinity Health on March 30. These filings show how far the dispute has already spread beyond the original case.
These are allegations, not findings of liability. Filing a proposed class action does not mean a class has been certified. HIPAA itself generally does not have a private right of action (i.e., patients cannot sue under HIPAA); patients are pursuing other legal theories that depend on the governing law and facts.
Still, patient lawyers are using the January complaint and providers’ own notices to build their cases. Some challenge the detail or timing of notice. That does not mean every requested detail was legally required, or that a separate Epic letter was needed in addition to a sufficient provider notice. The actual notice duties and arrangements need their own review.
Questions every potentially affected provider needs to answer
The GuardDog order does not answer these questions for your organization:
- Did any implicated entity actually receive our patients’ information, or do we have only evidence of requests? Did a search response itself reveal protected information?
- Which patients, dates, documents, and data fields were involved? Are we counting requests, records, or unique people? Those numbers are not interchangeable.
- Which organization identifiers, aliases, intermediaries, and exchange routes were used? Could the same operator have appeared under another name?
- Was there a genuine treatment purpose or another permitted basis for the disclosure? What evidence supports that conclusion?
- Who received the information next? Was it viewed, copied, summarized, supplied to attorneys, or used for another purpose?
- What records can Epic identify, and what must come from our own systems, Health Gorilla, OCHIN, or other exchange partners? Where are the gaps?
- What has actually been deleted or secured? What remains with downstream recipients or under a litigation hold?
- Did questionable incoming documents enter our clinical record, and could they affect patient care?
- When did we know, or when should reasonable diligence have revealed, enough to trigger our duties? Which legal, contractual, network, and insurance deadlines apply?
- Do our facts support notice, a documented low probability of compromise, a regulatory exception, or a conclusion that our information was not impermissibly disclosed? Who approved that decision, and what would cause us to revisit it?
Getting the breach analysis right
Start with what actually happened. A network rule violation is not automatically a reportable HIPAA breach. Later misconduct by an independent recipient does not automatically make an earlier, lawful disclosure unlawful either. But a working connection and valid credentials do not establish a valid purpose.
HIPAA generally permits treatment disclosures without patient authorization. Its minimum necessary standard generally does not apply to disclosures to, or requests by, a healthcare provider for treatment. The question here is whether the particular requests really were for treatment. Other confidentiality laws may impose additional restrictions.
Under HIPAA’s breach definition, an impermissible acquisition, access, use, or disclosure of unsecured protected health information is generally presumed to be a breach. An applicable exception or a documented low probability of compromise can change that result. The low probability assessment must consider at least four factors:
- The nature and extent of the information, including the identifiers involved and the likelihood of identifying the patient.
- The unauthorized person who used or received it.
- Whether the information was actually acquired or viewed.
- The extent to which the risk was mitigated.
This is not an identity theft test. “Nobody has reported financial harm” does not establish a low probability of compromise of medical information. Encryption during transmission also does not settle the issue if an unauthorized recipient received readable records. And neither a court’s deletion command nor the recipient’s professional title replaces evidence about what happened to the information. HHS allows an organization to provide breach notification without first conducting the low probability assessment. It still needs to identify the affected people, give accurate notice, and meet its other duties. If it chooses not to notify, it needs a documented, supportable reason. Missing evidence is not evidence that the risk is low.
Importantly, underreporting can leave patients uninformed and create additional regulatory and litigation exposure. “We were not named in Epic’s lawsuit” and “our vendor has not sent a final list” are not substitutes for an assessment. Overreporting creates a different problem. Telling every patient that every part of their record was stolen, without support, can needlessly alarm people and create an inaccurate account that later appears in a complaint. Unsupported certainty is hard to take back once the letters leave the building. That is not a reason to withhold required notice. A legally required notice is not, by itself, an admission of negligence. The goal is a timely, accurate account of what is known and what remains uncertain. The way to manage class action risk is to make and document sound decisions, not to let fear of a lawsuit decide who gets told.
How to complete your organization’s incident assessment
1. Assemble the right team
Bring together privacy, security, health information management, EHR and exchange staff, clinical leadership, risk management, and communications. Involve experienced healthcare privacy and data incident counsel early, with litigation counsel as needed. Check insurance reporting and counsel requirements. Assign responsibility for the investigation, decisions, and notices. Counsel should structure the legal work deliberately; copying a lawyer on every email does not magically make the entire incident privileged.
