Churchill Downs Incorporated has asked the Federal Trade Commission (FTC) to order an independent review of the Horseracing Integrity and Safety Authority, escalating scrutiny of the regulator days before HISA provisionally suspended trainer Angel Quiroz over a series of alleged medication and horse-welfare violations.

In an August 28 letter to FTC Chairman Andrew Ferguson and Commissioner Mark Meador, Churchill Downs said a series of recent events had raised “significant questions about the governance, transparency, technology controls, and accountability” of HISA. The company asked the FTC, which oversees HISA, to require or initiate a formal independent review covering racing and wagering integrity, non-public information and the safeguarding of sensitive industry data.

The intervention follows controversy over the so-called “Fair Hill Five” betting episode and HISA’s handling of confidential veterinary information accessed through its online portal by horse racing data analyst and owner Marshall Gramm.

The latest enforcement action came on August 31, when HISA served Quiroz with a notice alleging violations of Rules 2215 and 2221. His registration was provisionally suspended from noon EDT on September 1, pending a provisional hearing. The notice says HISA believed there was “clear and convincing evidence” that his actions or inactions presented an immediate threat of serious injury or death to covered horses or riders.

HISA alleges three horses under Quiroz’s care, Bonita Rough, Scootaloo and Tepeyac, returned adverse analytical findings for Albuterol, which is classified as a banned substance unless prescribed in specified circumstances. Each alleged anti-doping violation involving a banned substance carries a potential two-year period of ineligibility and $25,000 fine.

Quiroz suspended after three horses test positive for Albuterol

The first case involved Bonita Rough, whose blood sample was collected after a Vet’s List Workout at Fair Hill Training Center in Maryland on July 10.

According to the notice, laboratory analysis detected Albuterol, while HISA Portal records showed no dispensation, prescription or treatment with the drug during the period Quiroz was the horse’s Responsible Person.

HISA’s filing says Quiroz subsequently told investigators he had nebulised Bonita Rough with Albuterol obtained from the horse’s veterinarian at Gulfstream.

“You stated that you nebulized Bonita Rough with Albuterol that you received from Bonita Rough’s Veterinarian at Gulfstream,” the charge letter quoted in the notice says. “You stated the Veterinarian had prescribed the medication to another horse but informed you that you could use it on Bonita Rough if needed.”

HISA alleges that this amounted to administering a controlled medication outside a valid veterinarian-client-patient relationship. Its notice also says no corresponding Albuterol treatment records existed in the HISA Portal for Bonita Rough, Scootaloo or Tepeyac.

The regulator said Quiroz was notified of the potential Bonita Rough violation on July 28. Thirteen days later, an out-of-competition sample was collected from Scootaloo at Saratoga Race Course and subsequently tested positive for Albuterol, according to the notice.

A sample taken from Tepeyac at Fair Hill on August 13, 16 days after the initial notification concerning Bonita Rough, also returned an adverse analytical finding for Albuterol, HISA said.

HISA said the alleged discovery of banned substances in multiple horses after Quiroz had already been notified of the first case posed an “immediate threat of serious injury or death to Covered Horses or Riders”. The allegations remain subject to the disciplinary process.

Quiroz also faces a separate allegation that he caused Bonita Rough to breach her provisional suspension by posting a timed and reported workout at Fair Hill on July 29.

Churchill Downs says HISA scrutiny goes beyond Gramm

The Quiroz action comes as Churchill Downs is challenging HISA over broader questions about its technology, oversight and disclosure practices.

Its August 28 FTC letter focused heavily on the controversy surrounding Gramm’s access to confidential veterinary and horse-health information through the HISA Portal.

HISA announced on August 17 that it had charged Gramm with multiple rule violations, including fraud, after an investigation into confidential information appearing in past-performance reports for Deterministic and Griffin’s Wharf. HISA said the information should only have been available to the horses’ connections and regulatory veterinarians.

HISA said its investigation, which included an independent forensic cybersecurity analysis, concluded Gramm had deliberately accessed confidential information over approximately six weeks and developed an automated method for obtaining it “at scale” in a way designed to mimic authorized activity and avoid detection.

Gramm has disputed HISA’s characterisation of his conduct. In a public statement, he said the information was available through his authorised HISA account and that he used his own credentials, did not conceal his identity and bypassed no security protocols or safeguards.

“I intend to vigorously defend myself in the HISA proceedings,” Gramm said.

He acknowledged exercising “poor judgment” by failing to alert HISA sooner to the vulnerability after the issue became public, but argued that focusing on him distracted from weaknesses in HISA’s systems.

The Jockey Club separately said Gramm had accessed veterinary information relating to horses he did not own and announced that its stewards would meet to take steps to remove him as a member.

Portal controversy raises questions over HISA security controls

Churchill Downs told the FTC it was not seeking to “excuse, minimize, or prejudge” any alleged misconduct by Gramm. Instead, it argued that the controversy exposed a separate institutional problem.

“But the institutional question is separate and more fundamental: why was such information accessible in the first place?” the company said.

The company stressed what it characterized as a reversal in HISA’s public explanation of the episode. According to the letter, HISA CEO Lisa Lazarus had initially said screenshots circulating online could not have originated from the HISA Portal, before HISA later acknowledged the health information had come from its system.

Churchill Downs said HISA’s subsequent focus on allegations of “fraud”, “misappropriation” and other wrongdoing by Gramm did not answer critical questions about the regulator’s own controls.

Among them were how an authorised user could access records for horses with which they had no legitimate connection, whether similar vulnerabilities existed elsewhere, whether other users accessed comparable information, how long the vulnerability existed and why it was not detected sooner.

HISA, meanwhile, said it had changed its technology systems to prevent similar unauthorised access and was devoting additional resources to protecting confidential information.

“There must be significant consequences for individuals who violate the integrity of our rules and obtain and abuse confidential horse health information,” Lazarus said. “HISA will take every necessary step to fiercely protect the integrity of Thoroughbred racing and ensure that violators of our rules are punished appropriately.”

Churchill Downs seeks independent review of HISA governance

Churchill Downs wants the FTC review to extend well beyond the Gramm case.

Its letter calls for an independent examination of the Fair Hill Five episode, the timing and disclosure of a previously undisclosed banned-substance positive connected with the matter, the HISA Portal vulnerability, whether other users downloaded or shared confidential information, and HISA’s relationships with technology providers.

The company also questioned whether HISA’s procurement, vendor oversight and information-security governance were appropriate for an organisation exercising federally authorised regulatory powers.

“HISA’s legitimacy depends on confidence that it is transparent, accountable, technologically competent, and subject to meaningful oversight,” Churchill Downs said.

It added that restoring confidence would require more than assurances that individual wrongdoers would be punished.

“It will require an independent accounting of what happened, why it happened, whether it could happen again, and whether HISA’s governance and technology infrastructure are adequate for the responsibilities it has been given,” the company said.

HISA’s own materials state that it operates under FTC oversight and that its national racing integrity framework is subject to federal review.

Featured image: HISA via press release