The news broke at the beginning of October 2026 that Epic had paused most MyChart new product development for the next six weeks to aggressively fix newly discovered security flaws with the potential to expose patient data. This sounds alarming, as it should, but law firms should know that as of November 4, 2026, there is no evidence that patient data has been exposed, altered, or stolen. However, the Epic MyChart security flaw does present potential issues for personal injury and other law firms that rely on medical records to build their cases. We have everything you need to know right now.
Why Did Epic Pause MyChart New Product Development?
Epic paused MyChart new feature development after Epic’s security team discovered significant security flaws that put patient data privacy at risk. The discovery was made by an internal stress test, using Anthropic’s Mythos AI cybersecurity model, and no external breaches were found before, during, or after this discovery.
The flaw was significant enough that Epic believed it was important to pause most development until they could repair the flaws. This pause was expected to last six weeks while Epic sends out the required security patches to all their health system clients. Those clients may have needed to provide significant resources toward security remediation, emergency patching, and auditing their current configurations to determine any exposure they may have.
What Security Flaws Were Identified?
The pause was initiated after internal stress tests identified vulnerabilities in the way that the MyChart software interacts with certain system configurations. Specifically, the way that some healthcare organizations configured their systems could allow outside hackers to gain unauthorized access to patient health data without leaving any trace in the digital audit logs. While there is no indication or confirmation that a hacker would be able to alter the data, the mere fact that patient data could be accessed without being logged was enough for Epic to put a halt on new feature development until they could make sure this vulnerability no longer presents a threat.
It is important to note that the flaw stems from how some healthcare organizations configured their MyChart portals. This means that some, but not all, facilities using the software are exposed.
Is MyChart Safe to Use?
Generally, yes, MyChart is safe to use. The MyChart security vulnerability and flaws Epic found were from an internal stress test rather than an external breach. There is no indication currently that there has been any breach of any MyChart patient data. Healthcare systems, law firms, and patients can still safely use MyChart.
Separately, scammers are using the MyChart name in an AI-driven phishing campaign. That campaign isn’t connected to the security flaw and doesn’t mean MyChart has been breached, but users should stay cautious with any unexpected messages.
Was Patient Data Exposed in the MyChart Security Flaw?
There is no report that patient data was exposed. However, because the flaw could allow access without leaving a record in the audit logs, there’s no way to fully confirm that it wasn’t. That uncertainty is why Epic treated the flaw so seriously, and it’s also why the flaw may matter for your cases, as we explain below
Paper Medical Records and Health Records vs. Electronic Health Records
Paper medical records security consists of locked rooms, restricted access buildings, and secure filing cabinets. Those with permission to access the records have keys, PINs for keypads, or electronic badges that grant access.
Today, MyChart and systems like it contain electronic health records (EHR). EHR security consists of physical, administrative, and technical safeguards. Technical safeguards include audit logs, access controls and authentication, encryption, firewalls and antivirus protections. Administrative controls include policies and risk assessments, staff training, and incident response plans. Physical safeguards include facility security, device protections, data backups and disposal.
Security Awareness
While this security flaw was found during an internal test of the system, it does bring awareness to the fact that EHRs can still be at-risk if one or more safeguards fail. Law firms should use this as an opportunity to not only evaluate all of their own systems to identify and secure any weak points, but also to evaluate all of their partners and make sure systems that touch medical records or any other part of the case file are properly secured.
AI-Driven Phishing
Separate from the security flaw, scammers are running an AI-driven phishing campaign that uses the MyChart name to steal login credentials, credit card information, and other personal information from patients. Most of these messages promise a “free Medicare Kit” or claim that urgent test results are available.
This doesn’t affect law firms directly, but it’s a good opportunity to remind clients that personal injury victims are at heightened risk of being targeted by scams. Encourage them to avoid responding to unexpected emails or texts asking for logins or personal information, call their provider at a published phone number to confirm that a message is real, and use strong passwords they don’t reuse elsewhere.
What Was Epic’s Security Response?
Epic responded to the discovery of the flaw with an immediate corporate-wide lockdown on product development. This allowed them to turn their focus entirely to security remediation. Epic’s security response was a three-pronged approach.
Six Week Security Sprint
The pause on new product development allowed Epic to pull engineers off their usual projects and redeploy them to testing, rewriting, and otherwise strengthening the code. This ensured that the priority was fixing the configuration vulnerabilities instead of new development.
