EHR & Health Data Systems · Health Data Network / HIE · Private litigation
Health Gorilla
Headline
Health Gorilla is one of the ten federally designated QHINs and also runs a consumer 'Patient Access' service that lets individuals pull their own records from national networks.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Health Gorilla is one of the ten federally designated QHINs and also runs a consumer 'Patient Access' service that lets individuals pull their own records from national networks. In January 2026 Epic Systems and several affiliated healthcare providers sued Health Gorilla in federal court in California (C.D. Cal. No. 26-cv-00321). Epic alleges patient records were obtained through Health Gorilla's network connections for purposes other than treatment. Health Gorilla 'categorically reject[s]' the allegations. It says it suspended the connections in question, and it filed a motion to dismiss in February 2026 arguing Epic skipped the networks' required dispute processes. One connected company, GuardDog Telehealth, stipulated to a consent judgment with Epic in March 2026. Health Gorilla says that judgment has no legal effect on it and that GuardDog always represented its queries as treatment. These are unproven allegations in contested litigation. For consumers, the case shows that records on national networks can be requested by companies claiming a treatment purpose, and patients have little visibility into who asked.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-15
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. www.prnewswire.com/news-releases/health-gorilla-releases-statement-in-response-to-epic-lawsuit-302670823.html — Unverified - heuristic first draft.
Terms
Arbitration
None found. The Patient Access User Agreement is governed by California law. Website claims are governed by Delaware law.
Data sharing
QHIN routing records between payers, providers, EHR vendors, digital-health firms, labs and life insurers (its listed customer types include life insurers). Patient Access notice: identifiable data is used for record retrieval, operations including fraud detection, and product development including analytics, and is shared externally for the same purposes. Data persists after deactivation until deletion is requested. The website privacy policy says it has not sold personal information in the preceding 12 months.
Fees and billing
No fees mentioned in the Patient Access User Agreement.
Contacts
Privacy contact. support@healthgorilla.com; (844) 446-7455
Legal notice. Health Gorilla, Inc., Attn: Associate General Counsel, 121 Alhambra Plaza Suite 1000, Coral Gables, FL 33134 (per privacy policy)
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Company press release (defendant) · 2026-01-27 www.prnewswire.com/news-releases/health-gorilla-releases-statement-in-response-to-epic-lawsuit-302670823.html | whole row | Unassigned | confirmed | “We categorically reject these allegations.” Quote basis: not recorded. |
| Company press release (defendant) · 2026-02-26 www.businesswire.com/news/home/20260226940871/en/Health-Gorilla-Files-Motion-to-Dismiss-Reaffirming-Confidence-in-Interoperability-System | whole row | Unassigned | confirmed | “Bypassing them risks destabilizing systems that hundreds of millions of patients and providers depend on.” Quote basis: not recorded. |
| Company press release (defendant) · 2026-03-20 www.businesswire.com/news/home/20260320700188/en/Health-Gorilla-and-GuardDog-Telehealth-Set-the-Record-Straight | whole row | Unassigned | confirmed | “We always represented to Health Gorilla that our services were for treatment purposes and they were.” Quote basis: not recorded. |
| TEFCA RCE · 2026 rce.sequoiaproject.org/designated-qhins/ | whole row | Unassigned | confirmed | “Health Gorilla” Quote basis: not recorded. |
| Company privacy notice (consumer service) · 2024-08-30 www.healthgorilla.com/home/policies/patient-access-privacy-notice | whole row | Unassigned | confirmed | “Health Gorilla follows HIPAA rules but is not a Covered Entity.” Quote basis: not recorded. |
| Company privacy policy · 2024-08-30 www.healthgorilla.com/home/privacy-policy | whole row | Unassigned | confirmed | “In the preceding 12 months, Health Gorilla has not sold personal information.” Quote basis: not recorded. |
| Consumer user agreement · 2026 hg-policies.s3.amazonaws.com/PatientAccessUserAgreement.pdf | whole row | Unassigned | confirmed | “This Agreement is governed by the laws of the State of California, without regard to its choice of law provisions.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.healthgorilla.com/home/privacy-policy | Not fetched yet | NOT CONFIRMED |
| Terms of service https://www.healthgorilla.com/home/terms-of-use | Not fetched yet | NOT CONFIRMED |
| Website https://www.healthgorilla.com | Not fetched yet | — |
| Primary source https://www.prnewswire.com/news-releases/health-gorilla-releases-statement-in-response-to-epic-lawsuit-302670823.html Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
| Action | Amount | Link |
|---|---|---|
| Epic Systems Corp. v. Health Gorilla, Inc. (alleged fraudulent 'treatment' record pulls via Carequality/TEFCA) Private plaintiffs (EHR vendor and health systems), 2026 Complaint, No. 2:26-cv-00321 (C.D. Cal. filed Jan. 13, 2026); related to MDL No. 3193 (S.D. Fla.) | — | proposed |
| In re Health Gorilla, Inc. Data Security Breach Litigation (MDL No. 3193) Private plaintiffs (putative nationwide patient class actions), Judicial Panel on Multidistrict Litigation, 2026 JPML Transfer Order, MDL No. 3193 (Aug. 7, 2026) (centralized before Judge K. Michael Moore, S.D. Fla.) | — | proposed |
Links are proposed matches, not yet reviewed.
State statute
Headquarters on file: FL. Provisions of FDBR on file:
| Provision | Type | Source |
|---|---|---|
| Applicability — Narrowest of Any State; $1B Revenue + Specific Activities Fla. Stat. § 501.702 | threshold | source |
| Enforcement — Highest Per-Violation Penalties; Trebled for Minor Violations Fla. Stat. § 501.72 | hard | source |
Related companies
Linked to the same enforcement action
- Epic Systems (corporate EHR) · EHR & Health Data Systems