A MyChart security issue raises a troubling question for patients: could someone access a medical record without leaving the expected evidence behind? Epic is addressing flaws reportedly uncovered with Anthropic’s Mythos cybersecurity model, including a weakness tied to some customer configurations. No confirmed exploitation has been disclosed. Still, the possibility of medical-record access without normal audit logs changes how patients and healthcare organizations should think about security, detection, and accountability.
MyChart Security Flaw Explained
Epic has paused most product development for an expected period of about six weeks while teams focus on security work. According to the TechCrunch report, that effort followed testing with Anthropic’s Mythos cybersecurity model, which uncovered flaws that could put patient information at risk. Epic has not released the technical details publicly, so important questions remain.
The most unusual part is not simply that MyChart has bugs. Epic Chief Security Officer Stirling Martin reportedly said some customer configurations could allow outsiders to access patient records without the intrusion being recorded in the software’s logs. TechCrunch did not report evidence that attackers have already used the flaws, and the story does not say every MyChart installation is affected. MyChart is used in connection with more than 320 million patient records, so even a configuration-specific weakness deserves attention.
Why MyChart Audit Logs Matter
An audit log is a running record of activity inside a computer system. In healthcare, those records can show which account signed in, when something happened, which records were opened, and what actions were taken. If suspicious activity appears later, investigators can use that trail to work backward. Logs do not stop intruders, but they help show what happened.
The HIPAA Security Rule requires covered organizations and business associates to use mechanisms that record and examine activity in systems containing or using electronic protected health information. HHS spells out these HIPAA audit-control requirements as part of the rule’s technical safeguards. A useful audit trail can help answer questions such as:
- Which patient records were opened, changed, or deleted?
- Which user or account performed the activity?
- When did the access take place?
- Did the activity fit that person’s normal role?
Those answers can narrow an investigation and help identify affected patients.
When MyChart Access Is Not Logged
The reported MyChart weakness stands out because it may affect both access and visibility. If someone can reach patient information without creating the application-level record investigators expect, a key part of the trail may be missing. That does not mean an attacker would automatically become invisible. Identity systems, servers, databases, network equipment, endpoint tools, and other platforms may still record useful clues.
Investigators may have to rebuild the story from several places instead of following one dependable record. NIST’s work on cybersecurity log management stresses the need for organizations to have the log data required for effective security and compliance. If a MyChart log is incomplete, a hospital may need to compare sign-in records, server activity, database events, and network traffic to determine whose information was viewed and when. That takes more effort and leaves more uncertainty.
MyChart Vulnerability vs. Data Breach
A vulnerability and a data breach are not interchangeable terms. A vulnerability is a weakness that could be exploited. A breach involves protected information being accessed, acquired, used, or disclosed in a way that meets the legal definition. A serious flaw does not prove anyone used it.
HHS explains that under the HIPAA Breach Notification Rule, an impermissible use or disclosure of protected health information is generally presumed to be a breach unless the organization can show, after a required risk assessment, that there is a low probability the information was compromised. Nothing in the current MyChart reporting establishes that attackers used these flaws to steal patient records, and there is no reported evidence of a nationwide MyChart compromise.
Patients should pay attention to the issue, but the available information does not justify assuming their records have already been taken.
Why MyChart Security Risk Varies
MyChart can look like one large service from the patient side. Behind the screen, healthcare organizations run their own systems and can use different configurations, integrations, identity tools, access rules, and security controls. Two hospitals can use MyChart while having very different environments.
Epic’s patient mobile privacy policy says MyChart apps for iOS and Android connect to servers and systems operated and maintained by healthcare organizations that use Epic. The same policy says Epic does not receive or store copies of health or fitness data that users transmit to those organizations through the mobile apps. That helps explain why one configuration may be affected while another is not.
Healthcare teams need to determine whether their environment matches the affected conditions, follow Epic’s remediation instructions, test the changes, and make sure access controls and logging still work afterward.
How AI Finds Hidden Security Flaws
Another part of this story reaches well beyond healthcare. Anthropic describes Mythos as a highly capable model family for cybersecurity and biology research, with access to Mythos 5.1 limited to vetted organizations because those capabilities can be useful for both defensive work and misuse.
Security teams have used scanners, fuzzers, scripts, and code-analysis tools for years. AI can make that work faster. A capable model may help researchers examine large amounts of code, test unusual combinations, follow possible attack paths, and spot patterns faster.
That is useful when defenders find the problem first, but it also raises the stakes. Faster discovery may leave vendors less time to investigate, patch, test, and deploy fixes before someone else finds the same weakness.
