Introduction

The recent judgment in Real Time Medical Systems, Inc. v. PointClickCare Technologies, Inc. by the United States Court of Appeals for the Fourth Circuit (dated March 12, 2025) sets forth a new precedent regarding the interplay of automated access (“bots”) in electronic health record (EHR) systems and claims of unfair competition through information blocking. In this case, Real Time Medical Systems (a health analytics provider) challenged PointClickCare’s non-transparent and seemingly arbitrary blocking measures—specifically the imposition of indecipherable CAPTCHAs and user-locking policies—when accessing patient data on its dominant EHR platform.

The core dispute arose after PointClickCare, which also seeks to compete in the health analytics sector, suddenly adopted a series of measures to prevent bot-based data extraction. Real Time argued that such measures, which disrupted its ability to provide timely and life-saving analytics to a wide network of skilled nursing facilities, amounted to information blocking in violation of the 21st Century Cures Act and constituted unfair competition under Maryland law.

Summary of the Judgment

The court affirmed the district court’s preliminary injunction in favor of Real Time, concluding that PointClickCare’s use of unsolvable CAPTCHAs and account-blocking policies were designed to impede access to essential health data. The court found that:

• Real Time had demonstrated a sufficient likelihood of success on its unfair competition claim by effectively leveraging the principles of the information blocking provisions of the 21st Century Cures Act.
• PointClickCare’s defenses – including its reliance on the manner, health-IT-performance, and security exceptions – failed due to lack of consistent application and convincing evidence supporting any technical impossibility or genuine security threat.
• The balance of hardships and the public interest heavily favored preserving Real Time’s data-access ability, thereby protecting the interests of patients and healthcare providers.

By affirming the preliminary injunction, the court effectively held that a party’s arbitrary and asymmetric enforcement of its automated access policies may constitute unfair competition when it results in information blocking.

Analysis

A. Precedents Cited

The judgment referenced numerous precedents to support its analysis. The court invoked established cases such as:

• COLLEGE LOAN CORP. v. SLM CORP. – This case underscored that evidence of a violation of a federal statute (even when such statute lacks a private right of action) can serve as evidence supporting a state-law claim. Here, the court adopted this reasoning to incorporate the 21st Century Cures Act provisions into the unfair competition claim.
• Trimed, Inc. v. Sherwood Med. Co. and Balt. Bedding Corp. v. Moses – These cases were cited regarding the broad scope of Maryland’s common-law tort of unfair competition, highlighting that fraudulent and deceptive practices in business could justify judicial intervention.
• N. Va. Hemp & Agric., LLC v. Virginia – The analysis also called upon this decision to discuss the proper application of preemption principles under the Supremacy Clause, emphasizing that Congress did not intend to displace state-law remedies entirely, especially where no direct federal enforcement mechanism exists.

These precedents collectively influenced the court’s view that using a federal information-blocking provision as evidence in a state unfair competition cause of action is acceptable and that state remedies should survive in areas of federal regulation.

B. Legal Reasoning

The court’s legal reasoning was multi-faceted and centered around several key analytical pillars:

• Establishing Likelihood of Success on the Merits: Real Time was able to show that PointClickCare’s measures were targeted, arbitrary, and designed to inhibit data access rather than simply protect system performance or security. The court noted the absence of any concrete evidence regarding security breaches or demonstrable performance degradation when compared to alternative data extraction methods.
• Burden Shifting in Information Blocking: The court supported the position that once Real Time demonstrated facial evidence of information blocking, the burden shifted to PointClickCare. It was then incumbent upon PointClickCare to satisfy its defenses under the manner exception, and other applicable exceptions found in the Cures Act regulations. Failure to do so significantly undermined its position.
• Interpreting Regulatory Exceptions: Detailed analysis was provided regarding the “manner,” “health-IT-performance,” and “security” exceptions in the Cures Act regulations. The court emphasized that the manner exception requires a party to genuinely attempt to deliver data in the manner requested and to engage in good-faith negotiation. PointClickCare’s abrupt cessation of negotiations and arbitrary enforcement of indecipherable CAPTCHAs did not meet these standards.
• Evaluation of Preemption Concerns: Addressing the preemption argument, the court found no clear congressional intent to displace state remedies even though federal regulation exists. The decision pointed out that the Cures Act itself contemplates state-level regulation by referring to “practices that restrict authorized access, exchange, or use” under both state and federal law.

C. Impact on Future Cases and the Legal Landscape

This judgment is likely to have substantial ramifications in both the health information technology and unfair competition arenas:

• Clarifying the Boundaries of Automated Data Access: By scrutinizing the use of bots and affirming that automated methods should not be penalized when there is no clear performance or security detriment, the court sets a cautious precedent on how automated access is regulated.
• Strengthening State Claims Supported by Federal Standards: The decision affirms that violations of federal mandates—even those without a private right of action—can underpin broader state-law claims. This may encourage additional litigation where state unfair competition or interference claims are supported by evidence of violation of federal regulatory standards.
• Impact on Negotiation Practices and Contracts in EHR Systems: Companies in the EHR market, particularly those that provide essential data services, will have to reassess their contractual and technical policies to avoid appearing to use security measures as a pretext for limiting competition.

D. Complex Concepts Simplified

To ensure clarity, several complex legal ideas were articulated in simpler terms:

• Information Blocking: This refers to practices that intentionally restrict access to electronic health information. In this case, PointClickCare’s use of unsolvable CAPTCHAs is considered a method of information blocking because it prevents real-time, automated access to patient data.
• Manner Exception: A regulatory provision under the Cures Act that permits a health information technology provider to supply data in any reasonable manner requested by an authorized user, but only if the provider is technically unable to comply or cannot agree on alternative terms. The court ruled that PointClickCare’s failure to engage in meaningful negotiations disqualified it from relying on this exception.
• Preemption: This legal doctrine prevents a state law remedy from interfering with federal law. In this case, the court found that federal law did not clearly displace the state unfair competition claim, meaning that state remedies remain available when federal law lacks a private enforcement mechanism.

Conclusion

In summary, the Fourth Circuit’s decision reinforces the view that health information system providers cannot effectively use automated access deterrents as a cover for anticompetitive practices. The judgment establishes that, under Maryland law, evidence of information blocking—even when connected to a federal statute without an independent right of action—can support an unfair competition claim.

The ruling not only mandates stricter adherence to the negotiated terms of data access between competitors but also clarifies the burden-related and interpretive aspects of applying the Cures Act exceptions. Ultimately, the decision is significant both for its immediate practical effects—safeguarding real-time analytics services vital to patient care—and for its broader legal influence on the regulation of automated data access and competition in the healthcare sector.