Electronic Health Records Fraud: When the Software Changes What Gets Paid

Electronic health records fraud includes false certification, clinical decision support kickbacks and upcoding through false or cloned notes. The software can misrepresent what a product does, steer a prescription for a paying sponsor or make a bill claim more care than the patient received.

EHR vendor fraud allegations led to the $155 million eClinicalWorks settlement with the company, its founding executives and employees. EHR billing fraud can begin with a single checkbox that generates extensive documentation to support a higher charge. If you work with these systems, you may recognize the gap between the test and the shipped product, the visit and the note, or the recommendation and the company paying for it.

How Electronic Health Records Connect Care, Claims and Certification

Electronic health records connect clinical work to billing and federal incentive payments. Clinicians use these systems to record care, order treatment and exchange patient information. Billing staff use the documentation behind a claim. Health care providers also use the system’s reported measures to support statements that they qualify for federal incentive payments. The same software sits between clinical work and government money.

A developer can know which build passed a certification test. A clinician can know whether the findings in the finished note describe the encounter.

Certification adds another set of actors. Under the Office of the National Coordinator for Health Information Technology’s certification program, authorized laboratories test the technology and authorized certification bodies certify it and conduct continuing oversight. That separation matters when a vendor shows the tester capabilities its customers never receive.

Why EHR Certification and Documentation Carry Money

Federal incentives made certification commercially valuable, while billing rules made the contents of the note financially valuable. The Centers for Medicare & Medicaid Services’ September 2018 payment report put program-to-date EHR incentive payments at $38,395,502,366. Behind that money were providers claiming that their technology and its use met the program’s requirements.

The payment could go to a provider even when the deception began at the vendor. The False Claims Act reaches someone who knowingly causes a false claim as well as someone who submits it. That is the connection behind a vendor’s responsibility for a customer’s claim: what the company misrepresented, what the provider relied on, and which payment followed.

In its June 2017 audit of Medicare payments to eligible professionals, the HHS Office of Inspector General estimated $729.4 million in improper incentive payments, or 12% of the total, for May 2011 through June 2014.

Its audit of Medicare acute-care hospitals, published in December 2019 and covering January 2013 through September 2017, estimated incorrect payments at less than 1%. The professional audit identified minimal documentation review of providers’ self-attestations. The payment depended on a statement. The oversight depended on checking what supported it.

The clinical note has its own financial pressures. The same record serves the clinician, the billing office and the incentive program, so the origin of the text matters in a fraud review: the patient’s history, the clinician’s work, a template and a billing requirement can all contribute to what looks like one continuous note.

What Has Replaced Meaningful Use?

Meaningful use became Promoting Interoperability: a continuing Medicare hospital program and, for clinicians, a category within the Merit-based Incentive Payment System. The Centers for Medicare & Medicaid Services’ program history distinguishes the continuing hospital program from the Medicaid program, which ended on December 31, 2021.

How False Documentation Becomes a False Bill

False documentation can make a claim describe more care than the clinician provided. The useful connection runs from the encounter to the text the system produced, then to the code selected and the payment sought. Knowledge can sit in the instruction to use a template, an internal discussion of inaccurate output or the decision to leave a favorable calculation unchanged.

What Constitutes Falsifying Medical Records?

Inserting false findings or leaving inaccurate copied material in a record can support upcoding: billing for a higher level of service than the care provided. The HHS Office of Inspector General’s description of overdocumentation explains the software mechanics: templates can fill fields automatically, and a single checkbox can generate extensive documentation. The finished prose can say much more than the user’s small action suggests.

Copy-and-paste EHR fraud follows that mismatch into the claim. A note carried forward can preserve findings that no longer describe the patient. A template can insert services or observations that were never performed.

Older documentation rules encouraged counting recorded history and examination elements. The payment rules changed: under the Medicare physician payment rule, beginning January 1, 2021, office and outpatient evaluation and management code selection shifted to medical decision making or time. From January 1, 2023, that approach applied to most other visit families. The agency’s evaluation and management guidance says documentation volume does not determine the service level to bill. A longer note cannot supply the missing clinical work.

What Is an EHR Audit Log?

An EHR audit log records system activity that can help establish who acted and when. The log’s reliability and whether anyone actually examined it are separate questions.

EHR audit logs in fraud review were used by only three of eighteen Medicare contractors, the HHS Office of Inspector General found in its January 2014 review. Its December 2013 safeguards report also described controls that providers could disable or bypass. A printout of the final note does not show how it was made.

Can a Whistleblower Report EHR Fraud?

Yes. EHR fraud whistleblowers have worked inside software companies and at the organizations using their products. The eClinicalWorks case began with a software technician formerly employed by a municipal health agency, and the government joined it. A former product-management executive brought the Modernizing Medicine case. The NextGen Healthcare whistleblowers were a nurse practitioner and a registered nurse using the software at a customer facility.

A developer may recognize test-only code. A clinician may recognize an inaccurate note or a prompt whose recommendation changed. A healthcare biller may see how the documentation became a code and a submitted claim. A compliance employee may understand the gap between a measure dashboard and the work it reports. Customers and competitors can see paid recommendations or product claims that someone outside the business would accept at face value.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Our whistleblower experts work with you on how to report electronic health records fraud, build your strongest case and bring in EHR fraud whistleblower lawyers with the expertise your case needs.

