FOR IMMEDIATE RELEASE
The electronic health records giant says a six-week pause will allow it to close gaps uncovered through an AI-driven security review of its MyChart platform.
VERONA, Wis., October 2, 2026 — Epic, the health technology company behind the widely used MyChart patient records software, has paused most of its product development work to address security vulnerabilities that could expose patient data, according to a report published by TechCrunch on October 2, 2026, citing comments from the company's leadership.
Judy Faulkner, Epic's founder and chief executive, told Modern Healthcare last month that the pause is expected to last roughly six weeks while the company focuses on what she described as "safeguarding" its products, according to TechCrunch. The review followed a deployment of Anthropic's cybersecurity model, Mythos, which according to the report identified security flaws that could have allowed unauthorized access to patient data.
Stirling Martin, Epic's chief security officer, told The New York Times that certain customer configurations of MyChart could permit outside access to patient records without generating any record of the intrusion in the software's logs, TechCrunch reported. Martin said the AI model did not determine whether the flaw could also be used to alter patient records undetected, but told the Times the risk was significant enough to warrant remediation, according to the report. Martin did not respond to TechCrunch's own request for comment.
MyChart is used to manage more than 320 million patient records across hospitals and physician practices throughout the United States, TechCrunch reported. Epic has stated that it does not itself hold customers' medical data, with that responsibility resting instead with healthcare providers such as hospitals and clinics that operate the software. However, the report noted that an undisclosed flaw in the system could still allow hackers to compromise multiple MyChart-linked systems across the country and extract the data they contain.
TechCrunch characterized Epic's decision to halt development as unusual, noting that it is rare for a technology company to pause its product roadmap specifically to address security issues. The report linked the move to broader concerns in the cybersecurity field that artificial intelligence tools capable of rapidly discovering and exploiting software vulnerabilities could give attackers new advantages over defenders.
The report placed Epic's situation within a pattern of escalating healthcare data breaches. It cited a 2024 ransomware attack on Change Healthcare, a company owned by UnitedHealth that processes payments and billing for most of the United States healthcare system, which resulted in the theft of health data belonging to more than 192 million people, according to TechCrunch. The report said the company paid its attackers on two separate occasions in an effort to prevent the stolen data from being published.
TechCrunch also reported that 2026 has brought a series of additional healthcare-related breaches, including an incident at electronic health data storage provider CareCloud, the theft of millions of rows of data from pharmaceutical distributor McKesson, and an unspecified data breach at Craneware, a United Kingdom-based health technology company whose software is used throughout North America. The report further noted that the U.S. Department of Health and Human Services currently lists a breach at dental insurer DentaQuest, affecting 15 million people, as the largest healthcare data breach recorded so far in 2026.
About
This article was prepared by the communications office of the organization that publishes this site, which issues formal releases on developments in healthcare technology, data security and related fields as part of its ongoing coverage of matters affecting the public.
