EHR: Private Whistleblowers Getting in on “Meaningful Use” Crackdown

Wrongful payment of electronic health records (EHR) “meaningful use” incentives has become a growth area in federal health care fraud enforcement. And now private whistleblowers are getting in on the act by leveraging EHR fraud to bring suits for money damages in civil courts.

The Government EHR Fraud Crackdown
While EHR abuse has been on the government radar for a while, 2017 proved to be a breakthrough year. In June, the OIG issued a report citing CMS for paying $729.4 million in wrongful EHR incentive payments between May 2011 and June 2014 and declaring the agency’s intention to get that money back.

Just two weeks earlier, the Justice Department announced that leading EHR software vendor eClinicalWorks had settled false claims charges stemming from allegedly overstating the capabilities of its product. In addition to paying $155 million, the Massachusetts-based vendor agreed to enter into a Corporate Integrity Agreement imposing onerous restrictions.

The Privatization of EHR Fraud Litigation
The new EHR fraud is case against over 60 Indiana hospitals unsealed on Nov. 21 breaks new ground: it is the first such case in which the government is not involved. Instead, the case was filed as a civil lawsuit by a whistleblower without any government intervention.

The other novel aspect of the $325 million qui tam case is the identity of the whistleblowers. A group of medical malpractice attorneys who claim they were among the victims to suffer personal harm as a result of the hospitals’ alleged inclusion of inaccurate and untimely data about their medical records processing practices in their EHR meaningful use attestations. The relators claim they relied on the faulty data in bringing malpractice claims on behalf of their clients. The relators also claim that a national “release of information” provider overcharged patients for copies of their records in violation of HIPAA.

Takeaway: On a related note, the U.S. Supreme Court has been asked to decide whether patients can bring a private lawsuit against a provider for failing to furnish timely notification that its protected health information has been breached.