False EHR Security Risk Analysis Attestations: The Work Behind the Checked Box

An EHR security risk analysis false attestation tells the government that a provider completed or reviewed required security work when it did not. The statement helps the provider obtain EHR incentive payments. For the security officer or IT employee who saw the work, the questions are concrete: which systems were examined, who reviewed the findings and whether anyone did the analysis the hospital said it had done. In Coffey Health System’s case, the government alleged false attestations for the 2012 and 2013 reporting periods. The hospital’s former chief information officer described the missing work from inside the organization.

What Is the EHR Incentive Program?

The historical Medicare and Medicaid EHR Incentive Program paid eligible healthcare providers to adopt certified electronic health record technology and demonstrate meaningful use. Providers had to attest that they satisfied the applicable requirements, including measures for analyzing and addressing security risks. The U.S. Attorney’s Office for the District of Kansas described that payment connection in its Coffey announcement.

Buying the software was one part of the bargain. The provider also represented that it had done the work required to qualify for the money. For the security measure, that work concerned the risks to patient information and the response to those risks.

The Centers for Medicare & Medicaid Services’ February 2014 tipsheet for eligible professionals described conducting or reviewing a security risk analysis, implementing necessary security updates and correcting identified deficiencies through risk management. It also explained that installing a certified EHR left the provider responsible for a full analysis. The product’s certificate could not answer whether the provider had examined its own environment.

Coffey’s Alleged False Security Attestations

Coffey Health System agreed to pay $250,000 in May 2019 to settle allegations that it falsely attested to conducting or reviewing security risk analyses. The whistleblower’s complaint identified incentive payments of $1,202,600 for 2012 and $961,968 for 2013.

Coffey operated a critical access hospital in Burlington, Kansas. The government alleged that its representations for the reporting periods at issue supported false claims to Medicare and Medicaid. The complaint alleged that the insider joined Coffey’s IT department as a consultant in June 2014, became chief information officer that August and learned that no security risk analyses had been performed for 2011 through 2013.

The complaint put a specific security problem behind that allegation:

That alleged exposure reached beyond the hospital’s EHR application to the network around it. If the allegations are true, a checked box concealed a very different picture of patient security.

Two whistleblowers brought the case. The Department of Health and Human Services’ Office of Inspector General and the U.S. Attorney’s Office for the District of Kansas investigated it.

What Did the Security Risk Analysis Cover?

A security risk analysis examines potential threats and vulnerabilities to electronic protected health information, including its confidentiality, integrity and availability. The Department of Health and Human Services’ Office for Civil Rights guidance from July 2010 describes an assessment of the organization’s actual environment: where information resides, how it moves, what can go wrong and how the existing safeguards work.

That scope reaches information on portable devices, individual workstations and networks connecting multiple locations. The Centers for Medicare & Medicaid Services’ tipsheet made the point in everyday equipment: a tablet, a practice manager’s mobile phone and a copier that stores data. A review confined to the EHR application can leave the surrounding systems unexamined.

The work also reaches people and procedures. The Department of Health and Human Services’ guidance identifies technical weaknesses alongside ineffective or missing policies. It asks whether security measures are configured and used properly.

The analysis connects a threat to a weakness, considers how likely the threat is to occur and how much damage it could cause, and assigns a risk level. Those findings feed the corrective work. For a health care organization, keeping information available for care belongs in that assessment alongside preventing unauthorized access.

The Centers for Medicare & Medicaid Services’ March 2016 guidance made the follow-through concrete. Its action plan called for the planned corrective steps, the person responsible and a target date. Software updates, changes in workflow or storage, revised policies and staff training could all follow from an analysis. Each addresses a finding about the practice rather than supplying a generic promise that the product is secure.

Missing Documentation, Inadequate Analysis and a False Attestation

We look at the attestation beside the work behind it: who performed the analysis, what it covered and what the people approving the statement knew.

The Department of Health and Human Services requires a documented risk analysis but does not prescribe one format. Its HIPAA audit protocol calls for the written analysis or other records showing the assessment. Auditors examine the systems covered, identified threats, existing safeguards, and the likelihood and impact of harm. A checklist can help start an analysis, the Centers for Medicare & Medicaid Services explains, but falls short of performing or documenting the systematic assessment. Missing documentation alone does not establish that no analysis occurred. Evidence that the assessment omitted patient-data systems or failed to examine threats and their impact instead points to deficient work.

