Findings · 16 of 16
The EHR layer
The company holding your chart is one you never signed with
What it is
Almost every US medical record now lives inside a vendor's EHR (Epic, Oracle Health/Cerner, athenahealth, eClinicalWorks, NextGen, MEDITECH and others) and moves between providers over exchange networks (CommonWell, Carequality, TEFCA QHINs) and clearinghouses (Change Healthcare). Patients have no contract with any of these companies: they act as HIPAA business associates of the provider, so the patient's rights run only against the doctor or hospital. The documented harms at this layer are concentrated in four places: (1) certification/kickback fraud — six DOJ False Claims Act resolutions against EHR vendors 2017–2023 (eClinicalWorks $155M, Practice Fusion $145M incl. the first criminal case against an EHR vendor, Greenway $57.25M, ModMed $45M, NextGen $31M, athenahealth $18.25M); (2) concentration breaches — Change Healthcare (~192.7M people, the largest health breach on record) and the 2025 Oracle Health legacy-Cerner server theft; (3) information blocking and access disputes (Particle Health v. Epic, Real Time Medical Systems v. PointClickCare, Texas v. Epic); (4) the HIPAA exit — once a patient pulls records into a consumer app (Apple Health Records, TEFCA individual-access apps), HIPAA no longer applies.
Why it matters
A patient cannot opt out of the vendor, cannot read its contract, and — under several patient-portal terms reviewed — may be bound to arbitration through the portal app. A small practice is the vendor's actual customer: its EHR contract decides liability caps, claim deadlines, data-return fees at exit, and whether sponsored clinical alerts can appear in its charts (the Practice Fusion pattern).
Who holds your chart
Companies and rows it touches
All rows in the 'EHR & Health Data Systems' tab; MyChart (Epic Systems); UnitedHealthcare; OptumRx; Kaiser Permanente; CareFirst; HCA; Quest; Labcorp
Where to look
findings tab 'EHR & Health Data Systems'; enforcement_actions ids beginning doj-fca-*, doj-practice-fusion-2020, hhs-ocr-*, ne-ag-*, tx-ag-epic-*; statutes_draft ids beginning hipaa.*, cures.*, part2.*, tx_sb1188.*