Epic Pauses Product Development to Address Security Flaws
AI-generated image · US National Wire
The medical records giant is halting development for approximately six weeks after an AI model identified vulnerabilities in its MyChart software.
Epic, the provider of the MyChart software used to manage more than 320 million patient records in the U.S., has suspended most of its product development to remediate security vulnerabilities. According to TechCrunch, founder and CEO Judy Faulkner told Modern Healthcare the pause would likely last six weeks to focus on "safeguarding" the company's products.
The decision follows the deployment of Mythos, a frontier cybersecurity model from Anthropic, which uncovered flaws that could expose patient data. While Epic has not disclosed the specific nature of the bugs, Chief Security Officer Stirling Martin told The New York Times that certain customer configurations of MyChart could allow external parties to access patient records without leaving a trace in the software's logs. Martin noted that while the AI model did not determine if records could be altered without detection, the risk warranted remediation.
Epic maintains that healthcare providers, rather than the company, are responsible for medical data. However, TechCrunch reports that unknown bugs could allow hackers to compromise multiple affected MyChart systems nationwide. This move comes amid a surge in healthcare data breaches, including a 2024 attack on UnitedHealth-owned Change Healthcare that affected over 192 million people. Other recent breaches cited by TechCrunch include the electronic health data storage firm CareCloud, pharmaceutical distributor McKesson, and U.K.-based Craneware. Additionally, the Department of Health and Human Services identified a breach at DentaQuest affecting 15 million people as the largest healthcare-related breach of 2026 to date.