"Epic Systems, a titan in electronic health records, has temporarily suspended the majority of its technology development, a strategic move aimed at fortifying its systems against escalating cyber threats. While the company assures that its long-term roadmap remains intact, this significant pause in innovation raises critical questions about potential impacts on healthcare providers and patient access to vital services."
The healthcare technology landscape is in a constant state of evolution, driven by advancements in artificial intelligence, interoperability, and the ever-present need for robust cybersecurity. Epic Systems, a dominant force in this arena with its widely adopted MyChart patient portal and comprehensive electronic health record (EHR) solutions, recently announced a significant, albeit temporary, shift in its development priorities. Founder and CEO Judy Faulkner disclosed at Modern Healthcare’s Leadership Summit that the company is pausing "most" of its technology development to dedicate resources to enhancing system security. This directive impacts hundreds of ongoing projects and is projected to last for approximately six weeks.
This announcement, however, was met with a nuanced follow-up statement from an Epic spokesperson, suggesting a slightly different emphasis. The spokesperson stated that the company’s development roadmap has not changed since it was presented at the August 2026 Users Group Meeting. This apparent discrepancy highlights the delicate balance healthcare technology companies must strike between driving innovation and ensuring the unwavering security of sensitive patient data. While neither Faulkner nor Epic has confirmed a specific breach or attack, the proactive nature of this security overhaul underscores the growing threat of cyberattacks in the healthcare sector, where EHR systems are critical infrastructure for numerous hospitals and clinics nationwide. Any disruption or delay in system updates, no matter how temporary, can have a cascading effect on the daily operations of healthcare professionals and the continuity of care for millions of patients.
The divergence in messaging between Epic’s founder and its spokesperson underscores the complexities of managing public perception and internal strategy during critical operational adjustments. Faulkner’s assertion of a broad pause affecting "hundreds of projects" suggests a significant reallocation of resources and a potential slowdown in the delivery of new features. Conversely, the spokesperson’s emphasis on an unchanged roadmap implies that core strategic initiatives, particularly those related to artificial intelligence and interoperability, are continuing, albeit perhaps at a modified pace or with a reduced scope for other projects. This suggests that the security reinforcement may involve shifting personnel and prioritizing critical updates, rather than a complete cessation of all development activities.
According to reporting from Modern Healthcare, Faulkner indicated that product development would proceed at a reduced pace during this security-focused period, with some areas potentially still seeing ongoing work. Epic’s spokesperson, in a statement to Fierce Healthcare, elaborated that progress continues on key initiatives, including expanded AI features, the company’s Agent Factory platform, its EpicOps business software, and crucial interoperability efforts designed to expedite prior authorization processes. This suggests that while a comprehensive pause on "most" development may have been announced, strategic areas deemed vital to the company’s future and the industry’s needs are still being addressed.
The possibility that both accounts can coexist lies in the nature of project prioritization. It is conceivable that Epic is channeling its development talent into critical security patches and essential updates, while simultaneously slowing down or temporarily shelving less urgent projects. The crucial unknown factor for hospitals and patients is the specific nature of the projects that have been paused, the number of staff members reassigned to security tasks, and whether these decisions will translate into tangible delays for features that healthcare providers were anticipating.
It is important to note that Epic’s heightened focus on cybersecurity predates this recent announcement. The company had already revealed at its August meeting that it was leveraging advanced AI models to scrutinize its own code for potential vulnerabilities, a proactive measure against evolving cyber threats. The spokesperson confirmed this, stating, "We’re participating in Project Glasswing and using AI tools to stay ahead of cybersecurity threats that are growing across all industries." Project Glasswing, an initiative spearheaded by AI company Anthropic, involves partner organizations utilizing an unreleased AI model to identify software flaws and bolster defenses. Anthropic’s expansion of this project to include organizations from various sectors, including healthcare, underscores the widespread recognition of the need for pre-emptive security measures. This type of work, aimed at identifying and rectifying weaknesses before malicious actors can exploit them, is inherently preventive and does not necessarily indicate a response to a known incident.
