Practice Fusion will pay a total of $145 million to resolve criminal and civil investigations for being the mastermind behind a kickback scheme designed to increase opioid sales, making it the first ever criminal action against an electronic health records software vendor. Particularly notable are the new compliance obligations imposed upon it, which are as weighty and significant as the fine itself.

Calling Practice Fusion’s conduct “abhorrent,” Christina Nolan, U.S. Attorney for the District of Vermont, said the recovery is commensurate with the nature of Practice Fusion’s misconduct and “represents the largest criminal fine in the history of this District and requires Practice Fusion to admit to its wrongs.”

As part of the criminal resolution, announced by the Department of Justice on Jan. 27, the health-information technology developer admits it solicited and received kickbacks from pharmaceutical companies—including one unnamed opioid company Reuters identified as Purdue Pharma—in exchange for allowing pharmaceutical companies to influence the development and implementation of clinical decision support (CDS) alerts in Practice Fusion’s EHR software in ways aimed at increasing prescriptions for their opioid drugs.

Specifically, Practice Fusion allegedly allowed the drug companies to help design the CDS alert, including “selecting the guidelines used to develop the alerts, setting the criteria that would determine when a healthcare provider received an alert, and in some cases, even drafting the language used in the alert itself,” the Department of Justice said. “In discussions with pharmaceutical companies, Practice Fusion touted the anticipated financial benefit to the pharmaceutical companies from increased sales of pharmaceutical products that would result from the CDS alerts.”

Compliance obligations

Under terms of the criminal settlement, Practice Fusion must pay a criminal fine of $25.4 million and forfeit criminal proceeds of nearly $1 million. It’s also entered into a deferred prosecution agreement (DPA) with the U.S. Attorney’s Office for the District of Vermont that requires Practice Fusion to make documents relating to its unlawful conduct publicly available through a website to ensure transparency and public awareness of the company’s activities.

Under the DPA, Practice Fusion must further retain an independent oversight organization for three years from the date of appointment to review and approve any sponsored CDS alerts before they can go live and establish a comprehensive “Sponsored CDS Compliance Program” designed to ensure such abuses are not repeated.

Compliance obligations Practice Fusion must implement include, but are not limited to:

Enhanced clinical reviews. Practice Fusion must enhance its methodology for reviewing and approving sponsored CDS programs to ensure they are medically appropriate and not influenced or directed by its sponsors’ commercial interests. Such medical review of any sponsored CDS will include consultation with medical professionals with expertise in the area of medicine relating to the sponsored CDS at issue.

Sponsor contractual confirmations. Prior to implementing any sponsored CDS, Practice Fusion shall ensure the relevant contract with the sponsor includes certain representations and warranties, including that any remuneration provided to Practice Fusion was not sourced, directly or indirectly, from any sales, marketing or brand budgets; and that sales, marketing, or brand personnel were not directly or indirectly involved in any decision to design, implement, or sponsor the sponsored CDS.

Chief compliance officer review. All sponsored CDS must receive written approval by Practice Fusion’s compliance officer before launch. This review shall include, but not be limited to, confirming Practice Fusion took reasonable steps to ensure sponsors’ sales, marketing, or brand personnel were not involved, directly or indirectly, in designing, creating, or financing the CDS. The compliance officer must show the basis for their determination in writing. Any proposed sponsored CDS that does not satisfy such criteria shall not be implemented and shall be reported by the compliance officer to the oversight organization.

Random monitoring by compliance department. Practice Fusion shall implement randomized monitoring to ensure employees are not in violation of their compliance obligations or the Anti-Kickback Statute (AKS), including but not limited to, review of written communications in which Practice Fusion employees are engaged in covered activities. The compliance department shall conduct such monitoring and include random surveillance of covered activities to ensure sponsored CDS programs are not being promoted or utilized in any manner inconsistent with compliance requirements or in violation of the AKS.

Policies and procedures. Practice Fusion shall ensure all policies and procedures relating to its Sponsored CDS Compliance Program are disseminated internally to all relevant employees.

Training. Practice Fusion shall conduct annual AKS training for all current and new employees involved in covered activities, and each employee shall certify in writing to completion of that training. Such trainings shall include a discussion of how the AKS specifically relates to the covered activities, citing examples of how covered activities can violate the AKS. Additionally, the training shall include a discussion of the criminal, civil, and administrative sanctions that could be imposed on Practice Fusion and its employees for such violations.

Patient safety obligations. Practice Fusion shall review its policies and procedures and where necessary implement enhanced policies and procedures, training, and processes to ensure patient safety risks are identified and users appropriately and timely notified of patient safety issues, including by posting such issues and resolution specifics on Practice Fusion’s customer portal. Practice Fusion also shall ensure adequate systems to detect, identify, and record potential issues impacting patient safety.

Full cooperation. In addition, the company must cooperate fully with the Federal Trade Commission and the Department of Health and Human Services Office for Civil Rights concerning any ongoing investigations of the kickback arrangement and report any evidence of kickback violations by any other EHR vendor, a warning for all compliance officers of EHR vendors that more enforcement activity could be on the way if your house is not in order.

Civil settlements

In a separate civil settlement, Practice Fusion must pay $118.6 million, including approximately $113.4 million to the federal government and up to $5.2 million to states that opt to participate in separate state agreements to resolve the allegations.

The civil settlement resolves Practice Fusion’s civil liability arising from the submission of false claims to federal healthcare programs tainted by the kickback arrangement between Practice Fusion and the opioid company alleged to be Purdue Pharma. It also resolves allegations of kickbacks relating to 13 other CDS arrangements where Practice Fusion agreed with drug companies to implement CDS alerts intended to increase sales of their products.