009: HIPAA Infractions

HIPAA Infractions

Video File

Learning Objectives

Upon completion of this Case Study, participants should:

  • Understand compliance concerns applicable to the healthcare industry,
  • Describe how government investigations can undermine a well funded start-up company, 
  • Explain why leaders of companies in evolving sectors should invest resources to assess potential industry risks, and  
  • Create a record of good corporate practice to help mitigate potential civil and legal liability. 

State of the Industry

Congressional legislation has failed to keep up with technological innovation in healthcare, leading to uncertainty with regard to how healthcare providers must comply with regulations. Rapidly growing companies should act prudently and cautiously. Company leaders expose shareholders and team members to higher levels of risk for government investigations if they misinterpret rules and regulations. 

Government investigations in the healthcare industry have resulted in many settlements measured in the hundreds of millions of dollars. Further, settlements require cooperation with prosecutors. Those cooperation agreements portend legal troubles for as-yet-to-be-named healthcare companies that violated rules and regulations.     

Background and Analysis

Allscripts Healthcare Solutions trades publicly on the Nasdaq stock exchange. It serves the healthcare industry providing technology solutions that advance clinical, financial, and operational results. That technology connects people, places, and data across what they describe as an Open, Connected Community of Health. Such innovations empower caregivers to make better decisions and deliver better care. Allscripts’ healthcare solutions include electronic health records (EHR), population health, patient engagement, and revenue cycle management services, enabling organizations worldwide—of all sizes—to manage their healthcare facilities. The company employs more than 9,600 people. It operates from its headquarters in Chicago and has a market valuation in excess of $2 billion.

A group of business leaders launched Practice Fusion, Inc, a company based out of San Francisco, in 2005. The company provides web-based systems for physicians. Practice Fusion offers charting, scheduling, e-prescriptions, billing, lab integrations, referral letters, and patient EHR. The company grew quickly with the acceptance of telemedicine. At its zenith, Practice Infusion raised seed capital at a valuation of $1.5 billion, providing substantial equity for stakeholders that had invested a cumulative total of $157 million to fund the company. 

The business community turned on Practice Infusion as rumors began swirling about a potential Department of Justice (DOJ) investigation. Government officials investigated the company’s role in the opioid abuse scandal rocking the nation. Allegations of the company’s role in kickback schemes and its EHR certification presented a legal quandary. The company’s business leaders wanted to limit exposure by selling the business to a larger organization. The company contacted more than 40 potential suitors. Only two companies offered bids. The offers valued the company at about $250 million, which was far lower than earlier valuations.

Allscripts bid between $225 and $250 million, with the final amount depending on the results of its due diligence investigation of Practice Infusions’ business. Soon after Allscripts made its bid, another EHR vendor, eClinicalWorks, resolved government allegations that it had participated in a kickback scheme and falsified EHR certifications. To settle matters, eClinicalWorks agreed to pay $155 million. Upon learning of the settlement, Allscripts and the other bidder pulled their bids. 

Despite the illegality of kickbacks, the practice of paying for customers became fairly common practice in the relatively new EHR industry. EHRs brazenly offered money and incentives in exchange for new customers. Regardless of how other industries operate, healthcare laws strictly forbid compensation related to customer acquisition. 

The DOJ also contended that eClinicalWorks falsely obtained certification for its product. According to prosecutors, the company concealed that its products did not fully comply with the requirements for certification. Prosecutors cited several faults, including “failure to incorporate certain standardized clinical terminology necessary to ensure the reciprocal flow of information concerning patients and the accuracy of electronic prescriptions.”

After a brief renegotiation, Allscripts lowered its offer to $100 million, accounting for the potential liability. Despite receiving offers of as much as $145 million, Practice Fusion accepted Allscripts’ lower bid because it agreed to absorb liability from any fallout with the DOJ investigation. The acquisition closed in January of 2018.    

After acquiring Practice Fusion, Allscripts contacted the DOJ to inquire about resolving the outstanding government threat. Corporate negotiators hoped to cap the liability at or near $150 million. The government, however, rarely moves quickly, even with a motivated innocent third-party defendant like Allscripts. Allscripts’ stock fell by almost half from $10.21 in January 2018 to $5.51 in mid-2019. 

Between April 2018 and January 2019, DOJ prosecutors demanded documents and records related to the growing civil investigation. Then in March 2019, the company received a grand jury subpoena. Prosecutors wanted to learn more about Practice Fusion’s potential violations of the Anti-Kickback Statute, HIPAA, and payments received under the Health and Human Services EHR incentive program. The government released scant specific information about the nature of the alleged violations by Practice Fusion.

The case eventually settled for $145 million, in alignment with Allscripts’ budget, though not accounting for legal expenses or lost productivity from the distraction. The settlement required Allscripts to strengthen Practice Fusion’s compliance program and continue cooperating. The DOJ continued to investigate the broader kickback scheme, given that it required Practice Fusion to report similar behavior from competitors as part of the settlement.


With rapidly growing companies in innovative fields, we recommend that companies hire subject matter experts to help assess risk. Regardless of growth levels, all businesses have a responsibility to understand regulatory requirements. Laws pertaining to healthcare make it a federal offense to make payments for customer acquisitions. A risk analysis would have diagramed Practice Fusion’s customer acquisition strategy. If those diagrams showed a practice of offering compensation in exchange for each new customer, a subject matter expert would have spotted the legal liability.

Both Practice Infusion’s management and shareholders feared potential personal liability from the DOJ investigation into the company. As a result of noncompliance, stakeholders lost tens of millions. eClinicalWorks and the division of McKesson faced nearly identical legal issues, as did other companies such as Greenway Health.

Practice Infusion, eClinicalWorks and McKesson would have been well served by demonstrating that they took the time to identify issues, ran the decision making by senior management and legal counsel, and made a final determination after thoughtful consideration. 

Take the quiz

Click the quiz below to get started.


Press Releases

Other Sources: