In August 2026, electronic health records software vendor eClinicalWorks agreed to resolve a False Claims Act lawsuit alleging that it obtained federal certification for its software while hiding known security vulnerabilities, following a four-day jury trial. The government declined to intervene in the case, so the whistleblowers pursued it on their own for eight years and took it to trial, showing what is possible even when the government does not join a qui tam lawsuit. According to panelists at the American Health Law Association’s annual forum on fraud and compliance, the DOJ has announced 19 settlements totaling more than $97 million under its Civil Cyber-Fraud Initiative since the initiative began in 2021.
The Whistleblowers Alleged eClinicalWorks Hid Security Flaws to Obtain Certification
The case was originally filed in 2018 by a group of employees at an IT support company that works with healthcare providers. Through that work, they became familiar with eClinicalWorks software and its weaknesses.
The federal government paid financial incentives to Medicare providers that used electronic health records technology certified by the Department of Health and Human Services’ Office of the National Coordinator for Health IT (ONC). The whistleblowers alleged that eClinicalWorks obtained that certification falsely by failing to disclose material vulnerabilities in its software. Because providers received incentive payments based on that certification, the whistleblowers argued that eClinicalWorks caused those payments to be made on false pretenses.
The whistleblowers also alleged that eClinicalWorks caused providers to falsely certify compliance with the security rule under the Health Insurance Portability and Accountability Act (HIPAA). A Georgia federal court dismissed that theory before trial but allowed the false certification theory to proceed. The court had also ruled that the whistleblowers could seek to hold eClinicalWorks liable for the full value of the incentive payments that the government made to its customers, which could have resulted in a very large damages award had the case gone to verdict.
This is not the first time eClinicalWorks has faced False Claims Act liability. In 2017, the company paid $155 million to resolve allegations that it misrepresented its software’s capabilities to obtain certification.
The DOJ’s Civil Cyber-Fraud Initiative Targets Deficient Security
The eClinicalWorks case is one of the latest connected to the DOJ’s Civil Cyber-Fraud Initiative. Launched in 2021, the initiative uses the False Claims Act to pursue companies that knowingly provide deficient cybersecurity products or services, misrepresent their security practices, or fail to meet their obligations to protect government and personal information. According to the conference panelists, cases involving the protection of health and other personal information make up a large share of those settlements.
Two points about these cases are worth understanding. First, a data breach is not required. The claim is false because the company did not meet its security obligations, not because hackers got in. Second, the company does not have to contract directly with the government. A software vendor whose product leads others to submit false claims, as was alleged with eClinicalWorks, can be held liable.
Medical Devices Are the Next Area of Enforcement
In July 2025, genomic sequencing company Illumina agreed to pay $9.8 million to resolve allegations that it sold sequencing systems with cybersecurity vulnerabilities to federal agencies, including the Department of Health and Human Services, the Department of Veterans Affairs, and NASA. The government alleged that between 2016 and 2023, Illumina failed to build cybersecurity into the design and monitoring of its software, failed to fix design features that created vulnerabilities, and falsely represented that its software met recognized security standards.
The case was brought by a former director at Illumina, and the government intervened. It was the first False Claims Act settlement involving cybersecurity in a medical device, and it signals that device makers selling to federal agencies or billing federal healthcare programs face the same exposure as software vendors.
Reporting Cybersecurity Fraud
Security failures are usually known inside a company long before anyone outside learns about them. Those who may have knowledge include:
- Software engineers and developers who know about vulnerabilities that were never fixed or disclosed;
- Product security and compliance staff whose warnings were ignored or whose teams were understaffed;
- Employees who prepared certification submissions or compliance representations that they knew were inaccurate; and
- IT support staff and outside consultants, like the eClinicalWorks whistleblowers, who work with a product and see its weaknesses firsthand.
Speak to a Whistleblower Attorney About Coming Forward
If your employer, or a company whose products you work with, is misrepresenting the security of its software or devices to obtain government money, you can step forward as a whistleblower. If the government recovers money, you may be entitled to a portion of what it receives as compensation for reporting the misconduct, and your rights as a whistleblower protect you from employer retaliation.
With the help of a whistleblower attorney at Keller Grover, you may be able to file a qui tam lawsuit on behalf of the government as the relator. Contact our legal team at Keller Grover today to discuss what you know.