A sign of the same name outside Epic’s headquarters in Verona, Wisconsin.
Source: Yiem (via Wikipedia CC)
Epic Systems, the largest medical records management software company, says a venture-backed startup called Particle Health is using patient data in an unauthorized and unethical manner that has nothing to do with treatment. .
Epic told customers in a notice on Thursday that it had cut off their connection to Particle, impeding the company’s ability to wiretap systems containing more than 300 million patient records. Particle is one of several companies that act as a kind of intermediary between Epic and organizations that need the data, usually hospitals or clinics.
Patient data is inherently sensitive and valuable, and is protected by the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a federal law that requires patient consent or knowledge for third-party access. One way to access Epic’s electronic health record (EHR) is to care qualityThis facilitates the exchange of more than 400,000 documents per month, according to the website. Particle is a member of the Carequality network.
To join the network, organizations must be vetted and agree to adhere to clear “permitted purposes” for the exchange of patient data. Epic will respond to requests for data that fall under the permitted purpose of “Treatment.” This means the recipient is providing care to the person requesting the records.
Epic said in Thursday’s notice that it formally partnered with Carequality on March 21, citing concerns that Particle and its participating organizations “may have misrepresented the objectives related to records searches.” He said he had filed a dispute. The company suspended its connection with Particle on the same day.
“This raises potential security and privacy risks, including possible violations of the HIPAA Privacy Rule,” Epic said in a notice obtained by CNBC.
in blog post Late Friday, Care Quality said it takes disputes “very seriously and is committed to maintaining the integrity of the dispute resolution process and trustful interactions within the framework.” The organization says it cannot comment on the existence of conflicts or the activities of its members.
Representatives for Epic and Particle did not respond to requests for comment. However, Particles blog post On Friday night, the company announced that it had begun “immediately addressing the issue” after Epic “stopped responding to data requests from some customers” on March 21st. Particle said in its post that a major challenge in these matters is “the lack of a standard reference point.” This is to evaluate the definition of treatment. ”
“These definitions are becoming more difficult to draw as health care becomes more complex, with providers, payers, and payers all consolidating into various large health care conglomerates,” Particle wrote. ing.
Epic is a 45-year-old privately held company based in Wisconsin. of Largest EHR vendor According to a May report, the U.S. hospital market share is 36%; KLAS research. oracle That ranks second behind the software company’s $28 billion acquisition of Cerner in 2022, at 25%.
As of July 2022, Particle has raised a total of $39.3 million from investors including Menlo Ventures, Story Ventures, and Pruven Capital. release. The New York-based startup said at the time that its technology “uniquely leverages data from the medical records of more than 270 million patients by aggregating and consolidating medical records from thousands of sources.” “We will combine.”
Epic said Particle introduced thousands of new participant connections to Carequality in October, claiming they fall under the treatment use case. In the months that followed, all of Particle’s participating organizations claimed authorized therapeutic purposes for their requests, Epic said.
“Non-therapeutic use case”
But Epic started noticing some red flags. The company said it observed anomalies in patient record exchange patterns, including requests for large numbers of records within certain geographic areas. Additionally, Epic said the companies associated with the particles have not returned any new data from patients, which “suggests non-therapeutic use cases.”
Epic and the Care Everywhere Governing Council, made up of 15 industry representatives, will evaluate Particle’s new participant connections and join organizations such as Integritort, MDPortals, and Reveleer. Acquired MDPortals Last year, “the treatment may not have been fit for its authorized purpose,” the notice said.
Epic said it has learned that another Carequality member plans to challenge Integritort’s use of patient data to identify potential class action participants. On March 28, Epic discovered that a participant named Noveria claimed to be requesting records of his treatment, even though it had publicly advertised its product as a “personal health tool.” Announced.
Integritort, Reveleer and Novelia did not respond to requests for comment.
Epic said it has filed a formal complaint with Care Quality following the Governing Council’s recommendation. According to the notice, Epic asked Particle on April 4 to provide additional information to explain how participants qualify for the treatment use case.
Michael Marchant, director of interoperability and innovation at UC Davis Health, chairs Epic’s governing council. He said it’s difficult to know exactly why Particle provided records to these organizations or whether it intentionally engaged in fraudulent activity. But he said companies must act responsibly even when pressured to deliver financial results.
“If you’re selling to something that you know isn’t a therapeutic entity to meet venture capital funding or margin or revenue goals, that’s really bad,” Merchant said in an interview with CNBC. Told.
in Statement on LinkedIn On Wednesday, Particle founder Troy Bannister said Epic had acted unilaterally and that Particle had seen no “substantiation, legitimacy, or public arguments” surrounding these issues.
Bannister wrote that to the best of the company’s knowledge, “all affected partners are directly supporting treatment.” He said these organizations pull data for care providers and share data with the Carequality network.
“While we continue to maintain our connection to care quality, the ability of a single practitioner to make the decision to disconnect large-scale healthcare providers without evidence or warning is limited by the ability of a single practitioner to disconnect hundreds of thousands of providers. “Not only does it jeopardize clinical operations for patients, it also jeopardizes trust in the quality of care, which is critical for transactions based on trust,” Bannister wrote.
Bannister did not respond to Epic’s April 4 request for additional information.
Formal dispute proceedings are still ongoing. Merchant, who also co-chairs the Care Quality Advisory Committee, said this is the first time in the network’s history that complaints have reached this level.
clock: Insurance company stocks fall due to Medicare interest rates
