One of the most widely deployed record platforms in American medicine has stopped building new features. Epic Systems has paused most of its technology work and pointed engineers at a security overhaul.
Founder and CEO Judy Faulkner put the number at hundreds of stalled projects during an appearance at Modern Healthcare’s Leadership Summit, and said the security push should run about six more weeks. She offered no evidence of an intrusion, describing the effort as preventive.
A day later the company disputed the framing. Epic told Fierce Healthcare that its product roadmap, shown to customers at an August users meeting, stands unchanged, and that new AI features, its Agent Factory product, the EpicOps business line, and prior-authorization tools all remain on schedule.
The mixed messages matter to hospital IT teams. Epic software holds the clinical record for a large share of US patients, so any slowdown in updates, or a sudden burst of security fixes, lands on the daily schedules of clinicians and patients. Health systems that plan upgrades and training around Epic’s release calendar now face a shakier timeline.
For security leaders, the disclosure is a signal about where the software giant sees risk. Ransomware crews have spent two years hammering hospitals through vendors, help desks, and identity providers, and EHR platforms sit at the center of that blast radius. A vendor pausing feature work to audit its own code and encryption is a rare public acknowledgment that the record system itself is a front line.
