A lawsuit filed by electronic health record giant Epic could encourage reforms to a problematic system, where non-health companies can access patient records without their knowledge.