Healthcare Attorney Oscislawski Says Epic, Health Gorilla Suit Shows Need for Tight IT-Legal Coordination

The high‑profile Epic versus Health Gorilla litigation has thrust the TEFCA framework into the spotlight, revealing how loosely‑defined governance can translate into costly legal battles. At the heart of the dispute, GuardDog—a Health Gorilla partner—conceded to releasing patient data to third‑party law firms, a move that breaches contractual obligations but does not automatically constitute an unlawful HIPAA disclosure. This distinction matters for health system leaders who must parse contract language, consent forms, and statutory requirements before labeling an incident a breach. Understanding these nuances helps CIOs and legal teams avoid premature public statements and costly litigation.

Interoperability pressures further complicate the picture. Although TEFCA is technically a voluntary national exchange model, many EHR vendors—most notably Epic—have aligned their products with TEFCA to simplify compliance with CMS’s ADT notification mandates. This creates a de‑facto requirement for Epic‑based health systems to route data through a TEFCA‑designated QHIN, effectively back‑dooring participation. Organizations using alternative regional HIEs retain flexibility, but must still meet federal interoperability standards without relying on the national network. Engaging vendors in discussions about optional pathways can preserve strategic autonomy while satisfying regulatory obligations.

Finally, the lawsuit raises broader concerns about fraud allegations and breach notification strategies. Criminal HIPAA provisions demand proof of intentional, unlawful sale of protected health information, a threshold the Department of Justice has not yet confirmed in this case. Consequently, health systems should conduct meticulous fact‑finding—verifying patient authorizations, assessing contractual breaches, and consulting in‑house counsel—before issuing breach notices. Over‑notification can erode patient trust, while under‑notification risks penalties. A balanced, evidence‑driven approach ensures compliance, protects reputations, and underscores the critical need for tight IT‑legal coordination in today’s data‑driven healthcare environment.