The provider’s attestation connects that work to the government payment. Coffey’s settlement concerned the allegation that the hospital falsely represented that it had conducted or reviewed the required analyses. The false-attestation question turns on whether that submitted statement matched the work for the reporting period. In Coffey’s case, the complaint alleged that the earlier analyses had never been performed.

The response to the findings leaves its own trail. CMS’s guidance placed corrections on the timeline established through the provider’s risk-management process. In Coffey’s complaint, the whistleblower alleged that very few deficiencies identified in a later analysis were corrected despite his efforts. That was his allegation about the response to identified problems, distinct from his account of earlier analyses never performed.

Why the Reporting Period Matters

The reporting period identifies the security work the attestation represented. Coffey’s settled allegations concerned its incentive submissions for the earlier periods.

The Centers for Medicare & Medicaid Services’ 2016 tipsheet allowed the analysis to occur outside the EHR reporting period, while requiring it to cover the technology used during that period and the full reporting period. It also required an annual analysis or review before attestation. The Department of Health and Human Services’ underlying guidance describes an ongoing process that responds to changes in technology and operations.

The requirement has continued under newer programs. CMS’s account of the program transition distinguishes hospital Promoting Interoperability from the MIPS Promoting Interoperability category for clinicians. Security assessment remains part of clinician reporting. For hospitals and critical access hospitals, the rule for the 2026 reporting period adds an attestation about security risk management to the existing attestation about security risk analysis.

We connect the statement to the work required for that provider and that reporting period. If you know a current attestation described security work nobody performed, that is a conversation to have with our whistleblower experts.

Who Could Know Whether the Review Happened?

A security officer, compliance employee, IT consultant or chief information officer may connect the statement submitted for payment with the work inside the organization. The Coffey complaint shows why an insider’s vantage point matters: the person describing the alleged absence of earlier analyses also described efforts to correct later security deficiencies.

The Department of Health and Human Services’ audit protocol examines workforce responsibilities and management involvement as well as the assessment itself. It looks at earlier analyses, updates and evidence that security measures were implemented or were being implemented in response to findings. Those records show more than whether a report sits in a folder.

An insider can explain who commissioned the review, which systems the reviewer examined and who received the results. We want to understand how those findings reached the people who approved the incentive submission.

We see a hospital seeking public money on the strength of a security review it allegedly never performed. The money arrived. Where was the review? The person who knows whether the work happened can connect the promise to the operation of the hospital.

Why Incentive Payments Changed the Stakes

The incentive program made a provider’s representation about security work part of its request for government money. That made the difference between adoption and implementation consequential.

A Panacea or a Problem? Electronic Health Records and the Complicated Politics of Its Stakeholder Network, a 2022 Vassar College thesis, argues that financial incentives encouraged rapid adoption while the quality of integration lagged. Its analysis of the incentive program puts the distinction plainly:

That distinction matters for security: acquiring the software leaves the provider’s work on its own network, devices and patient information still to be done. We ask what analysis, review and corrective work supported the answer it sent the government.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Coffey’s case began with whistleblowers who challenged the provider’s representations about that work.

EHR Measure Calculations and False Attestations

EHR measure-calculation allegations concern the numbers software produces to support a provider’s attestation. Security-risk-analysis allegations concern the provider’s representation about an assessment or review. The evidence follows the particular statement used to obtain payment.

In the government’s case against Greenway Health, it alleged that an earlier version of Prime Suite incorrectly calculated the percentage of office visits for which users distributed clinical summaries. The government further alleged that Greenway knew about the error and left it uncorrected so users would receive incentive payments.

That allegation points toward software calculations and decisions about correcting a known defect. Coffey’s security allegation points toward the analysis the provider said it had conducted or reviewed. An insider’s account becomes useful when it connects the specific representation, the people behind it and the work or system that supposedly supported it.

When You Know What the Attestation Concealed

If you worked on security, compliance or an EHR incentive submission and know that the attestation described work nobody performed, speak with our whistleblower experts. We work beside you to build your strongest EHR fraud whistleblower case, connecting the security work, the people who approved the representation and the government payment. We bring in EHR fraud whistleblower lawyers who understand provider incentive cases and stay with you throughout the process.