The implications of cybersecurity disruptions within hospital systems are far-reaching and have direct consequences for patient care. When a healthcare provider’s records system becomes inaccessible due to a cyberattack, the repercussions can be severe. Clinicians may be forced to revert to paper-based charting, a process that is not only inefficient but also increases the risk of errors. Ambulances may need to be diverted from emergency rooms, potentially delaying critical care for patients in need. Furthermore, patients may face significant challenges in refilling essential prescriptions or accessing crucial test results. The 2024 ransomware attack on Ascension serves as a stark reminder of these vulnerabilities; the incident disrupted operations at several of its hospitals, leading to ambulance diversions and a prolonged reliance on paper records for weeks.
The prevalence of such breaches is a concerning reality. The U.S. Department of Health and Human Services maintains a public database of health data breaches affecting 500 or more individuals, and a significant proportion of these reports are attributed to hacking and IT incidents. Smaller and rural hospitals often face a particular disadvantage due to limited IT staffing and resources, which can prolong recovery times in the event of an attack. For any healthcare organization, the need to implement urgent security updates often presents a difficult trade-off, requiring planned downtime that can temporarily affect patient portal access, appointment scheduling, and internal messaging systems.
While the majority of patients will likely not experience any direct changes in their day-to-day interactions with their healthcare providers, adopting certain habits can be beneficial during periods of intensified security updates. It is advisable for patients to remain vigilant for any notices from their hospital or clinic regarding scheduled portal maintenance. Maintaining an up-to-date personal record of medications, allergies, and upcoming appointments, kept separately from the portal, can provide a crucial fallback. Furthermore, if a health system offers it, enabling two-step verification for MyChart accounts adds an essential layer of security.
Patients should exercise extreme caution regarding unsolicited emails or text messages that appear to relate to Epic security updates and prompt them to click on links or enter login credentials. Healthcare providers manage patient accounts directly, and it is always safer to log in through the organization’s official website or dedicated mobile application rather than through a link provided in a message. In instances of urgent medical need during a portal outage, patients are strongly advised to proceed to an emergency department or call 911 rather than waiting for portal services to be restored.
Individuals managing complex medical conditions, such as those undergoing cancer treatment, dialysis, or experiencing high-risk pregnancies, should proactively confirm alternative methods for contacting their care teams by phone in the event of temporary portal unavailability. Similarly, caregivers who manage a parent’s or child’s MyChart account through proxy access should establish clear communication protocols with their healthcare providers.
Several key questions surrounding Epic’s cybersecurity initiative remain unanswered. The company has not yet released a comprehensive list of the specific projects that have been paused, and no hospital system has publicly reported any new delays directly attributable to this security focus. If Faulkner’s six-week projection holds true, the intensive security work is expected to conclude around early November. MedicalDaily will continue to monitor developments and report on any subsequent announcements from health systems regarding delays, new security updates, or changes to promised technological advancements.
Key Questions Answered
Did Epic suffer a cyberattack?
No cyberattack or data breach has been reported. The company’s CEO, Judy Faulkner, described the pause as a preventive measure to ensure the robustness of Epic’s systems against potential vulnerabilities.
How long is the security work expected to last?
According to Modern Healthcare’s reporting on Faulkner’s remarks on September 22, the security reinforcement efforts are anticipated to take approximately six more weeks to complete.
Is Epic delaying the release of new products?
Faulkner indicated that the majority of technology development has been paused and will proceed at a slower pace. However, an Epic spokesperson stated that the company’s development roadmap remains unchanged since its August user meeting.
Will MyChart cease to function?
There is no indication that MyChart will be taken offline. However, some hospitals might schedule brief periods of maintenance to implement security updates, necessitating that patients monitor their provider’s communications.
What steps can patients take to protect their accounts?
Patients should utilize strong, unique passwords, enable two-step verification if available, and ensure they only access their accounts through their health system’s official website or mobile application.
Why is cybersecurity in healthcare significant for patients?
Cyberattacks on healthcare facilities have, in the past, resulted in the diversion of ambulances, the necessity of transitioning to paper-based record-keeping, and delays in obtaining prescriptions and critical test results.
