Loading story…
GuardDog Telehealth admitted in a proposed consent judgment that it obtained patient medical records through a health information exchange by falsely claiming the access was for treatment, then provided those records to law firms. The filing emerged in litigation brought by Epic and other plaintiffs, who allege GuardDog and other sham entities improperly accessed records through Health Gorilla, an interoperability platform and Qualified Health Information Network participating in nationwide data exchange frameworks including TEFCA and Carequality.
The case could result in GuardDog being barred from further participation in health data exchanges, underscoring the risk of abuse within trusted interoperability channels when organizations misrepresent their purpose for accessing protected health information. A separate report about a $5 million settlement involving Geisinger Health and Nuance Communications concerns a different incident: the alleged theft of roughly 1.3 million patient records by a former Nuance employee, and is not part of the Epic-Health Gorilla-GuardDog dispute.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Health Gorilla said GuardDog did not disclose any non-treatment use to it and argued that the proposed consent judgment has no legal impact on Health Gorilla, while maintaining Epic's lawsuit is an attack on interoperability.
Under the proposed consent judgment, GuardDog would be permanently barred from requesting patient records through TEFCA and Carequality and would have to delete patient data obtained through those frameworks.
A proposed consent judgment disclosed by March 17, 2026 states that GuardDog Telehealth admitted it requested patient records by falsely claiming the requests were for treatment and then provided those records to law firms.
After Epic's lawsuit, three new putative class action lawsuits were filed against Epic and other defendants. The plaintiffs allege Epic negligently failed to prevent misuse of its Care Everywhere platform, resulting in alleged data breaches.
In January 2026, Epic filed a lawsuit alleging that GuardDog Telehealth and other companies improperly obtained patient medical records through Health Gorilla's interoperability connections to Carequality, TEFCA, and related exchanges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple legal actions highlighted ongoing **privacy and data-protection risk** across healthcare and consumer platforms. Epic Systems sued health information exchange implementer **Health Gorilla** and several provider organizations, alleging improper access to roughly **300,000 patients’ records** and claiming some participants abused interoperability frameworks (including **Carequality** and **TEFCA**) to obtain and monetize sensitive health data without appropriate consent or authorization. Separately, pharmacy services provider **PharMerica** agreed to a **$5.2 million** class-action settlement tied to a **2023** hacking incident attributed to the **Money Message** ransomware group, which claimed exfiltration of **4.7 TB** and later leaked data affecting **5.8 million** people (including SSNs and medication/insurance details), alongside commitments to invest further in security. Outside healthcare, California’s Attorney General opened a probe into **xAI** after **Grok** was used to generate and post non-consensual sexualized deepfakes, while Google agreed to pay **$8.25 million** to settle claims that its **AdMob SDK** collected data from children’s devices in “Designed for Families” apps in alleged violation of **COPPA**; a separate YouTube children’s-data settlement was also noted. A HIPAA Privacy Rule update was also reported as moving closer to finalization following an HHS OCR tribal consultation notice, but it is a regulatory development rather than a specific incident.
Jun 29, 2026
US healthcare data-breach litigation and enforcement activity saw multiple updates, including new criminal charges tied to the **2023 Geisinger Health** breach. Prosecutors filed a superseding indictment adding **two counts of false statements** against **Max Vance**, a former **Nuance Communications** employee accused of intentionally accessing a protected computer and obtaining **PHI for more than 1.3 million Geisinger patients** shortly after his termination; the new counts allege he lied to the FBI about downloading or storing unauthorized data on personal devices. Separately, two civil class-action matters reached settlement in breach cases involving patient data exposure. **Capital Health** agreed to a **$4.5M** settlement tied to a **2023 ransomware incident** in which intruders had network access for roughly two weeks and encrypted files; **LockBit** claimed responsibility and alleged **~7 TB** of data exfiltration, while Capital Health reported the incident to HHS OCR as affecting **503,071 individuals**. **Gryphon Healthcare** agreed to a **$2.87M** settlement (including a **$2.8M** fund) over a **2024 cyberattack** affecting a billing-services partner relationship, with **393,358 patients’ PHI** potentially viewed or obtained; the company denied liability but settled to avoid continued litigation costs and uncertainty.
Jun 29, 2026
Multiple healthcare-related organizations disclosed **separate** incidents involving exposure or theft of patient data. Delta Medical Systems reported unauthorized access to its email environment on July 15, 2025, with potentially exposed data including names, dates of birth, Social Security numbers, driver’s license information, bank details, insurance information, and medical information. A separate HIPAA Journal report described additional incidents at Cedar Valley Services, Community Nurse, and Health Dimensions Group, including a likely **Qilin ransomware** intrusion at Cedar Valley Services and a vendor-linked compromise affecting Community Nurse through *Doctor Alliance*, where files may have been accessed between October 31 and November 17, 2025. In a different but related healthcare privacy matter, a judge approved a **$5 million settlement** in litigation against Geisinger Health and *Nuance Communications* over the theft of medical records affecting roughly **1.3 million patients** by a former Nuance employee. The stolen records reportedly included names, birthdates, addresses, medical record numbers, treatment details, and insurance information. While all three reports concern healthcare data exposure, they describe **distinct incidents** rather than one unified breach event, spanning direct compromises, third-party/vendor exposure, suspected ransomware activity, and post-incident legal resolution.
Jul 12, 2026