The EHR Fraud Patterns Behind the Software

EHR fraud settlements include the $57.25 million resolution with Greenway Health, where the government alleged both a rigged certification test and a known calculation error left in place so customers would qualify for incentive payments. Other settlements concern who paid for a recommendation or what a provider said it had done.

EHR Certification Fraud at the Test Boundary

EHR certification fraud allegations included hardcoding just 16 drug codes needed for testing in the eClinicalWorks case. The Justice Department’s May 2017 announcement alleged that those hardcoded answers stood in for the ability to retrieve codes from a complete drug database. The announcement also described allegations of inaccurate audit logs, unreliable imaging orders and drug-interaction checks, and failures in data portability. Certification uses published test scripts. The government complaint alleged that eClinicalWorks knew in advance which codes its tester would check.

In Greenway’s case, the government alleged that modifying test-run software made Prime Suite appear to support the required clinical vocabulary. The alleged calculation error in an earlier version concerned how many office visits received clinical summaries.

The eClinicalWorks government complaint quotes an employee confronting a similar dashboard problem:

That passage puts the calculation and the company’s knowledge in the same place.

NextGen’s settlement concerned, among other allegations, an auxiliary product built to perform certification test scripts. According to the Justice Department, the software released to users lacked required functions for vital signs, medical vocabularies and complete clinical summaries. The Viztek and Konica Minolta case supplies another alleged version of the same practice: hardcoded testing software and customer software the vendor knew would not meet the criteria. We see the same absurd bargain in these allegations: the test gets the capability, and the customer gets the certificate.

Clinical Decision Support Kickbacks

Clinical decision support kickbacks included a payment of nearly $1 million sought from an opioid company to create a prescribing alert in the Practice Fusion case. Under its 2020 deferred prosecution agreement, Practice Fusion admitted soliciting and receiving kickbacks to influence opioid prescribing. The Justice Department’s account of that criminal resolution describes an alert financed and shaped by the opioid company’s marketing department, with a sales pitch based on doctors prescribing more opioids.

The marketing department was helping write the clinical prompt.

The separate civil settlement of approximately $118.6 million also covered allegations involving thirteen other sponsored alert arrangements. The Justice Department alleged that sponsors could help select guidelines, set the criteria that triggered an alert and sometimes draft its language. It also alleged certification failures and disabling a patient-data export feature after certification.

For someone in product or commercial work, the agreement, the alert’s configuration and the sales forecast can describe the same transaction from different sides. The clinician sees a recommendation. The sponsor’s documents can explain what that recommendation was intended to sell.

EHR Kickbacks Through Referrals, References and Donations

EHR kickbacks ran in several directions in the allegations resolved by Modernizing Medicine’s $45 million settlement in 2022. The Justice Department alleged that the vendor received payments from Miraca Life Sciences to recommend its pathology services, paid people to recommend its own software, and joined Miraca in improper EHR donations intended to expand lab orders and software customers.

An EHR donation tied to lab referrals connects the software purchase to the specimens sent afterward. In the alleged arrangement, the vendor sought more users and the lab sought more orders by providing the practice with the system. The agreements and referral expectations explain what the supposed gift buys.

The 2021 CareCloud case shows how the sales reference itself can become the product. The government alleged that participating customers received credits, bonuses and success payments for recommendations, while contracts barred them from sharing negative information. Prospective customers allegedly learned neither that the reference was paid nor that criticism was prohibited. We would want to know both before trusting the recommendation.

Meaningful Use Fraud and False Attestations

Meaningful use fraud allegations produced a $250,000 settlement with Coffey Health System in 2019. The government alleged that the hospital falsely stated it had conducted or reviewed security risk analyses for the reporting periods of 2012 and 2013.

21st Century Oncology reported in its self-disclosure that it knowingly submitted false EHR attestations. It also reported fabricated utilization reports with vendor logos superimposed to make them look legitimate. The appearance of a vendor-generated report was part of the deception the company disclosed.

The KPMD case shows a vendor taking a more direct role in the payment. The Justice Department’s account of the criminal case resolved by KPMD’s guilty plea describes a hospital assigning its incentive payments to the software company in exchange for implementation. The vendor’s chief executive later bought the hospital. KPMD then falsely attested that the emergency room met incentive requirements even as the hospital was closing.

What Are Examples of Information Blocking?

Barriers to exporting records or exchanging electronic health information can raise information-blocking concerns. EHR data export and information blocking concern whether patients and providers can access, exchange and use that information.

The additional fraud question is what the business knowingly represented to obtain or cause a federal payment. Practice Fusion’s alleged export restriction was tied to representations made for certification and resulting incentive claims. That connection gives the access problem a place in a false-claims case.

You Know What the Software Actually Did

If you can explain why a test build, clinical prompt, patient note or attestation tells the wrong story, speak with our whistleblower experts about your EHR fraud case. We build the case strategy with you, find EHR fraud whistleblower lawyers who understand the technology and payment connection, and stay beside you throughout the case. We have walked this road with whistleblowers many times.