Health Care Data Wars: Stretching the Regulations on Information Blocking and The New Burdens of AI

The previous article in this series explained how Real Time Medical Systems, Inc. raised the ire of PointClickCare Technologies, Inc. and was prevented from using bots and screen scraping to get access to patient data. Now we’ll see how Real Time responded and look at the new burdens that AI is placing on health care as revealed by the case.

One of the key goals of health care reform, going back to HIPAA in 1996 and particularly the HITECH act of 2009, is to allow the free flow of patient data in a secure and privacy-preserving way. Health care reformers pushed for these bills, knowing that billions of dollars were being wasted while patients were languishing because each health care provider failed to share data with others.

Most barriers to data sharing were built into technology and institutions. APIs such as promoted by Amazon.com in retail were simply missing in health care. Documents between different organizations were incompatible, even if the organizations claimed to comply to standards such as HL7. Patients were reduced to taking a cart to the doctor’s office and loading it with paper copies of their records (or more recently, with a CD), often after payment of an outrageous copying fee.

Hundreds of pages of regulations were produced from 2009 on, trying to force the health care industry to provide the data sharing (or “interoperability,” the term preferred in the industry) that other fields take for granted. Progress has been slow. For instance, a friend told me that a recent conversion to a new EHR by her provider permanently wiped out years of email exchanged between her and her doctors.

A few years ago, the federal government decided to attack a more blatant barrier to interoperability, which they characterized as deliberate “information blocking.” It’s hard to prove that actions are deliberate, but more than a thousand claims of information blocking have been submitted over approximately a three-year period to the Office of the National Coordinator (ONC) in HHS.

The law was designed for a situation like this: A patient has been treated for a serious condition such as cancer at Hospital A. The patient moves to Hospital B, perhaps because her doctor moved there or she needed a different level of care. However, Hospital A is not releasing her records, jeopardizing her recovery. Indeed, the vast majority of information blocking claims have been brought by patients.

Information Blocking in Real Time v. PointClickCare

Real Time has put the information blocking law to a very different use here—and the legal channel they use is just as ground-breaking as the claim itself.

First, Real Time is suing not as a patient or even a clinician, but as an analytics firm. They argue that lack of access cuts off operations they perform for their clinical clients.

Second, instead of merely reporting their claim to the ONC and waiting for an investigation, they launched a lawsuit with information blocking at the center. Perhaps they expected the judge to act faster than the ONC would—and if so, the strategy paid off in the preliminary injunction. PointClickCare has appealed the decision and asked for expedited review.

Brendan Keeler, Interoperability and Data Liquidity Practice Lead at HTD Health, points out that ironically, Real Time had the opportunity to invoke “information blocking” only because PointClickCare had recently become a certified EHR. Still, this application of the “information blocking” doctrine is unique. It won’t remain unique for long, if the final decision of the court upholds it. Keeler and Lisa Bari, CEO of Civitas Networks for Health, say that many other firms have similar axes to grind in relation to EHRs.

Information Blocking Depends on the Context

Currently, patient data is usually owned by the clinicians who create it. PointClickCare, which offers an EHR to clinical sites, acknowledges that the clinicians own the data. But PointClickCare does not allow all accesses at all times. Many other EHRs have similar restrictions, which are in place for performance, privacy, and security reasons. Commercial considerations also play a role, because the EHR vendors resemble other cloud services in their means of deriving revenue from client access.

Bari says, “Commercial concerns do not constitute information blocking.” While patients have the right to get their own data free of charge, companies such as Real Time are subject to reasonable charges. Still, denying a whole company access to data when its clients have empowered it to read that data is pretty drastic.

Even the information blocking regulation, Bari says, includes exceptions, and PointClickCare relies on three of these in its defense: that frequent automated access by bots stresses its network and server capacity, that the manner of access opens up security violations, and that PointClickCare offers alternative access methods that Real Time has refused to use. The judge analyzed these exceptions and found them invalid in this case.

I should mention here a comment Real Time made on the issue of security: “Real Time has been certified by HITRUST, an information protection standards organization and certifying body and was also named the top post-acute analytics vendor in the 2024 Best in KLAS software and services report. Real Time has been competitively selected by many private and government organizations, including the State of Maryland for a contract that PCC also competed for, in part because of the security we deploy.”

On Monday, PointClickCare appealed the Court’s preliminary injunction, warning that a backdoor exception for Real Time bots would threaten the security of critical health information. They argue the legally mandated rollback of industry-standard technology carries profound implications for the protection of data across healthcare.

