Epic’s Legal Troubles and the Deeper Crisis in Health Data

CureIS Healthcare’s lawsuit against Epic Systems is more than a routine addition to the mounting pile of digital health litigation. It marks a deeper unraveling—one that exposes the structural fragility of the U.S. electronic health record (EHR) market. For years, a handful of entrenched vendors have controlled this space with minimal resistance. Now, that dominance appears to be reaching its breaking point. What is unfolding is not just a legal dispute, but a potential collapse of platform control, strained by contradictions around interoperability, data stewardship, and competitive neutrality.

CureIS, a managed care technology firm serving Medicare, Medicaid, and other public programs, alleges that Epic Systems has orchestrated a “multi-prong scheme to destroy” its operations. At the heart of the complaint are claims that Epic blocked access to critical data, triggered baseless security concerns, and interfered with CureIS’s partnerships across the healthcare sector. The allegations go far beyond routine competitive friction. If proven, they depict a dominant vendor not just protecting its turf, but deliberately undermining challengers whose viability depends on the same data Epic controls. In this light, the lawsuit casts Epic not as a neutral platform provider, but as an active gatekeeper weaponizing its scale against potential disruptors.

Epic’s response to the lawsuit has been predictably sanitized. The company insists it supports “free and fair competition” and that its customers are free to adopt other solutions. But that narrative collapses under even mild scrutiny. Once a provider system is built around Epic’s infrastructure, the operational and financial cost of switching becomes prohibitive. A 2022 report from the Government Accountability Office documented how many providers feel locked into their current EHR vendors, with smaller vendors and care management platforms facing steep integration barriers and arbitrary data access restrictions (GAO Report).

CureIS’s case is not unfolding in isolation. The company is represented by Quinn Emanuel Urquhart & Sullivan, the same law firm behind a separate antitrust suit filed last year by Particle Health. In that case, Particle alleged that Epic’s dominance in the EHR sector was being used to shut out competitors in adjacent markets, including data interoperability tools and analytics platforms (CNBC on Particle Health). The emergence of two independent legal challenges—both brought by firms whose survival depends on regulated data exchange—points to a systemic issue rather than a one-off conflict.

The implications extend well beyond corporate rivalries. The Office of the National Coordinator for Health IT (ONC), through its Cures Act Final Rule, has made clear that information blocking is illegal. Health IT developers are expected to enable seamless, standards-based access to clinical data for care coordination, public health reporting, and other lawful purposes (ONC Cures Rule). If Epic is found to have blocked access in ways that violate this rule, the consequences will not be limited to courtrooms. Regulatory intervention from HHS, CMS, or even the Federal Trade Commission could follow, creating new liabilities for Epic clients who may be complicit, knowingly or not, in reinforcing closed systems.

The lawsuit also forces health systems, public agencies, and private vendors to confront a difficult reality: interoperability, as it is marketed, may be far less real than assumed. Despite widespread adoption of Fast Healthcare Interoperability Resources (FHIR) standards and increasing federal pressure to improve data sharing, most EHR vendors still function as walled gardens. According to a 2023 peer-reviewed analysis published in JAMIA Open, the availability of FHIR APIs does not guarantee practical interoperability. Many vendors use throttling, custom documentation requirements, and license-based restrictions to control access even when APIs are technically in place (JAMIA Open).

The conversation has moved well beyond interface design or workflow efficiency. At stake now is whether a single company should be allowed to control access to over 280 million patient records while simultaneously competing in the very markets that depend on that access. CureIS’s lawsuit does not just challenge Epic’s behavior—it exposes a deeper tension embedded in the structure of modern health IT. Can interoperability truly exist when the platform owner sets the terms of engagement? Or has it become a convenient marketing claim, abandoned the moment a rival edges too near?

Vendor lock-in is not new, but the stakes have changed. State Medicaid programs increasingly rely on third-party care management platforms to meet complex reporting and coordination mandates. Accountable Care Organizations and Medicaid Managed Care Organizations now depend on continuous access to claims and clinical data for risk adjustment, care gaps, and social determinant interventions. If a dominant EHR vendor can throttle or revoke data access based on vague security concerns or opaque business criteria, the operational integrity of these programs is compromised. For states managing value-based payment models, this is not a vendor issue—it is a compliance risk.

Epic’s insistence that competition is alive and well in the EHR space is increasingly disconnected from the lived experience of its users and the strategic pressures facing the broader ecosystem. CureIS’s legal action puts a spotlight on what many vendor executives, CIOs, and digital health startups have suspected for years but rarely had the legal standing to pursue: that the rules of engagement in health IT are too often rewritten by the companies that own the pipes.

What happens next may reshape the regulatory and competitive frameworks governing health data access in the United States. If Epic is compelled to open its systems or alter its contracting practices, the ripple effects will reach every corner of the care delivery and analytics markets. Providers, states, and vendors would be wise to begin re-evaluating their dependencies and integration architectures now. Waiting for a final verdict may mean standing still while the industry’s most powerful gatekeepers redraw the map.