Epic Pauses Most Product Development to Address MyChart Security Risks

Epic Systems has temporarily paused most product development. At the same time, the healthcare software company focuses on strengthening security across its products after AI-assisted testing uncovered vulnerabilities that could put patient data at risk.

Epic founder and CEO Judy Faulkner told Modern Healthcare that the pause is expected to last about six weeks while teams concentrate on safeguarding the company’s software and systems.

The decision followed the deployment of Anthropic’s advanced cybersecurity model Mythos, which identified security weaknesses in Epic’s technology. The company has not publicly disclosed the full technical details of the vulnerabilities.

Some MyChart configurations could expose patient records

Epic Chief Security Officer Stirling Martin told The New York Times that certain customer configurations of MyChart could potentially allow unauthorised users to access patient records without the intrusion appearing in the software’s logs.

Martin said the AI testing did not establish whether an attacker could also alter medical records without detection. Epic nevertheless considered the potential exposure serious enough to prioritise remediation over most ongoing product development.

MyChart is widely used by hospitals and medical practices to give patients access to health information, appointments, test results and other services. Epic’s systems are associated with more than 320 million patient records across healthcare organisations in the United States.

Epic says it does not directly hold or control the medical records its customers store. Its MyChart data storage guidance explains that healthcare organisations such as hospitals and doctors’ offices are responsible for storing and managing patient information.

That distinction does not eliminate the potential impact of a software vulnerability. A flaw affecting widely deployed MyChart configurations could expose information across multiple healthcare organisations if attackers could exploit the same weakness in different systems.

Healthcare systems remain a major cyber target

Epic’s response comes as healthcare organisations continue to face large-scale ransomware and data theft. The 2024 attack on Change Healthcare exposed health information belonging to more than 192 million people, while major breaches reported in 2026 have affected companies including CareCloud, McKesson and Craneware.

The Department of Health and Human Services currently lists a DentaQuest breach affecting 15 million people as the largest healthcare-related incident reported this year.

Epic has not said the vulnerabilities it identified were exploited or that patient records were stolen. The development pause is a preventive measure to fix weaknesses before attackers can exploit them.