Epic Hits Pause to Fix a Security Problem With Patient Records
Epic has paused most of its work on new products while it protects its software from cyberattacks. TechCrunch
Founder and chief executive Judy Faulkner said the pause would likely last six weeks while the company works to make its products safer.
Deployment of Mythos, a security-checking AI model from Anthropic, unearthed flaws in Epic systems that could allow access to patients' data. Epic makes MyChart, the software people use to see their medical records.
Chief Security Officer Stirling Martin said some customer setups of MyChart could let outsiders see patient records without leaving a trace in the software's logs, like a visitor book with missing entries.
MyChart holds more than 320 million patient records across hospitals and doctor's offices in the United States. Epic says it does not have access to customers' medical data, with responsibility falling on healthcare providers such as hospitals and doctor's offices.
A 2024 ransomware attack on Change Healthcare allowed hackers to steal health data on more than 192 million people. The U.S. Department of Health and Human Services lists a breach at dental insurance company DentaQuest affecting 15 million people as the largest healthcare-related data breach of 2026 so far.
Separately, Epic faces regulatory pressure. Texas Attorney General Ken Paxton sued Epic in December, accusing the company of shutting out would-be rivals by holding data hostage. Reuters The U.S. Federal Trade Commission was probing health-records company Epic Systems as of August 2026.
The broader context here is the difference between a flaw in the main software and a setup problem. Main software can be fixed once and sent to everyone. A setup problem must be found and fixed site by site. Each hospital and clinic runs its own version, access rules and connections. That work is slower. It requires listing systems, checking fixes and working with local IT teams.
Looking at what this means for security, logs are central. When access leaves no log entry, teams cannot find the intrusion. They cannot tell how far it went. Response becomes guesswork. They cannot answer what was seen, when and by whom, so they must assume wider exposure. For systems holding medical histories, prescriptions, billing details and contact information, that uncertainty brings practical and legal costs.
In my view, the pause itself is the signal to take seriously. Stopping most new work focuses effort on checking, testing and fixing systems in the field. It accepts delay elsewhere. Roadmaps slip. Linked work waits. For a medical records supplier at this scale, that is a costly tradeoff. It is usually better than quiet access to data, especially where records of access are incomplete.
For the longer term, two shifts are worth watching. First, use of powerful AI models to check security in advance is becoming normal practice. Automated checks find login, permission and record-keeping problems that busy human review misses. Second, shared responsibility only works when safe settings are standard and activity records are complete. Worth flagging, vendors can write clear setup guides, but providers work under staffing and budget limits. My children grew up assuming portals like these just worked. Behind that sits a lot of unseen work by hospital IT staff.
Looking ahead, if Epic returns to full development after six weeks with stronger code, fixed setups and logs that can be verified, customers gain more than fixes. They gain a clearer starting point for watching MyChart and handling the next incident. That starting point makes future automation, attack detection work and outside review effective.
