Domain Atlas / Clinical decision support & deterioration alerting
Practice Fusion Pain CDS
Explore this deployment in the PAN Lab ↗
In the PAN Lab, the readouts of this case's model organization carry a shaded evidence band whose width follows the least-established class among the modeling inputs the readings rest on.
The least-established input behind this case's model organization's readings is an assumption, not a measurement. Evidence base: 2 assumed · 14 published baseline.
Practice Fusion, Inc., a free ad-supported cloud electronic health record used by tens of thousands of provider practices, admitted in a stipulated Statement of Facts that it solicited and received $959,700 from an opioid manufacturer's marketing department for a clinical decision support alert — $144,600 for a retrospective analysis and $815,100 for the alert work, under a statement of work effective 1 March 2016. It admitted that it had modeled the sponsor's return on investment at 5.8 to 7.8 times cost, with a projected 'patient gain' of 2,777 and $8,458,232 to $11,277,643 in additional opioid revenue, and had deliberately kept that model out of the written proposal; that the sponsor's Director of eMarketing proposed edits to the alert's workflow and treatment-option list and Practice Fusion's chief medical officer approved them, neither the closing account director nor the approving officer having experience treating pain or prescribing schedule II narcotics; and that an early patient-safety concept, screening patients for opioid-abuse risk, was discussed and dropped. On 27 January 2020 the U.S. Attorney for the District of Vermont charged the company by a two-count felony information — one count of soliciting and receiving kickbacks under 42 U.S.C. 1320a-7b(b)(1) and one count of conspiracy under 18 U.S.C. 371 — and resolved it by deferred prosecution agreement, in what the Department of Justice and trade press reported as the first criminal action against an electronic health records vendor. The company was never convicted and entered no plea. The global resolution was $145,000,000: a $25,398,300 criminal fine, $959,700 in forfeiture equal to the payment, and a $118,642,000 civil settlement.[3]
What happened
Practice Fusion gave its electronic health record away. Tens of thousands of small practices ran on it, and it was used during millions of patient encounters a month; the company monetised the platform in part by taking payments from pharmaceutical manufacturers for clinical decision support alerts. Beginning around the autumn of 2013 its life-sciences sales function solicited such a payment from an extended-release-opioid manufacturer — pseudonymized throughout the criminal papers as "Pharma Co. X". An early concept for the alert was a patient-safety one, screening patients for opioid-abuse risk. It was discussed and dropped. What was built instead was designed to increase sales of the sponsor's product category.
The commercial arithmetic is stipulated. Practice Fusion modelled the sponsor's return on investment at 5.8 to 7.8 times cost, projecting a "patient gain" of 2,777 and $8,458,232 to $11,277,643 in additional opioid revenue, and an internal instruction kept that model out of the written document: "Don't include the ROI in the proposal. We'll walk the client through the ROI." A September 2015 proposal sought about one million dollars. Under a statement of work effective 1 March 2016 the sponsor's marketing department paid $959,700 — $144,600 for a retrospective analysis and $815,100 for the alert work. That figure is exactly the criminal forfeiture ordered four years later, which is the record's own way of saying what was purchased.
The Pain CDS itself is three chained alerts, and there is no learned model anywhere in it. The first prompts the clinician to record a pain score. The second suggests a Brief Pain Inventory for patients with two or more pain scores at or above 4 out of 10 within three months, or a chronic-pain diagnosis. The third prompts the creation of a pain follow-up plan, firing where pain at or above 4 was reported twice within four months or an inventory was completed. It terminates in a drop-down of nine treatment options placed on equal footing — biofeedback, non-opioid analgesics, nonpharmacologic care, referral, surgery, "pain resolved", and "Opioid Therapy (short-acting, long-acting/extended release)". The sponsor's Director of eMarketing proposed edits to that workflow, including a 29 January 2016 change adding an "Extended Release Opioid initiated" checkbox to trigger re-assessment; Practice Fusion's chief medical officer approved them. Neither the account director who closed the deal nor the approving officer had experience treating pain or prescribing schedule II narcotics. On 15 March 2016, mid-build, the CDC published its opioid-prescribing guideline — start with immediate-release, lowest effective dose, non-opioid therapy preferred. It was circulated among the designers at both companies and it was not incorporated. As shipped, the alert offered extended-release opioids to opioid-naive patients and to patients whose pain was not chronic, contrary to that guideline, to the applicable clinical quality measure, and to the sponsor's own approved product labeling. It named no brand at any point: unbranded clinical messaging was an explicit design feature, and the mechanism was steering between drug categories rather than toward a product.
