Viztek and Konica Minolta: Hardcoded Certification Tests and the EXA EHR Settlement

In the Viztek Konica Minolta EXA EHR settlement, the companies agreed to pay $500,000 to resolve allegations that Viztek hardcoded its software to pass certification tests and caused false Medicare incentive-payment claims. The government’s allegation went straight to the difference an engineer or implementation specialist would recognize: the software shown to the certifier could pass an exam that the software released to customers could not actually perform.

The Justice Department announced the settlement on August 27, 2020. A former Viztek project manager responsible for EXA EHR brought the whistleblower case. According to the complaint, the project manager worked with the development teams and participated in certification testing, operating the computer while the tests ran. Special agents of the Department of Health and Human Services Office of Inspector General investigated the case.

EXA came out of a healthcare imaging-software business. Viztek’s platform combined picture archiving, radiology information, mammography viewing and electronic health records. That matters because the certification dispute concerned the EHR’s particular capabilities inside a broader radiology product line. The complaint described a development team working on other EXA modules as well as the EHR.

What Does It Mean to Have a Certified EHR?

A certified EHR has passed tests and received certification that it meets government requirements for specified functions. In this case, those were the 2014 Edition criteria, and the complaint identifies the product as EXA EHR version 1.0.

The Office of the National Coordinator for Health Information Technology sets the certification framework. Outside laboratories perform the tests, and authorized certification bodies issue the certificates. InfoGard Laboratories served as both the testing laboratory and certification body for EXA.

The tests used scripts made available to vendors in advance. As the complaint explains the testing process, those scripts sampled representative capabilities. The certification body also relied on the vendor’s statements about requirements the scripts did not test directly.

That is the opening the government alleged Viztek exploited. A disclosed test tells a developer what the examiner will ask. We expect the answer to come from working software. The allegation here was that Viztek supplied the answer without building the capability behind it.

What Is the EHR Incentive Program?

The historical Medicare and Medicaid EHR Incentive Program paid eligible hospitals and health care professionals to adopt certified electronic health records and demonstrate meaningful use of the technology. Certification connected the vendor’s product to the customer’s eligibility for government money.

The complaint described the incentive available to an individual practitioner: up to $43,720 over five years from Medicare or $63,750 over six years from Medicaid.

The EXA settlement concerned Medicare incentive claims for the 2015 and 2016 program years. In the settlement agreement’s account of the alleged conduct, the government said Viztek misrepresented compliance to its customer and caused eligible professionals to falsely attest that they met the requirements for payment.

The alleged false statement began with the software maker. The request for government money came from the provider using the software. Following that connection explains why the case reached the vendor: its representations about certification allegedly supplied the basis for someone else’s Medicare claim.

Hardcoded Certification Tests and the Customer Product

The government alleged that Viztek hardcoded EXA EHR during testing from August 26, 2015 through March 15, 2016, knowing that the software released to customers would not satisfy all the certification criteria. EXA received its 2014 Edition certification on March 16, 2016.

Viztek developed EXA EHR in 2014. Konica Minolta bought Viztek during the testing period, on October 1, 2015, according to the complaint. The agreement identifies the buyer as Konica Minolta Medical Imaging U.S.A., which later became Konica Minolta Healthcare Americas. The government’s detailed hardcoding allegation names Viztek.

The Buyout Put Pressure on Certification

The complaint alleged that developers had neglected EXA EHR because they expected to adapt Viztek’s older Opal EHR, which had passed 2011 Edition certification. They were also working on other EXA modules. When testing began, the project manager said, little of the required functionality was ready.

With the Konica Minolta sale approaching, the president allegedly told the project manager to get the software certified:

According to the complaint, the president said they could lose millions of dollars if certification was not complete by February 2016. That was the alleged pressure behind the demonstrations the project manager described.

The Languages in the Test Script

The whistleblower alleged that Viztek programmed the preferred-language field to handle only the sample languages the test would use. The required capability extended to the full language standard. The test checked a small, disclosed sample.

That made the difference between implementing a standard and implementing its examination questions concrete. According to the complaint, the developers coded the software to work for the few languages needed to pass, while the broader language capability remained missing. A tester could enter the expected examples and see a successful result without exposing the limitation.

A Prepared Screen for Medication Reconciliation

The complaint alleged that EXA could not display information from two sources together for medication, problem and medication-allergy reconciliation. The required view would let a user compare the lists and their attributes. The alleged substitute was a screen made ahead of time:

The examiner allegedly saw the result of reconciliation without the software doing the reconciliation. A picture of a function.

