Terms Unconditional

EHR & Health Data Systems · Health Data Network / HIE · Private litigation

Health Gorilla

Headline

Health Gorilla is one of the ten federally designated QHINs and also runs a consumer 'Patient Access' service that lets individuals pull their own records from national networks.

Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.

Health Gorilla is one of the ten federally designated QHINs and also runs a consumer 'Patient Access' service that lets individuals pull their own records from national networks. In January 2026 Epic Systems and several affiliated healthcare providers sued Health Gorilla in federal court in California (C.D. Cal. No. 26-cv-00321). Epic alleges patient records were obtained through Health Gorilla's network connections for purposes other than treatment. Health Gorilla 'categorically reject[s]' the allegations. It says it suspended the connections in question, and it filed a motion to dismiss in February 2026 arguing Epic skipped the networks' required dispute processes. One connected company, GuardDog Telehealth, stipulated to a consent judgment with Epic in March 2026. Health Gorilla says that judgment has no legal effect on it and that GuardDog always represented its queries as treatment. These are unproven allegations in contested litigation. For consumers, the case shows that records on national networks can be requested by companies claiming a treatment purpose, and patients have little visibility into who asked.

  • SeveritySeverity 3 of 5, not independently verified. Health Gorilla is one of the ten federally designated QHINs and also runs a consumer 'Patient Access' service that lets individuals pull their own records from national networks.
  • Evidence tierUnassigned
  • Claims confirmedNo sourced claims yet
  • Last verified2026-10-15

Case status. Private litigation; the legal tier of its sources has not been assigned yet.

Primary source. www.prnewswire.com/news-releases/health-gorilla-releases-statement-in-response-to-epic-lawsuit-302670823.html — Unverified - heuristic first draft.

Last verified 24 days agoverified 24 days ago0180 days
Freshness. Last verified 24 days ago (2026-10-15); stale after 180 days.

Terms

Arbitration

None found. The Patient Access User Agreement is governed by California law. Website claims are governed by Delaware law.

Data sharing

QHIN routing records between payers, providers, EHR vendors, digital-health firms, labs and life insurers (its listed customer types include life insurers). Patient Access notice: identifiable data is used for record retrieval, operations including fraud detection, and product development including analytics, and is shared externally for the same purposes. Data persists after deactivation until deletion is requested. The website privacy policy says it has not sold personal information in the preceding 12 months.

Who holds your data. Data chain: Health Gorilla, then Health Gorilla, Inc. (private; investors not verified this pass) (parent), then EHR vendor layer. See cross-cutting finding 16: THE EHR LAYER — THE COMPANY HOLDING YOUR CHART IS ONE YOU NEVER SIGNED WITH.

Fees and billing

No fees mentioned in the Patient Access User Agreement.

Contacts

Privacy contact. support@healthgorilla.com; (844) 446-7455

Legal notice. Health Gorilla, Inc., Attn: Associate General Counsel, 121 Alhambra Plaza Suite 1000, Coral Gables, FL 33134 (per privacy policy)

Mailing address. Not recorded.

Written channel present
Paper trail: written. Written channel present.

Evidence

No claims have been itemized for this row yet.

Sources

SourceClaimTierStatusQuote
Company press release (defendant) · 2026-01-27
www.prnewswire.com/news-releases/health-gorilla-releases-statement-in-response-to-epic-lawsuit-302670823.html
whole rowUnassignedconfirmed“We categorically reject these allegations.”
Quote basis: not recorded.
Company press release (defendant) · 2026-02-26
www.businesswire.com/news/home/20260226940871/en/Health-Gorilla-Files-Motion-to-Dismiss-Reaffirming-Confidence-in-Interoperability-System
whole rowUnassignedconfirmed“Bypassing them risks destabilizing systems that hundreds of millions of patients and providers depend on.”
Quote basis: not recorded.
Company press release (defendant) · 2026-03-20
www.businesswire.com/news/home/20260320700188/en/Health-Gorilla-and-GuardDog-Telehealth-Set-the-Record-Straight
whole rowUnassignedconfirmed“We always represented to Health Gorilla that our services were for treatment purposes and they were.”
Quote basis: not recorded.
TEFCA RCE · 2026
rce.sequoiaproject.org/designated-qhins/
whole rowUnassignedconfirmed“Health Gorilla”
Quote basis: not recorded.
Company privacy notice (consumer service) · 2024-08-30
www.healthgorilla.com/home/policies/patient-access-privacy-notice
whole rowUnassignedconfirmed“Health Gorilla follows HIPAA rules but is not a Covered Entity.”
Quote basis: not recorded.
Company privacy policy · 2024-08-30
www.healthgorilla.com/home/privacy-policy
whole rowUnassignedconfirmed“In the preceding 12 months, Health Gorilla has not sold personal information.”
Quote basis: not recorded.
Consumer user agreement · 2026
hg-policies.s3.amazonaws.com/PatientAccessUserAgreement.pdf
whole rowUnassignedconfirmed“This Agreement is governed by the laws of the State of California, without regard to its choice of law provisions.”
Quote basis: not recorded.

Source vault

Link status: Candidate - not yet fetched

DocumentLast fetchPDF
Privacy policy
https://www.healthgorilla.com/home/privacy-policy
Not fetched yetNOT CONFIRMED
Terms of service
https://www.healthgorilla.com/home/terms-of-use
Not fetched yetNOT CONFIRMED
Website
https://www.healthgorilla.com
Not fetched yet—
Primary source
https://www.prnewswire.com/news-releases/health-gorilla-releases-statement-in-response-to-epic-lawsuit-302670823.html
Verification: Unverified - heuristic first draft
Not fetched yet—

Enforcement

ActionAmountLink
Epic Systems Corp. v. Health Gorilla, Inc. (alleged fraudulent 'treatment' record pulls via Carequality/TEFCA)
Private plaintiffs (EHR vendor and health systems), 2026
Complaint, No. 2:26-cv-00321 (C.D. Cal. filed Jan. 13, 2026); related to MDL No. 3193 (S.D. Fla.)
—proposed
In re Health Gorilla, Inc. Data Security Breach Litigation (MDL No. 3193)
Private plaintiffs (putative nationwide patient class actions), Judicial Panel on Multidistrict Litigation, 2026
JPML Transfer Order, MDL No. 3193 (Aug. 7, 2026) (centralized before Judge K. Michael Moore, S.D. Fla.)
—proposed

Links are proposed matches, not yet reviewed.

State statute

Headquarters on file: FL. Provisions of FDBR on file:

ProvisionTypeSource
Applicability — Narrowest of Any State; $1B Revenue + Specific Activities
Fla. Stat. § 501.702
thresholdsource
Enforcement — Highest Per-Violation Penalties; Trebled for Minor Violations
Fla. Stat. § 501.72
hardsource

Related companies

Linked to the same enforcement action