Washington wants to punish the company that caught people stealing your health records

Do you know who has access to your health records? From diagnoses and prescriptions to test results and treatment plans, these records tell a deeply personal story — which is why health record privacy protections were a central part of the Health Insurance Portability and Accountability Act (HIPAA) when it was passed in 1996.Decades of progress in digitizing healthcare records have made that information more useful: helping patients manage their health, physicians make informed decisions, and care teams coordinate across offices and hospitals. In the truly electronic age, it should be a simple matter to share that information among providers. But making records easier to share also raises several fundamental questions: Who should be able to see them, under what circumstances, and how do we strike a balance between accessibility and privacy?As both a patient and the husband of a physician, I’ve seen firsthand how important electronic health records (EHRs) are to ensuring people receive appropriate care. That’s why I was so alarmed when I learned that a small group of tech startups and their collaborators pulled patient data from the national health data exchange network without patient consent to sell that data to mass-tort law firms. The company that caught the theft and sale of personal health data, Epic, went to court to stop this illegal activity. Epic is the developer of MyChart, the software that many patients and physicians use for electronic health records (EHRs) — and is regarded by many physicians as the gold standard for EHRs. Fundamentally, EHRs (and patient data sharing broadly) are the product of decades of continued innovation by companies like Epic, Oracle, and AthenaHealth, to develop tools that enable people to access their health data quickly, easily, and consistently.Incredibly, the Texas attorney general and the Federal Trade Commission (FTC) are now investigating Epic for trying to ensure that only trusted entities can access the personal health data on the system!The FTC and Texas AG are treating the privacy safeguards that Epic has built, and which allowed for Epic to catch the culprits of data theft, as evidence of “information blocking.”FIVE STATES WITH YOUTH TRANSGENDER MEDICINE AND SPORTS ON THE BALLOT: WHAT TO KNOWHIPAA exists to protect your records while they sit with your doctor, hospital, or insurer. Once your personal information moves to an app or an AI chatbot, most of that protection is potentially gone. Big Tech and startup founders are pushing the Trump administration to make it easier for patient health data to be shared with outside apps – which expressly fall outside of HIPAA.By removing data from HIPAA, these companies are able to do whatever they please with patient data, under the guise of “consent” buried in the “legalese” acceptance forms that people seldom read thoroughly, if at all.Even more worrying is that the FTC recently dropped its policy of applying breach-notification rules to health apps. So, while it is loosening consequences for apps, it is investigating the company responsible for protecting and vetting who has access to the records.Checking who is asking for records and why is how privacy works in practice. Members of Congress have praised Epic’s patient privacy controls and pushed other vendors to copy them. But the new frontier of privacy is rapidly evolving – and companies need to work to mitigate risk.While the talk of the town in Washington is the risk associated with accelerating AI development, Epic is walking the walk and doubling down on cybersecurity to protect patient data. Last month, Epic used an advanced AI model designed for cybersecurity research to identify — and immediately patch — security vulnerabilities, pausing new developments to ensure that patient data stays private.In contrast, a 2024 hack of Change Healthcare (a subsidiary of United Health Group, and the processor of half of all U.S. health transactions) was hit by a Russian ransomware attack, leaving over 190 million Americans’ health information exposed. United Health paid the ransom and later testified that they were not using appropriate cybersecurity protocols like multi-factor authentication.Congress banned information blocking in 2016 to ensure patients have fast and free access to their health records and that these records flow smoothly across health platforms, and HHS has started enforcing that law. Thus far, HHS has logged more than 1,500 complaints and has begun referring cases to its inspector general.But antitrust is a sledgehammer for a problem that already has a scalpel. Free-market and limited-government activists spent four years fighting former FTC Chair Lina Khan’s theories of antitrust. Situations like this underscore that despite her tenure being over, those theories persist. Punishing a homegrown, unsubsidized Midwestern American company for its success sets a precedent – and leaves Americans more vulnerable to bad actors, both domestic and foreign.AN ‘EPIC’ FAILURE: I PAID MY HOSPITAL BILL — THEN THEIR AI DEMANDED $27,000 MOREInstead, Washington should focus on punishing fraudsters, ensuring that patients’ medical records stay where they belong: within their control and only seen by the doctors they trust. This would help keep your records move from your general practitioner to your gastroenterologist instead of to trial lawyers or Chinese hackers. Washington’s job is to catch the people stealing patient health data and ensure that the next generation of AI tools improve patient outcomes, not punish innovative companies.Your records will keep moving, and they should. Washington’s job is to catch the people stealing them, not punish those trying to protect them.Andrew Langer is President of the Main Street Foundation