Two recent federal cases are providing insight into what to expect in state court litigation related to information blocking, defined in the 21st Century Cures Act (Cures Act) as a practice that interferes with the access, exchange, or use of electronic health information.
On March 12, 2025, the Fourth Circuit upheld the Maryland District Court’s preliminary injunction for the plaintiff in Real Time Medical Systems Inc. v. PointClickCare Technologies, 131 F.4th 205 (2025). In sum, the Fourth Circuit agreed with the District Court that PointClickCare’s “use of indecipherable CAPTCHAs and choice to block certain users is illegal under the information-blocking provision of the federal Cures Act, which supports [Real Time’s] unfair competition claims” under Maryland law. The Fourth Circuit relied in part on Intus Care, Inc. v. RTZ Assocs., Inc., Case No. 24-cv-01132, 2024 U.S. Dist. LEXIS 100190 (June 5, 2024), where a District Court judge found that a violation of the Cures Act would constitute an “independently wrongful” act sufficient to support a claim for intentional interference with prospective economic advantage under California law, even though the Cures Act lacks a private right of action.
These rulings provide useful insight into how information blocking violations can be litigated through state law claims despite the lack of a federal private right of action, and that good faith negotiations are requisite to satisfy the Manner Exception.
Case Summaries
Real Time Medical Systems Inc. v. PointClickCare Technologies
Real Time provides analytics services to skilled nursing facilities and relies on bots to expedite access to health care data maintained by PointClickCare for Real Time’s clients. Over the course of three years, PointClickCare employed indecipherable CAPTCHAs and account deactivation at various times, depriving Real Time of access to its client’s health care data. Ultimately, Real Time brought Maryland state law claims including unfair competition and tortious interference and sought a preliminary injunction. The District Court granted the preliminary injunction.
On appeal, in pertinent part, PointClickCare argued that Real Time could not rely on a violation of the information blocking provision in the Cures Act to support claims of unfair competition under Maryland law because (i) a federal statute lacking a private right of action cannot support a Maryland unfair competition claim and (ii) the Cures Act preempts any state law claim. PointClickCare also argued that even if Real Time could rely on the Cures Act, PointClickCare did not violate the information blocking provision of the Cures Act because the Manner, Health IT and Security exceptions applied. The Fourth Circuit rejected all these arguments. On April 23, 2025, the Fourth Circuit rejected PointClickCare’s petition for enbanc review. The case is set to go back to the District Court for trial proceedings.
Intus Care, Inc. v. RTZ Assocs., Inc.
Intus Care is also a health analytics company that contracts with care providers who provide care through the federal Program of All-Inclusive Care for the Elderly (PACE). Many of these providers maintain their records in a program called PACECare, which is operated by RTZ. Intus Care alleged that RTZ refused to provide Intus Care access to these records in an effort to force these providers to RTZ’s competing analytics product. Intus Care brought California state law claims including intentional interference with prospective economic advantage. RTZ’s motion to dismiss this claim was denied.
Key Holdings
- An alleged information blocking violation under the Cures Act can be the basis for a state law unfair competition claim.
PointClickCare asserted that because there is no private right of action under the Cures Act for an information blocking violation, it could not be relied upon when assessing the viability of Real Time’s state law unfair competition claim. The Fourth Circuit disagreed, noting that the lack of a federal private right of action, in and of itself, does not bar a plaintiff from relying on such a violation as evidence to support a state law claim. Instead, the Fourth Circuit distinguished between whether the violation is being used as evidence to support an existing state law claim or whether the state law claim is a shell for an otherwise-unavailable federal claim. Where, as was the case in Real Time, the violation is used as evidence to support an element of state-law claim for unfair competition – that is, used to establish that an action was unfair or wrongful – the lack of a private right of action is inconsequential. Similarly, the trial judge in Intus Care concluded that a Cures Act violation would constitute an “independently wrongful” act sufficient to support a claim for intentional interference with prospective economic advantage under California law, even though the Cures Act lacks a private right of action.
- Federal law does not preempt state law claims involving information blocking violations.
The Fourth Circuit also concluded that state law claims involving information blocking violations are not preempted by federal law. The Court noted that the Cures Act contemplates state regulation related to information blocking. It explained that the existence of federal mechanisms to resolve Cures Act violations is insufficient to show Congressional intent to preempt state law causes of actions based on behavior that would qualify as information blocking.
- The Manner Exception requires parties to negotiate in good faith and articulate some reason for an impasse other than unwillingness to negotiate for each category of requested data.
The Manner Exception states that entities subject to the information blocking regulations (i.e. certified health IT developers, health information networks/health information exchanges, and providers (each an “actor”)) “must fulfill a request for electronic health information in any manner requested, unless the actor is technically unable to fulfill the request or cannot reach agreeable terms with the requestor to fulfill the request in the manner requested.” 45 C.F.R. § 171.301(a)(1). Even where parties cannot reach agreeable terms, the request must be fulfilled in an alternative manner. 45 C.F.R. § 171.301(b)(1). PointClickCare asserted that even if its failure to share information with Real Time could be considered information blocking, the Manner Exception should apply because the parties could not reach agreeable terms for disclosure. The Fourth Circuit rejected this reasoning, noting that PointClickCare has been unwilling to agree to disclosure terms. In emphasizing the high bar for the Manner Exception, the Court noted that the phrase “cannot reach agreeable terms” implies at least some reasonable efforts and articulable reasons why the parties cannot come to an agreement, which did not exist in the case. The Court highlighted that a party seeking to invoke the Manner Exception must do so separately for each category of requested data.
- The Health IT and Security Exceptions must be implemented in a consistent and nondiscriminatory manner.
PointClickCare also tried to rely on the Health IT and Security Exceptions to justify its failure to disclose information to Real Time. But the Fourth Circuit opined that both the Health IT and Security Exceptions did not apply because PointClickCare’s practice of using indecipherable CAPTCHAs was not implemented in a consistent and nondiscriminatory manner, as required under both exceptions. The Security exception did not apply also because PointClickCare failed to articulate a specific security risk posed by Real Time’s bot access.
Conclusion
State courts may soon play a more prominent role in information blocking enforcement as the premise for state law violation claims, even if the number of such cases is still low. With respect to the Manner Exception specifically, based on these holdings, actors should document their good faith efforts to negotiate with requestors of electronic health information and explanations of why such efforts failed when they do. Actors also should document how they have provided access to all categories of data requested and for any categories of data requested where they were not able to do so, how a different exception applied, such as the infeasibility exception where the request was too burdensome or not possible.