Epic Pauses Product Development to Fix Security Flaws in MyChart Software

Epic, the software company behind the widely used MyChart platform for accessing patient medical data, has paused most of its product development as it works to address security vulnerabilities that could expose patient records, the company confirmed. Judy Faulkner, Epic's founder and chief executive, told Modern Healthcare last month that the pause would likely last six weeks while the company focuses on safeguarding its products. The decision followed a deployment of Anthropic's frontier cybersecurity model, Mythos, which uncovered security flaws that could allow access to patients' data. Epic has not disclosed the specific nature of the bugs. However, chief security officer Stirling Martin told The New York Times that some customer configurations of MyChart could permit outsiders to access patient records without leaving any trace in the software's logs. Martin told the Times that the AI model did not indicate whether the bug could be exploited to alter patient records without detection, but he said the risk was significant enough to warrant remediation. Martin did not return TechCrunch's request for comment. MyChart is used to maintain more than 320 million patient records across hospitals and doctor's offices throughout the United States. Epic states that it does not have access to customers' medical data, with that responsibility falling to healthcare providers such as hospitals and doctor's offices. However, a bug unknown to Epic could allow hackers to compromise multiple affected MyChart systems across the country and access the data stored within them. It is rare for a company to pause development to fix security bugs, but the emergence of AI tools capable of rapidly identifying and exploiting security vulnerabilities has raised concerns that attackers could more easily steal data. Healthcare breaches have become increasingly common as hackers seek access to highly sensitive health and medical data, betting that providers will pay to prevent the information from being published online. A 2024 ransomware attack on Change Healthcare, a health tech company owned by insurance giant UnitedHealth that handles payments and billing for most Americans, allowed hackers to steal health data on more than 192 million people, the majority of the U.S. population. The company paid the hackers twice not to publish the stolen data. This year, a series of back-to-back data breaches at healthcare and tech companies have affected tens of millions of Americans. These include medical records stolen during a breach at electronic health data storage giant CareCloud, millions of rows of patient data from pharmaceutical distributor McKesson, and an unspecified amount of stolen data from U.K.-based health tech company Craneware, whose software is used across North America. The Department of Health and Human Services currently lists a breach at dental insurance company DentaQuest affecting 15 million people as the largest healthcare-related data breach of 2026 so far.