A federal appeals court ruled that electronic health records company PointClickCare can't block health analytics firm Real Time Medical Systems from accessing patient data from its skilled nursing facility customers.

The Fourth Circuit Court of Appeals on Wednesday affirmed a district court's order and kept in place a preliminary injunction that bars PointClickCare from blocking Real Time's access to its clients' patient data. PointClickCare, an EHR used by thousands of long‐term and post‐acute care providers and hospitals, had filed an appeal back in August seeking to overturn the preliminary injunction a district court put in place.

Real Time filed a lawsuit against PointClickCare in the U.S. District Court for the District of Maryland back in January 2024, alleging information blocking and other practices that substantially interfered with its business operations and harmed its facility customers. 

The company provides analytics services to skilled nursing facilities by accessing health records from the large EHR provider. Real Time's customers include around 1,700 skilled nursing facilities as well as health insurers, CVS Health Corporation and the state of Maryland, according to court documents.

Real Time is resting its claim of unfair competition under Maryland state law in part on a violation of the 21st Century Cures Act’s prohibition on information blocking. Information blocking is defined in 2016’s 21st Century Cures Act as the intentional interference with access, exchange or use of electronic health information except when required by law or under certain exceptions (PDF).

The Fourth Circuit ruled (PDF) that Real Time is likely to succeed on the merits of its claim that PointClickCare’s use of certain security protocols, referred to as indecipherable CAPTCHAs, and blocking of user accounts constitutes information blocking under the Cures Act. 

Real Time frequently accesses the health records in question using “bots,” or automated users, and company executives told the court it has been using bots to pull data from PointClickCare’s EHR for the past 10 years.

PointClickCare maintained that it legitimately must implement the protocol to protect patient healthcare data and maintain the performance integrity of its systems. The Fourth Circuit said, in its appeals ruling, that the EHR company "failed to articulate a specific security risk posed by Real Time’s bot access, instead gesturing very broadly to the potential malicious use of bots."

The case will now proceed to discovery and trial on the permanent injunction and underlying unfair competition claims.

"This is an impactful day for patients as the Fourth Circuit’s ruling protects patients’ rights to the care team they selected and the caregivers responsible for their health and safety," Real Time’s Executive Director Scott Rifkin, M.D., said in a statement provided to Fierce Healthcare.

"The Fourth Circuit has now affirmed what Real Time has been saying since the start of this litigation—that PCC’s blocking of access to patient data through insolvable CAPTCHAs is not just dangerous, it’s also against the law, and we are grateful that the injunction will remain in place," Rifkin said.

"Critically, the Fourth Circuit agreed with the District Court’s finding that there was no evidence Real Time posed a security concern to PCC and found that the evidence instead suggested PCC’s actions were taken to harm its competitor," Rifkin said. "For nearly a decade, Real Time was able to access the patient data that PCC electronically stores for our shared customers with zero issue, benefiting both companies, healthcare providers, and patients alike. Real Time’s services are proven to reduce hospital admissions, pain, and even death, so yes, this is a win for us, but most importantly, it is a win for patients." 

In a statement, PointClickCare said it was "disappointed" with the Court’s decision. "We will continue to take all necessary steps to protect our customers, the patients and residents they serve, and the broader healthcare industry."

"Protecting our customer data, the personal health information of patients and residents, and the integrity and performance of our system are top priorities for PointClickCare. Our security policies adhere to applicable federal requirements to safeguard patient data and are designed to prevent potentially malicious bot use—not block information," the company said in its statement.

"We remain highly committed to interoperability, as evidenced by the 1,900-plus partners who access the health data they need daily through our eight approved and secure options," the company said.

PointClickCare works with more than 27,000 long‐term and post‐acute care providers, 3,600 ambulatory clinics, 2,800 hospitals, 350 risk-bearing providers and 70 state and government agencies.

Brendan Keeler, a self-described advocate for interoperability and healthcare integration, said the Fourth Circuit Court of Appeal's decision is a wake-up call for EHR companies. "The high-level takeaway is that people can sue for information blocking and not wait for regulators to figure it out," he said.

Since April 2021, there have been 1,239 claims of information blocking submitted to the federal government's information blocking complaint portal. The Department of Health and Human Services' health IT arm categorized 1,162 of those as "possible claims." 

So far, there has been no enforcement action against an actor as it relates to an information blocking violation at the federal level.

The appeals court ruling this week established that violations of the Cures Act can support state law unfair competition claims even though the Act lacks a private right of action, noted Keeler, interoperability and data liquidity practice lead at healthcare strategy and software development firm HTD Health.

"Apps can sue EHRs to litigate when they feel blocked via the information blocking provisions," Keeler said.

On social media, many health tech executives praised the Fourth Circuit's ruling as a "win for healthcare innovation."

The court's ruling has implications for EHR companies, Keeler noted. "When a provider wants to use an app, they either need to essentially give an application programming interface (API) to give an input-output that can be used for something for that purpose, allow for screen scraping, or allow direct to database. This is hugely impactful for digital health point solutions that want to connect to EHRs," Keeler said.

The federal information blocking rule makes broad exceptions for security and other concerns.

PointClickCare defended its actions to put in security protocols and said its activities fall under three common exceptions: the manner exception, the health IT-performance exception and the security exception. 

The Fourth Circuit agreed with the District Court’s finding that there was no evidence Real Time posed a security concern to PointClickCare and that "none of the exceptions that PointClickCare invokes apply." 

The Fourth Circuit also found that the evidence instead suggested PointClickCare's actions were taken to harm its competitor. 

"The present record strongly supports an inference that PointClickCare sought to leverage its control over its EHR system to harm Real Time’s business, and that its cited reasons for its actions (security and system performance) were a cover for its true motivations (hurting a competitor)," the Fourth Circuit judges wrote.

PointClickCare argued that Real Time could access the data in other ways. But, the Fourth Circuit found that the evidence does not support any immediately viable alternatives that would avoid irreparable harms to Real Time's business.

"The Marketplace or USCDI systems provide only about 30% of the necessary data and involve a contract that, without modifications, would arguably place Real Time in immediate breach. Hiring 450 humans to replace the bots would risk breach of Real Time’s contracts with its customers during the significant time it would take to hire and train these individuals, and would carry a substantial risk of financial ruin once they were hired because the cost of staffing would exceed Real Time’s revenues from its customers," the appeals court said.

The Fourth Circuit also considered the public interest in its ruling. "The record supports that Real Time’s inability to perform its work threatens real harm to patients, including the very real potential for increased nursing-home deaths," the judges said in the ruling.

A recent academic study showed that hospital readmissions significantly decreased where Real Time’s program was implemented. The researchers noted that, if all skilled nursing facilities could reduce their readmissions to the rate shown for the Real Time- associated facilities in their study, the Centers for Medicare & Medicaid Services would save around $2.8 billion annually. 

The case is Real Time Medical Systems Inc. v. PointClickCare Technologies Inc., case number 8:24-cv-00313, in the U.S. District Court for the District of Maryland.