Epic AI Patient Risk Scoring: How Your EHR Data Predicts Your Care

Epic Systems, the dominant electronic health record platform in the United States, has deployed AI-powered patient risk scoring models that influence clinical decisions, resource allocation, and care pathways for hundreds of millions of patients. These models analyze demographic data, diagnostic history, medication records, lab values, and social determinants of health to generate risk scores that guide clinical workflows. The risk scores produced by Epic AI modules directly influence which patients receive proactive outreach, how quickly appointment requests are triaged, which preventive screenings are recommended, and how care management resources are allocated. Higher-risk patients theoretically receive more intensive monitoring, but the accuracy and equity of the underlying models have faced scrutiny. Research has demonstrated that healthcare AI risk models can perpetuate existing disparities. Models trained on historical healthcare data may learn patterns that reflect systemic inequities in healthcare access and quality rather than genuine medical risk. If a demographic group historically received less healthcare, the model may predict lower risk for that group, perpetuating the under-service pattern. Epic has implemented bias monitoring tools, but the fundamental challenge of training equitable models on inequitable historical data remains unresolved. Patients generally have no visibility into whether AI risk scoring influences their care, what factors contribute to their score, or how to contest a score they believe is inaccurate. The opacity of these systems stands in contrast to the transparency requirements that apply to consumer financial scoring under laws like the Fair Credit Reporting Act.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.