IN RE: HEALTH GORILLA (2026)

TRANSFER ORDER

Common defendant Health Gorilla, Inc., moves under 28 U.S.C. § 1407 to centralize this litigation in the Southern District of Florida. The litigation consists of nine actions pending in three districts, as listed on Schedule A.¹ The Panel has been notified of a related action pending in the Central District of California.² Plaintiffs in the Southern District of Florida Hughes and Lott actions oppose centralization but, if the Panel grants the motion, request the Southern District of Florida as the transferee district. Defendant Epic Systems Corporation in two Central District of California actions does not oppose centralization in the Southern District of Florida.

On the basis of the papers filed and the hearing session held, we find that the actions listed on Schedule A involve common questions of fact and that centralization in the Southern District of Florida will serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation. This litigation arises from the alleged exploitation of the Carequality and Trusted Exchange Framework and Common Agreement (TEFCA) national interoperability frameworks, which were established to allow the electronic exchange of medical records among healthcare providers and others.³ Access to the frameworks is governed by contractual agreements that bind both the “implementers”—the companies that connect or “onboard” entities seeking access to the frameworks—and the entities or customers that they onboard. In January 2026, Epic Systems, an implementer, and several of its healthcare provider and health technology customers filed an action in the Central District of California ⁴ alleging that Health Gorilla, a competing implementer, had improperly connected entities to the frameworks with knowledge or despite clear signs that they sought patients’ records for impermissible purposes, and that Health Gorilla customers had sold the records to others. Plaintiffs in the Epic action bring claims for fraud, aiding and abetting fraud, breach of contract, and violation of the federal Computer Fraud and Abuse Act and California consumer protection law. They allege that Health Gorilla's misconduct has threatened the viability of the interoperability frameworks and that they have incurred costs in keeping copies of improperly transferred records and investigating improper transfers.

The actions before us followed shortly after the filing of the Epic action and involve substantially similar allegations regarding Health Gorilla's conduct. All cases now before us are putative nationwide class actions on behalf of patients whose records allegedly were fraudulently requested and obtained by Health Gorilla customers through the frameworks. Plaintiffs allege that they have suffered or are at risk of identity theft and have experienced inconvenience and expense addressing the consequences of the misuse of their private information. They assert claims for negligence and breach of implied contract; some also assert claims for breach of the covenant of good faith and fair dealing, unjust enrichment, or invasion of privacy.

Common questions of fact will include whether and when Health Gorilla had knowledge that its customers intended to use the frameworks to acquire records for impermissible purposes, whether its customers did so and, if so, to whom the records were transmitted and how they were misused. Claims against additional defendants Epic Systems and healthcare providers whose records were requested ⁵ will involve related questions of fact as to whether such defendants took adequate measures to safeguard patient records against such improper requests and how they responded upon learning that records had been acquired for misuse. Centralization will prevent overlapping discovery and prevent inconsistent rulings on pretrial motions, particularly with respect to standing and class certification.

Plaintiffs in the Southern District of Florida Hughes and Lott actions oppose centralization. They maintain that the actions do not share sufficient questions of fact to warrant centralization, noting that the actions name various different defendants that played different roles with respect to the transfer of patient records. They contend that plaintiffs do not assert a single data breach, but rather a series of separate breaches at different times due to the conduct and inadequate security measures of multiple different parties, including Health Gorilla, Health Gorilla customers, Epic, and various healthcare providers. Thus, they argue, plaintiffs variously contend that Health Gorilla inadequately vetted and improperly onboarded customers, that Epic's record-exchange network is deficient in its design and operation, that the healthcare provider defendants failed to adequately safeguard patient records, and that Health Gorilla and—at least in some cases—healthcare provider defendants permitted third parties to obtain plaintiffs’ private information for sale to others. The Hughes and Lott plaintiffs contend that liability for these distinct categories of defendants will turn on different evidence, such as what each defendant knew about access risks, how each implemented safeguards, what data each maintained or transferred, and how each responded to the alleged unauthorized access.⁶

The Hughes and Lott plaintiffs compare this litigation to that which we declined to centralize in In re Accellion, Inc., Customer Data Security Breach Litigation, 543 F. Supp. 3d 1372 (J.P.M.L. 2021). According to them, the actions involve even fewer common questions of fact than those in Accellion because they do not relate to the breach of a single file-transfer system and involve different categories of defendants and different alleged misconduct.⁷ They further argue that previous orders centralizing complex, multi-defendant data breach litigation do not support centralization here. They maintain that the Health Gorilla actions do not involve a central actor that directs or controls a uniform course of conduct across multiple related actors, such that the core liability issues are common. Rather, they contend, Health Gorilla is not alleged to be the central decision-maker controlling all data disclosure in these cases and each of the types of defendants—Health Gorilla, its customer Mammoth Path Solution, LLC, the healthcare providers, and Epic—bears separate responsibility for its own data governance and disclosure policies and actions.

