Skip to main content
Celeste Bruce, Mike Marr and RWL Seek Injunction on Behalf of RTMS to Ensure Continuing Access to Health Care Data Under the 21st Century Cures Act
https://www.law360.com/articles/1851046/judge-likely-to-block-medical-record-co-s-anti-bot-captchas
Judge Likely To Block Medical Record Co.’s Anti-Bot CAPTCHAs
Near the end of two days of witness testimony and oral arguments on Real Time’s May 30 preliminary injunction request, U.S. District Judge Paula Xinis repeatedly returned to the 2016 law’s guiding principle of enhancing provider and patient access to electronic health records, which Real Time said PointClickCare, or PCC, had violated with unsolvable CAPTCHA tests intended to keep out Real Time’s automated bots.
“The reason I’m persuaded by what I’ve heard from the plaintiffs’ side is the presumption is access,” Judge Xinis told Goodwin Procter‘s William Jackson, who represents PCC.
The injunction request comes amid Real Time’s broader lawsuit accusing PCC of tortious interference and violation of unfair competition laws, which the company filed in January after both acquisition and formalized data sharing talks fell through last year. In February, Real Time says, the company’s bots began encountering CAPTCHA tests that were solvable by humans but still slowed its access to patient data it needs to formulate its “analytical interventions.”
Real Time contracts with nursing facilities to recommend medical interventions to providers by comparing patients’ daily health record updates against their established baselines. But it claims that PCC, a major repository for electronic health records, began obstructing its access shortly after PCC purchased a competitor to Real Time and was outbid by the plaintiffs for a major Maryland nursing home contract.
Judge Xinis seemed unpersuaded by PCC’s argument that the anti-bot safeguards were done solely to protect its system from intruders and performance degradation, pointing to the fact that Real Time had been using bots to pull patient data from PCC’s portal multiple times per day for nearly 10 years. And she took umbrage at Jackson’s suggestion that granting the injunction would constitute an unprecedented step of telling a company to roll back security measures and would put PCC at risk of a data breach that could cost the company millions.
“You have a 10-year footprint with this company and no evidence … that they pose a risk,” she said Tuesday afternoon, pointing out that the unsolvable CAPTCHAs that Real Time is seeking an injunction against hadn’t started appearing until May. “So how am I putting you at risk?”
Judge Xinis stopped short of issuing a ruling from the bench Tuesday, but said she would do so via a July 3 video call. She insisted that granting the injunction wouldn’t put her “out on a limb, dangling over the Grand Canyon,” as she said Jackson was suggesting.
From the witness stand Monday, Real Time’s executives recounted what they saw as a multipronged effort by PCC to first obtain a detailed explanation of how their company gathers data before systematically trying to shut the company out from getting detailed “point-of-care” information from the companies’ mutual nursing home customers.
Having already bought one of Real Time’s competitors, PCC approached it about a possible acquisition in early 2023. With a non-disclosure agreement in place, the two companies then discussed Real Time’s products and operations before, according to Real Time executives, PCC went silent. After months with limited contact, PCC said an acquisition wasn’t in the cards, and the conversation turned to avenues for improving data sharing between PCC’s electronic patient health records and Real Time.
But according to Timothy Buono, Real Time’s chief strategy officer, those talks broke down as well when PCC required, as a precondition for any new agreement, that Real Time sign an “onerous” agreement that PCC could terminate at any point and would have foreclosed Real Time’s preexisting access methods.
Under one of the discussed structures, PCC asked for Real Time to pony up $125 per facility per month to get all the patient health records it had been accessing for nearly a decade.
“We thought it was onerous for access to data they didn’t own but were warehousing,” Buono said.
Real Time countered at $70, but the negotiations fell apart, with PCC going silent once again and declining to even discuss Real Time’s counter. Shortly thereafter, Real Time’s automated login system began encountering the CAPTCHAs.
If Real Time gets its way, the injunction would stop PCC from blocking its access to data until the broader case runs its course, which could take years given that the suit was only filed in January and is in the pleadings stage.
On Tuesday, Bachar Fourati, one of PCC’s top security executives, took the stand to explain that bots were posing a growing threat to the company’s network and, on several occasions, had slowed down its system, prompting it to impose the anti-bot policy in 2023.
But Judge Xinis had issues with his explanations, and PCC’s stance more broadly. She told Jackson during oral arguments that Fourati hadn’t specified how Real Time’s system posed a threat, and it seemed like PCC wasn’t adhering to the anti-bot policy with any consistency.
“How is it a consistent and non-discriminatory manner when … I still don’t understand what the objective criteria is to be placed on the watch list?” the judge asked Jackson, referring to PCC’s bot watch list that Real Time’s accounts had landed on. “I don’t have anything in front of me that says your system has been slow. … I don’t have any meat on the bones of how it’s slowing you down for more than a day or two.”
And most importantly, Judge Xinis said, Real Time had made clear that of all the alternative paths PCC offered to get data to Real Time without bots, none would have encompassed all the daily information that Real Time needs. During their testimony, several Real Time executives said that what PCC was offering would have amounted to roughly 30% of what it had been getting since 2014.
That, Judge Xinis said, could violate the Cures Act’s mandates that patient information not be gated for providers and others who have authorization.
The law requires that, if the data sharing can’t be executed for certain reasons, the medical records company must find a way to fulfill the request in an “alternative manner.” But according to testimony from several Real Time executives, PCC had unilaterally ended talks about finding alternative pathways to the data.
“There’s … uncontroverted testimony that the talks just stopped,” Judge Xinis said Tuesday.
Real Time is represented by M. Celeste Bruce and Madelaine Kramer Katz of Rifkin Weiner Livingston LLC.
PCC is represented by Brian T. Burgess, William C. Jackson and Ashley M. Drake of Goodwin Procter LLP, and Rod J. Rosenstein and Jeremy M. Bylund of King & Spalding LLP.
The case is Real Time Medical Systems Inc. v. PointClickCare Technologies Inc., case number 8:24-cv-00313, in the U.S. District Court for the District of Maryland.
–Editing by Adam LoBelia.