2026 University of Michigan Health-West — illicit record pulls via nationwide health-information exchange (Epic notifies ~119 Chart patients)
Data compromised
Demographics, diagnoses, meds, allergy data, insurer metadata; no confirmed SSN exfiltration per UM Health-West public statement
Technical writeup
University of Michigan Health‑West traced improbable Health Information Exchange (HIE) pull patterns after January 2026 alerts routed through Epic Systems. Between March 12 and March 25 2026, internal adjudication flagged third-party solicitor identities misrepresenting care relationships and surfacing parallels to Epic’s litigation naming Health Gorilla and affiliates for façade-provider abuse. Unauthorized chart exposure window published to patients ranged October 18 2023 through November 12 2025 with fields spanning demographics (name, addresses, MRNs), clinical artefacts (labs, diagnoses, meds) and payer metadata—explicitly excluding Social Security numbers according to UM Health-West’s bulletin. Personalized letters began May 1 2026 for approximately 119 affected individuals/registrants with hotline amplification.
Root cause
Fraudulent or otherwise impermissible HIE-mediated release of PHI following misrepresented third-party clinician identities (per UM Health-West and Epic-aligned dispute narrative)