We do not find these arguments persuasive. While it may be true that these actions do not involve a single data breach incident, Health Gorilla's conduct is a central issue in all the actions. Opposing plaintiffs’ reliance on Accellion is misplaced. The denial of transfer in Accellion was largely based on “the preference of most parties to informally coordinate,” 543 F. Supp. 3d at 1373-74; and their largely successful efforts in doing so—neither of which is present here. The Health Gorilla actions seem more comparable to those centralized in In re MOVEit Customer Data Security Breach Litigation, 699 F. Supp. 3d 1402 (J.P.M.L. 2023). There, the “[p]laintiffs opposing transfer argue[d] that, instead of a singular breach, there ha[d] been numerous successive intrusions into different servers, which weighs against centralization because multiple entities responded differently to the alleged intrusions and at least one entity to which plaintiffs had given their [personally identifiable information] prevented the intrusion from occurring.” Id. at 1405. We nonetheless concluded that transfer was warranted because “the MOVEit vulnerability [was] at the core of all cases.” Id. As we explained:

Even if the MOVEit vulnerability led to successive breaches, Progress, direct users of MOVEit software, and customer-facing companies ․ are alleged to be responsible for the compromise of plaintiffs’ PII and are named in varying combinations among the overlapping putative class actions. Disentangling the allegations against Progress (and, in many cases, direct users of MOVEit software ․) from the allegations against other defendants in the same case seems impracticable, if not impossible.

Id. at 1405. The same will be true here, where Health Gorilla's conduct led to all the alleged breaches, and various parties with varying roles in the transfer of the subject data are “named in varying combinations among the overlapping putative class actions.”

Although the Epic Systems v. Health Gorilla action was not included on the motion to transfer and no party has identified it as a potential tag-along action, we intend to include it in this MDL through the conditional transfer order process. The Epic action led to the filing of all actions on the motion and includes substantially the same allegations regarding Health Gorilla's improper onboarding of customers and those customers’ improper use of data acquired through the interoperability frameworks. That Epic involves different causes of action and alleged injuries does not warrant its exclusion from coordinated pretrial proceedings given this common factual core.⁸

The Southern District of Florida is an appropriate transferee district for this MDL. All parties either support or do not oppose centralization in that district. Health Gorilla, the central actor in these cases, has its principal place of business in Coral Gables, within the Southern District of Florida. The largest number of actions were filed in the Southern District of Florida, where all have been consolidated before Judge K. Michael Moore. Judge Moore has appointed interim class counsel, and plaintiffs have filed an amended consolidated class action complaint. We assign the litigation to Judge Moore, who is an experienced and capable transferee judge. We are confident that he will manage the litigation in a prudent and efficient manner.

IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the Southern District of Florida are transferred to the Southern District of Florida and, with the consent of that court, assigned to the Honorable K. Michael Moore for coordinated or consolidated pretrial proceedings.

PANEL ON MULTIDISTRICT LITIGATION

Matthew F. Kennelly Acting Chair

David C. Norton

Madeline Cox Arleo

Richard Seeborg

Dale A. Kimball

M. Casey Rodgers

SCHEDULE A

Central District of California

PATTERSON v. UVA HEALTH, ET AL., C.A. No. 2:26−01938 FOX, ET AL. v. EPIC SYSTEMS CORPORATION, ET AL., C.A. No. 2:26−04678

Southern District of Florida

LOTT v. HEALTH GORILLA, INC., C.A. No. 1:26−21639 HUGHES v. HEALTH GORILLA, INC., C.A. No. 1:26−21952 DELIS v. HEALTH GORILLA, INC., ET AL., C.A. No. 1:26−22178 HAWKINS, ET AL. v. HEALTH GORILLA, INC., ET AL., C.A. No. 1:26−22328 MALENKOVICH v. HEALTH GORILLA, INC., C.A. No. 1:26−22757

Eastern District of Michigan

JACKSON v. TRINITY HEALTH CORPORATION, ET AL., C.A. No. 4:26−10948 PABON v. TRINITY HEALTH CORPORATION, ET AL., C.A. No. 4:26−10989

FOOTNOTES

FOOTNOTE.  

1.   The Western District of Michigan Banh action listed on the motion was dismissed on June 15, 2026.

2.   This and any other related actions are potential tag-along actions. See Panel Rules 1.1(i), 7.1, and 7.2.

3.   The Carequality framework was created by private entities. The TEFCA framework was created by Congress through the 21st Century Cures Act and is federally operated.

4.   Epic Systems Corp., et al. v. Health Gorilla, Inc., et al., C.D. California, No. 26-00321.

5.   Healthcare provider defendants named in various actions include Trinity Health Corporation, Reid Hospital & Health Care Services, Inc., and The Rector and Visitors of the University of Virginia (named as UVA Health).

6.   Plaintiff in the Lott action also opposes centralization on the ground that plaintiffs in the two Eastern District of Michigan actions reportedly intend to move for Section 1404 transfer to the Southern District of Florida. No such motions have been filed and those actions are currently stayed pending a ruling on plaintiffs’ motion to consolidate the actions.

7.   Opposing plaintiffs also contend that some of the involved actions fail to name Health Gorilla as a defendant. This is incorrect—Health Gorilla is a defendant in all actions on the motion.

8.   The parties will have an opportunity to object to transfer of the action after the conditional transfer order is issued. See Panel Rule 7.1.

Before the Panel:∗ FN∗ Judge Karen K. Caldwell did not participate in the decision of this matter. In addition, one or more Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.