Marshall Gramm will not face a HISA hearing in September as was initially widely reported. The two disciplinary cases against him have been taken off the September calendar and are unlikely to be heard before November — and when they are, they will be heard together.
Agreed orders signed September 11 by Joseph De Francis, chair of the HISA Board Panel, and Dr. Susan Stover, chair of the Racetrack Safety Committee, postpone and consolidate both matters because the cases involve common questions of fact and legal argument, and because one hearing avoids duplicating evidence and testimony.
The orders state that counsel for both sides “have conferred and are available for a hearing on Monday, November 9, 2026 and Tuesday, November 10, 2026,” and that alternative dates can be proposed if those don’t suit the Committee or the Panel. The next significant news on the matter is likely to come in November.
Gramm agrees to remain provisionally suspended under the terms he accepted on August 23, and the suspension runs until at least the end of this process.
HISA CEO Lisa Lazarus described the trade this way in an interview last week: “We scheduled the case quickly because we felt it was really important that it be addressed quickly. Understandably, Marshall’s legal team wanted more time. So the way that we bridge that gap is Marshall agreed to take a voluntary suspension during the pendency of his case and we agreed to postpone the hearing to November.”
The orders are signed for HISA by enforcement counsel Rebecca Price, and for Gramm by Michael de Leeuw and Sarah Krissoff of Cozen O’Connor in New York.
That pairing is worth noting. De Leeuw is vice-chair of the firm’s national business litigation group, leads its appellate practice and has been counsel of record in multiple US Supreme Court cases. Krissoff spent thirteen years as an assistant US attorney in the Southern District of New York, working complex financial fraud, money laundering, racketeering and cyber crime, with particular experience in the public corruption and asset forfeiture units. She now defends clients against federal criminal matters brought by the Department of Justice and against enforcement actions by federal agencies, the Federal Trade Commission among them.
HISA referred this matter to the FBI last month and in light of that, Gramm has hired accordingly.
Who can see the data
There have been a lot of questions asked about the availability of horse health data. I asked Lazarus a set of questions about access to horse health records, because the question of who else can see this information has been the loudest unanswered thing in this story since the charges were filed.
She explained that beyond a horse’s own connections, roughly a dozen people at HISA can view full treatment records. A three-person veterinary team. The four-person HISA field support team, which trainers and owners contact to make changes, since many of HISA’s users aren’t comfortable doing it themselves. Some members of the IT team, from time to time, when they’re working on the system. And, she believes, herself and a few senior colleagues, though she said she has never looked and isn’t sure she’d know how.
“Twelve, maximum fifteen,” was her total count, excluding attending veterinarians.
It also excludes the help desk itself. HISA’s 24/7 line is answered by seven representatives from Ansafone, an outside call-centre contractor. Asked whether they can see treatment records, HISA said they can. “Ansafone representatives, as members of the help desk, do have access to view treatment records,” a spokesperson said, adding that they “do not have any connection to racing outside of their capacity as trained customer service representatives.”
The veterinarian exclusion is the bigger one. Almost every covered horse has a private veterinarian treating it, and that vet can see the horse’s records once approved by the owner or trainer. HISA says there are approximately 1,400 registered veterinarians in the Portal — regulatory, attending and private practice. Each of them is, in principle, scoped to their own horses.
On board members, she was categorical. “There’s not a single board member that has access to the system, nor would even have. None of our board members are even registered.” The reason is statutory: people on the HISA board or staff cannot own horses or be involved in racing in any way.
Stakeholder groups like the Horsemen’s Advisory Group, she said, have no formal power and no access beyond their own horses.
Standing committees are a different category. HISA has confirmed to me in writing that a member of its Anti-Doping and Medication Control Committee played a part in the Gramm case. “HISA’s internal investigation was led by HISA employees and HIWU investigators, with the assistance of an ADMC Committee member who — acting in their capacity as an industry participant — provided industry-specific information and expertise that aided the investigative process,” a HISA spokesperson said.
Gramm told me on the record that the committee member was David Ingordo, a racehorse owner and bloodstock agent who sits on the ADMC Committee, which makes recommendations to the board on anti-doping rules. HISA confirmed it. “Yes, David Ingordo was the ADMC Committee member who was involved in the initial interview with Marshall Gramm,” a spokesperson said. “He was acting in the capacity of assistance of Committee members as necessary when they can provide industry-specific information and expertise that aid the investigative process.”
I had asked Lazarus about Ingordo in our interview, before HISA’s written confirmation. “He’s there specifically to be a voice of the horsemen,” she said, “but that doesn’t give him any access to information.” Her answer concerned access to records. I hadn’t asked her about the investigation, and she didn’t raise it.
Nor is a committee member’s involvement how HISA described the investigation when it announced the charges. Its August 17 release referred to interviews conducted by HISA employees and contractors. A standing committee member is neither. HISA had not said at the time of writing whether any policy governs committee members taking part in investigations of covered persons. Ingordo did not respond to a request for comment.
