Derek Lewis was working as an electronic health records specialist for the nation’s largest hospital chain when he heard about software defects that could lead to the death of patients.
The doctors at Midwest (City) Regional Medical Center in Oklahoma worried that the software failed to track some drug prescriptions or dosages properly, posing a “huge safety concern,” Lewis said. Lewis cited the alleged safety hazards in a whistleblower lawsuit that he and another former employee of Community Health Systems (CHS) filed against the Tennessee-based hospital chain in 2018.
The whistleblowers also allege that Medhost, the Tennessee firm that developed the software, concealed defects during government-mandated reviews that were supposed to ensure safety.
The lawsuit is one of dozens filed by whistleblowers, doctors, and hospitals alleging that some electronic health records (EHR) software used in hospitals and medical offices has hidden flaws that may pose a danger to patients—and that a substantial chunk of the $38 billion in federal subsidies went to companies that deceived the government about the quality of their products, an ongoing Fortune-KHN investigation shows.
The subsidies were designed to persuade hospitals and doctors’ offices to install software that would track the medical history of every patient and share the information seamlessly with other health care providers.
But the software makers allegedly gamed the system, repeatedly. Three major EHR vendors have made multimillion-dollar settlement deals—totaling $357 million—over DOJ investigations which include allegations that they rigged or otherwise gamed the government’s certification test. At least two other companies are under investigation.
Beyond those cases, federal officials have paid hundreds of millions of dollars in subsidies to doctors and hospitals that couldn’t show they were even qualified to receive them, according to federal officials. Nearly 28 percent of doctors and 5 percent of hospitals who attested to meeting government standards later failed audits. Federal officials told Fortune and KHN that they have clawed back $941 million in improper subsidies.
The concern isn’t just about wasteful spending of tax dollars. EHRs monitor the medicines people take and their vital signs, so software glitches that prevent doctors from accessing files quickly, that mix up patients, or send vital test results to the wrong file can contribute to serious injuries, or even deaths.
Leaping Into the Digital Era
In 2009, Congress committed billions of dollars in economic stimulus funds to bring the era of paper medical records to a close. Officials hoped to cut down on medical errors caused by illegible paper records and draw on the power of massive troves of medical data to drive down the cost of health care and help develop improved treatments for disease.The hastily devised plan offered Medicare doctors and other medical professionals up to $44,000 and $64,000 in subsidies if they bought the software and accepted patients on Medicaid, the federal health care program for low-income people.
The money was intended to help them pay vendors to install EHRs in their offices. Hospitals, which required more sophisticated and costlier software, could receive millions in subsidies, based on the number of inpatients treated. To give them a nudge, officials warned doctors and hospitals that the failure to wire up would trigger gradual cuts in their Medicare payments. EHR vendors had to meet certification standards set by the HHS Office of the National Coordinator for Health Information Technology, or ONC.
Providers had to attest that their EHR software could perform a variety of functions, which the government described as making “meaningful use” of the technology.
Certification was essentially an open-book test in which the government gave vendors the questions in advance—for instance, the names of 16 or so drugs the system would have to prescribe electronically to pass. The Justice Department has alleged that some vendors simply doctored their software to pass the test—for example, programming the required codes for just the specified 16 drugs they would be tested on, rather than all medicines—as officials had expected.
Frank Poggio, who recently retired from a 45-year career in health technology, saw the cases of fraud coming, he said, because the tests “were superficial, and if you wanted to game it, you could game it.”
He said there were many weaknesses in the system that allowed a vendor to show a “prototype” as opposed to live software.
Dr. Scott Monteith, a Michigan psychiatrist who served as an early certification juror, said he saw some limitations firsthand. He said one vendor took 30 minutes to produce a list of patients who had diabetes and also smoked, data he figured any computer program should be able to spit out in seconds. The vendor passed.
“That’s an example of how poorly thought-out the whole thing was,” said Monteith, who noted he was then, and still is, a big booster of EHRs.
Jeffery Daigrepont, a senior vice president at Coker Group, a firm that advises health providers on business decisions, said the government erred by handing out too much money in the early stages of the program, when many doctors and hospitals hadn’t yet done much more than agree to participate.
“It was an upside-down pyramid,” he said. “You got the bulk of the money for doing the least amount of effort.”
Dr. John Halamka, a physician and Harvard Medical School professor who chaired the HHS Office of the National Coordinator for Health Information Technology (ONC) standards committee, which wrote the certification rules, defended the process.
“The only problem [with certification] is that it presupposed that the product the vendor certified would be the same product they sold,” Halamka said. “It presupposes that people will go into the certification process and participate in good faith.”
That didn’t always happen in the rush to snatch up subsidy dollars, according to the whistleblowers’ suits. The DOJ case against eClinicalWorks, which has 130,000 providers, accused the company of rigging tests to win certification, claims that the company has denied. The company didn’t respond to numerous requests for comment.
The whistleblower case filed by Lewis and former co-worker Joey Neiman accuses the CHS hospital chain of submitting more than $385 million in false claims for EHR stimulus payments between 2012 and 2014.
