Epic Systems (corporate EHR)

Epic is the software company behind the medical records at a very large share of US hospitals, and through its Cosmos research database it pools de-identified records on about 310 million patients from roughly 2,358 hospitals and 52,500 clinics (Epic's own figures). Patients almost never sign anything with Epic directly: Epic runs the software on behalf of their hospital or doctor, and Epic's own patient-app privacy policy says it does 'not sell or license your information' and sends medical-record questions back to the provider. Epic's market power has been challenged in two lawsuits (no final merits ruling in either was located as of Oct 2026). Texas Attorney General Ken Paxton sued Epic in Texas state court in December 2025, alleging it illegally monopolizes the records market, slows record access for non-Epic providers, and ships MyChart with default settings that limit parents' proxy access once a child turns 12; Epic calls the suit 'flawed and misguided' and says providers, not Epic, decide parental access. Separately, a federal judge in New York (S.D.N.Y., Sept. 4, 2025) let data company Particle Health's monopolization claims against Epic go forward while dismissing others. In January 2026 Epic itself sued health-data network Health Gorilla and some of its clients in federal court in California, alleging they pulled nearly 300,000 Epic-managed patient records while posing as health care providers. These are allegations; none has been decided on the merits.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-15

Primary source. www.healthcaredive.com/news/texas-epic-antitrust-lawsuit-parent-access-medical-records-ken-paxton/807783/ — Unverified - heuristic first draft.

Arbitration

No direct patient contract for the hospital EHR (Epic acts for the provider, typically as a HIPAA business associate). For the patient app, see the MyChart row: The Lever reported in Sept 2025 that Epic is rolling out MyChart terms with binding arbitration and a class-action waiver, with a downgraded version for patients who decline. Epic's own terms text could not be retrieved this pass.

Data sharing

Cosmos: Epic pools de-identified data from participating customers into a research dataset - Epic's Cosmos site lists 2,358 hospitals, 52.5K clinics and 310 million patients, with access available on request to health-system affiliates. Epic's site does not explain the de-identification method. Epic is a Carequality member and provides the tools its customers use to exchange records nationally; the Health Gorilla suit shows that this exchange network can be abused by parties falsely claiming a treatment purpose (alleged). Epic's patient-app privacy policy says Epic does not sell or license patient information and does not store health/fitness data sent through its apps.

Contacts

Privacy contact. PrivacyInquiries@epic.com; +1 608-271-9000 (EU: EUPrivacyInquiries@epic.com)

Legal notice. Epic Systems Corporation, 1979 Milky Way, Verona, Wisconsin 53593 (headquarters address from epic.com/contact; registered agent not confirmed - the Wisconsin DFI corporate search blocked automated access)

Mailing address. Not recorded.