MyChart (Epic Systems)

The Markup found in June 2022 that 33 of Newsweek's top 100 US hospitals were sending Facebook a packet of data whenever a patient clicked 'Schedule Appointment' - and in some cases tracking code sat INSIDE the password-protected patient portal, so logging in to read test results or message a doctor transmitted that activity to advertisers. On July 20, 2023 the FTC and HHS's Office for Civil Rights announced a joint letter sent to approximately 130 hospital systems and telehealth providers warning about exactly this. Advocate Aurora settled for $12.225 million (In re Advocate Aurora Health Pixel Litigation; final approval July 10, 2024), and other health systems - including BJC HealthCare ($5.5 million fund, up to $9.25 million) - have followed. Epic's own liability is genuinely contested and should be recorded as such: in most suits the hospitals that configured the tracking are the primary defendants, Epic maintains its software is HIPAA-compliant when used correctly, and courts have not uniformly resolved the question. No hacker was involved in any of it. Given that Epic software touches a very large share of US patients, the configuration decisions of individual hospitals scaled into one of the broadest health-privacy exposures on record.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites — Verified - primary source confirmed.

Arbitration

REPORTED, CONFIRMED BY EPIC'S SPOKESPERSON (licence text itself not retrieved - verify against the app licence before publication): Epic's 2025 end-user licence agreement for the MyChart mobile app requires 'binding arbitration on an individual, and not a class or representative' basis; an Epic spokesperson told CTV News (Sept. 2025), 'We've included an arbitration provision and class action waiver.' Patients who decline the app agreement can still use the web-based MyChart run by their own health system, which Epic says is not covered by its standard terms (each organization may have its own terms); The Lever described the non-accepting option as 'a downgraded version with limited features.' Given Epic's market position, the practical choice for many patients is between accepting the app terms and using the more limited web portal.

Data sharing

ONE OF THE MOST CONSEQUENTIAL FINDINGS IN THIS ENTIRE TRACKER GIVEN SCALE: the Texas Attorney General's December 2025 antitrust complaint alleges Epic's software holds more than 325 million patient records - which Texas characterizes as more than 90% of US citizens (an allegation in pending litigation, not a finding). MULTIPLE INDIVIDUAL HEALTH SYSTEMS have separately settled Meta-Pixel-in-MyChart lawsuits (SSM Health, preliminary approval Sept 2025; Catholic Health System, undisclosed-amount settlement paying up to $20 per claimant, preliminary approval Dec 11, 2025; BJC HealthCare, $5.5 MILLION fund (up to $9.25M depending on claims), payments issued Jan 2026) — all alleging protected health information was transmitted to Meta/Google via tracking pixels embedded in the MyChart patient portal without consent. No source located in this review shows Epic Systems itself named as a defendant in the hospital pixel-tracking cases, which name the hospitals that configured the trackers; Epic has been named in separate matters, including the December 2025 Texas AG antitrust suit and a March 9, 2026 federal antitrust suit in the Western District of Texas. SEPARATELY, a January 2026 lawsuit brought by Epic together with other health organizations as PLAINTIFFS, against health-data network Health Gorilla, alleges patient records were improperly obtained by entities POSING AS LEGITIMATE HEALTHCARE PROVIDERS (the plaintiffs - Epic, OCHIN, Reid Health, Trinity Health and UMass Memorial Health - allege that Health Gorilla, Mammoth, RavillaMed and others improperly accessed and profited from nearly 300,000 patient records; allegations, not findings).

Contacts

Privacy contact. PrivacyInquiries@epic.com; +1 608-271-9000

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.