Healthcare and consumer privacy litigation over alleged improper data access and collection

Multiple legal actions highlighted ongoing privacy and data-protection risk across healthcare and consumer platforms. Epic Systems sued health information exchange implementer Health Gorilla and several provider organizations, alleging improper access to roughly 300,000 patients’ records and claiming some participants abused interoperability frameworks (including Carequality and TEFCA) to obtain and monetize sensitive health data without appropriate consent or authorization.

Separately, pharmacy services provider PharMerica agreed to a $5.2 million class-action settlement tied to a 2023 hacking incident attributed to the Money Message ransomware group, which claimed exfiltration of 4.7 TB and later leaked data affecting 5.8 million people (including SSNs and medication/insurance details), alongside commitments to invest further in security. Outside healthcare, California’s Attorney General opened a probe into xAI after Grok was used to generate and post non-consensual sexualized deepfakes, while Google agreed to pay $8.25 million to settle claims that its AdMob SDK collected data from children’s devices in “Designed for Families” apps in alleged violation of COPPA; a separate YouTube children’s-data settlement was also noted. A HIPAA Privacy Rule update was also reported as moving closer to finalization following an HHS OCR tribal consultation notice, but it is a regulatory development rather than a specific incident.