MyChart / Epic Systems Lawsuits 2026, Pixel Tracking Settlements, Antitrust Claims, and a Data Breach — What Patients Need to Know

Millions of patients who use MyChart — the patient portal operated by Epic Systems and deployed by hospitals across the United States — are at the center of a wave of class action lawsuits and government legal actions that span privacy violations, antitrust monopoly allegations, and improper access to nearly 300,000 medical records. Multiple settlements are already in progress, at least one claim deadline has passed, and several major federal cases are actively moving through the courts. Here is what each case alleges, who is affected, and what patients can do right now.

What Is MyChart and Who Does This Affect?

MyChart is an online patient portal developed by Epic Systems, the largest electronic health records (EHR) company in the United States. It allows patients to view test results, message providers, schedule appointments, and manage their health history. Hospitals and health systems across the country use it, and Epic’s software holds records for more than 325 million patients — representing over 90% of U.S. citizens. If you have ever logged into a hospital website to check lab results or send a message to your doctor, there is a strong chance you used MyChart.

Case 1: Tracking Pixel Privacy Lawsuits (Multiple Settlements — Some Already Closed)

What Happened

Between 2022 and 2024, privacy researchers and legal investigators discovered that some hospitals using MyChart had embedded third-party tracking tools — including Meta Pixel (Facebook’s tracking code) and Google Analytics — into their patient portal pages. These tools, designed for advertising and web analytics, were allegedly transmitting sensitive patient data to Meta, Google, and other outside companies without patients’ knowledge or consent.

The data allegedly transmitted included details tied to patients’ health activity on MyChart — such as information connected to test results, appointment bookings, and medical messaging. Patients never agreed to share this information with advertisers. Many had no idea such tracking was technically possible. The lawsuits argue this violated HIPAA, the federal Electronic Communications Privacy Act (ECPA), and in some states, additional consumer privacy protections.

Critically, the legal dispute over who is responsible is contested. Epic has stated that it does not include tracking tools in MyChart by default and that hospitals added third-party code to their own portal implementations. Some hospitals have countered that tracking tools were embedded in templates or third-party services without their full awareness.

Settlements Reached — Key Details by Health System

Several hospital systems have already reached class action settlements. Below are the most significant:

Inova Health Care Services — $3.15 Million Settlement

• Covers patients who visited an Inova public-facing website between April 29, 2022 and April 29, 2024, and who had an Inova MyChart account whose data may have been shared with Facebook, Google, or related tracking tools
• Preliminary court approval: December 17, 2025
• Claim filing deadline: April 6, 2026 (now closed)
• Final approval hearing: April 16, 2026
• As part of the settlement, Inova agreed to implement remedial measures to bring its website practices into compliance with ECPA and HIPAA
• Contact: HealthPixelSettlement.com | 1-877-757-7915

Catholic Health System (CHS) MyChart Settlement

• Covers patients who logged into CHS MyChart between January 1, 2020 and December 11, 2025
• Cash payout: Up to $20 per valid claim
• Privacy benefit: 12-month Dashlane Premium subscription
• Claim deadline: April 10, 2026 (now closed)
• Final approval hearing: April 23, 2026

BJC HealthCare and Mount Sinai

• Both settlements have closed claim periods; payments may still be in distribution for eligible claimants who filed before deadlines

Who Is Eligible Across These Settlements Eligibility generally requires that you: (1) had an active MyChart account with the specific health system named in each case; (2) visited the health system’s public-facing website during the covered period; and (3) may have had personal or health information transmitted to third parties through tracking tools without consent.

Important Note on Claim Deadlines Several deadlines have passed as of April 2026. If you missed a claim window, you may still be eligible for future payment distributions if you filed on time. If you did not file, check whether any settlements remain open for the specific health system where you receive care.

Case 2: Epic vs. Health Gorilla — Data Breach Affecting 300,000 Patients (Epic Is the Plaintiff Here)

This case is different in a critical way: Epic Systems is not the defendant — it is the one suing.

What Happened

In January 2026, Epic Systems and several co-plaintiff health systems — including OCHIN, Reid Health, Trinity Health, and UMass Memorial Health — filed a federal lawsuit against Health Gorilla, a health data exchange network, and several associated companies. The case is filed in the U.S. District Court for the Central District of California (Case No. 2:26-cv-00321).

