Electronic Health Records Fraud FAQ: What the Software Said and Who Got Paid

This electronic health records fraud FAQ explains how false software certification, fabricated documentation and paid recommendations can produce false Medicare and Medicaid claims. You may know the test build customers never received, the note that describes work nobody did, or the customer reference paid to stay positive. Those details can connect a product decision to government money.

Are Electronic Health Records a Fraud Hazard?

Yes. Electronic health records make it easier to copy inaccurate information and generate documentation that appears to support a higher bill. Vendor cases also reach the software’s certification, its payment calculations and the recommendations it puts in front of clinicians.

That shared record can support both treatment and payment. The people building the software and the people using it may see different parts of the same problem.

What Qualifies as Healthcare Fraud?

Knowingly submitting or causing a false government claim can violate the False Claims Act. In electronic health records cases, the false account may concern what the software can do, what care a patient received, or whether a provider met the conditions for an incentive payment.

False billing supported by an electronic record starts with the connection between the note and the charge. Vendor certification cases follow the product’s claimed capabilities into the customer’s request for payment. Both turn on the information behind the claim and what the people responsible knew.

Who Is Committing Healthcare Fraud?

Electronic health records cases have reached software vendors, health care providers, drug companies and laboratories. The roles differ: a vendor can misrepresent a product, a provider can falsely attest to its use, and a commercial partner can pay to influence clinical recommendations.

What Does It Mean to Have a Certified EHR?

A certified electronic health record has been tested and certified for specified capabilities under the applicable federal criteria. Authorized organizations perform the testing and certification. The developer’s product version and represented capabilities matter because providers rely on them when seeking federal payments.

EHR certification fraud exploits that reliance. The government publishes test procedures, the developer submits its software, and the customer relies on the certification and software-generated measures when attesting to eligibility. A false product representation can travel all the way to a payment request.

The Justice Department alleged several recognizable variations:

• Hardcoded answers. eClinicalWorks allegedly typed the 16 tested drug codes into its software instead of implementing access to the complete standardized drug vocabulary.
• A different test build. Greenway allegedly modified its test software to make the certifier believe it could use the required clinical vocabulary.
• Temporary functionality. NextGen allegedly used a temporary version of its separate Knowledge Based Model product to pass certification testing while the software used by providers lacked required capabilities.
• A function switched off. Practice Fusion allegedly disabled the certified patient-data export feature, leaving users to request exports from the company.
• A favorable calculation left wrong. Greenway allegedly knew its clinical-summary measure was miscalculated and left it uncorrected so customers would continue to qualify for incentives.

In the government’s eClinicalWorks complaint, an employee’s words expose the problem inside an attestation dashboard:

United States ex rel. Delaney v. eClinicalWorks LLC, government complaint quoting an employee, paragraph 77

A provider is asked to stand behind a number the vendor’s own employee says is hard to justify. An engineer or support specialist may know when that calculation was challenged and what happened next.

Can Healthcare Providers Be Held Liable for False Claims?

Yes. Providers can face False Claims Act cases over their own false attestations, while vendors can face cases for causing customers to submit false claims.

Who Should Be Held Accountable for Errors Made Within the Electronic Health Record?

Responsibility follows who made or caused the false claim and what they knew. The False Claims Act also reaches people who deliberately avoid the truth or recklessly disregard whether the information is true.

What Is an Example of a False Claims Act Case in Healthcare?

NextGen agreed to pay $31 million in 2023 to resolve allegations involving certification and kickbacks. The government alleged that temporary test functionality concealed missing capabilities in the software clinicians actually used.

Coffey Health System illustrates the provider side. It agreed to pay $250,000 in 2019 to resolve allegations that it falsely attested to conducting or reviewing security risk analyses for the 2012 and 2013 reporting periods.

What Constitutes Falsifying Medical Records?

Inserting false clinical information to support a charge is one way electronic health records can be used for fraud. The Department of Health and Human Services Office of Inspector General described templates that auto-populate fields and checkboxes that generate extensive text. When that text describes services or findings that did not occur, it can manufacture the apparent support for payment.

What Are the Risks of EHR Cut and Paste?

Copying without updating or checking the information can leave an inaccurate medical record and support inappropriate charges. The practical question is what the copied text says happened during this patient’s encounter.

The industry’s billing incentives help explain why records grow. A 2022 Vassar College senior thesis, A Panacea or a Problem? Electronic Health Records and the Complicated Politics of Its Stakeholder Network, argues:

A Panacea or a Problem? Electronic Health Records and the Complicated Politics of Its Stakeholder Network, Vassar College, 2022

In a suspected false-billing case, we connect the generated text to the service, the charge and the decision to use it.

What Does CMS Say About Copy and Paste?

The Centers for Medicare & Medicaid Services’ June 2016 documentation-integrity fact sheet identifies cloning, errors in auto-filled information and disabled safeguards as integrity concerns.

What Are Some Examples of Upcoding?

An upcoding example in electronic health records is false or irrelevant template text used to support a higher service level than the care delivered.

CMS’s May 2026 evaluation and management guidance directs selection for most visit families by medical decision making or time. Documentation volume does not determine the level to bill. More text is not more care.

What Is an EHR Audit Log?

An electronic health record audit log records activity in the system, helping explain who acted and when. It can help authenticate the note supporting a claim. That is why it is important for electronic health record systems to keep audit logs: the finished note and the history of changes answer different questions.

The government alleged that eClinicalWorks did not accurately record user actions and failed to reliably track certain order deletions. We examine how the particular product recorded the event, alongside the note and the claim.

What Are the Requirements for an EHR Audit Trail?

