Epic pauses most development for about six weeks over MyChart flaws an AI model found

A hospital that pulls its MyChart audit trail this week would see the same thing whether an outsider had read records or not ^[5]. Log review shows what a hospital's logs capture. By Martin's account, outside access through some configurations would not be in them ^[5].

Every detail so far comes from one report, TechCrunch's, as summarized by SC World ^[9]. Martin tied the problem to some configurations, so exposure will vary from one Epic customer to the next ^[5]. Epic has not disclosed the exact nature of the bugs ^[4]. The account describes potential weaknesses that could allow unauthorized access to patient records ^[3].

I'd expect the useful work before details arrive to be an inventory. It would cover which MyChart options a hospital has turned on, and which records of portal access it keeps outside MyChart itself. A hospital with that list can match its setup against the affected configurations quickly if Epic names them.

I think the clearest signal of how Epic rates the read-access risk is what it agreed to spend: most of its product development, for about six weeks ^[1][2]. Epic made that call while the question of undetected alteration was still open ^[7][6].

SC World places the pause beside breaches at Change Healthcare, CareCloud and McKesson that affected millions of people ^[8]. It also frames the episode as part of AI's dual role in finding and exploiting security flaws ^[11]. This report documents only the finding side. A model surfaced the weaknesses, and the vendor stopped work to fix them ^[3][1].