Because this series is not judging the court case and I lack enough information to even start characterizing the competing claims, let’s take off on a much more important topic: looking at the needs of the health analytics industry as a whole through the lens of the court case. I’ll talk first about performance and security, and finish out with some expert commentary and broad conclusions.

The New Burdens of AI

It’s axiomatic that modern analytics benefit from enormous amounts of data. The entire Internet has proven inadequate for the current iterations of popular generative AI programs such as ChatGPT (especially since a growing percentage of material on the Internet is AI-generated, which means that the AI models are now eating their own offal).

When the term “big data” first appeared some 20 years ago, it was described as a set of V’s, including volume and velocity. Not only do real-time analytics benefit from large volumes of data; they want to obtain up-to-date data at a high velocity.

Data scientists are aware of the demands they’re making on networks and data centers, and are always looking for more efficient algorithms. In its lawsuit, Real Time itself described some ways they had reduced the volumes of data they pulled from PointClickCare servers as well as the frequency with which they queried the servers. At the same time, they claimed that their data communications weren’t unusually copious and could not have placed an unwarranted load on PointClickCare’s infrastructure—that in fact this load hadn’t been a problem for their first nine years with PointClickCare.

In general, the health care industry has to look at its ever-growing data needs and design new means of data storage to accommodate them. Clinicians have to be willing to pay for the storage and networking they need for modern analytics.

It isn’t unusual to maintain the same data in separate databases for separate purposes. Many firms use one database to satisfy real-time transactions and another for analytics.

Lisa Bari, CEO of Civitas Networks for Health, discussed with me some of the complexity of Service-Level Agreements (SLAs) and terms of service in vendor contracts. It’s very hard to extrapolate from the technical promises in these agreements to figure out how they match one’s business needs. But in general, one cannot expect to hit an online service with requests at the same rate that a major retail or financial corporation queries its internal databases.

Privacy and Security

Modern analytics introduce subtleties into the classic concepts of patient privacy and identifying information. It should not be a HIPAA violation for an analytics firm to download data provided by its clients, so long as the analytics firms are properly vetted as business associates (in the Department of Health & Human Services’ terms) of the clinician.

But analytics can potentially invoke the commonly-called “mosaic effect” of combining many tiny facts to identify a patient who was meant to be anonymous. The categorizations of patients that are fed to AI models, or generated by them, also may reflect bias.

In short, modern forms of analytics are not just traditional analytics with an extra “oomph” provided by AI. Their security and privacy implications need to be assessed with fresh eyes.

Responses from Analysts

Neither of the independent experts who talked to me for this article (Bari and Brendan Keeler, Interoperability and Data Liquidity Practice Lead at HTD Health) jumped onto the judge’s bandwagon and promoted Real Time’s position. But both expected a lot more cases like this that invoke information blocking.

If the case ultimately comes down on Real Time’s side, Keeler sees it becoming harder for EHR vendors and their customers to cite the performance and security exceptions in the information blocking regulations and avoid being penalized. He also expects an increase in the use of screen scraping—but on the positive side, EHR vendors will have a new incentive (more of a stick than a carrot) to add additional APIs covering more of their data. “I cannot overstate the potential impact of this decision if it stays and is not challenged in a higher court,” he summarizes.

Who is Losing in This Environment

Judge Paula Xinis starts her preliminary injunction for Real Time v. PointClickCare with strong language prefiguring the opinions to come: “This case concerns the ugly underbelly of electronic access to patient healthcare records.”

Indeed, it does. EHRs and data storage systems designed for 1980s-style data use haven’t kept up with the precipitous move to AI and big data. The government has placed heavy expectations for data interoperability on a sagging technical foundation.

I am not blaming individual organizations here; I’m pointing out that Real Time v. PointClickCare is forcing a public discussion of matters about which analysts were aware but silently shrugged.

It’s our data that’s being tossed around like a football here. Debates over terms of service and business goals obscure the harm that’s being caused to us through the manipulation of our own data.

The lawsuit in this article is not the first data-related disagreement between EHR vendors and their clients. Keeler, for instance, points to a dispute involving the Epic EHR. At something of an extreme, a small Maine hospital named Full Circle Health Care was completely denied access to all patient data by its EHR vendor in a payment dispute.

Terms of service, security, and performance are all important concepts. But the various actors in health care are issuing thrusts and parries over the basic question, Who should control patient data? Any answer but “the patient” will lead to abuses and agendas that eclipse patient needs. Patients ultimately become the losers.

The key to unlocking the power of patient data is to wrench it from the clutches of clinicians, payers, and other companies who exploit the data for marketing, overbilling, or narrowly limited applications and return the data to us, who can assess its value for all sorts of innovative and valuable uses that come along.