Epic Pauses Software Development for Six Weeks to Fix Security Flaws Affecting 320 Million Patient Records
Anthropic’s Mythos AI uncovered Epic vulnerabilities that could let outsiders access MyChart records without triggering intrusion logs. CEO Judy Faulkner ordered a roughly six-week development pause to secure software used across more than 320 million patient records.
Epic, the health technology company behind the widely used MyChart patient records system, has halted most of its product development to address security vulnerabilities that could expose patient data to unauthorized access.
Founder and CEO Judy Faulkner told Modern Healthcare last month that the pause would last approximately six weeks while the company works on “safeguarding” its products. The decision follows the deployment of Anthropic’s cybersecurity AI model Mythos, which uncovered security flaws in Epic’s software. The pause was reported in October 2026.
Epic’s chief security officer Stirling Martin told The New York Times that certain customer configurations of MyChart could allow outsiders to access patient records without triggering any log of the intrusion. Martin added that the AI model did not confirm whether the bug could be used to alter patient records without detection, but said the risk was sufficient to warrant remediation. Epic has not publicly disclosed the specific nature of the bugs.
MyChart is used to maintain more than 320 million patient records across hospitals and doctor’s offices in the United States. Epic says it does not directly hold customers’ medical data — that responsibility lies with healthcare providers — but an undetected vulnerability could potentially allow hackers to compromise multiple affected systems simultaneously.
It is rare for a company to pause development specifically to address security bugs. The move comes amid a broader wave of healthcare data breaches in the United States. A 2024 ransomware attack on Change Healthcare resulted in the theft of health data belonging to more than 192 million people. In 2026, separate breaches at CareCloud, McKesson, and Craneware have affected tens of millions more Americans. The Department of Health and Human Services currently lists a breach at dental insurer DentaQuest, affecting 15 million people, as the largest healthcare data breach of 2026 to date.