jili tutorial

Churchill Downs, Horsemen Pen Letters to FTC Calling for Independent Review of HISA

By jili tutorial · September 4, 2026

Churchill Downs, Horsemen Pen Letters to FTC Calling for Independent Review of HISA

Background: Marshall Gramm Suspension Sparks Data Security Concerns

In the wake of Marshall Gramm accepting a provisional suspension from the Horseracing Integrity and Safety Authority (HISA), two major industry stakeholders have asked the Federal Trade Commission (FTC) to conduct an independent review of the regulatory body. The letters question whether HISA can adequately safeguard confidential data on its online portal.

“Recent events have highlighted troubling gaps and warning signs in HISA’s governance,” Churchill Downs Inc. CEO Bill Carstanjen wrote to FTC Chairman Andrew Ferguson and Commissioner Mark Meador last Friday.

Gramm, a horse owner and handicapper, admitted to accessing health information from HISA’s database on horses he did not own over a six-week period earlier this year. He then used that data to buy horses entered in claiming races and participated in several handicapping contests. After HISA made the charges public on August 17, Gramm returned his contest earnings. In a preliminary agreement signed last week, he also agreed to return any purse money he won as an owner, as well as the horses he claimed. Gramm must divest all other racehorses he owns before they can compete or work out officially.

Horsemen’s Group Questions Data Security

Three days before Churchill’s letter, the National Horsemen’s Benevolent and Protective Association (NHBPA), along with the North America Association of Racetrack Veterinarians (NAARV) and the U.S. Trotting Association (USTA), contacted Ferguson requesting a separate inquiry into HISA’s data security.

The NHBPA represents over 30,000 owners and trainers across the country, many of whom have horses listed in the HISA portal. The letter, signed by NHBPA CEO Eric Hamelback and leaders from NAARV and USTA, called for the FTC to require independent audits of HISA’s cybersecurity and financial records before approving the authority’s next budget.

According to the NHBPA letter, HISA spent $10.7 million on its IT systems in 2025—a 75% increase from the $6.1 million allocated in 2023. The horsemen and veterinarians argue that this allocation should be sufficient to secure the portal properly.

The portal gives approved veterinarians access to update a horse’s health records, and approved state regulators may also receive access. Horse owners must register, but their access is limited to their own horses.

The issue surfaced in mid-June when customized past performance charts containing restricted information appeared on social media. HISA CEO Lisa Lazarus initially denied that the data came from the authority’s database. In an August 17 statement, Gramm said he inadvertently accessed data for all horses through his own HISA portal account and regretted not coming forward earlier.

HISA claims Gramm used an automated process to retrieve records in tranches over six weeks, pulling a volume of data similar to what approved veterinarians would access. The horsemen’s letter posed a pointed question: “How could an individual using his own log-in credentials repeatedly obtain a huge data set of confidential veterinary information that was outside the scope of his legitimate access, automate the process, and allegedly continue doing so for approximately six weeks without the HISA system detecting and stopping the activity?”

Churchill and NHBPA Have Sued HISA Previously

The NHBPA was among the organizations that opposed HISA’s creation. The Horseracing Integrity and Safety Act, passed by Congress nearly six years ago, established HISA as a private entity under FTC oversight to nationalize the sport’s rules. Horsemen from several states sued in federal court, claiming the authority was unconstitutional. HISA won a decision from the U.S. Fifth Circuit Court of Appeals in 2022, but the Sixth Circuit later upheld the law. The case reached the U.S. Supreme Court, which sent it back for reconsideration. In June, the Fifth Circuit once again sided with the NHBPA.

Churchill Downs initially supported the legislation. However, in February, HISA charged that the Louisville-based gaming company—which owns tracks in Kentucky, Louisiana, Pennsylvania, and Virginia—failed to pay its 2025 fees. The two sides disagreed on the assessment: HISA claimed Churchill owed more than $6 million, while Churchill argued its bill should be less than $2.5 million. The authority threatened to block Churchill’s tracks from being simulcast nationwide, potentially preventing bettors from wagering on the Kentucky Derby. Churchill sued HISA in federal court, but the two sides settled the matter in March.

‘Fair Hill Five’ Issue Raised

Carstanjen also raised concerns about the “Fair Hill Five,” a group of horses connected to trainer Angel Quiroz that worked out at the Fair Hill Training Center in Maryland. The horses ran last month at Monmouth Park in New Jersey and Saratoga Race Course in New York, each racing for the first time in several months. Despite that, at least a dozen London bookmakers reported taking significant wagers on those horses—bets that did not affect parimutuel odds. Four of the five horses won, with the fifth unable to overcome a poor start. The London shops’ losses totaled hundreds of thousands of dollars.

On Monday, HISA announced it had suspended Quiroz after three of his horses tested positive for a banned substance, including Tepeyac (winner at Monmouth) and Scootaloo (out of the money at Saratoga). HISA’s public report indicated that Bonita Rough, another Quiroz horse, failed its drug test in July, and the trainer received notice before his other horses raced. Carstanjen wanted to know why the first failed test was not disclosed sooner.

“One of HISA’s central promises was more uniform, timely, and transparent handling of integrity-related matters,” the letter stated. “Delayed disclosure of significant violations was precisely the type of problem HISA was created to address.”

HISA Welcomes Inquiries

A HISA spokesperson told Gambling Insider that the authority appreciates Churchill Downs and the horsemen for speaking out about the sport’s integrity. “HISA has been in communication with the FTC about the issues raised in the letters and welcomes the FTC’s ongoing oversight and review of our actions, policies, protocols, and systems,” the spokesperson said in an email.

In 2023, when HISA established its anti-doping and medication control program, the authority sought to issue provisional suspensions and public notices immediately upon confirmation of a positive test, with the charged individual given the right to seek a hearing to lift the suspension. The purpose was to prevent trainers accused of drug violations from entering other horses that may have been administered a banned substance. However, the authority faced pushback from the racing community, leading to delays in public disclosure.

Calls for Independent Audit and Answers

Both the horsemen and Churchill Downs are demanding an independent review to determine how the data breach occurred and whether anyone else accessed data inappropriately.

“HISA rightly expects the racing industry to learn from failures and address systemic problems before they happen again,” the NHBPA letter stated. “When a horse gets injured, the sport does not simply move on. There is a review of the racing surface, veterinary records, training history, and other available information to determine what happened and whether a systemic problem contributed to the incident. That rigor is intended to identify the underlying cause and prevent the next incident. The same principle should apply here, and HISA should be held to the same standard.”

Carstanjen said the questions raised by the industry cannot be addressed by “a public-relations campaign” about the Gramm case. He emphasized that HISA has a responsibility to tracks, horsemen, and bettors to keep sensitive data out of the hands of those who could use it for personal gain.

“The industry is entitled to understand whether this was an isolated event, a broader systems failure, or a symptom of more significant weaknesses in HISA’s technology and oversight processes,” the Churchill executive wrote.

Additionally, owner Mike Repole has called for a third-party review of HISA and the entire integrity system.