Medical records giant Epic pauses product development to fix security bugs that risk patients’ data

What happened

Epic, the developer of the widely used MyChart system, has paused most of its product development to address critical security vulnerabilities. The company used an AI cybersecurity model called Mythos to identify security flaws that could allow unauthorized access to patient data. Some customer configurations of MyChart could allow outsiders to access patient records without detection. The company is working to fix these issues, and the pause is expected to last six weeks.

Why it matters

The security vulnerabilities in MyChart could allow hackers to access and potentially alter patient records, which is a significant risk for healthcare providers and patients. The use of AI tools to find and exploit vulnerabilities highlights the growing threat to data security in the healthcare sector. Addressing these issues is crucial for maintaining trust in digital health systems.

• Epic is prioritizing security over product development to address critical vulnerabilities in its MyChart system.
• AI tools like Mythos are being used to identify and exploit security flaws, raising concerns about data breaches.
• The potential for unauthorized access to patient records underscores the importance of robust cybersecurity measures in healthcare.
• Recent data breaches highlight the increasing risk of cyberattacks on healthcare and tech companies.
• The use of AI in cybersecurity is a double-edged sword, offering both opportunities for improved security and new threats.

The bigger picture

The pause in product development and the focus on security fixes could delay new features and updates for Epic's customers. However, it is necessary to prevent potential data breaches and protect patient information. The incident also highlights the growing role of AI in identifying and exploiting security vulnerabilities, which has significant implications for cybersecurity in the healthcare industry.

Epic's decision to pause product development to address security vulnerabilities in its MyChart system reflects the growing importance of cybersecurity in the healthcare sector. The use of AI tools to identify and exploit vulnerabilities highlights the need for continuous security improvements to protect sensitive patient data.

Technical details

• Mythos, an AI cybersecurity model developed by Anthropic, was used to identify security flaws in Epic's systems.
• The AI model identified bugs that could allow unauthorized access to patient records without logging any intrusion.
• The company's chief security officer, Stirling Martin, confirmed the risks associated with these vulnerabilities.

FAQ