What Patients and Health Systems Can Do
Patients cannot patch Epic software or change the way a hospital configured MyChart. Those responsibilities belong to Epic and healthcare organizations. Users still have control over several common risks around their own accounts, especially stolen passwords and phishing.
For patients:
- Use a strong, unique MyChart password that is not reused on other accounts.
- Turn on multifactor authentication if your healthcare provider offers it.
- Open MyChart through the official app or your provider’s website.
- Treat urgent messages about test results, prescriptions, bills, or account problems with caution.
- Watch for official notices from your healthcare organization.
Healthcare organizations should review Epic’s communications, identify affected configurations, apply the required fixes or mitigations, test access controls, and verify that important events are still being recorded. They should also avoid relying on a single log source when investigating suspicious activity.
CISA recommends multifactor authentication for businesses and says organizations should aim for phishing-resistant methods when practical. MFA will not repair the reported MyChart flaw, but it can block another common route into sensitive systems when a password has been stolen or reused.
JENI® and Local Device Security
The MyChart issue is a server-side and application security problem. A maintenance tool running on a home or office computer cannot patch Epic’s software or change a healthcare provider’s MyChart configuration. There is no local tool a patient can install to repair this specific problem.
JENI® focuses on local maintenance for Windows and macOS computers. Keeping a device maintained and updated supports broader digital hygiene, but it is only one layer. MyChart users should keep their operating system and browser current, avoid suspicious links, protect the device they use to reach health information, and secure the account itself. The underlying repair still has to come from Epic and affected healthcare organizations.
MyChart Security FAQ
Has MyChart been hacked?
The current reporting does not establish that attackers exploited these newly reported vulnerabilities or stole patient records through them. Epic is responding to security weaknesses that could create unauthorized-access risk in some customer configurations.
Are all MyChart accounts affected?
No public evidence shows that every MyChart system or account is affected. The reported issue involves some customer configurations, so the actual risk may depend on how a healthcare organization set up and connected its systems.
Can patients view MyChart audit logs?
The information available to patients can vary by healthcare organization and system configuration. Anyone concerned about inappropriate access can contact the provider’s privacy or security office and ask what record-access information can be reviewed.
Should I stop using MyChart?
The current reporting does not show that all MyChart use is unsafe or that patients should stop using their accounts. Using the official service with a unique password, multifactor authentication when available, and caution around phishing remains a sensible approach.
Why is AI important to this story?
An advanced AI cybersecurity model reportedly helped uncover the weaknesses, showing how AI can speed up vulnerability research. Faster discovery can help defenders find difficult bugs earlier, but it also puts more pressure on software vendors to investigate, patch, and verify fixes quickly.
What This Means for Healthcare Security
The MyChart story highlights a part of cybersecurity most patients rarely consider. Keeping an intruder out is only half the job. Hospitals and clinics also need dependable evidence showing when sensitive systems were accessed, what happened inside them, and whether security controls worked. When part of that trail is missing, even an experienced security team can face a much harder investigation.
HHS created healthcare-specific Cybersecurity Performance Goals to help organizations prioritize high-impact protections, including vulnerability management, multifactor authentication, email security, and other controls. The MyChart findings show why those pieces need to work together. Strong authentication can make account takeover harder. Vulnerability management can close known weaknesses. Reliable logging can expose suspicious activity. Incident responders can then compare evidence across systems when one record is incomplete.
Patients should not assume this report means their medical records were stolen. No confirmed exploitation of these specific flaws has been disclosed. Protect the account features you control and pay attention to official notices from your healthcare provider.
For hospitals, clinics, and software vendors, the lesson is broader. AI-assisted security research is moving quickly, and weaknesses that once stayed buried for months or years may be found sooner. Systems need to be patched promptly, tested carefully, and monitored well enough that a missing application log does not leave the whole incident in the dark.
Related Articles
Security Logging for Small Teams
Learn how useful security logs and alerts help small teams spot suspicious activity, investigate incidents, preserve evidence, and respond with more confidence.
Why Legacy MFA Can Still Fail
See why older MFA methods can still be defeated by modern phishing attacks and how phishing-resistant authentication can better protect sensitive accounts.
First 60 Minutes After a Data Breach
Learn what businesses should do during the first hour of a breach, from containment and evidence preservation to access control and incident communication.
How AI Is Speeding Up Security Updates
Explore how AI is shrinking the time between vulnerability discovery and patching, and why faster security updates are becoming more important for everyone.
