The audit trail had a blind spot

In 2008, staff at UCLA Medical Center kept opening the chart of a famous patient who was being treated there. Thirteen employees were fired and six physicians suspended. Three years later the health system paid $865,500 to the federal government over two celebrity-patient complaints. Nobody confessed. The hospital knew who had looked because every look had been written down.

That is how the medical record polices itself. Not with locks, mostly, because the people who need the chart are many and the moments they need it are urgent. With a log. Anyone with a reason can open the record, and the record remembers who did.

What the log is for

The federal rule is short. HIPAA's audit-controls standard requires a covered entity to "implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information." Record and examine. Everything downstream rests on those two verbs.

The breach rule rests on them too. An improper access is presumed to be a breach, and the notification clock starts on the day the breach "is known" or, with reasonable diligence, "would have been known." The evidence for knowing is the log. An access that never reached it is not known, and with no record to examine, diligence finds nothing either.

And the patient is not in the loop at all. You have a right to an accounting of certain disclosures of your record, but it excludes treatment, payment and operations, which is to say almost everyone inside the building. In 2011 regulators proposed an access report that would have shown patients the name of every user who opened their electronic record, with the date and time. Hospitals filed hundreds of objections, the proposal was pulled back for a rewrite, and it was never finalized. So the log exists, it is required, and it works for the institution. The patient's side of the arrangement is trust that it is complete.

The hole was in the writing down

On September 22 Judy Faulkner, Epic's chief executive, told a Modern Healthcare audience that the company had paused most development, hundreds of projects, for about six more weeks. She said little about why. The reason arrived later, through Epic's chief security officer, Stirling Martin, speaking to the New York Times: testing with Anthropic's Mythos model had found that some customer configurations of MyChart could let outsiders access patient records "without recording any intrusion in the software's logs," as TechCrunchsummarized it.

Epic says more than 325 million patients have a current electronic record in its systems. MyChart is the part patients touch.

No breach has been confirmed. I believe that, and I would like to know what it means. The specific failure was access that did not make it into the record of access, so the usual instrument for confirming a breach is the one the flaw switched off. Other logs may still show something (identity systems, web and network traffic, depending on how each hospital set things up), and security leaders are being told to go and ask. Whether records could have been altered as well as viewed is undetermined; the model's findings did not settle it, and part of the answer reportedly depends on technology that is not Epic's.

None of this is a scandal about Epic. Configurations are set by thousands of customers, the company found the problem by testing for it, and stopping development for six weeks is an expensive thing to do on purpose. Its spokesperson also said the AI roadmap is unchanged, with agents and automated prior authorization still coming. Every one of those agents will read and write the same records, and every one of their actions is supposed to land in the same log.

Who gets to look for the next one

Mythos is not a product you can buy. Anthropic launched Project Glasswing in April with a dozen named partners (cloud providers, chipmakers, banks, security firms) and about forty more organizations it invited because they "build or maintain critical software infrastructure." Its own page names "storing medical records" as an example. Epic confirmed in August it was one of them.

Then, on June 12, a Commerce Department directive told Anthropic to suspend all access to Fable 5 and Mythos 5 by any foreign national, and the company complied by turning them off for everyone. I called it a gate at the time and worried about who ends up outside it. I had not pictured a regional hospital's security team. Two weeks later Commerce allowed access to be restored for "certain trusted partners," without saying how many or by what criteria. In September a federal appeals court upheld the Pentagon's designation of Anthropic itself as a supply-chain risk, for defense contracting, which is a strange thing to read in the same month its model became the reason a medical-records company checked its own logs. Only on October 6 did Anthropic open a tiered program that security teams can apply to.

Anthropic has not said which other electronic health record vendors have had access. Perhaps several. Perhaps none. A regional vendor with a few hundred hospitals, or the hospitals themselves, had no way to be on the list in April or in June, and their records are as full as anyone's.

The arrangement used to be simple, if imperfect. The people who held the records also held the means of checking them: their own staff, their own auditors, commercial tools anyone could license. The best instrument for finding where the log goes blind now sits behind an access decision made by a company and, at one point, by the Commerce Department. If you are on the list, you can find the holes in your own audit trail before someone else does. If you are not, you can read about the ones that were found.

Patients are on no list at all. They could not see who opened their chart before any of this, and they still cannot. What changed is that the record of access they were asked to trust turned out to have an edge, and the tool that can map the edge has a guest list.

The audit trail is the whole of healthcare's answer to the question of who saw you. It inevitably has blind spots, as every system does. The question for the next decade is not whether models will find them. It is whose.

—TJ