Data breach investigation
University Hospitals & Epic Systems Data Breach Investigation
University Hospitals in Ohio · Epic Systems · UH MyChart
Hall Attorneys is investigating the October 2026 digital shutdown at University Hospitals in Ohio and potential claims involving University Hospitals and Epic Systems Corporation, the developer of MyChart. We are reviewing patient privacy, access to digital services, and any related harm. A data breach and Epic’s responsibility have not been established.
What happened at University Hospitals?
Cleveland 19 reported on October 23, 2026 that University Hospitals detected unusual activity on October 22 and disconnected its systems from the internet as a precaution. The hospital said patient care had not been affected and digital disruptions could continue for several days while it investigated.
Becker’s Hospital Review reported that affected services included UH MyChart and the health system’s public website. These reports concern University Hospitals, the Cleveland-based Ohio health system.
As of this page’s review, the available reporting does not establish whether patient information was accessed or stolen, how many people may be affected, or the cause of the activity. An outage alone does not establish a data breach, ransomware attack, or exposure of a particular person’s records.
How are Epic Systems and MyChart involved?
University Hospitals’ own materials describe its transition to Epic electronic health records and its use of the MyChart patient app. The UH MyChart signup page identifies MyChart as licensed from Epic Systems Corporation.
Our investigation includes the roles of University Hospitals and Epic in protecting information and maintaining access to patient services. We are examining what systems were involved, who operated them, and whether any failures contributed to documented harm.
The use of Epic software does not establish that Epic’s own systems were breached, that an Epic vulnerability caused the shutdown, or that other hospitals using MyChart were affected. Responsibility remains under investigation.
What are we investigating?
We are seeking information about the scope and duration of the disruption, any unauthorized access, notices to patients or employees, and the organizations responsible for the affected services.
We are also reviewing whether medical records, patient identifiers, contact details, insurance or billing information, account credentials, or employee information were involved. These are categories under investigation, not confirmed categories of exposed information.
Individual experiences matter. We want to understand any documented difficulty accessing records or communicating with providers, as well as related expenses, suspected misuse, or other consequences. Neither an outage nor a relationship with University Hospitals automatically establishes a legal claim or entitlement to compensation.
Who should contact Hall Attorneys?
We would like to hear from current or former University Hospitals patients, parents or authorized patient representatives, and employees who:
- Had difficulty accessing UH MyChart, records, appointment information, test results, or provider messages during the October 2026 disruption.
- Received a security notice or other communication concerning their information or access to services.
- Encountered suspicious messages or account activity using nonpublic information, or incurred potentially related expenses or losses.
You do not need a breach notice to request a review. Using MyChart at another hospital does not establish a connection to this incident. Suspicious activity alone does not establish that University Hospitals or Epic caused it.
What should you preserve?
Keep dated screenshots of error messages, security notices, emails, appointment communications, and updates from University Hospitals. Note when access stopped and resumed, which services were unavailable, and any steps you took to contact your provider.
Preserve receipts, account alerts, suspicious messages, and a record of related time or expenses. Keep existing records in your possession; a brief description is enough for an initial inquiry.
Do not send medical records, diagnoses, test results, Social Security numbers, insurance identifiers, passwords, or full financial-account details in an initial email or website submission. Do not search for, download, or share allegedly stolen patient records.
Contact Hall Attorneys
Provide your name, preferred contact information, your relationship to University Hospitals, and a brief description of your concern. Include the approximate dates and whether you received a security notice. Let us know whether it is safe to leave a voicemail.
If additional records are needed, we will discuss an appropriate way to provide them. For questions about current appointments, treatment, or test results, contact your healthcare provider directly.
Nicholas Hall
Email: nhall@hallattorneys.com
Request a Case ReviewAttorney Advertising. Responsible attorney: Nicholas Hall, Hall Attorneys, P.C., Edna, Texas. Hall Attorneys is not affiliated with University Hospitals or Epic Systems Corporation. This page describes an investigation, not a filed lawsuit by Hall Attorneys concerning this incident. A data breach, individual exposure, and liability have not been established. It provides general information, not legal advice. Contacting the firm or submitting information does not create an attorney-client relationship. No outcome is guaranteed.