Visiting the Oklahoma hospital as part of a troubleshooting team in June 2015, Lewis heard that physicians worried flaws in the system could result in patients being sent home “with the wrong drugs, doses, or instructions,” according to the suit.
Things got so bad that local doctors were threatening to admit patients elsewhere unless the hospital fixed the software problems, according to the suit.
In a statement, CHS said it had “complete confidence” in its records systems.
“The allegations made in the lawsuit against our hospitals are completely without merit,” the company said.
The Electronic Health Record Association, a trade group that represents more than 30 vendors, didn’t respond to a request for comment. However, vendors have argued that they faced a tangle of regulations that required them to meet constantly shifting standards that government officials often could not explain.
System Glitches and Accusations of ‘Gaming’ the System
While the ONC sets the standards, the federal Centers for Medicare & Medicaid Services (CMS) had the job of paying doctors and hospitals that attested to meeting the “meaningful use” criteria. As of September 2018, CMS had paid out $38.4 billion of these funds.In 2012, CMS hired accounting firm Figliozzi and Co. of Garden City, New York, which audited almost 50,000 medical professionals. Nearly 28 percent failed, even after they had previously attested to meeting the standards. Hospitals did better, posting a 5 percent failure rate. CMS officials said they have recovered some $941 million in improper payments. The losses to the Treasury are likely far higher, because only 14 percent of the medical professionals and 40 percent of the hospitals receiving payments were audited.
Michael Arrigo, who has served as an expert witness in health IT-related fraud and medical malpractice cases, said in some cases, EHR vendors misled hospitals about the challenges of replacing paper records with computers.
Others rolled the dice, apparently hoping the program was so large and complicated that they were unlikely to be targeted for audit.
“Sometimes [providers] got away with it until a whistleblower found out,” Arrigo said.
Reviewing state and federal court filings, Fortune and KHN found more than two dozen cases, many filed by hospitals against vendors, which depict chaotic EHR installations and safety concerns as they pursued meaningful-use dollars.
Parrish Medical Center, a 210-bed public hospital on Florida’s Space Coast, is one. In December 2010, the Titusville hospital contracted with McKesson’s Enterprise Information Solutions. One of America’s largest companies, McKesson said its product would be easy for doctors and nurses to learn and help them “deliver high-quality, safe patient care.”
But the deal collapsed, prompting a bitter court battle in which the hospital repeatedly assailed McKesson’s competence. For instance, the hospital alleged that bugs in the software caused it to create more than one record for the same patient, a flaw dubbed a “major safety issue.”
An expert hired by Parrish said he contacted eight other hospitals, including three in Florida, which had dumped McKesson due to what he called “poor or unsatisfactory customer service.”
The medical staff at one of those hospitals was “up in arms” because it took 63 mouse clicks to look up a patient’s lab results, according to the expert’s report.
Both Parrish and McKesson declined to comment for this story.
Parrish later signed on with another EHR vendor and the suit has since been settled. McKesson sold its health IT business to Allscripts in October 2017. Earlier this year, Allscripts reported to the Securities and Exchange Commission that government attorneys have requested documents from the company as part of an investigation into McKesson’s certification.
In another lawsuit, Weirton Medical Center, a hospital in West Virginia, stated in a court filing that it submitted “inaccurate” meaningful-use data to the government—although it blamed the vendor. The hospital alleged the system failed to identify a patient who was critically ill and in the hospital.
Hamstrung by Technology?
ONC officials said they keep no log of complaints they receive.That’s “a concerning number, and we have to do something to address that,” said researcher Raj Ratwani, the director of the MedStar Health National Center for Human Factors in Healthcare and a co-author of the study. These systems were used in 786 hospitals and by 37,365 provider organizations, according to Ratwani, who said there’s no way to know how many defects have been fixed.
Another 132 government-certified products have been flagged for corrective action due to “non-conformities.” As for the technology that the government alleges was fraudulently certified, it’s still used in health care settings across the country.
While those vendors faced multimillion-dollar settlements and now must operate under the oversight of a government monitor, their technology wasn’t taken off the market. Nor were they dumped by many customers who, for the most part, however, dissatisfied, were stuck with it.
ONC seemed to acknowledge that decertifying a large vendor would cause major disruption, noting in an October 2016 regulation: “Our first and foremost desire would be to work with developers to address any problems.”
In the regulations, ONC cited the costs medical providers would face should their EHR vendor shut down as ranging from $33,000 to as much as $650 million.
“It is very difficult to switch product,” said Steve Waldren, chief medical informatics officer for the American Academy of Family Physicians. “You couldn’t just go down the street and pick up another EHR, put it in and move your data over.”
He noted that beyond the considerable cost of the technology, providers would have to take time to learn a new system.
“ONC does seem to have a stance that removing some of these players from the market would be very disruptive,” said Brad Ulrich, a Tennessee health IT expert. “They are almost too big to fail.”