The complaint alleges that Health Gorilla allowed outside companies — including telehealth firms and law practices — to pose as legitimate healthcare providers in order to request and obtain patient medical records through national health information exchange networks. These entities allegedly accessed nearly 300,000 patient records under the false pretext of treatment purposes, then mined and sold the data, including to law firms seeking litigation clients.

In mid-March 2026, one defendant — GuardDog Telehealth — admitted to the allegations as part of a consent judgment and acknowledged accessing patient records under false pretenses. GuardDog was responsible for approximately 6,000 of the records in question. Epic has stated the case will continue against the remaining defendants.

What This Means for Patients

Law firm Wolf Popper LLP has separately announced it is investigating potential claims on behalf of patients whose MyChart records may have been improperly accessed through this scheme. If you believe your records may have been involved, consider consulting with a privacy attorney. There is no claim form or settlement to file at this time — the investigation is ongoing.

Case 3: Antitrust and Disability Access Lawsuits — Epic Accused of Monopolistic Practices

These cases are not about data breaches or pixel tracking. They are about whether Epic has used its dominant market position to control patient access to their own medical records.

Case 3A: Federal Class Action — American Association of Disability Justice v. Epic Systems

Filed: March 9, 2026 | Court: U.S. District Court, Western District of Texas

A disability advocacy organization — the American Association of Disability Justice — along with two individual plaintiffs, filed a proposed class action against Epic. The lawsuit accuses the company of using its market dominance to fragment patient health data across multiple, disconnected MyChart portals and of making it effectively impossible for disabled individuals to compile the comprehensive medical records they need to support Social Security disability benefit claims.

The individual plaintiffs tell a stark human story. One plaintiff died while his disability appeal was pending after his claim was denied twice for insufficient medical documentation. After his death, his father could not access his records across multiple MyChart accounts. Another plaintiff, John Hodges, spent more than two years assembling records from multiple providers after suffering several heart attacks while applying for disability benefits — during which time he experienced homelessness and lost custody of his daughter.

The complaint also alleges that Epic interfered with the advocacy organization’s efforts to build a third-party platform that would aggregate records across providers using federal interoperability standards. Claims alleged include violations of federal antitrust law, the Americans with Disabilities Act, and the information-blocking provisions of the 21st Century Cures Act. Plaintiffs are seeking class certification, financial damages, and court orders requiring Epic to remove barriers that prevent third-party platforms from retrieving electronic health information.

Epic has not yet issued a formal public statement specific to this lawsuit, but has broadly denied antitrust allegations in related matters, stating its systems facilitate more than 725 million health record exchanges each month.

Case 3B: Texas Attorney General v. Epic Systems

Filed: December 10, 2025 | Court: Tarrant County District Court, Texas

Texas Attorney General Ken Paxton filed a state antitrust lawsuit against Epic, bringing claims under the Texas Free Enterprise and Antitrust Act and the Texas Deceptive Trade Practices Act. The complaint accuses Epic of inserting itself as the “gatekeeper” of patient data, locking hospitals into its EHR systems and then dictating who can access that data.

A distinctive feature of this suit is its focus on parental access. The lawsuit alleges Epic’s MyChart default settings automatically limit a parent’s proxy access to their child’s health records when the child turns 12 — hiding medication lists, treatment notes, and provider messages from parents without explicit notice. Paxton argues this denies parents rights guaranteed under Texas law. One clinic, Austin Diagnostic Clinic, had already settled with the state and was required to restore parental proxy access for children aged 12 to 17.

Epic called the action “flawed and misguided,” stating it reflects a failure to understand the company’s business model and pointing to its interoperability statistics.

Case 3C: Particle Health and CureIS Healthcare Antitrust Suits

In the Southern District of New York, competing health data company Particle Health has filed a federal antitrust lawsuit against Epic, alleging anti-competitive practices in the health data market. In September 2025, a federal judge allowed the Particle Health suit to proceed — a significant signal that courts are willing to scrutinize Epic’s market conduct. CureIS Healthcare has filed a similar complaint.

