Epic Systems' Walled Garden Is Under Federal Scrutiny

Epic runs the software behind American medicine. Now the FTC is investigating whether its tight grip on data and employees is illegal. This is about more than software; it's about control.

If you’ve been to a hospital in the last decade, your medical data almost certainly lives inside a server controlled by Epic Systems. The company’s software is the quiet, powerful plumbing for American healthcare, a digital fortress based in Verona, Wisconsin that holds the records for a majority of the country's patients. The user interface is fine. The business practices are the actual story. Now, federal investigators are finally at the gates, asking whether Epic’s fortress has become an illegal monopoly that stifles competition and traps the most sensitive data a person has.

The Federal Trade Commission is examining Epic's alleged anti-competitive behavior, and the inquiry has two main prongs. First is the technology itself. Epic's platform is a famously walled garden. While it has an API and an app marketplace called App Orchard, competitors and researchers have long complained that gaining access is costly, slow, and subject to Epic's absolute discretion. This makes it incredibly difficult for new, innovative tools to integrate with a hospital's core records system. The second front, according to three people who were recently contacted by investigators, concerns Epic's notoriously strict non-compete agreements, which can bar former employees from working for a vast swath of the healthcare technology industry, effectively trapping talent and knowledge within Epic's walls.

This isn't a battle of scrappy startups. Epic is a private behemoth, still run by its founder, that dominates the market. A 2023 KLAS Research report shows Epic holding a commanding 36% of the U.S. hospital market, with high multi-million dollar switching costs that create immense customer lock-in. Its closest competitor, Oracle's Cerner, trails significantly. The players losing this game are the hospitals who pay exorbitant fees for limited flexibility, the tech startups who can't get their foot in the door to build better patient tools, and the clinical researchers who struggle to access aggregated, anonymized data. The FTC’s probe signals a potential shift where the government, not the vendor, gets to define what a fair market for health data looks like.

The investigation is in its early stages and could take years to resolve. A settlement might force Epic to loosen its API restrictions or abandon its aggressive non-compete clauses. A full-blown antitrust suit, while less likely, could reshape the entire health IT landscape. In the immediate 1-3 years, the probe itself will have a chilling effect, making hospital CIOs think twice about their deep vendor dependency and emboldening rivals to challenge Epic's control. But the core tension remains unresolved, and the FTC is just one actor in a much larger drama. The real question isn't whether one company has too much power. It's who should ultimately have final say over a person's health records: the patient, the doctor, or the code that binds them together?