2. Preserve evidence and contain the identified risk
Preserve audit logs, requests and responses, transaction identifiers, organization identifiers, credentials, purpose codes, alerts, contracts, and earlier complaints. Apply an appropriate litigation hold. Preserve evidence of what actually left the system, not just what was requested. Take justified containment steps while investigating. GuardDog’s deletion obligation is not an instruction for your hospital to delete its medical records or evidence.
3. Work directly with Epic and the relevant exchange partners
For an Epic customer, Epic’s cooperation may be essential to identifying the affected records. Ask for entity names and aliases, technical identifiers, date ranges, query reports, and available response or delivery logs. Ask how each report was generated and what it leaves out. Match the results to your patients and the actual information sent. Count unique people rather than treating every document as a different patient. Health Gorilla and other exchange partners may hold more evidence. Epic may not see every route or downstream recipient. Put requests in writing, assign follow-up dates, and track unanswered questions. Cooperate on the facts while preserving your own legal analysis. Working with Epic does not automatically create a shared legal privilege or align everyone’s litigation interests.
4. Build the timeline and identify each party’s role
Separate the dates of access, discovery, escalation, and confirmation. Determine whether each entity was your business associate, a subcontractor, an independent covered entity, or another recipient. Network membership does not answer that question. Review the agreements and actual conduct, including whether an agent’s knowledge counts as your organization’s knowledge. Identify the legal basis for each disclosure and whether the stated purpose matched the facts. The January 13 lawsuit is not automatically every provider’s discovery date. The March 20 judgment does not restart an existing clock. Under HIPAA, discovery can include what reasonable diligene woudl have revealed, rather than only the date leadership received a finished patient roster.
5. Make and document the breach determination
Apply the HIPAA analysis to your information and circumstances. If relying on an exception or a low probability of compromise, explain why the evidence supports it. Address each risk factor and material uncertainty. Also check state breach and medical confidentiality laws, including special protections for HIV, mental health, and substance use disorder records. Determine whether Part 2 applies. Use the law applicable to the records, entities, and timing; HIPAA may not be the whole analysis. Notification duties may apply even while everyone disputes who caused the incident or should pay. A reportable breach does not automatically establish negligence. And a fight over reimbursement cannot put required patient notice on hold.
6. Verify mitigation and protect patient care
Verify that the identified access paths have been blocked or corrected. Where possible, obtain a list of recipients and copies, restrictions on further use, and credible deletion or return confirmations. Address retained litigation material with counsel. Check whether questionable incoming documents affected the clinical record, and correct them through proper procedures while preserving evidence. Make controls fit the problem. A blanket shutdown of legitimate exchange can disrupt care and create other legal issues. Review network requirements and information blocking rules, including the conditions of any IBR privacy or security exception you rely on.
7. Resolve notice duties while the investigation continues
Calendar each applicable deadline separately. HIPAA generally requires individual notice without unreasonable delay and no later than 60 calendar days after discovery. Sixty days is an outer limit, not a standard waiting period. Business associate notice to the covered entity has its own requirement, and contracts may require much faster reporting. For breaches involving 500 or more individuals, HHS notice is due with the individual notice. Smaller breaches are reported to HHS no later than 60 days after the end of the calendar year in which they were discovered; that does not extend the patient notice deadline. Media notice applies when a breach involves more than 500 residents of a state or jurisdiction. State, network, and contract requirements may have different triggers and shorter deadlines.
Do not assume waiting for Epic or another partner extends a deadline. Determine who will notify on whose behalf, and verify that it happens. HHS permits estimated counts and later updates to its report when necessary. Notice should describe the incident, relevant dates if known, types of information, protective steps, mitigation, and contact information as required. Say what your evidence supports; update appropriately as material facts develop.
8. Record the decision and keep it current
Create a dated decision record showing the evidence, remaining gaps, applicable law, risk assessment, mitigation, and reasons for notifying or not notifying. Identify who approved the decision, what follow-up is needed, and what facts would change the result. Retain required documentation and preserve material under a litigation hold. Track response costs, and have counsel review contractual notice, defense, indemnity, and recovery rights. Each organization needs its own conclusion. Different patients, records, recipients, dates, and mitigation evidence can lead to different defensible outcomes. This is intensely fact sensitive. Copying another hospital’s notice, or its decision not to send one, is not an assessment.
Epic made GuardDog heel. Your organization still needs to be able to explain what happened to its patients’ information and why its response was legally sound. Resolve the matter only after the evidence and documented analysis support that decision.