Coffey Health System: The Security Work the Government Said Was Missing

In the Coffey Health settlement, Coffey Health System agreed to pay $250,000 to resolve allegations that it falsely claimed to have conducted or reviewed security risk analyses for the 2012 and 2013 reporting periods. For hospital IT and compliance staff, the case reaches into familiar work: finding the analysis behind an attestation, identifying vulnerabilities, and seeing what happened before the next submission for payment.

Coffey operated a twenty-five-bed critical access hospital in Burlington, Kansas. The Department of Justice announced the settlement on May 31, 2019, following an investigation by the Department of Health and Human Services Office of Inspector General and the United States Attorney’s Office for the District of Kansas.

Two former employees brought the qui tam case under the False Claims Act. Their complaint identifies their roles as chief information officer and corporate compliance officer and grant writer. Their account describes what happened when the information officer went looking for the security work the hospital had already told the government it had done.

What Is the EHR Incentive Program?

The EHR incentive program offered Medicare and Medicaid payments to eligible health care providers that adopted certified electronic health record technology and met requirements for its use. The American Recovery and Reinvestment Act of 2009 established the program to encourage adoption and meaningful use. The security analysis was part of the representation needed to obtain the money.

As the Justice Department explained in its settlement announcement, providers had to attest that they met criteria that included analyzing and addressing security risks to electronic health records. An attestation told the government that the provider had satisfied those requirements. It connected the work inside the hospital to a request for federal funds.

Under the law that established the program, a qualified electronic health record could support physician order entry and queries about health care quality. The hospital’s payment attestation concerned how it used that technology and met the program’s requirements.

The Analyses the Information Officer Could Not Find

The whistleblowers alleged that Coffey had already made security attestations for the earlier reporting periods when its future chief information officer arrived as an IT consultant in June 2014. After his promotion that August, he asked for the most recent security risk analysis. According to the complaint, he repeatedly confirmed that no analysis had been performed for 2011 through 2013.

The complaint alleged a direct conflict between the hospital’s submissions and its supporting records: the Centers for Medicare & Medicaid Services attestation portal showed the security analyses as completed, while the information officer found no documentation supporting those attestations.

He then conducted basic network-security tests. The complaint describes the alleged access problem in unusually concrete terms:

We see an extraordinary gap in that allegation: a hospital seeking money for secure use of electronic records while patient information was allegedly reachable from a school or library.

A Later Review and Another Attestation

The complaint alleged that a later security review identified serious vulnerabilities and that Coffey corrected very few of the deficiencies before another disputed attestation.

According to the complaint, the information officer arranged for MainNerve to conduct a security risk analysis for the upcoming 2014 attestation. The analysis was completed in October 2014 and identified dozens of vulnerabilities, including five rated critical. The information officer reported the results to Coffey and began trying to address the highest-priority problems.

The whistleblowers alleged that the hospital did not provide adequate tools or support for that work. Very few of the identified deficiencies were corrected, they said, and the hospital caused another false security attestation to be submitted. The allegation followed the findings into the hospital’s decisions about what to fix and what to tell the government.

The complaint puts the hospital’s resource decisions between the review and the attestation. For someone responsible for the fixes, that is a recognizable decision: what support management provided, what remained unresolved, and what the hospital submitted anyway.

Manually Created Data Presented as EHR Output

The complaint also alleged that Coffey submitted manually generated clinical quality measures data while representing that the data came from its certified electronic health record technology. The whistleblowers described an effort to make the submission look like something the software had produced:

The information officer refused to support the 2014 attestations, according to the complaint. The whistleblowers alleged that Coffey nonetheless submitted the disputed attestations in April 2015.

The Incentive Money Behind the Settlement

We see a striking gap: a $250,000 settlement over the earlier security attestations, against at least $3 million in incentive payments alleged in the whistleblowers’ broader complaint.

The complaint alleged that the hospital obtained payments it would never have received without the false attestations. In the whistleblowers’ account, the representations got ahead of the work. The money followed.

The government joined the whistleblowers’ case for settlement on May 23, 2019. Coffey agreed to the payment to resolve the government’s allegations about the security reviews.

Coffey and Kettering: Same Attestation, Different Evidence

Kettering Health Network faced a whistleblower case involving the same security-risk-analysis attestation question, and the court dismissed it. The court’s account of that case describes a certification covering the analysis, necessary security updates and correction of identified deficiencies through the provider’s risk-management process.

The Kettering case rested on the network’s letters reporting improper employee access to patient records. Coffey’s complaint described a different set of evidence: the information officer’s search for missing analyses, the later security findings, the hospital’s response and the attestations submitted for payment.

For a hospital insider, that is where the useful comparison lies. The assessment, the corrective work and the payment representation each have their own history. Coffey’s whistleblowers alleged connections among them, including what the hospital knew before another submission. Those connections are the substance we examine with someone who saw the work from inside.

Why the Incentive Check Could Outrun the Work

A 2022 Vassar College senior thesis, A Panacea or a Problem? Electronic Health Records and the Complicated Politics of Its Stakeholder Network, argues that the financial push for EHR adoption often put installation ahead of useful integration into clinical work. Its discussion of adoption makes the distinction plainly:

The thesis argues that the rollout strengthened vendors’ financial position while often disregarding clinical utility. Applied to the question Coffey raises, it directs attention to the work after a system is bought: assessing the local environment, responding to findings and supporting the statements made for payment.

At Coffey, the alleged conflict was concrete: the hospital wanted another incentive payment while, according to the complaint, providing inadequate support to address the security findings. The incentive paid for adoption and meaningful use. The people responsible for making that use secure still needed resources to do their jobs.

What Evidence Is Needed to Report Fraud?

We work with you to connect the security analysis, what the hospital knew, and its statement seeking incentive money for the reporting period. Coffey’s complaint made those connections through an attestation portal, the search for earlier analyses, a later assessment and the alleged response to its findings.

An IT employee may know what the assessment found and which corrections were completed. Someone responsible for quality reporting may know how the submitted data was produced. A compliance employee may know what the hospital was asked to confirm. We work with you to connect that knowledge to the payment representation and build the case around the decisions you can explain.

How Much of a Settlement Does a Whistleblower Get?

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

In Coffey’s case, the announced combined reward for the two whistleblowers was about 20% of the settlement. Their knowledge of the hospital’s IT and compliance work put the facts behind the attestations into a case the government joined.

You Know What Supported the Attestation

If you saw the security analysis, the unresolved findings or the quality data behind a hospital’s incentive claim, speak to one of our whistleblower experts about building your strongest EHR whistleblower case. We build the case with you, bring in healthcare fraud whistleblower lawyers who understand EHR incentive attestations, and stay beside you through the pursuit of a recovery.