By Marianne Kolbasuk McGee

Federal prosecutors say an electronic health records vendor has agreed to pay US$500,000 to settle a whistleblower case about the software maker allegedly falsifying testing results in 2015 to obtain product certification for participation in the HITECH Act meaningful use incentive program.

In a statement, the Department of Health and Human Services’ Office of Inspector General and Department of Justice say Konica Minolta Healthcare Americas Inc., based in Wayne, New Jersey, agreed to settle the case alleging that its former subsidiary, Viztek LLC, caused healthcare providers to submit false claims for federal incentive payments for EHR use by misrepresenting the capabilities of its EHR software.

Court documents in the case indicate that in December 2017, a former Viztek project manager responsible for the company’s EXA EHR product filed a lawsuit under the whistleblower provisions of the False Claims Act, alleging the company caused false claims to be submitted to HHS for federal EHR incentive payments.

A Justice Department spokesman tells Information Security Media Group the whistleblower in the case will receive about US$100,000 of the settlement.

The whistleblower alleged that Viztek knowingly caused healthcare professionals who used EXA EHR to falsely attest to compliance with HHS Centers for Medicare and Medicaid Services’ meaningful use requirements during the 2015 and 2016 programme years.

To obtain certification for their products, EHR vendors were required to demonstrate that their products met HHS-adopted criteria for the “meaningful use” of their products by eligible healthcare professionals and hospitals.

Falsified Testing

Court documents allege Viztek falsified a variety of EHR certification testing results because the company failed to build the capabilities into the product offered to customers. During part of the testing period, Viztek was being acquired by Konica Minolta in Oct. 2015.

“To ensure that their product was certified and that their customers received incentive payments, Viztek and Konica Minolta falsely attested to (testing company) InfoGard that their software met the certification criteria; hard-coded their software to pass certification testing requirements temporarily without ensuring that the software released to customers met certification criteria; and caused their users to falsely attest to using a certified EHR technology, when their software could not support the applicable certification criteria in the field,” prosecutors allege in court documents.

InfoGard is also named as a defendant in the federal government’s complaint in the case. Prosecutors alleged that the testing company “knew or recklessly disregarded the fact that Viztek’s EXA EHR did not meet the certification criteria.”

InfoGard was acquired in December 2015 by UL, a global safety science company.

Neither Konica Minolta nor UL immediately responded to ISMG’s request for comment on the case.

Allegedly Faked Capabilities

Among a long list of capabilities that Viztek allegedly falsified in its EHR product was the ability to provide patients with an online means to view, download and transmit to a third party their EHR data.

The ability for healthcare providers – and health IT products – to provide patients with access to their digital health information is an intensifying focus for HHS.

In addition to the HIPAA-mandated patient right to access their records, new health IT interoperability and information blocking regulations under the 21st Century Cures Act also spotlight patients’ records access rights.

“The new information blocking rules require that patients be provided access,” says regulatory attorney Marti Arvin of the security and privacy consultancy CynergisTek. “The new interoperability rule conditions of certification include a prohibition on information blocking and a requirement to develop application programming interfaces that allow patient selected applications to connect to the EHRs.”

The HITECH Act of 2009’s Medicare and Medicaid EHR incentive programs, which provided billions of dollars to hospitals and physicians for adopting certified EHR systems, have evolved over the last couple of years into the Promoting Interoperability Program for hospitals and the Quality Payment Programme for eligible clinicians. Both offer new financial incentives to encourage healthcare providers to meaningfully use certified EHR technology.

In addition to falsifying information on patient access, Viztek allegedly falsified the EHR software’s ability to:

• Reliably record the date that a patient’s medication list or medication history data were entered;
• Reliably record the severity of medication allergies or the date that medication allergy data were entered;
• Electronically receive and incorporate laboratory tests and results.

“The flaws in the EHR defendants’ software not only rendered the system unreliable and unable to meet meaningful use standards, but the flaws also created a risk to patient health and safety,” prosecutors alleged. “Rather than spend the time and resources necessary to correct the flaws in its EHR software, the defendants opted to do nothing.”

The HHS OIG declined comment to ISMG on the number of healthcare providers and hospitals using the Vitek product that attested to meaningful use of those EHRs and received financial incentives – or whether any of those healthcare providers would be asked to return the incentive payments.

“The claims settled by this settlement are allegations only, and there has been no determination of liability,” the Justice Department says.

Other Cases