In a recent court filing, electronic health records giant Epic Systems proved one of health care providers’ worst fears: Companies are posing as providers to gain access to patient records. 

Health care providers holding those records can’t legally refuse the request. But if they share the records with someone who doesn’t have rights to them, they violate HIPAA, the federal law that protects patients’ health information.

Regardless of the outcome of the lawsuit itself, Epic has opened up a Pandora’s box, forcing the federal health department to consider policy changes to assuage providers’ fears. Even as experts agree on the need for more regulatory clarity, they worry about  any changes, whether directly or indirectly, being dictated by the industry’s biggest player. 

STAT+ Exclusive Story

STAT+



This article is exclusive to STAT+ subscribers
Unlock this article — and get additional analysis of the technologies disrupting health care — by subscribing to STAT+.

Already have an account? Log in

Individual plans

Group plans

View All Plans

To read the rest of this story subscribe to STAT+.

Subscribe