In Stipulated Judgment, GuardDog Telehealth Admits Providing Patient Records to Law Firms

On Jan. 13, Epic and a group of healthcare providers—OCHIN, Reid Health, Trinity Health, and UMass Memorial Health—filed a lawsuit against companies allegedly exploiting confidential patient records for profit. Now one of the defendants, GuardDog Telehealth, and Epic have filed a stipulated judgment.

The original lawsuit claims that Health Gorilla, a health information network, allowed Mammoth, RavillaMed, and other companies to improperly access and profit from nearly 300,000 patient medical records belonging to members of the Epic community. This is in addition to an unspecified number of records taken from organizations nationwide, including the VA and providers using other EHRs.


According to an Epic statement, if entered by the court, the judgment will be entered against GuardDog on the claims asserted by the plaintiffs. GuardDog admitted that while “its goal was to provide chronic care management and remote patient monitoring for patients,” that “did not happen.” “For the duration of its existence, its business instead focused on requesting, reviewing, and summarizing medical records, and providing those medical records to law firms.” 

GuardDog obtained these records “by asserting a treatment purpose” through Carequality, the interoperability framework hospitals rely on to share records for patient care.
Under the terms of the stipulated judgment, GuardDog would be permanently barred from “requesting records using the TEFCA or Carequality interoperability frameworks,” required to “delete any patient health information or records obtained from the TEFCA or Carequality frameworks within one week,” and barred from “any further use or dissemination of any patient health information or records” it obtained.

As Brendan Keeler, author of the Health API Guy blog, has noted, although no money is changing hands, the judgment explicitly preserves plaintiffs' claims against every other defendant, including Health Gorilla itself.  

A hearing on Health Gorilla's motion to dismiss is set for April 23. Keeler wrote that this stipulation gives hints about how Epic might handle the Health Gorilla and RavillaMed’s motions to dismiss, which posited that Epic should have used the mandatory dispute resolution processes baked into the CCA and Common Agreement of TEFCA  before going to court. He noted that GuardDog’s agreement to a permanent injunction is framed as addressing “immediate injunctive relief” for “irreparable harm,” which fits the exact exception to that process that both agreements provide.

Health Gorilla has said its motion to dismiss “emphasizes that the lawsuit relies on facts that Health Gorilla provided to Epic after it willingly cooperated in investigations concerning certain network participants, during a months-long, exhaustive and voluntary process involving Carequality, the TEFCA network administrator, and several of the nation’s largest health providers. This clearly demonstrates Health Gorilla’s commitment to vet and investigate concerns, honoring its obligations to protect the system.”