Epic's stance: Sharing patient portals with third-party apps (even if it's shared by the patient themselves) could lead to misuse of patient info, and these apps should be subject to the same HIPAA standards as Epic and other patient portals. The opposing argument: Epic is only pushing for this so that they can "hold patient data hostage.".