CMS’s 2016 fact sheet describes audit trails protected against alteration or deletion, with a record of who changed audit-log settings and when.

The HHS Office of Inspector General’s 2013 review found that the criteria then in use did not specifically require tracking whether text was copied, imported or entered directly. For an insider, the useful distinction is between a log showing that a record changed and one showing how the text arrived.

What Are Some Examples of Kickbacks in Healthcare?

Electronic health records kickbacks can buy customer recommendations, laboratory referrals or influence over a clinical alert. Following who paid whom reveals what the arrangement was meant to change.

Under its criminal deferred prosecution agreement, Practice Fusion admitted soliciting and receiving kickbacks to influence opioid prescribing through its software. The company solicited nearly $1 million for an alert intended to increase extended-release opioid prescriptions, with funding and design input from the drug company’s marketing department. The return it pitched was more opioid prescriptions. We see a sales objective placed inside the clinical decision.

In the separate civil settlement, the Justice Department alleged other sponsored-alert arrangements and the disabled export feature described above.

CareCloud’s customer-reference program allegedly paid customers through credits, cash and success payments while contracts barred negative information. According to the government, prospects were told neither that the reference was paid nor that criticism was prohibited. We see a sales pitch disguised as a customer reference.

In the Modernizing Medicine case, the government alleged that the vendor received payments from Miraca Life Sciences to recommend and arrange use of its pathology services. The product’s ordering workflow and the commercial agreement belong in the same account.

What Law Prohibits Payments for Patient Referrals?

The federal Anti-Kickback Statute prohibits payments intended to induce referrals, purchases, orders or recommendations involving federally payable items or services. That is why electronic health records sales incentives can reach beyond the software contract.

A laboratory subsidy, referral agreement or paid recommendation deserves a review of the arrangement and the period involved.

What Is the EHR Incentive Program?

The historical Medicare and Medicaid programs paid eligible providers to adopt and meaningfully use certified electronic health record technology. Providers self-reported compliance with program requirements, and vendor calculations supplied some of the measures behind those reports.

Meaningful use fraud concerns false representations about eligibility or use. A security analysis, a clinical-summary percentage and the attestation can tell different stories. Implementation and compliance staff may know where they diverged.

What Has Replaced Meaningful Use?

Promoting Interoperability carries the requirements through different programs. CMS distinguishes the continuing hospital program and clinicians’ Merit-based Incentive Payment System requirements from the Medicaid program, which ended in 2021.

What Are Examples of Information Blocking?

Unreasonable barriers to accessing or exchanging electronic health information can raise information-blocking concerns. Examples include obstructed exports and organizational policies delaying release. The practice, the responsible organization and its reason for restricting access are central to the inquiry.

How Can WJN Help Assess an Information-Blocking Exception?

An information-blocking exception depends on the reason for restricting access and the conditions attached to it. We assess that reason against the actual request and conduct with you.

Who Enforces Information Blocking?

The HHS Office of Inspector General investigates information-blocking allegations, while the Office of the National Coordinator for Health Information Technology oversees compliance through its certification program. Bring the restriction and any connection to government payments into our case assessment.

Can a Doctor Withhold Lab Results?

A blanket policy holding lab results solely for clinician review can raise an information-blocking concern. Federal health-IT guidance identifies that kind of organizational delay as likely interference. We examine the reason for the hold and the access circumstances with you.

What Evidence Is Needed to Report Fraud?

Useful electronic health records fraud evidence connects the product or clinical record, the payment and what someone knew. In certification cases, that may mean the difference between tested and released software, a known calculation problem or an export feature customers could not use. In billing cases, it may mean the note, its history and the resulting charge.

Engineering and quality-assurance staff may understand the test build. A clinician may recognize an invented finding. Commercial staff may know who funded an alert or paid a customer reference. We connect those accounts to the decisions behind the claim.

What If I Have Information About Fraudulent EHR Purchases or Programs?

Talk with our whistleblower experts about the purchase, product or attestation you know and its connection to government money.

What Qualifies as a Whistleblower Complaint?

Specific facts connecting knowing misconduct to a false government claim can support a qui tam case. Your part may be the internal warning, the misleading test result or the payment arrangement.

Can a Whistleblower Report EHR Fraud?

Yes. Whistleblowers have brought electronic health records cases from inside vendors and from organizations using their products. A municipal health-agency software technician brought the eClinicalWorks case. A registered nurse and nurse practitioner using NextGen brought its case, which the government joined. Customer experience can reach the product decisions behind a false claim.

What Happens When You Report Medicare Fraud?

When you bring an electronic health records concern to us, we assess the conduct, the payment connection and the evidence with you. We find whistleblower lawyers who understand health care software and federal payment cases, and stay beside you as the case develops.

How Much of a Settlement Does a Whistleblower Get?

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

How Much Is a Whistleblower Claim Worth?

The eClinicalWorks announcement reported approximately $30 million for the whistleblower who brought that case. We assess the payment and evidence behind your case with you.

How Can WJN Help With Questions About Anonymity?

Bring questions about anonymity, retaliation and HIPAA to our whistleblower experts. We handle those concerns with you as part of assessing your case and the information involved.

What Is a Gag Clause in Healthcare?

In electronic health record contracts, a gag clause restricts what users can say about the technology. Federal health-IT regulators described confidentiality and nondisparagement provisions that limited discussion of usability and safety concerns. Questions about your contract, screenshots or patient information belong in our conversation about the case.

You Know What Happened Inside the System

If the test, clinical note, attestation or paid recommendation here resembles something you have seen, speak with our Whistleblower Experts about the decision behind it. We build the case with you, connect the software to the payment, and bring in EHR fraud whistleblower lawyers with the expertise your evidence calls for.