Cybersecurity Policy Report, 4th Cir.: District court properly enjoined operator of host of patients’ EHR from restricting access to operator’s systems, (Mar 18, 2025)

By Sara Cracau, J.D.

District court properly granted preliminary injunction against operator of system that hosts patients’ electronic health records to enjoin operator from restricting access to its systems.

The Court of Appeals for the 4th Circuit affirmed the decision of the district court granting a preliminary injunction against an operator of a system that hosted patients’ electronic health records to enjoin the operator from restricting access to its systems finding that the company providing analytics services to skilled nursing facilities demonstrated a sufficient likelihood of success on the merits. The company providing analytics services alleged six causes of action but pressed only three claims for purposes of injunctive relief: tortious interference with business relations, unfair competition, and breach of contract as a third party beneficiary. The district court addressed the first two claims and because the court of appeals agreed as to the unfair competition claim, it did not analyze the tortious interference claim (Real Time Medical Systems, Inc. v. Pointclickcare Technologies, Inc., No. 24-1773 (4th Cir. Mar. 12, 2025)).

A health-analytics company that serviced skilled nursing facilities and other providers brought an action against a company that operated a system that hosted patients’ electronic health records seeking to enjoin it restricting access to its systems. The health analytics company accessed health records from the other company and it frequently used “bots’ or automated users to gain such access. The other company contended that use of bots raised security and system performance concerns and, therefore, it blocked the profiles of users whom it suspected gained access using bots. The district court granted a preliminary injunction to prevent the access restriction. The company operating the system that hosted the patient health records appealed.

Unfair competition claim. The 4th Circuit determined that a Maryland state claim for unfair competition can be premised in part on a federal statute. Maryland case law establishes that it is acceptable to use a violation of a federal statute as evidence supporting a state law claim but not to advance a state law claim that is merely a shell for a federal claim that would otherwise not be available. Furthermore, the court noted that Maryland unfair competition is a highly flexible tort and the supreme court of Maryland would likely allow such a claim to proceed. The 4th Circuit concluded that the supreme court of Maryland would likely permit a plaintiff to rely on the information-blocking violation of the Cures Act to support an unfair competition claim. Furthermore, it rejected the argument that the unfair competition claim is pre-empted by federal law, noting that the mere fact that Congress provided a federal executive avenue for resolving instances of information blocking was insufficient to show conclusively that Congress intended to pre-empt any state-law judicial cause of action based on behavior that would be considered information-blocking under the Cures Act.

Success on the merits. The Cures Act “accelerate[s] the discovery, development, and delivery of 21st century cures” and seeks to prevent companies from engaging in “information blocking” of electronic health information. Here, the operator of the system that hosts patients’ electronic health records conceded that use of indecipherable CAPTCHAs and locking out users facially constitutes information blocking under the Cures Act, if an exception does not apply. It contended that the company providing analytics services had to affirmatively show that the exceptions did not apply but the district court disagreed with this determination. Rather, both the district court and the 4th Circuit determined that the company providing analytics services had the burden of showing that one of the exceptions applied and found that this company failed to meet its burden. In examining the manner exception, the 4th Circuit noted that “[a]n actor must fulfill request for electronic health information in any manner requested, unless the actor is technically unable to fulfil the requestor cannot reach agreeable terms with the requestor to fulfil the request in the manner requested.” Because the operator of a system that hosts patients’ electronic health records undisputedly blocked access to the company that provided analytics services to skilled nursing facilities, the company providing analytics services was likely to succeed on the merits of its claim on this basis alone. For completeness, however, the court analyzed the second part of the analytics services provider’s request, examining the meaning of “cannot reach agreeable terms.” The 4th Circuit rejected the argument that “cannot reach agreeable terms” means “have not reached agreeable terms.” It noted that, for this phrase to carry any weight, it must imply at least some reasonable efforts and articulable reasons why the parties cannot come to an agreement. Here, the record did not suggest that the operator of the system that hosted patients’ electronic health records was not able to find “agreeable terms” for alternatives. In fact, the parties were close to reaching a mutually agreeable alternative when the operator of the system that hosted patients’ electronic health records decided to terminate the discussions and, so, therefore, it cannot then reap the benefits of the manner exception. The parties need to try to fulfil requests for access, exchange, or use of electronic health information in the manner requested to help ensure access to electronic health information when it is needed rather than simply claiming an inability to reach agreeable terms.

The 4th Circuit also rejected the arguments of the operator of the system that hosted patients’ electronic health records to invoke the health-IT-performance and security exceptions. The health-IT exception applies only where “a third-party application…is negatively impacting the health IT’s performance. Here, there was no evidence to indicate that the operator of the system that hosted patients’ electronic health records had ongoing service issues or that its performance improved when it introduced indecipherable CAPTCHAs and locked out the company providing analytics service’s users. With respect to the security exception, an act that constitutes information blocking falls under that exception only I it is “tailored to the specific security risk being addressed.” There was no need for the court to reach the tortious-interference claim.

Other preliminary injunctionfactors. The court determined that the remaining preliminary injunction factors were satisfied. There was a showing of irreparable harm in the form of “actual and imminent” loss of customers. Balance of the equities weighed in favor of the company that provided analytics services. Finally, with respect to the public interest factor, the evidence suggested that the company providing analytics services’ use of bots did not pose a risk to the company that hosted patients’ electronic health records. Furthermore, the public interest did not weigh in favor of anticompetitive and harmful behavior.

The case is No. 24-1773.

Judge: Gregory, R.

Attorneys: Marie Celeste Bruce (Rifkin Weiner Livingston, LLC) for Real Time Medical Systems, Inc. Nicole Bronnimann (King & Spalding LLP) for PointClickCare Technologies, Inc. d/b/a PointClickCare.

Companies: Real Time Medical Systems, Inc.; PointClickCare Technologies, Inc. d/b/a PointClickCare

Cases: CaseDecisions FederalLegislation CMSNews CyberPrivacyFeed EHRNews DataPrivacy MarylandNews NorthCarolinaNews SouthCarolinaNews VirginiaNews WestVirginiaNews DataSecurity