Epic sued in federal court for alleged monopolistic behavior (Updated)

Health tech startup takes on the Monster of Madison: what are the stakes?

Oct 25, 2024

Updates:

28 January 2025: After hearing both sides’ arguments, a judge will now decide on Epic’s motion to dismiss Particle Health’s complaint.

9 January 2025: Particle Health responds to Epic’s motion to dismiss.

20 December 2024: Epic filed a motion to dismiss the complaint, arguing Particle Health hasn’t provided any plausible evidence of anticompetitive behavior.

25 October 2024: Epic requested a pre-motion conference with the judge to detail its intention to move to dismiss Particle Health’s antitrust lawsuit, arguing it acted properly in restricting the flow of patient data to non-healthcare providers in Particle’s client base.

Original Article (Oct 8 2024):

Particle Health, a health tech startup, sued Epic Systems in federal court for the Southern District of New York, accusing the giant EHR vendor of monopolistic behavior outlawed by the Sherman Act.

The allegations arose from a business dispute between the two firms dating back months. Besides providing insight into Epic’s business practices, the lawsuit will shine a spotlight on the intense but largely secret battle for control of patient data in healthcare.

The 21st Century Cures Act disrupted the health data ecosystem (and Epic’s business)

Under the Affordable Care Act passed in 2010, EHR vendors were mandated to (someday) produce interoperability standards ensuring data portability. But there was no specific requirement or enforcement mechanism, the vendors didn’t comply meaningfully, and data handling in major vendors’ systems (e.g., Epic and Cerner) remained largely proprietary. Sharing patient records has continued to be a cumbersome task often relying on fax machines.

Since 2021, Congress and the executive bureaucracy created tougher rules for data accessibility and portability:

Generally speaking, patients are supposed to be in charge of their data.
Doctors’ notes must be viewable to patients.
A new industrywide framework for data sharing was created, called Fast Healthcare Interoperability Resources (FHIR): no more foot-dragging or excuses.
The rules come with new teeth: Any individual or entity guilty of illegally blocking legitimate patient data transfer can face up to $1 million in fines.

Most problematic for Epic and other large vendors, the new rules effectively mandated that vendors maintain APIs (application programming interfaces) to allow thousands of startup vendors to build apps that can interact with Epic. This will eventually allow patients to access their health data on smartphones through a variety of apps (think of how fintech apps can easily access your banking data with your permission).

This will inevitably break the vendors’ stranglehold on massive troves of valuable patient data and improve portability of medical records, but also raises privacy concerns.

A Dispute Over Data Escalates

Particle Health is a startup that aims to build new plumbing between EHR vendors like Epic and the new app developers. They promote themselves as enhancing patient control over health records with the hashtag #destroythefaxmachine.

Carequality is an interoperability network managed by a small nonprofit that provides the plumbing for Epic’s Care Everywhere system and many other patient data transfers. For Particle Health to succeed, its plumbing and software (and the apps that use it) must interact seamlessly with Carequality’s network.

Earlier this year, Epic allegedly cut off access to its data (through Carequality) for some of Particle Health’s customers, alleging that they misrepresented their reasons for accessing patient records in Epic. In a statement, Epic named Integritort, a data broker for personal injury class action suits, which Epic claims misrepresented itself as a healthcare provider treating patients to obtain data through Particle Health.

The dispute was reportedly resolved through Carequality’s internal processes. However, Particle Health saw an existential risk to its business and filed a lawsuit in federal court.

Particle Health vs Epic

The lawsuit alleges that Epic’s behavior was not to protect patient data or to comply with HIPAA but to harm Particle Health’s growing business, thereby slowing the evolution of the new data marketplace to protect Epic’s alleged monopoly.

Particle alleges other instances of anticompetitive behavior beyond the dust-up with Carequality and Integritort. The startup put out a statement saying,

“Epic Systems controls the medical information of nearly every American – meaning one private company has unchecked power over our health care … Now, Epic is using that power to thwart an emerging industry intended to bring payers and providers into closer collaboration for better patient care.”

Epic released a statement as well, calling for disclosure of the Carequality internal inquiry—a tactic to reduce the scale of the issue back to a simple dispute over compliance and privacy during patient data transfers:

Carequality's Steering Committee has overseen the dispute and issued their resolution. Particle has publicly mischaracterized the resolution. Particle should join Epic in asking Carequality to release the resolution immediately so that patients, healthcare organizations, other network participants, interoperability advocates, lawmakers, and journalists can evaluate the facts for themselves.

Particle Health then told a news outlet, “Carequality asked that the resolution remain confidential. If Carequality wishes to release it now, we have no objection."

Particle Health has retained Quinn Emanuel Urquhart & Sullivan, LLP, a leading antitrust litigation firm. The suit seeks a ruling that Epic’s behavior violated the Sherman Act (the basis of U.S. antitrust enforcement), undisclosed monetary damages and a court order compelling Epic to stop allegedly restricting data transfer.

FTC’s Lina Khan Weighs In

Lina Khan, chair of the Federal Trade Commission, happened to be in Madison, Wisconsin (11 miles from Epic HQ) talking about grocery store consolidation, when reporters asked her about the Epic lawsuit. She responded cryptically:

“We're not involved in that litigation, which is brought by a private company, but it's actually something I had heard concerns about, especially among entrepreneurs and startups that were trying to enter the healthcare space,” Khan said, according to a media outlet.
“It's too early for us to say” whether FTC would file an amicus brief in the case, Khan said.
She then added something that probably wasn’t too reassuring to Epic:
“[W]hen you consolidate control over data that can actually leave systems much more vulnerable to certain types of cyber attacks or other hacks that lead to systems really crashing.”

(She may need to act fast. Rumors are swirling that whoever wins the presidential election in November, Khan may be out.)

Protecting Privacy Through Transparency?

Besides revealing some of Epic’s business practices, another public benefit to the lawsuit will be increased attention on the fast-growing, chaotic and weakly regulated patient data ecosystem created by the new portability rules.

Thousands of new businesses—from venture-backed startups to colossal corporate behemoths—are jockeying to build apps to enhance patient experiences and control of their health data.

That’s a lot of new “covered entities” (in the parlance of HIPAA privacy law) who will be handling patient data. Most of their activity is being governed by a legal framework built in 1996. Many are garage-level startups with no experience in healthcare compliance. It’s doubtful that most have adequate defenses against state-sanctioned cyberattacks.

New technical and legal standards for compliance, transparency and privacy need to be built and applied (with enforcement) to the actors in the new regime of patient data portability. If they are not, it’s easy to foresee that very quickly, every American’s medical information will be available on the dark web and entered into large language models for nefarious purposes (scams, extortion, etc).

Particle Health seems to be a potential contributor to those privacy vulnerabilities. As part of the Carequality dispute resolution, it reportedly agreed to a “corrective action plan” after permitting two customers to acquire patient records under false pretenses.

It’s hard to find a good guy in this dispute. But the adversarial and invasive discovery process has an interesting tendency to expose information that benefits the public, which wouldn’t be learned any other way.

More details will be published here as they develop.

Discussion about this post

Ready for more?