The alert went live on 6 July 2016 and ran until the spring of 2019, alerting more than approximately 230,000,000 times — a count of displays, not of prescriptions and not of patients. Through 30 November 2016 alone it had fired during 21 million patient visits involving 7.5 million patients and 97,000 healthcare providers. And it worked: Practice Fusion's own analytics recorded that providers who received the alerts prescribed extended-release opioids at a higher rate than those who did not, with a general shift from immediate-release toward extended-release largest in emergency medicine, orthopedics and pain medicine. That comparison was made by the platform on its own data and is not an independent causal study.
The same analytics answered the clinical question. Presented to the sponsor at its headquarters on 14 December 2016, they reported that extended-release opioids were the least effective listed option at lowering pain — only 39.17 percent of patients treated with them had lower pain — and second-least effective among chronic-pain patients. That finding travelled to the party paying for the program and to no one prescribing under its influence. A sponsor attorney at that meeting expressed reservations and considered pausing the program. It continued for a further two and a half years, and materials gathered afterwards for that side's belated legal review omitted the program's commercial objective. Earlier warnings had gone the same way: a 2014 email observing that sponsor influence over clinical decisions carried legal implications, and a September 2015 internal reviewer's flag on the proposal — "Please do not share. Just be aware."
On 27 January 2020 the U.S. Attorney for the District of Vermont filed a two-count felony information — one count of soliciting and receiving kickbacks under 42 U.S.C. 1320a-7b(b)(1), one count of conspiracy under 18 U.S.C. 371 — together with a deferred prosecution agreement. It was reported as the first criminal action against an electronic health records vendor. Practice Fusion admitted the stipulated Statement of Facts; it was not convicted and entered no plea. The global resolution came to $145,000,000: a $25,398,300 criminal fine, $959,700 in forfeiture, and a $118,642,000 civil settlement of which $113,374,952 went federal (half of it, $56,687,476, as restitution) and $5,267,048 was escrowed for state Medicaid settlements. The civil side reached far beyond the one criminal count and remains allegation settled with an express no-admission clause: fourteen sponsored-alert arrangements with various pharmaceutical manufacturers first entered between 11 November 2013 and 17 August 2017, in which sponsors are alleged to have selected the guidelines an alert cited, set its trigger criteria and in some cases drafted its language; and a separate allegation that the company obtained 2014 Edition certification for software that did not enable data export and did not support the required clinical terminology standard SNOMED CT or LOINC, Logical Observation Identifiers Names and Codes, causing false meaningful-use attestations. Allscripts, which had acquired Practice Fusion on or about 13 February 2018 for a reported $100 million — after the conduct — took a reported $154 million charge for the resolution.
The agreement's forward-looking half is the part governance readers should study, because it created a control that no other deployment in this atlas has and then let that control be watched failing. Its terms: a three-year term extendable to five; an independent Oversight Organization that must review and approve any sponsored clinical decision support before implementation; a public online repository of the documents underlying the conduct, hosted at Practice Fusion's expense with the sponsor's identity, employees and drug brands redacted; a compliance program separating clinical from commercial activities; and an obligation to report evidence of kickbacks by other record vendors. The oversight organization then resigned. On 25 August 2021 the U.S. Attorney's Office issued a notice alleging that Practice Fusion had failed to retain a replacement, to give that organization adequate access to information and witnesses, and to pay certain of its expenses. A letter agreement of 17 March 2022, filed on the criminal docket, settled those allegations for $200,000 with an express no-admission clause and extended the agreement's term by eleven weeks, to 13 April 2023. The docket was terminated on 9 May 2023.
Two people-shaped codas close the record. The sponsor identified itself: on 24 November 2020 Purdue Pharma L.P. pleaded guilty in the District of New Jersey to three felonies, among them conspiracy to violate the Anti-Kickback Statute through its payments to an electronic health records company, and later Department of Justice releases in the related obstruction case state that it paid almost one million dollars in exchange for altering the physician-facing interface to generate more opioid prescriptions. And Steven Mack, Practice Fusion's former Director of National Accounts on that account, pleaded guilty on 8 March 2021 to attempting to obstruct the grand-jury investigation by deleting hundreds of files from his company laptop; on 13 May 2024 he was sentenced to one year of probation, a $20,000 fine, and forty hours of community service involving people suffering from drug addiction. In June 2021 the American Medical Association's House of Delegates, citing this case, adopted policy opposing direct-to-prescriber pharmaceutical promotional content in electronic health records and e-prescribing software.
