Epic pauses product development to fix security flaws found by AI

Epic, the company behind the widely used MyChart software for accessing patient medical data, has halted most of its product development to address security vulnerabilities. The pause, expected to last about six weeks, is a response to flaws discovered by Anthropic's AI model, Mythos, which could potentially allow unauthorized access to sensitive patient information.

Epic's Chief Security Officer Stirling Martin indicated that certain customer configurations of MyChart might permit external parties to access patient records without leaving any trace in the software's logs. While it remains unclear if these vulnerabilities could be exploited to alter records undetected, Epic considers the risk significant enough to warrant immediate remediation.

The MyChart software is utilized by hospitals and doctor's offices across the United States, safeguarding the records of over 320 million individuals. The company emphasizes that it does not directly access customer medical data; this responsibility lies with the healthcare providers. However, undiscovered bugs could potentially compromise multiple MyChart systems and lead to data breaches.

The decision to pause development highlights growing concerns about the use of AI tools in identifying and exploiting security weaknesses. Healthcare data breaches are on the rise, with attackers targeting sensitive health information, assuming providers will pay ransoms to prevent data publication. Recent large-scale breaches, such as the one affecting Change Healthcare, underscore the increasing threat landscape in the healthcare sector.