XML That the Software Could Not Produce

The whistleblower also alleged that developers manually created the XML output needed for a patient-data test. The capability being tested allowed patients to view, download and transmit their information. The examiner watched the output to see whether it used the required format.

The complaint puts the alleged substitution plainly:

In another episode, the complaint alleged that developers copied XML from a competitor’s example on a certification-testing website. The competitor’s name remained in the code. The project manager flagged the copied name. According to the complaint, the software-development executive instructed the project manager to continue testing.

A Break, a Different Build, Another Attempt

The complaint alleged that remote screen-share testing let Viztek switch tabs, pause the screen and change the software behind the demonstration. When a test failed, managers allegedly instructed the project manager to request a break while offsite developers worked on a solution.

According to the complaint, the developers had multiple builds running on different servers. Teams tried workarounds on those builds at the same time, and whichever build worked first was used to finish the test. The alleged solution to a failed function was to change what the examiner was seeing.

The complaint also alleged that EXA could not reliably record medication-allergy severity or receive and incorporate laboratory results.

The testing allegedly exposed live patient data, too. The complaint said the EXA product line was already in use and patient information sat on Viztek’s servers. During attempts to work around the tests, developers allegedly caused that information to appear in test output.

The Five-Defendant Case and the Two Settling Companies

The complaint named Viztek, Konica Minolta Healthcare Americas, Viztek’s founder and former president, its software-development executive, and InfoGard Laboratories. The settlement agreement placed the payment obligations on Viztek and Konica Minolta Healthcare Americas. The whistleblower alleged that the founder and software-development executive explicitly directed employees to cheat on certification tests.

The whistleblower alleged that InfoGard’s tester allowed repeated attempts and breaks after failures. In one episode, the tester allegedly noticed that the displayed version number had changed after a break, told the team to complete testing on a single version and server, and nevertheless awarded a pass for that portion of the test. The complaint also alleged that the tester noticed changes in colors and in the positions of fixed screen elements.

How Much of a Settlement Does a Whistleblower Get?

The EXA agreement allocated 20% of the settlement proceeds to the whistleblower.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Here, the agreement stated the share directly. The project manager’s account of the testing became the basis of the qui tam case that the settlement resolved.

The Settlement Against the Business Behind It

The complaint put Viztek’s annual revenue above $70 million at the time of the sale. The agreement required a $500,000 settlement and a separate $155,352 in fees and costs for the whistleblower’s counsel. For a business of that size, we see a small price for settling allegations that a federal certification test became a staged demonstration.

Why a Passing Demonstration Matters in Patient Care

Reconciliation and data export connect information across people and systems. In their 2019 investigation, Death by a Thousand Clicks: Where Electronic Health Records Went Wrong, Fortune and Kaiser Health News reported that 96% of hospitals had adopted EHRs while proprietary systems still routinely failed to exchange information. The investigation also described patient-safety reports involving software glitches, user errors and other failures.

The EXA complaint alleged risks to patient health and safety. Its examples show why the distinction between a prepared screen and a working capability matters: the medication lists and patient-data outputs were functions intended to be used in care. We care about what happens when the demonstration ends and the practice needs the software to do the same work.

The same testing gap appears in other vendor allegations. In eClinicalWorks’ case, the government alleged that developers hardcoded the sixteen drug codes used in testing. Greenway allegedly modified its test software to make the required clinical vocabulary appear available. NextGen allegedly used a separate product built for certification scripts. And the civil allegations against Practice Fusion concerned a certified export function later disabled.

The common question is what the certification represented about the product customers could use. EXA’s complaint answers it with the people in the testing room, the screens they displayed and the builds they changed.

What Evidence Is Needed to Report Fraud?

For an EHR certification case, we connect the test scripts, the software demonstrated, the version released to customers and the representations supporting incentive payments. The EXA project manager could describe the testing firsthand. The complaint identified particular functions and the methods allegedly used to make them appear complete.

For an engineer, the important difference may be between the test build and the released build. For an implementation specialist, it may be between the capability promised to a customer and the product delivered. We work with that knowledge and the available development and payment records to establish how the pieces fit. An insider’s account can explain a discrepancy that a certificate alone conceals.

You Saw What the Test Could Not

If you saw a prepared screen, a borrowed output or a test build that customers never received, talk with our whistleblower experts about the software behind the certificate. We build the case with you and bring in EHR fraud whistleblower lawyers who understand certification and Medicare incentive payments. We stay beside you from the first technical account through the pursuit of a recovery.