Churchill Downs, Horsemen Pen Letters to FTC Calling for Independent Review of HISA

In the days after Marshall Gramm accepted a suspension from the Horseracing Integrity and Safety Authority, two major entities in the sport that have had issues with the regulatory body sent letters to the federal agency overseeing it asking for an independent review of HISA, including whether it’s able to maintain confidential data on its online portal.

“Recent events have highlighted troubling gaps and warning signs in HISA’s governance,” Churchill Downs Inc. CEO Bill Carstanjen wrote to Andrew Ferguson, the chairman of the Federal Trade Commission, and Mark Meador, an FTC commissioner, last Friday.

Churchill Downs’ letter came four days after Gramm accepted a provisional suspension on charges he accessed health information from the authority’s database on horses he did not own over a six-week period earlier this year and then used the data to make buy horses entered in claiming races. He also participated in several handicapping contests during that period.

Gramm returned his contest earnings after HISA made the charges public on Aug. 17, and he said last week after signing the preliminary agreement that he would return any purse money he won as an owner as well as any horses he claimed. Gramm must also divest all other racehorses he owns before they would be able to enter a race or run an official workout.

Three days before Churchill sent its letter, National Horsemen’s Benevolent and Protective Association, along with the North America Association of Racetrack Veterinarians and harness racing’s U.S. Trotting Association, contacted Ferguson seeking its own inquiry into HISA’s data security.

Horsemen Question Data Security

The NHBPA serves more than 30,000 owners and trainers across the country, and many of its members have horses in the HISA portal. That letter, signed by NHBPA CEO Eric Hamelback and leaders from NAARV and the USTA, called for the FTC to require HISA’s cybersecurity and financial records to undergo independent audits before approving the authority’s next budget.

HISA, which operates off fees it assesses to tracks, spent $10.7 million on its IT systems in 2025, according to the NHBPA letter. That represents a 75% increase from the $6.1 million allocated in 2023. The horsemen and veterinarians said that allocation should allow the authority to secure the portal properly.

The authority gives portal access to approved veterinarians to update a horse’s health records, and approved state regulators may also receive access. Horse owners also must register. Their access limits them to only their horses.

The issue came to light in mid-June after customized past performance charts featuring the restricted information appeared on social media platforms. HISA CEO Lisa Lazarus denied, at first, that the data came from the authority’s database.

Gramm said in an Aug. 17 statement regarding his charges that he inadvertently accessed the data for all the horses through his own HISA portal account and regretted not coming forward. HISA claims Gramm used an automated process to retrieve the records in tranches over a six-week period, with the amount of data pulled similar to what approved veterinarians would make.

“How could an individual using his own log-in credentials repeatedly obtain a huge data set of confidential veterinary information that was outside the scope of his legitimate access, automate the process, and allegedly continue doing so for approximately six weeks without the HISA system detecting and stopping the activity?” the horsemen’s letter asked.

Churchill, NHBPA Sued Authority

The NHBPA was one of the organizations that opposed the creation of HISA. The Horseracing Integrity and Safety Act, passed by Congress nearly six years ago, established the authority as a private entity under the auspices of the FTC to nationalize the sport’s rules.

Horsemen from several states sued in federal court, claiming the authority was unconstitutional. It won a decision from the U.S. Fifth Circuit Court of Appeals in 2022. The Sixth Circuit Court of Appeals, however, upheld the law establishing HISA. The case went to the U.S. Supreme Court, but the justices returned the cases for reconsideration. In June, the Fifth Circuit once again sided with the NHBPA.

Churchill Downs, meanwhile, came out in support of the legislation. However, HISA charged in February that the Louisville-based gaming company that owns thoroughbred tracks in Kentucky, Louisiana, Pennsylvania, and Virginia failed to pay its 2025 fees as the two sides disagreed on the assessment. HISA claimed Churchill Downs owed more than $6 million in fees for certain tracks, and Churchill argued its bill should be less than $2.5 million. The authority threatened to prevent Churchill’s tracks from being simulcasted across the country, a move that could have kept bettors from wagering on the Kentucky Derby.

In response, Churchill Downs took HISA to federal court, but the two sides settled the matter in March.

‘Fair Hill Five’ Issue Raised

Carstanjen also raised concerns about another recent controversy in the sport, the “Fair Hill Five.” That name refers to a group of horses connected to trainer Angel Quiroz that worked out at the Fair Hill Training Center, situated in the northeast corner of Maryland halfway between Baltimore and Philadelphia.

The horses ran last month at Monmouth Park in New Jersey and Saratoga Race Course in New York, with each racing for the first time in several months. Despite that, at least a dozen bookmakers in London reported taking significant wagers on those horses, bets that did not affect the parimutuel odds. Four of the five horses won their races, with the other unable to overcome a poor start. The London shops’ losses totaled in the hundreds of thousands of dollars.

On Monday, HISA announced it suspended Quiroz after three of the horses he trained tested positive for a banned substance, including Tepeyac, who won at Monmouth Park, and Scootaloo, who finished out of the money at Saratoga. HISA’s public report indicated Bonita Rough, another of Quiroz’s horses, failed its drug test in July, with the trainer receiving the notice before his other horses raced. Carstanjen wanted to know why the first failed test did not become public knowledge sooner.

“One of HISA’s central promises was more uniform, timely, and transparent handling of integrity-related matters,” the letter stated. “Delayed disclosure of significant violations was precisely the type of problem HISA was created to address.”

HISA Welcomes Inquiries

A HISA spokesperson told Gambling Insider that the authority appreciates Churchill Downs and the horsemen speaking out regarding the sport’s integrity.

“HISA has been in communication with the FTC about the issues raised in the letters and welcomes the FTC’s ongoing oversight and review of our actions, policies, protocols, and systems,” the spokesperson said in an email.

In 2023, when HISA established its anti-doping and medication control program, the authority sought to issue a provisional suspension and public notice immediately upon confirmation that a horse tested positive, with the charged individual given the right to seek a hearing to lift the suspension. The purpose of an immediate suspension was to prevent trainers accused of drug violations from entering other horses that may also have been administered a banned substance.

The authority, however, received pushback from the racing community to delay the public disclosure of the violation and the preliminary violation until later in the review process.

Answers Demanded From HISA

Both the horsemen and Churchill Downs want to know through an independent review how the data breach occurred and if anyone else accessed data inappropriately, among other issues.

“HISA rightly expects the racing industry to learn from failures and address systemic problems before they happen again,” the NHBPA letter stated. “When a horse gets injured, the sport does not simply move on. There is a review of the racing surface, veterinary records, training history, and other available information to determine what happened and whether a systemic problem contributed to the incident. That rigor is intended to identify the underlying cause and prevent the next incident. The same principle should apply here, and HISA should be held to the same standard.”

Carstanjen said the questions raised by the industry can’t be addressed by “a public-relations campaign” pertaining to the Gramm case. HISA, he said, has a responsibility to the tracks, horsemen, and bettors to keep sensitive data out of the hands of people who could use it for their own benefit.

“The industry is entitled to understand whether this was an isolated event, a broader systems failure, or a symptom of more significant weaknesses in HISA’s technology and oversight processes,” the Churchill executive wrote.

In addition, owner Mike Repole called for a third-party review of HISA and The Jockey Club in a statement on X two weeks ago. The billionaire entrepreneur offered to pay for the inquiry in wake of “the biggest gambling-related scandal” in racing history.

“Horse owners deserve it,” he said. “Horseplayers deserve it. Trainers and veterinarians deserve it. The integrity of the entire sport demands it.”