UPMC Data Breach 2026 (Health Gorilla HIE Scandal): 687 Patients Exposed Through Abused TEFCA Pipeline. What To Do

What happened

This is not a classic data breach. UPMC is part of the Epic / Health Gorilla Health Information Exchange (HIE) scandal — the same systemic incident that affected Trinity Health and other Epic-community health systems in early 2026.

The University of Pittsburgh Medical Center (UPMC) is a major integrated health system based in Pittsburgh, PA, running on the Epic EHR.

On January 13, 2026, Epic Systems notified UPMC that its network monitoring had flagged unauthorized HIE access against UPMC’s records. Health Gorilla, a QHIN / interoperability platform on the TEFCA / Carequality network, and “certain network participants” had submitted electronic record requests under the pretext of providing treatment to shared patients — but the records were actually being routed to law firms for mass-tort and litigation-driver purposes. Sham or fraudulent NPIs were used to construct the appearance of legitimate treatment relationships.

Parallel reporting on Michigan Medicine references approximately 300,000 records pulled across Epic-community health systems via this scheme.

UPMC publicly announced the breach on March 13, 2026, sent patient notification letters, and filed with HHS OCR on March 14, 2026 — confirming 687 affected UPMC patients. On March 17, 2026, Pittsburgh-based Lynch Carpenter LLP announced a class action investigation.

UPMC characterizes the incident as abuse of the TEFCA / national exchange trust framework — records left UPMC’s Epic instance via an authorized HIE channel that downstream actors abused, not a hack of UPMC’s systems.

Why HHS OCR classifies this as “Unauthorized Access/Disclosure at Other”

The “Other” location code captures the HIE-as-business-associate categorization. Records moved through an authorized federated-exchange pipe with the wrong identity claim at the other end. The systemic implication: TEFCA and Carequality identity-verification governance has a gap that downstream actors can exploit at scale.

What was stolen

Per UPMC’s notice:

• Full name, date of birth, age
• Clinical notes, visit reasons, diagnoses
• Medical history, orders, test results

Explicitly NOT in scope: Social Security number. UPMC’s notice frames the exposure as clinical-only — no insurance info or driver’s licenses mentioned (a notable difference from Trinity Health’s same-incident filing, which included DL).

What UPMC is offering

• Written notice to affected individuals
• Toll-free line: 1-855-460-8762 (Monday to Friday, 9 a.m. to 5 p.m. Eastern)

No credit monitoring or Cyberscout / identity protection program is mentioned in UPMC’s notice. This contrasts with Trinity Health’s same-incident filing (24 months of Cyberscout). The absence is likely because no SSN or financial data was exposed in UPMC’s case — but if your name is on the leaked clinical records, the exposure is still consequential for mass-tort marketing and unwanted attorney contact.

What to do

1. Watch your insurance Explanation of Benefits for unfamiliar claims (low risk here given the clinical-only exposure).
2. Be alert to mass-tort marketing solicitations — if you receive unsolicited contact from law firms or medical companies referencing your specific UPMC treatment history, that is potentially evidence of misuse from this leak.
3. Document any solicitation that names a specific UPMC visit, diagnosis, or treatment detail — these documents may be valuable in the pending Epic v. Health Gorilla litigation and any future class action.
4. Call UPMC at 1-855-460-8762 if you have questions or want to verify whether your records were among those flagged.
5. Stop the ongoing flow of your records through health information exchanges. HealthConsent files HIPAA restriction requests including across TEFCA / Carequality / eHealth Exchange pathways — these federated networks are difficult to opt out of through standard provider workflows.

Continue reading

• Your eight HIPAA rights, in plain English
• Trinity Health Data Breach 2026 (Health Gorilla HIE — sister incident)
• Other 2026 healthcare data breaches