Quick Reference: All Active Cases

Case	Type	Court	Status
Pixel Tracking — Inova Health	Class Action Settlement	Federal	Final approval hearing April 16, 2026
Pixel Tracking — Catholic Health System	Class Action Settlement	Federal	Final approval hearing April 23, 2026
Pixel Tracking — BJC / Mount Sinai	Class Action Settlement	Federal	Claim periods closed
Epic v. Health Gorilla	Data breach lawsuit (Epic as plaintiff)	C.D. California	Active; one defendant consented
Disability Justice v. Epic	Class Action / Antitrust	W.D. Texas	Newly filed; class cert pending
Texas AG v. Epic	State Antitrust	Tarrant County, TX	Active
Particle Health v. Epic	Antitrust	S.D. New York	Allowed to proceed (Sept. 2025)

Epic’s Overarching Defense

Across all of these cases, Epic has maintained consistent defenses. On pixel tracking, it argues hospitals — not Epic — added third-party code to their portal implementations. On antitrust and interoperability claims, the company points to its scale of data sharing: over 725 million record exchanges per month, participation with nearly 1,000 patient-facing apps, and nearly 15 years of integration with the Social Security Administration. On the Texas parental access claims, it called the action “flawed and misguided.” On the disability access lawsuit, it has not yet formally responded.

One additional development worth noting: Epic has recently updated MyChart’s terms of service to include binding arbitration language and a class-action waiver. Patients who click through future terms-of-service agreements may be signing away their right to participate in class action lawsuits against Epic directly — making the current wave of litigation even more significant for establishing legal precedent before those waivers take broad effect.

What Patients Should Do Right Now

If you had a MyChart account with Inova, CHS, BJC, or Mount Sinai: Check whether you received a settlement notice in the mail or by email. If you filed a claim before the deadline, watch for payment distribution after final court approval. If you missed the deadline, you likely cannot participate in the current settlement round.

If you believe your records were accessed without authorization: Contact Wolf Popper LLP or a privacy attorney. The Health Gorilla case investigation is ongoing, and additional patients may have claims not yet accounted for in current filings.

If you are a disabled person who struggled to access records across providers: The disability class action filed March 9 in Texas may be relevant to your situation. Consult a civil rights or disability rights attorney to understand whether you have standing to join or benefit from that litigation.

General caution: Read any updated MyChart terms of service carefully before clicking “agree.” The new arbitration and class-action waiver language — if accepted — may limit your legal options if future privacy issues arise.

FAQs

Is there one MyChart class action lawsuit I can join? 

No — there are multiple separate lawsuits and settlements involving different hospitals that use MyChart. Eligibility depends on which health system you used, during which dates, and what type of harm you experienced. There is no single, centralized MyChart class action open for claims as of April 2026.

How much could I receive from a settlement?

 Payouts in the pixel tracking settlements have been modest — up to $20 in the CHS settlement, with pro-rated amounts in the Inova settlement depending on the number of valid claims filed. In healthcare privacy class actions generally, per-person payouts typically range from $50 to a few hundred dollars, depending on fund size and participation rates.

Does joining a class action affect my right to sue separately? 

Generally, yes. Class action members who do not opt out typically give up their right to pursue individual claims arising from the same facts. If you believe your damages are unusually large, consult an attorney before joining any settlement class.

Has Epic done anything wrong? 

No court has yet ruled that Epic itself violated any law. In the pixel tracking cases, settlements have been reached with hospitals — not directly with Epic. The antitrust and disability cases are at early stages. All allegations remain unproven unless and until a court determines otherwise.

What is the MyChart arbitration clause and should I be worried? 

Epic recently introduced a binding arbitration clause and class-action waiver into its MyChart terms of service. Legal experts have raised concerns that this could prevent future patients from participating in class actions if they click through the new terms without opting out. Read these terms carefully before accepting.

What is the Health Gorilla case, and am I affected? 

This is a case where Epic is suing a data network that allegedly allowed unauthorized access to nearly 300,000 patient records by companies posing as healthcare providers. If your records were accessed, you may have a claim. Wolf Popper LLP is investigating. No claim form exists yet — contact a privacy attorney if you believe you may be affected.

Last Updated: April 18, 2026

This article is for informational purposes only and does not constitute legal advice. Allegations described in this article are drawn from court filings and public reporting. Settlements are subject to final court approval. All parties are presumed innocent unless and until proven otherwise in a court of law. Deadlines noted were accurate as of the publication date — verify current status with settlement administrators or legal counsel.