Epic pauses product work to fix MyChart security flaws

Epic, the software giant behind the widely used MyChart platform for accessing patients’ medical records, has paused most of its product development as it works to protect its software and systems from cyberattacks. Founder and CEO Judy Faulkner told Modern Healthcare last month that the pause would likely last six weeks while the company continues “safeguarding” its products, after a deployment of Anthropic’s frontier cybersecurity model Mythos turned up security flaws that could allow access to patients’ data.

Epic has not disclosed the nature of the bugs, but its chief security officer, Stirling Martin, told The New York Times that some customer configurations of MyChart could let outsiders access patient records without the intrusion being recorded in the software’s logs. Martin, who did not return TechCrunch’s request for comment, told the Times that the AI model did not say whether the bug could be exploited to alter patient records without detection, but argued the risk was enough to warrant remediation.

Epic’s MyChart software is used to maintain more than 320 million patient records across hospitals and doctors’ offices in the United States. Epic says it does not have access to customers’ medical data — that responsibility falls on healthcare providers like hospitals and doctors’ offices — but a bug unknown to Epic could allow hackers to compromise multiple MyChart-affected systems across the country and access the data stored within.

It’s rare for a company to pause development to fix security bugs, but the rise of AI tools capable of rapidly finding and exploiting vulnerabilities has raised concerns that attackers could have an easier time stealing data. Healthcare breaches are increasingly common as hackers seek access to sensitive health and medical data, on the assumption that providers will pay to keep stolen information from being published online.

Why it matters

Using an AI model to surface flaws serious enough to justify halting product work shows how much more aggressively AI-driven security tools can now probe widely deployed healthcare software — well before any breach is confirmed.