Epic pauses most product development for about six weeks to fix MyChart security flaws: what hospitals and clinics should ask

Epic pauses most product development for about six weeks to fix MyChart security flaws: what hospitals and clinics should ask

2 October 2026 — Epic Systems, the largest supplier of electronic health record software in the United States, has paused most of its product development for about six weeks to fix security flaws, TechCrunch reported on 2 October 2026, citing interviews Epic's leaders gave to The New York Times and Modern Healthcare.

Not yet independently verified. This rests on TechCrunch’s report of what Epic’s chief executive and chief security officer told The New York Times and Modern Healthcare; we have not read those interviews or any statement on Epic’s own site, and Epic has not said which configurations are affected. We will update this when it can be confirmed, and remove this note.

What was reported

• The pause: "most of its product development", for about six weeks, as Epic's chief executive Judy Faulkner told Modern Healthcare.
• The flaws: Epic's chief security officer, Stirling Martin, told The New York Times that some customer configurations of MyChart, Epic's patient portal, could "allow outsiders to access patient records without recording any intrusion in the software's logs". He did not confirm whether records could also be changed without detection.
• How they were found: TechCrunch says an AI security model found the flaws while it was being deployed at Epic.
• Scale: TechCrunch puts the number of patient records in MyChart at more than 320 million across US hospitals and doctors' offices.

Why it matters

A flaw that leaves no trace in the logs is the worst kind for a healthcare organisation: it removes the evidence needed to decide whether a breach happened and whom to notify under HIPAA and state breach laws. A six-week development pause also means features and fixes customers were expecting will slip.

What to ask Epic, and what to do

• Which MyChart configurations are affected, whether yours is one of them, and when the fix for your version will ship.
• Interim mitigations: settings to change or features to switch off until the fix arrives.
• Logging: whether other sources, such as web-server, identity-provider and network logs, can show access the application logs missed, and keep those logs longer than usual for now.
• Your roadmap: which planned releases and integrations move because of the pause, so upgrade and go-live plans can be adjusted.
• Third parties: if a partner or consultancy hosts or configures your Epic environment, ask what they are checking.

Sources

• TechCrunch (Zack Whittaker): Medical records giant Epic pauses product development to fix security bugs that risk patients’ data — 2 October 2026