Summary
- Epic has paused much of its product development while security remediation continues.
- AI assisted testing identified weaknesses affecting some configurations of MyChart.
- Epic and MyChart are used by NHS organisations in the UK, although no UK compromise has been established.
Healthcare software provider Epic has paused much of its product development while engineers address security weaknesses uncovered during testing with an advanced artificial intelligence cyber model.
Founder and chief executive Judy Faulkner said the pause was expected to last around six weeks, during which engineering resources would concentrate on safeguarding Epic’s products after testing with Anthropic’s Mythos model identified weaknesses that could affect access to patient information.
Epic has not published the vulnerabilities in full technical detail, although chief security officer Stirling Martin told the New York Times that some customer configurations of MyChart could allow outsiders to access patient records without the intrusion appearing in the software’s normal logs.
Neither that disclosure nor the current reporting establishes that attackers have exploited the weaknesses across Epic customers, and the company has not said that patient records could be altered without detection. The issue is therefore a remediation programme prompted by testing rather than evidence of a widespread breach.
Epic software also supports NHS care
Although the testing originated in the United States, Epic software has direct UK relevance because NHS organisations use the same broader product ecosystem. Guy’s and St Thomas’ NHS Foundation Trust describes MyChart as part of its Epic electronic patient record system, while King’s College Hospital NHS Foundation Trust launched Epic jointly with Guy’s and St Thomas’ in 2023.
Other UK hospitals also use Epic systems, but nothing in the current disclosure establishes that an NHS deployment has been compromised or that the configurations identified during Epic’s testing are present within any particular UK organisation.
The concentration of sensitive records in healthcare software makes access control and audit weaknesses particularly consequential because organisations need both to prevent unauthorised access and to reconstruct what happened when suspicious activity occurs.
Epic says healthcare providers remain responsible for the medical records stored within their deployments, while its own mobile applications connect patients to systems operated and maintained by those provider organisations. A defect in commonly deployed software can nevertheless create shared exposure across many independently operated environments.
AI assisted testing changes the pace at which that exposure can be discovered because models capable of examining software for vulnerabilities can increase the volume and speed of defensive research. The same capability also creates pressure to remediate quickly if comparable techniques become available to attackers.
Pausing much of normal product development is unusual for a software company of Epic’s scale, and the decision reflects the amount of engineering work the company believes the findings require. Until Epic discloses more about affected configurations and completed fixes, however, the precise technical scope remains limited to what the company has made public.
