From Pymnts · PYMNTS · · 1m 10s
Epic AI Test Finds Untraceable Patient Data Access
Epic's AI security test exposed hidden patient data access flaws in MyChart setups.
In brief
Epic's AI security test exposed hidden patient data access flaws in MyChart setups. Epic's AI test found untraceable patient data access risks in MyChart configurations that could let outsiders view records without audit trails. Originally reported by Pymnts.
AI Security Test Finds Hidden Risk
Epic's AI test turned up MyChart setups that could let outsiders read patient records without showing up in audit logs.
“Epic Systems found flaws in certain MyChart configurations that could let someone view patient records without the access appearing in an audit trail”
Security Work Ahead of New Features
Epic shifted engineers off product development for about six weeks to close security gaps.
“Judy Faulkner, Epic's founder and CEO, told Modern Healthcare the work would likely take about six weeks”
Patching Takes Two Weeks Per Fix
Fixing security flaws takes about two weeks each, with over 10,000 serious flaws found in one month.
“Anthropic reported 50 Glasswing partners found more than 10,000 high- or critical-severity vulnerabilities in the program's first month”
MyChart Supports 320 Million Records
MyChart supports more than 320 million patient records across U.S. hospitals and doctors' offices.
“MyChart supports more than 320 million patient records across U.S. hospitals and doctors' offices”
AI Finds Older Flaws Too
Mythos found a 27-year-old flaw in OpenBSD and a 16-year-old flaw in FFmpeg video software.
“Mythos found a 27-year-old flaw in the OpenBSD operating system, according to Anthropic”
Healthcare Breaches Cost $6.64m
Healthcare breaches cost an average of $6.64 million, the highest of any industry for the 13th straight year.
“Healthcare breaches cost an average of $6.64 million, the highest of any industry for the 13th straight year”
The big picture
Epic's AI test found untraceable patient data access risks in MyChart configurations that could let outsiders view records without audit trails.
