Meaningful Use Fraud: When the Attestation Outruns the Evidence

Meaningful use fraud involves knowingly false statements about a healthcare provider’s use of electronic health records to obtain federal incentive payments. A vendor’s certification says what its software can do. The provider attests to how it used that software and whether it qualified for payment. A security review nobody performed, a software measure that overstated performance, or a manufactured report can sit behind the claim. If you worked on the implementation, prepared the reports or questioned an attestation, you may know where the account given to the government diverged from what happened inside the hospital or practice.

What Is the EHR Incentive Program?

The historical Medicare and Medicaid EHR Incentive Programs paid eligible providers to adopt certified technology and meet requirements for using it. The HITECH provisions of the American Recovery and Reinvestment Act of 2009 created the payment framework. The provider sought government money based on the technology it used and its compliance with the program’s conditions.

The incentives gave the purchase a financial purpose alongside its clinical one. Under the standard original Medicare schedule, an eligible professional starting in 2011 or 2012 could receive up to $44,000 over five years. That money helped make an EHR contract affordable. Whether the practice actually used the technology as required was the next question.

A 2022 Vassar College senior thesis, A Panacea or a Problem? Electronic Health Records and the Complicated Politics of Its Stakeholder Network, argues that incentives accelerated adoption while meaningful integration lagged. It captures the gap between purchasing a system and getting something useful from it:

That distinction matters to the employee asked to translate an implementation into an attestation.

What Did Providers Attest To?

Providers attested that they met the requirements for the relevant reporting period, including use of certified EHR technology. The measures reached actual work: security-risk analysis, clinical summaries, clinical-quality reporting and eligibility for incentive payments.

For eligible professionals, an audit by the Department of Health and Human Services’ Office of Inspector General describes self-reporting through the Centers for Medicare & Medicaid Services’ online system. The data went into a federal repository. The inspector general found that the payment agency performed minimal documentation reviews of those attestations.

We see the weakness in that arrangement: the government was paying on answers it did little to check. Inside the organization, however, the answer had a history. Someone generated a measure, reviewed a security assessment or authorized the submission. The people who did that work could see whether the supporting records matched the answer.

The reporting period belongs beside the measure. A later security review answers a different question from whether the required review occurred for the period claimed. The payment year matters too: the Office of Inspector General separately identified incorrect payments to professionals who switched between Medicare and Medicaid. A provider’s attestation needs to be understood against the program and period it actually covered.

Shelby Regional’s Finance Chief Lied, and Medicare Paid the Hospital

According to the Justice Department’s criminal-case announcement, Shelby Regional Medical Center received $785,655 after its chief financial officer falsely represented that the hospital met meaningful-use requirements. The executive pleaded guilty to making a false statement.

According to the information presented in that criminal case, the chief financial officer oversaw the hospital’s EHR implementation and was responsible for its meaningful-use attestation. On November 20, 2012, he knowingly told Medicare that the hospital qualified when it did not. The payment followed that statement.

The executive’s role put implementation and attestation in the same hands. For an employee who worked on the system, that is a concrete connection: what the hospital had implemented, what the person overseeing it knew, and what that person represented to Medicare. HHS-OIG, the Texas Attorney General’s Medicaid Fraud Control Unit and the Federal Bureau of Investigation investigated the executive’s case.

Coffey Health System’s Alleged False Security Attestations

Coffey Health System agreed to pay $250,000 to resolve allegations that it falsely attested to conducting or reviewing security-risk analyses for the 2012 and 2013 reporting periods. The Justice Department’s settlement announcement identifies Coffey as a critical access hospital in Burlington, Kansas, and connects the attestations to Medicare and Medicaid incentive claims.

The case began with a whistleblower lawsuit. The Office of Inspector General and the United States Attorney’s Office for the District of Kansas investigated it. The security review was part of what Coffey said it had done to earn the payments.

The whistleblower complaint adds a view from inside the hospital. An IT consultant who became chief information officer alleged that no security-risk analyses had been performed for 2011 through 2013. The complaint also alleged that Coffey manufactured clinical-quality data and disguised its origin:

The allegation concerns both the data and the claim about where it came from. A person preparing clinical-quality reports could recognize the manual work behind a document presented as an output from certified technology. A person responsible for security could recognize an attestation to a review that had never occurred. Those are distinct things an insider may know about the same submission process.

21st Century Oncology’s Manufactured Reports

21st Century Oncology reported in a self-disclosure that it knowingly submitted or caused false attestations about its employed physicians’ EHR use. According to the Justice Department’s announcement, the company also reported that employees falsified usage data, fabricated software-utilization reports and superimposed vendor logos on those reports to make them look legitimate.

A vendor logo supplied the appearance of a vendor report. That is the absurdity we see in the company’s account: employees were making the evidence look as though the software had produced it. Manufactured proof.

The December 2017 civil settlement was $26 million and also resolved separate allegations involving physician referral relationships. The EHR conduct came to the government through the company’s disclosure. For someone who prepares utilization reports, the question is immediately recognizable: did the system generate this report, or did someone build a document that merely looked like it had?

