📋 Free Download: 2026 HIPAA Compliance Checklist — updated for the latest OCR enforcement priorities. Get it free →

Back to Blog
HIPAA Settlement

Electronic Health Records Vendor to Pay $14.5 Million

When an EHR vendor's data practices led to a landmark settlement — and what it means for healthcare technology contracts.

April 2026 3 min read AXIS CloudSync Compliance Team
Share
Prefer to listen? Hit play — audio available.
Listen

[00:00.0 - 00:03.1] Practice Fusion, Inc. admits to kickback scheme [00:03.1 - 00:05.7] armed at increasing opioid prescriptions. [00:05.7 - 00:08.5] Practice Fusion, Inc., Practice Fusion, [00:08.5 - 00:12.4] a San Francisco-based health information technology developer, [00:12.4 - 00:17.2] will pay $145 million to resolve criminal and civil investigations [00:17.2 - 00:19.7] relating to its electronic health records, [00:19.7 - 00:23.3] EHR software, the Department of Justice announced today.

[00:23.9 - 00:26.1] As part of the criminal resolution, [00:26.1 - 00:28.2] Practice Fusion admits that it's solicited [00:28.2 - 00:31.4] and received kickbacks from a major opioid company [00:31.4 - 00:34.2] in exchange for utilizing its EHR software [00:34.2 - 00:37.7] to influence physician prescribing of opioid pain medications. [00:38.3 - 00:42.2] Practice Fusion has executed a deferred prosecution agreement [00:42.2 - 00:46.0] and agreed to pay over $26 million in criminal fines and forfeiture. [00:46.0 - 00:47.4] In separate civil settlements, [00:48.1 - 00:53.0] Practice Fusion has agreed to pay a total of approximately $118.6 million [00:53.0 - 00:56.6] to the federal government and states to resolve allegations [00:56.6 - 00:59.6] that it accepted kickbacks from the opioid company [00:59.6 - 01:01.8] and other pharmaceutical companies [01:01.8 - 01:04.6] and also caused its users to submit false claims [01:04.6 - 01:06.7] for federal incentive payments [01:06.7 - 01:10.2] by misrepresenting the capabilities of its EHR software.

[01:11.0 - 01:15.0] Across the country, physicians rely on electronic health records [01:15.0 - 01:17.5] software to provide vital patient data [01:17.5 - 01:19.2] and unbiased medical information [01:19.2 - 01:21.4] during critical encounters with patients, [01:21.4 - 01:23.9] said Principal Deputy Assistant Attorney General [01:24.6 - 01:27.8] Ethan Davis of the Department of Justice's Civil Division. [01:28.6 - 01:31.8] Kickbacks from drug companies to software vendors [01:31.8 - 01:34.3] that are designed to improperly influence [01:34.3 - 01:37.4] the physician-patient relationship are unacceptable. [01:37.9 - 01:42.3] When a software vendor claims to be providing unbiased medical information, [01:42.3 - 01:45.9] especially information relating to the prescription of opioids, [01:45.9 - 01:48.7] we expect honesty and candor to the physicians [01:48.7 - 01:51.2] making treatment decisions based on that information.

[01:51.9 - 01:55.2] The resolution announced today addresses allegations [01:55.2 - 01:58.6] that Practice Fusion extracted unlawful kickbacks [01:58.6 - 02:00.3] from pharmaceutical companies [02:00.3 - 02:03.0] in exchange for implementing clinical decision support, [02:03.6 - 02:06.5] CDS alerts in its EHR software [02:06.5 - 02:09.2] designed to increase prescriptions for their drug products. [02:09.8 - 02:12.7] Specifically, in exchange for sponsorship payments [02:12.7 - 02:14.1] from pharmaceutical companies, [02:14.6 - 02:17.8] Practice Fusion allowed the companies to influence the development [02:17.8 - 02:20.2] and implementation of the CDS alerts [02:20.2 - 02:23.8] in ways aimed at increasing sales of the company's products. [02:23.8 - 02:27.0] Practice Fusion allegedly permitted pharmaceutical companies [02:27.0 - 02:29.7] to participate in designing the CDS alert, [02:29.7 - 02:33.0] including selecting the guidelines used to develop the alerts, [02:33.0 - 02:34.8] setting the criteria that would determine [02:34.8 - 02:37.2] when a healthcare provider received an alert, [02:37.2 - 02:38.4] and in some cases, [02:38.4 - 02:40.8] even drafting the language used in the alert itself.