On portal access, Lazarus’s answers address the version of the question that has been loudest — insiders at the Authority quietly reading records — and they are checkable against the statute and against the org chart.
Her answers stop at HISA’s own door. The attending veterinarian population sits outside her count entirely, governed by the same permission architecture that failed in Gramm’s case. And InCompass Track Manager, run by The Jockey Club, is a separate system that HISA does not administer and that Lazarus cannot speak to.
So I asked The Jockey Club. Track Manager, it says, is where all state veterinarians’ lists are created and stored, and it receives HISA’s vet’s list data, which is used to determine eligibility for entry. It “does not database any horse health records when it comes to treatments.” But it does carry “limited reports available showing horse treatment information provided via real-time data integrations from HISA and EquiTAPS systems.” Those reports go to regulatory veterinarians to assist with pre-race exams, and access to them is “limited to a small user group and is user specific.”
Access to vet’s list information in Track Manager was tightened after the leak. It is “now controlled at the user level,” across three tiers: no vet’s list information at all, on and off dates only, or everything including comments and notes. Access is granted by track management, with InCompass updating the user profile.
Asked who could see full vet’s list information before that change, The Jockey Club said it “has always been the responsibility of track management to decide who is granted access to specific parts of the system in order to perform their job duties.” Access, in other words, was set track by track, and the three-tier structure gave tracks a finer instrument than they had before.
The alarm that didn’t go off
HISA’s more useful answers came on monitoring, and they differ a little from what the Authority said in August.
At the press conference announcing the charges, Lazarus said Gramm had instructed his automated browser to download in batches of 500 to stay below the threshold that would trigger a security alert. She conceded at the time that Gramm had not admitted that intent and that HISA had assumed it from the evidence.
This week she explained what the threshold actually was, and why it failed.
“We had alerts in place for a large volume of records, like over 500,” she said. But Ten Strike Racing had 76 horses, and Gramm was an active owner making legitimate record requests constantly. “Five hundred transactions a day is, it sounds like a lot, but it’s actually for highly engaged covered persons, it’s actually a very normal number for us.”
One thing seems clear from what we know about Gramm’s activities: if there were limits in place, they were never triggered. When I mentioned the issue was millions of records in total rather than any single day’s activity, she agreed. “We didn’t set the parameters right.”
That is a plausible explanation. The alarm existed, by her account, but was configured in a way that couldn’t distinguish a busy owner from a script running over a matter of weeks.
She also said that logging was in place throughout, and that it is how Gramm was eventually identified — her chief technology officer, Steve Keech, went back and reviewed the data differently, and could see every horse, every login and every request. HISA’s system holds roughly 100,000 horses and 90,000 registered people. “It’s a lot of data,” she said, “which is why we weren’t as successful as I wish we had been in our first review, because we just weren’t looking in the right place.”
On why the permissions were as loose as they were, she gave an answer worth quoting at length, because it explains more about this industry than it does about this case.
“Everything that you do, security wise, that makes the system tighter, makes it a little bit less user friendly. Marshall Gramm is not our typical user. The majority of our stakeholders are not very technically savvy. A lot of them don’t even have [smart] phones or computers. They literally do all their transactions through our help desk.”
While not specifically relevant to the Gramm case, Lazarus brought up an example of how un-tech savvy many in racing are. Two-factor authentication, she said, is “a complete disaster” with this population. “It’s not an excuse, but it’s more of an explanation for why it wasn’t Fort Knox and it should have been. It was Fort Knox to the outside world. But within our user group, we were not locked down enough in terms of permissions.”
I understand this point directionally, but it’s important to note that the security that would have prevented Gramm from accessing the records would have been completely invisible to the user. However unsophisticated the typical user, restricting access to records is not something that makes the software less user friendly.
What happens next
HISA is required to conduct an IT audit annually under its obligations to the Federal Trade Commission. That audit normally happens toward the end of the year. Lazarus said it is being moved up, and that HISA will use one of the Big Three firms rather than balancing capability against cost as it has previously.
“Given the seriousness of what happened and given the public concern, which is completely valid, we’re going to be using one of the big three to ultimately do this audit.”
On the question of who leaked news of the charges to media before HISA announced them, she said the matter has been handed to law enforcement. “They have far better tools. We’re not the government, we’re not the police, we can’t subpoena records.” If that investigation doesn’t conclude in a way HISA considers comprehensive, she said, the Authority will take it up again.
As for the hearing itself: the standard is clear and convincing evidence. There is no broad discovery and no depositions under HISA’s rules, though Lazarus said “there’s nothing that we have that we wouldn’t be willing to turn over in connection with the case.” The three-member Board Panel is appointed by the chair of the HISA board. If Gramm is unhappy with the outcome, he can appeal to the FTC and from there to federal court.
Disclosure: Marshall Gramm is a friend and his Ten Strike Racing was the first commercial sponsor In the Money Media ever had. The Jockey Club is a client of In the Money Media.