Humana and RMS Lifeline Disclosed Attestation Problems

Humana and RMS Lifeline resolved provider-attestation allegations after the businesses disclosed conduct to the Office of Inspector General. The agency’s notices describe civil resolutions.

Humana agreed to pay $411,600 in September 2017. The Office of Inspector General alleged that it knowingly made or used false records or statements supporting federal health care claims, specifically identifying meaningful-use attestations in the EHR Incentive Program.

RMS Lifeline and Vascular Surgery Associates of Richmond jointly agreed to pay $79,668 in October 2021. The inspector general alleged that they falsely certified physicians as meeting meaningful-use requirements and qualifying for payments. The same resolution addressed separate allegations that nurse visits were billed as physician visits.

When the Vendor Supplies the Wrong Number

A vendor’s calculation can carry a false measure into a provider’s attestation. Greenway Health supplies a specific example: the government alleged that its Prime Suite software incorrectly calculated the percentage of office visits for which users distributed clinical summaries.

In its account of the Greenway settlement, the Justice Department alleged that the company knew about the defect and refrained from correcting it so customers would continue receiving incentive payments. The government also alleged that Greenway modified test software to conceal a certification failure.

For the provider’s part in an attestation, we look at what it saw, what it knew about the faulty measure and what it told the government.

For the people using the software, the practical comparison is between the reported percentage and the visits or actions it counted. The report can look precise while its calculation tells the wrong story. Product staff may know how the code reached the result. Clinical staff may know what happened during the visits. Bringing those accounts together makes the attestation understandable.

The government’s complaint against eClinicalWorks quotes an employee acknowledging a specific denominator problem in the attestation dashboard. The quoted message describes both the counting error and how long the company had known about it:

The calculation and the internal acknowledgment belong together: the government’s complaint alleged that the company knew its dashboard was counting the wrong thing. The civil settlement with eClinicalWorks and its personnel totaled $155 million, resolving certification and kickback allegations. The whistleblower, a software technician formerly employed by a municipal health agency, received approximately $30 million.

KPMD Took the Incentives and Made the Attestation

KPMD pleaded guilty to filing false claims. The Justice Department’s criminal-case announcement describes an agreement to implement EHR software at Southwest Regional Medical Center in exchange for an assignment of the hospital’s government incentive payments.

The announcement says KPMD’s chief executive later purchased the hospital. KPMD then falsely attested that the emergency room met incentive-payment criteria even while the hospital was closing. The resulting payments went to KPMD.

The vendor was implementing the system, had acquired the right to its customer’s incentives, and made the false attestation. For an insider in implementation or finance, the contract explains who expected to receive the money. The attestation explains what was said to obtain it. Here, both led to the vendor.

What Did the Meaningful-Use Audit Find?

The Office of Inspector General estimated $729,424,395 in improper Medicare incentive payments to eligible professionals for May 2011 through June 2014, while finding that the payment agency performed minimal documentation reviews. Its June 2017 audit found that sampled professionals had failed to maintain support for their attestations.

We see a government willing to pay hundreds of millions on answers it barely checked. In a suspected fraud case, we also follow who knew the submitted answer was false. The absent risk analysis alleged at Coffey, the reports described in 21st Century Oncology’s self-disclosure, and the known software defect alleged against Greenway each offer a concrete way to examine that knowledge.

What Has Replaced Meaningful Use?

Promoting Interoperability succeeded the historical Meaningful Use programs, with different paths for hospitals, clinicians and Medicaid. The 2018 program rename accompanied changes to objectives, measures and scoring.

The Centers for Medicare & Medicaid Services describes the transition: legislation in 2015 ended the standalone Medicare EHR Incentive Program for eligible professionals and incorporated similar requirements into the Merit-based Incentive Payment System. Promoting Interoperability is a performance category within that clinician program. The Medicare Promoting Interoperability Program continues for eligible hospitals and critical access hospitals. Medicaid’s program ended on December 31, 2021.

For hospitals in 2026, the final hospital payment rule adds an attestation to security-risk management alongside the existing security-risk analysis requirement.

The security attestation therefore still matters, with changed requirements. The historical cases concern what providers said under the rules for their reporting periods. When we examine a current attestation, we start with its particular program, measure and year.

What Evidence Is Needed to Report Fraud?

Evidence of meaningful use fraud connects the attestation to its supporting records, the payment and the decisions behind the submission. Security assessments, software-generated measures, utilization reports and the underlying contract can each answer a different part of that question.

An implementation worker may know what the system could do. A reporting employee may know how a percentage or supporting report was produced. A finance employee may know which organization received the incentive. We work with you to connect what you observed to the representation that brought in the money.

The experience can also come from using a vendor’s product. Healthcare professionals at a customer facility have brought an EHR whistleblower case. That firsthand experience matters when the report and the actual workflow tell different stories.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

When You Know How the Answer Was Made

If you know why an EHR attestation conflicts with the work behind it, speak with our whistleblower experts about what you saw. We build your case around the measure, the money and the decisions inside the organization, and bring in healthcare fraud whistleblower lawyers who understand EHR incentive claims. We stay beside you from that first conversation through the case.