[02:41.5 - 02:44.8] The CDS alerts that Practice Fusion agreed to implement [02:44.8 - 02:47.7] did not always reflect accepted medical standards. [02:48.3 - 02:50.8] In discussions with pharmaceutical companies, [02:50.8 - 02:54.2] Practice Fusion touted the anticipated financial benefit [02:54.2 - 02:56.0] to the pharmaceutical companies [02:56.0 - 02:58.6] from increased sales of pharmaceutical products [02:58.6 - 03:00.6] that would result from the CDS alerts. [03:01.2 - 03:03.7] Between 2014 and 2019, [03:03.7 - 03:07.2] healthcare providers using Practice Fusion's EHR software [03:07.2 - 03:10.3] wrote numerous prescriptions after receiving CDS alerts [03:10.3 - 03:13.1] that pharmaceutical companies participated in designing.

[03:13.8 - 03:17.1] Practice Fusion executed a deferred prosecution agreement [03:17.1 - 03:20.3] with the U.S. Attorney's Office for the District of Vermont [03:20.3 - 03:23.0] based on its solicitation and receipt of kickbacks [03:23.0 - 03:25.3] from a major opioid company [03:25.3 - 03:27.3] to arrange for an increase in prescriptions [03:27.3 - 03:31.2] of extended-release opioids by healthcare providers [03:31.2 - 03:33.8] who used Practice Fusion's EHR software. [03:34.4 - 03:37.3] As detailed in the criminal information made public today, [03:37.9 - 03:41.4] Practice Fusion solicited a payment of nearly $1 million [03:41.4 - 03:44.6] from the opioid company to create a CDS alert [03:44.6 - 03:46.4] that would cause doctors to prescribe [03:46.4 - 03:48.2] more extended-release opioids.

[03:49.0 - 03:50.3] That payment was financed [03:50.3 - 03:52.9] by the opioid company's marketing department [03:52.9 - 03:55.0] and the CDS was designed with input [03:55.0 - 03:56.2] from the marketing department. [03:56.9 - 03:58.9] Practice Fusion and the opioid company [03:58.9 - 04:01.4] entered the CDS sponsorship [04:01.4 - 04:03.0] because they believed that the CDS [04:03.0 - 04:04.9] would influence doctors' prescriptions [04:04.9 - 04:07.0] of extended-release opioids. [04:07.0 - 04:09.3] In marketing the pain CDS alert, [04:09.3 - 04:11.5] Practice Fusion touted that it would result [04:11.5 - 04:12.9] in a favorable return.

[04:12.6 - 04:19.2] turn on investment for the opioid company based on doctors prescribing more opioids. [04:19.2 - 04:21.9] Practice Fusion's conduct is abhorrent. [04:21.9 - 04:26.3] During the height of the opioid crisis, the company took a million-dollar kickback to [04:26.3 - 04:31.4] allow an opioid company to inject itself in the sacred doctor-patient relationship so [04:31.4 - 04:36.6] that it could peddle even more of its highly addictive and dangerous opioids, said Christina [04:36.6 - 04:40.0] E.

Nolan, U.S. Attorney for the District of Vermont. [04:40.0 - 04:43.8] The company's illegally conspired to allow the drug company to have its thumb on the [04:43.8 - 04:49.0] scale at precisely the moment a doctor was making incredibly intimate, personal, and [04:49.0 - 04:53.8] important decisions about a patient's medical care, including the need for pain medication [04:53.8 - 04:55.7] and prescription amounts.

[04:55.7 - 05:00.8] This recovery is commensurate to the nature of Practice Fusion's misconduct, represents [05:00.8 - 05:05.2] the largest criminal fine in the history of this district, and requires Practice Fusion [05:05.2 - 05:07.5] to admit to its wrongs. [05:07.5 - 05:12.1] It is another example of pioneering health care fraud enforcement by the talented Assistant [05:12.1 - 05:17.5] U.S. Attorneys and staff of this U.S.