The sociotechnical reading
Nearly every harm case in this atlas is a system that failed: a score that was wrong, a threshold that was miscalibrated, a reviewer who had ninety seconds. Read this one the other way. Nothing here malfunctioned. The alert fired on exactly the patients its rules named, rendered exactly the option list it had been authored to render, and produced exactly the behaviour change its designers had modelled in advance and priced at 5.8 to 7.8 times the sponsor's cost. The failure is not in the artifact at all — it is one layer up, in the supply chain that writes what the artifact says, and it is the reason this network's centre of gravity is a record store rather than a model. What was bought was a write path. What made the purchase effective was that the reader could not see it.
That combination — a compromised authoring channel plus invisibility at the point of use — dismantles the two defences clinical software normally relies on. The first is discretion, and here it was formally complete: every alert was advisory, the drop-down offered referral, non-opioid care and "pain resolved", and no clinician was ever compelled to prescribe anything. That defence fails not because it was overridden but because it was never engaged. A clinician exercises judgment about the patient; the judgment this situation actually required was about the guidance, and making that judgment needs a fact — that a manufacturer paid for this screen — which the design deliberately withheld. Unbranded messaging was not incidental camouflage, it was the product feature. The second defence is measurement, and it did not fail either; it succeeded and was pointed the wrong way. The platform measured its own effect well enough to know that the option it was steering toward was the least effective of the listed ones at lowering pain, 39.17 percent, and that measurement went to the party paying for the alert because measurement and marketing were the same channel. Nothing in this deployment fed observed outcomes back into what the alert offered. On the Lab diagram that is a reconciliation edge drawn at zero, and it is the honest shape of the problem: a loop that measured everything and closed nothing.
The internal warnings deserve their own line, because they are the part that generalises. Three times somebody with the relevant knowledge said something — a 2014 email about legal implications, a 2015 reviewer's flag asking that a proposal not be shared, a sponsor attorney's reservations in a room where the effectiveness numbers were on the screen. Each was an act of individual initiative against a decision that had already been made and funded, and none of the three had standing in the decision they were objecting to. Meanwhile the sign-off that did have standing was held by an officer with no experience treating pain or prescribing schedule II narcotics, sitting in a design loop beside an account director with none either and a commission on the deal. That is the readiness gap this network draws: not a floor that needs training, but an approval seat that could not tell a clinical judgment from a commercial one dressed as clinical guidance.
Then the prosecution built the control nobody had built, and the record kept running. The deferred prosecution agreement created an independent body with pre-approval authority over any sponsored decision support, a public document repository, and a compliance program separating clinical work from commercial work — the single most direct governance instrument aimed at this failure class anywhere in the atlas, and one no sibling deployment supplies. It then resigned, and the government alleged that no replacement was retained, that access to information and witnesses was withheld, and that its expenses went unpaid; the allegations settled for $200,000 without admission, and the term was extended by eleven weeks. Whatever else that sequence is, it is a documented instance of oversight-of-the-oversight — a gate that had to be enforced by its own principal, and whose reach was time-boxed by construction. That is why the pre-approval reviewer on this diagram is drawn low: not because the design was weak, but because the operating record is what a rung is supposed to encode.
Two boundaries hold, as always. Nothing on this network computes an outcome for any patient: the 230 million is a count of alert displays, the prescribing finding is a rate comparison the platform made on its own data, and no pain score, prescription or dependency for any person is derived from anything here. And the posture stays exactly where the documents leave it — a company that admitted stipulated facts and was never convicted, a sponsor that pleaded guilty on its own account in another district, an individual sentenced for destroying evidence, and a large body of adjacent conduct that remains allegation resolved without admission. The reason the case belongs in a governance atlas is not the size of the fine. It is that a clinical decision support alert is, structurally, a channel with an author, and this record is the one place where the question "who is paying the author, and does the reader know?" was asked in a courtroom with the emails attached.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library. The model organization for this case can be stress-tested in the PAN Lab.