SelfRx Claims It Doesn’t Know Who Took 100,000 Records in EHR Lawsuit

Electronic health record (EHR) giant Epic Systems has moved to dismiss its legal claims against SelfRx, a chronic condition management firm, marking a significant shift in a high-profile lawsuit concerning the alleged misuse of sensitive patient medical records. The litigation, which centers on allegations that patient data was accessed for non-treatment purposes, has drawn widespread attention to the security and interoperability protocols governing national health data exchange networks.

The legal action, initially filed in the U.S. District Court for the Central District of California on January 13, 2026, involved a coalition of health care providers and Epic Systems. The plaintiffs accused several entities—including SelfRx, RavillaMed, and LlamaLab—of exploiting data exchange frameworks to improperly access and monetize records belonging to patients within the Epic ecosystem. According to the complaint filed in the U.S. District Court, the defendants allegedly posed as medical providers to bypass standard safeguards intended to protect the sanctity of the patient-provider relationship.

Clarifying the Scope of Data Access

The dismissal of claims against SelfRx follows testimony from the company’s founder, Martin Hensel. In written court filings submitted on June 3, 2026, Hensel denied the allegations that his firm had requested hundreds of thousands of records for financial gain. Instead, he stated that SelfRx’s actual requests were limited to a significantly smaller subset of data. According to court documents reported by Healthcare Dive, Hensel testified that SelfRx requested records for only 21 patients, ultimately receiving data for 15 individuals—a total of fewer than 100 health records.

Hensel further clarified that SelfRx, which reportedly ceased operations in 2025, utilized an intermediary data broker known as Unit 387 to facilitate these requests through the Carequality interoperability framework. In his testimony, Hensel stated, “I do not know who took those over 100,000 patient records,” explicitly distancing his firm from the broader allegations of large-scale data harvesting that Epic had initially leveled against the defendants.

Broader Implications for Health Information Exchange

The lawsuit underscores the ongoing tension between the necessity of seamless health information exchange and the imperative to secure patient privacy. Epic’s initial allegations suggested that the defendants engaged in a scheme to sell patient data to law firms for the purpose of initiating class-action lawsuits, a practice that, if proven, would represent a severe breach of the trust inherent in digital health networks. Rob Klootwyk, director of interoperability at Epic, emphasized at the time of the filing that the litigation was pursued to safeguard the “deeply personal information” shared between patients and their physicians.

In response to the broader litigation, Health Gorilla—a designated Qualified Health Information Network also named in the suit—has consistently maintained its innocence. The company issued a statement asserting that it “vehemently denied” the allegations, framing the lawsuit as an attempt by Epic to engage in “exclusionary actions” that limit market competition. This defense highlights the complex landscape of health IT policy, where established vendors and newer entrants often clash over the standards and governance of data accessibility.

Key Developments in the Litigation

As the legal process continues, the dismissal of claims against SelfRx represents a notable narrowing of the case. While Epic continues to pursue allegations against other entities involved in the network, the focus remains on whether the current interoperability frameworks contain systemic vulnerabilities that can be exploited by third parties. The following points summarize the current status of the proceedings:

• Initial Filing: The lawsuit was initiated on January 13, 2026, in the U.S. District Court for the Central District of California, targeting multiple firms including SelfRx, RavillaMed, and LlamaLab.
• Specific Allegations: Plaintiffs alleged that nearly 300,000 patient records were accessed for non-treatment purposes, with Epic specifically accusing SelfRx of taking over 100,000 of those records.
• SelfRx Testimony: Founder Martin Hensel provided written testimony on June 3, 2026, stating that his firm requested records for only 21 patients and obtained fewer than 100 records in total.
• Case Status: Epic has moved to drop legal claims against SelfRx following the presentation of these records, while the litigation against other named defendants remains active.

For those interested in the integrity of health data and the future of digital medical records, this case serves as a critical indicator of how judicial systems and industry leaders are defining the boundaries of authorized data usage. As the legal proceedings move toward their next phase, observers will be watching to see how the court evaluates the responsibilities of data brokers and the adequacy of existing security measures within the Carequality framework.

We will continue to monitor the court docket for further updates as this litigation progresses. If you have insights or perspectives on the evolving standards of health data interoperability, we encourage you to share your thoughts in the comments section below.