Attorney's Office working with their partners in law [05:17.5 - 05:18.9] enforcement. [05:18.9 - 05:24.4] We cannot and will not tolerate technology companies influencing patient treatment merely [05:24.4 - 05:27.6] because a pharmaceutical company provided a kickback. [05:27.6 - 05:32.2] The criminal information charges, Practice Fusion with two felony counts for violating [05:32.2 - 05:42.3] the Anti-Kickback Statute, AKS-42-USC-SECOR-1387B-B1, and for conspiring with its opioid company [05:42.3 - 05:47.2] client to violate the AKS-18-USC-SECOR-371.

[05:47.2 - 05:52.0] This case is the first ever criminal action against an EHR vendor, and the unique Deferred [05:52.0 - 05:57.8] Prosecution Agreement imposes stringent requirements on Practice Fusion to ensure acceptance of [05:57.8 - 06:03.5] responsibility and transparency as to its underlying conduct, and to invest heavily [06:03.5 - 06:07.8] in compliance overhauls in an independent oversight organization. [06:07.8 - 06:12.7] The Deferred Prosecution Agreement requires Practice Fusion to pay a criminal fine of [06:12.7 - 06:20.5] $25,000 on AD-300, and forfeit criminal proceeds of nearly $1 million. [06:20.5 - 06:25.3] In addition, the company will cooperate in any ongoing investigations of the kickback [06:25.3 - 06:31.3] arrangement and report any evidence of kickback violations by any other EHR vendors.

[06:31.3 - 06:36.2] To ensure transparency and public awareness of the company's activities while the nation [06:36.2 - 06:41.4] continues to battle an epidemic of opioid addiction, the Deferred Prosecution Agreement [06:41.4 - 06:46.8] requires Practice Fusion to make documents relating to its unlawful conduct available [06:46.8 - 06:48.7] to the public through a website. [06:48.7 - 06:54.4] Additionally, the Deferred Prosecution Agreement mandates that Practice Fusion retain an independent [06:54.4 - 07:00.3] oversight organization that is required to review and approve any sponsored CDS before [07:00.3 - 07:05.6] Practice Fusion may implement the CDS, and create a comprehensive compliance program [07:05.6 - 07:08.8] designed to ensure such abuses are not repeated. [07:08.8 - 07:13.6] The civil settlement with the United States resolves Practice Fusion's civil liability [07:13.6 - 07:17.8] arising from the submission of false claims to federal health care programs tainted by [07:17.8 - 07:22.6] the kickback arrangement between Practice Fusion and the opioid company.

[07:22.6 - 07:27.9] It also resolves allegations of kickbacks relating to 13 other CDS arrangements where [07:27.9 - 07:33.2] Practice Fusion agreed with pharmaceutical companies to implement CDS alerts intended [07:33.2 - 07:35.9] to increase sales of their products. [07:35.9 - 07:42.9] The $118.6 million settlement amount includes approximately $13.4 million to the federal [07:42.9 - 07:48.3] government and up to $5.2 million to states that opt to participate in separate state [07:48.3 - 07:50.0] agreements. [07:50.0 - 07:53.9] Practice Fusion decisions should be based on accurate data regarding a patient's medical [07:53.9 - 08:00.3] needs, untainted by corrupt schemes and illegal kickbacks, said U.S.

Attorney David L. Anderson [08:00.3 - 08:02.8] of the Northern District of California. [08:02.8 - 08:08.4] In deciding what is best for patients, electronic health record software is an important tool [08:08.4 - 08:10.1] for care providers.

[08:10.1 - 08:14.5] It is critically important that technology companies do not cheat when certifying that [08:14.5 - 08:15.8] software. [08:15.8 - 08:20.4] In addition to the kickback allegations, the civil settlement with the United States resolves [08:20.4 - 08:24.9] allegations relating to two intersecting Department of Health and Human Services. [08:25.3 - 08:31.3] HHS programs, one at the Office of the National Coordinator for Health Information Technology, [08:31.3 - 08:37.5] ONC, that regulates the Voluntary Health IT Certification Program, and one at the Centers [08:37.5 - 08:43.8] for Medicare and Medicaid Services that oversees EHR incentive programs.