Shifting the Burden to Facility IT Departments
Because the vulnerability existed in the local client configuration of the software, Epic wasn’t able to unilaterally repair the flaw itself. Instead, they issued a blunt directive to the affected facilities to ignore the typical, slow maintenance schedules and prioritize patching the vulnerability immediately.
Project Glasswing
Epic’s work with AI security testing didn’t begin or end with this discovery. Epic is part of Project Glasswing, an Anthropic program that gives a select group of organizations access to its Claude Mythos Preview model for defensive security work. Epic used the model to test how hackers might use AI tools to reach confidential patient records, essentially thinking like an attacker to find weak points before real attackers could. The goal is to catch vulnerabilities like this one before anyone can exploit them.
What Does the Epic MyChart Flaw Mean for Law Firms?
While the MyChart security flaw was discovered through internal testing and no actual breach has been reported, the discovery itself may impact law firms whose clients are MyChart patients. There are a few different ways that the flaw may impact law firms.
The Audit Trail
The security flaw is a vulnerability that could allow outside hackers unauthorized and unlogged access to patient records. This means that their access would not be logged in the audit log. While there is no reported external breach of MyChart security, the very presence of this vulnerability could allow defense attorneys and insurance companies to question the integrity of the audit log when records were retrieved prior to the flaw being repaired.
Heightened Scrutiny of the Chain of Custody
While testing only confirmed unlogged access, it raised the question of whether that access would also allow a hacker to alter patient records. While there is no evidence of either access or alteration of records, cases in which the client is a MyChart patient may face closer scrutiny of the medical records’ integrity. If the facility the client uses is one of the ones with a vulnerable configuration, the records may require more than routine records certifications, such as technical expert testimony, to establish that the records are accurate.
Potential Retrieval Delays From Affected Providers
Affected healthcare organizations may have needed to divert massive amounts of manpower toward security remediation, emergency patching, and system configuration audits. This may have caused temporary system freezes or stricter portal verification measures that can slow down record requests coming directly from firms. It may also cause bottlenecks for third-party record retrieval services, depending on each facility’s instructions to its staff and its staff size. These slowdowns may continue after Epic resumes product development as facilities get back on track.
Potential Complications with Client-Gathered Records
Many personal injury firms ask clients to log into MyChart and download their own records to speed up initial case evaluations. While the security flaw is not an issue for this, many facilities are actively warning their patients not to click links or download unknown files via email due to the phishing campaign.
Firms will need to use extreme caution when directing clients to download records. Remind them to use only safe, direct app connections rather than emails. Instruct them to use verified links and provide phone numbers, logos, or other details for the client to look for when texts or emails are used to gather records.
Additionally, if a client’s account has been compromised by the phishing scam, firms may need to verify that downloaded records are complete and authentic. Incomplete or missing records can reduce a case’s settlement value in general, but under these circumstances, could also call into question the integrity of all the records and the case.
How Are Medical Records Kept Secure During Medical Record Retrieval?
From start to finish, we use strict technical, physical, and administrative safeguards mandated by HIPAA to make sure your client’s protected health information is secure, including:
- Restricting access based on user roles and permissions
- Ensuring all transmissions are encrypted to prevent hackers from intercepting them
- Storing records in an encrypted digital environment or secure physical location
- Maintaining audit trails to monitor who accesses PHI
- Following HIPAA-compliant disposal procedures, such as shredding physical documents or permanently deleting electronic files when records are no longer needed
At Records On Time, medical record security begins with your request. You submit your client’s signed HIPAA authorization in your CMS, where we pick up the request. We then use secure online portals or encrypted communication channels to submit your request to the provider, who uses the same secure methods to send the records to us. Once we’ve reviewed and OCR’d the records, we then use encrypted transmission to deliver the records directly into your CMS, into the case they belong to.
What Can We Do For You?
We can’t fix security flaws like the Epic MyChart security flaw, but we can take medical record retrieval off your hands. Turn the job over to us and we’ll handle everything from the initial request and any necessary follow-ups, through review and OCR preparation, and ending with delivery into your CMS. And you’ll always be able to see what’s happening with your request. Let us deal with the aftereffects of the MyChart security vulnerability and any other medical record retrieval frustrations. Then, you can focus on the tasks that keep your cases moving. Contact us today for a demo.
