Sign of the same name outside Epic headquarters in Verona, Wisconsin.
Source: Yiem via Wikipedia CC
Epic Systems, the largest provider of medical records management software, says a venture-backed startup called Particle Health is using patient data in unauthorized and unethical ways, has nothing to do with treatment.
Epic told customers in a notice Thursday that it had cut connections to Particle, hindering the company's ability to tap into a system with more than 300 million patient records. Particle is one of several companies that act as a kind of middleman between Epic and the organizations – usually hospitals and clinics – that need the data.
Patient data is inherently sensitive and valuable and is protected by the Health Insurance Portability and Accountability Act, or HIPAA, federal law requires patient consent or knowledge for third-party access. One way to access Epic's electronic health records (EHR) is through a so-called interoperability network Take care of, facilitates the exchange of more than 400,000 documents each month, according to its website. Particle is a member of the Carequality network.
To join the network, organizations must be vetted and must agree to adhere to clear “Permissible Purposes” for patient data exchange. Epic meets the data requirements for the permitted purposes of “Processing”, which means that the recipient is providing care to the person whose records they request.
Epic said in Thursday's announcement that it filed a formal dispute with Carequality on March 21, over concerns that Particle and its participating organizations “may inaccurately represent the purpose of regarding the retrieval of their records”. The company suspended its connection to Particle that day.
“This poses potential security and privacy risks, including the potential to violate the HIPAA Privacy Rule,” Epic said in the notice obtained by CNBC.
in one blog posts late Friday, Carequality said it takes the disputes “very seriously and is committed to maintaining the integrity of the dispute resolution process and trusted exchanges within the framework.” The organization said it cannot comment on the existence of any disputes or member activities.
Representatives for Epic and Particle did not respond to requests for comment. However, Particle has published one blog posts Friday night and said it began “immediately addressing this issue” after Epic “stopped responding to data requests from a small group of customers” on March 21. Particle said in the post. posted that the major challenge in such matters is “no standard reference”. to evaluate the definition of Treatment.”
“These definitions become more difficult to discern as care becomes more complex with providers, payers, and payers all consolidating within various large healthcare corporations,” Particle writes. ”.
Epic, a 45-year-old privately held company headquartered in Wisconsin, is the largest EHR vendor by hospital market share in the US, with 36% of the market, according to a May report from KLAS Research. Prophecy ranked second with 25%, behind 28 billion USD of software companies Buy Cerner in 2022.
As of July 2022, Particle had raised a total of $39.3 million from investors including Menlo Ventures, Story Ventures and Pruven Capital, according to A release. At the time, the New York-based startup said its technology “uniquely combines data from 270 million patient medical records by aggregating and unifying health care records. health from thousands of sources.
Epic said Particle onboarded thousands of new participant connections to Carequality in October and asserted that they were a treatment use case. In the following months, all participating Particle entities requested a permissible therapeutic purpose for their claims, Epic said.
'Non-therapeutic use case'
However, Epic started to notice some red flags. The company said it observed anomalies in patient record exchange patterns, such as requests for large numbers of records within a certain geographic area. Additionally, Epic said companies connected to Particle did not resubmit new data from patients, which “suggests a nontherapeutic use case.”
Epic and the Care Anywhere Board of Directors, comprised of 15 industry representatives, evaluated Particle's new participant connections and determined that organizations such as Integritort, MDPortals and Reveleer, acquired MDPortals last year, the announcement said, “may not comply with the Authorized Purpose of Treatment.”
Epic said it has learned that another member of Carequality is planning to file a dispute, alleging that Integritort is using patient data to try and identify potential class action participants. On March 28, Epic said it discovered that a participant named Novelia claimed to be requesting records of being treated, despite publicly advertising its product as a personal health tools”.
Integritort, Reveleer and Novellia did not respond to requests for comment.
Epic said it filed a formal complaint with Carequality following the recommendation of the Board of Directors. According to the announcement, on April 4, Epic asked Particle for additional information to illustrate how participants would qualify for the treatment's use case.
Michael Marchant, chief interoperability and innovation officer at the University of California Davis Health, serves as chairman of Epic's Board of Directors. He said it's difficult to know exactly why Particle may have provided records to these organizations or whether they knowingly engaged in wrongdoing. However, he said, companies must act responsibly even when under pressure to deliver financial results.
“If they sell to what they know are not treatment-related organizations in an effort to match VC funding or profit margins or goals,” Marchant told CNBC in an interview. spend revenue or what have you, that would be really bad.”
in one stated on LinkedIn Wednesday, Particle founder Troy Bannister said Epic acted unilaterally and that Particle has not seen “reasons, justifications or official statements” surrounding these issues.
Bannister wrote that, to the company's knowledge, “all affected partners are directly supporting the treatment.” He said these organizations take data on care providers and share it back to the Carequality network.
“While we continue to maintain contact with Carequality, the possibility of one person making the decision, without evidence or even without warning, to disconnect providers on a large scale, causes jeopardizing clinical operations for hundreds of thousands of patients as well as the trust that is so important to an exchange based on trust,” Bannister wrote.
Bannister did not address Epic's April 4 request for more information.
The formal dispute process is still ongoing. Marchant, who also co-chairs the advisory council at Carequality, said this is the first time in the network's history that a complaint has gone this far.