Specifically, the United [08:43.8 - 08:49.8] States alleged that Practice Fusion falsely obtained ONC certification for several versions [08:49.8 - 08:56.0] of its EHR software by concealing from its certifying entity, known as an ONC-authorized [08:56.0 - 09:02.2] certification body, that the EHR software did not comply with all of the applicable requirements [09:02.2 - 09:08.2] for certification. ONC's certification criteria were designed to promote enhanced functionality, [09:08.2 - 09:13.3] utility, and security of health information technology, and access to patient medical [09:13.3 - 09:19.0] information across the care continuum. HHS implemented the certification criteria for EHR [09:19.0 - 09:26.0] software in multiple stages, known as editions.

To be certified under the 2014 edition certification [09:26.0 - 09:32.1] criteria, EHR software was required to allow users to electronically create a set of standardized [09:32.1 - 09:37.7] export summaries for all patients. When Practice Fusion sought certification of this 2014 edition [09:37.7 - 09:43.9] criteria, Practice Fusion falsely represented to the certifying body that its software met this [09:43.9 - 09:49.7] data portability requirement when several versions of its software did not. The civil [09:49.7 - 09:55.4] settlement resolves allegations that, at the time these versions of Practice Fusion's software were [09:55.4 - 10:01.4] certified, its software was unable to permit a user to create a set of standardized export summaries.

[10:02.0 - 10:08.0] Additionally, after obtaining certification of the 2014 edition criteria, Practice Fusion [10:08.0 - 10:14.0] disabled access to this feature altogether. Instead, Practice Fusion required users to contact [10:14.0 - 10:19.7] it separately to request export of this critical patient data. In addition to failing to satisfy [10:19.7 - 10:25.9] the data portability requirement, Practice Fusion's software allegedly did not incorporate standardized [10:25.9 - 10:31.4] vocabularies as required for certification.

The United States alleged that, by fraudulently [10:31.4 - 10:36.6] obtaining certification for its products, Practice Fusion knowingly caused eligible healthcare [10:36.6 - 10:42.9] providers who use certain versions of its 2014 edition EHR software to falsely attest to [10:42.9 - 10:48.8] compliance with HHS requirements necessary to receive incentive payments from Medicare during [10:48.8 - 10:54.9] the reporting periods for 2014 through 2016 and from Medicaid during the reporting periods for [10:54.9 - 11:02.1] 2014 through 2017. As new technologies continue to develop and evolve, so too do new and innovative [11:02.1 - 11:07.8] fraud schemes, said Shimon R. Richman, Assistant Inspector General for Investigations of the U.S.

[11:07.8 - 11:13.0] Department of Health and Human Services. We will continue to be vigilant in detecting and [11:13.0 - 11:18.0] investigating these schemes in order to protect the safety of patients in federal health programs [11:18.0 - 11:22.1] and to ensure the appropriate use of electronic health records in providing their care. [11:22.9 - 11:28.5] Today's announcement shows that Practice Fusion exploited technology to profit at the expense of [11:28.5 - 11:34.9] a vulnerable population, patients seeking medical advice, said Timothy M.

Dunham, Special Agent in [11:34.9 - 11:40.5] Charge of the FBI's Washington Field Office, Criminal Division. The FBI is committed to [11:40.5 - 11:45.9] working with our partners to bring to justice the perpetrators of healthcare fraud in all its forms, [11:45.9 - 11:51.3] especially one that fans the flames of the already rampant opioid epidemic. The U.S.

[11:51.3 - 11:56.5] Attorney's Office for the District of Vermont handled the criminal investigation and resolution. [11:56.5 - 12:02.1] The civil investigation was jointly handled by the Civil Division's Commercial Litigation Branch [12:02.1 - 12:06.9] and the U.S. Attorney's Offices for the District of Vermont and the Northern District of California.

[12:07.4 - 12:13.7] The investigation was supported by the HHS Office of Inspector General and multiple HHS agencies [12:13.7 - 12:19.1] and components. The FBI's Field Office in Washington, D.C. also provided significant [12:19.1 - 12:24.8] investigative support.

Except for the conduct admitted in connection with the criminal resolution, [12:25.4 - 12:29.1] the civil claims resolved by the settlement are allegations only, [12:29.1 - 12:37.6] and there has been no determination of liability as to such civil claims. Source, www.yghs.gov.

Ready to protect your organization?

AXIS CloudSync gives healthcare, legal, and financial teams enterprise-grade encryption, audit logs, and a BAA — ready from day one.

Schedule a Demo
Schedule a Demo