Federal and state investigators are asking whether Epic uses its position to keep rivals away from patient data. CMS publishes a file that lets you count the thing being asked about — and the answer is stranger than either side’s version.
The inquiry STAT describes runs on two tracks. One is about the agreements barring Epic employees from working across a wide swath of health care. The other is about whether Epic uses its leverage over hospital customers to block rivals from reaching patient data. One asks whether people can leave. The other asks whether competitors can arrive.
The second one is countable. Every hospital in the CMS Promoting Interoperability program has to report which certified health IT products it used. That filing is public. It names 89 developers and 306 distinct certified products across 4,046 hospitals — and it tells you, hospital by hospital, who else got in the building.
Each circle is a state or territory. Horizontal: what share of its reporting hospitals are on Epic. Vertical: how many non-base-EHR certified developers the average hospital there reported — the quality-reporting engines, the interoperability gateways, the e-prescribing layers, the AI vendors. Circle area is the number of hospitals.
Most state-level correlations in health data are small-n artifacts that dissolve under a sample-size filter. This one does the opposite: drag Min hospitals to 40 and r goes from −0.66 to −0.82. The relationship is not being manufactured by tiny states.
And then it dissolves anyway — for a different reason. Switch the Y axis to Epic hospitals only and r falls to −0.13. Switch to non-Epic only and it falls to −0.01. Inside either group there is essentially no state effect at all. Epic hospitals report almost nothing third-party in Utah and in Wisconsin alike; non-Epic hospitals report about 1.6 either way. The entire state-level correlation is a composition effect — states differ because of how many of each hospital type they contain, not because anything varies with local Epic density. If you were going to cite the map as evidence of regional foreclosure, don’t.
Worth checking the obvious outlier too. Puerto Rico is the most extreme point in the file — 40 hospitals, zero on Epic, the highest third-party count in the country at 2.30. Drop it and r moves only from −0.66 to −0.62. The pattern is not one territory, which is the answer you want but the opposite of the answer most outlier checks give.
Averages hide the shape. Here is every reporting hospital, grouped by its base EHR, binned by how many third-party certified developers it named. Cell darkness is the count of hospitals.
The fourteen most-reported non-base developers, as a share of the hospitals that could have named them. Red is the rate at Epic hospitals; navy is the rate everywhere else.
Epic hospitals are big academic systems; of course they buy less bolt-on software. That is the first thing anyone says, and you can check it.
Joining every hospital in the file to the CMS Hospital General Information file splits them into acute care and critical access. The gap survives both.
SUBSTITUTION, NOT EXCLUSION
There is a completely benign reading of every chart on this page, and it is probably the dominant one. The certified-product list is a compliance surface: electronic case reporting, syndromic surveillance, eCQM calculation, e-prescribing. Epic ships modules for all of it. A MEDITECH community hospital has to go buy Medisolv or Inpriva to close the same gap. Zero third-party certified products at an Epic hospital is what product completeness looks like from the outside. It is indistinguishable, in this file, from what exclusion looks like.
Three more things this file cannot see, that matter more than what it can:
— Certification is not integration. The overwhelming majority of clinical AI running in an Epic shop today is not on this list, because it never needed ONC certification. Ambient documentation vendors, imaging triage, sepsis models: none of them appear here. This file counts a regulatory artifact, not a market.
— Self-reported, one program year. Hospitals fill this in themselves for program year 2023. There is no audit. Reporting fatigue is a plausible explanation for a hospital naming one product instead of four.
— The denominator is wrong for the question. Only hospitals participating in Promoting Interoperability are here. Non-Medicare facilities, and hospitals that use certified technology without reporting it, are simply absent. Roughly 550 of the 4,593 facilities in the raw file named no developer at all and are excluded from every calculation above.
Nothing on this page establishes wrongdoing, and Epic’s stated position is that it is a leader in interoperability and does not engage in anticompetitive behavior. No charges have been filed.
But it does mark the seam. The countable question is not how many vendors are certified — it is what a third party has to agree to in order to read a chart: the API terms, the pricing, the app-review timeline, the contractual language between Epic and the hospital about running competing tools. The CureIS complaint alleges an “Epic-first” policy requiring customers to drop third-party tools even where Epic has no equivalent product; Epic has moved to dismiss. That is the document class an FTC inquiry can compel and a public file cannot produce.
Which is the actual builder read here. The number you can count is 0.23 versus 1.58. The number that decides whether you have a business is in a contract nobody has published.