Criminal risks of entering inaccurate information into the EHCS: liability of managers and medical professionals

The information entered into the EHCS is used to generate reports, based on which the NHSU pays for medical services. Accordingly, any errors or deliberate distortion of data in the system directly affect budget payments. If the records in the EHCS do not correspond to the medical care actually provided, this may lead to the receipt of funds without proper legal grounds.

Recent court practice shows that law enforcement agencies are increasingly treating the entry of inaccurate information into the EHCS not as a formal violation of discipline or internal procedures, but as an act that may constitute a criminal offense. Risks arise for both healthcare facility managers and doctors and other medical personnel.

Criminal proceedings as an illustration of current approaches

A telling example is a criminal case that began in 2023 against employees of a regional healthcare facility. In 2022–2023, this facility entered into contracts with the NHSU to provide medical services under the “Mobile palliative care for adults and children” package.

During this period, payment for this package was made at a global rate. This mechanism provides for  a fixed monthly payment during the term of the contract. The global rate was determined based on the number of patients that the institution declared as eligible for assistance and the established tariff for the service.

Although the actual number of patients could exceed the planned number, the monthly payment amount did not change. At the same time, the data entered into the ESOS was crucial for determining the planned cost of contracts for subsequent periods. The NHSU also has the authority to adjust the contract cost during the year if the system shows that the agreed volumes have been exceeded.

Thus, the volume of services recorded in the EHCS directly affects the financial indicators of contracts with the NHSU.

The essence of the suspected violations

According to the investigation, for about two years, medical workers systematically entered information into the EHCS that did not correspond to the actual volume of care provided. This involved both recording services that were not actually provided and significantly overstating their number.

Among the circumstances identified were: entering records for patients who were abroad; recording regular visits and consultations that in reality were limited to occasional telephone contacts; including in the records persons who did not need palliative care and were not informed of their status.

As a result, the EHCS formed inflated indicators of the volume of services provided. Such data was used to calculate the planned cost of medical services for subsequent periods, which, according to the investigation, led to an unjustified increase in budget financing. The approximate amount of damage caused is estimated at more than four million hryvnias.

The investigation pays particular attention to the role of the director of the healthcare facility. According to the prosecution, he was not only aware of the nature of the data entered but also organized and controlled the relevant processes. Medical workers, in turn, certified the false records with their own qualified electronic signatures.

Potential legal consequences

The case is currently under judicial review. Given the number of episodes, the volume of financial documentation, the conduct of forensic economic examinations, and the need to question a large number of witnesses, the process may take quite a long time.

The actions of the defendants are classified under articles of the Criminal Code of Ukraine, in particular, those providing for liability for misappropriation of budget funds through abuse of official position, as well as for unauthorized actions with information in automated systems by a person who has access to them.

The penalties under these articles are severe and may include imprisonment for many years  , a ban on holding certain positions or engaging in professional activities, and the  confiscation of property. In addition to personal liability, negative consequences may also arise for the healthcare institution itself, including compensation for damages, loss of business reputation, and complications in relations with the NHSU.

Practical recommendations for healthcare institutions

An analysis of similar cases allows us to outline several practical steps to  reduce legal risks.

It is advisable for the management of healthcare facilities to:

• introduce systematic internal control over data entry into the EHCS;
• regularly conduct training and briefings for staff on the rules for working with the EHCS and the legal consequences of inaccurate records;
• set realistic targets without putting pressure on medical staff;
• clearly prohibit the transfer of qualified electronic signatures and record staff awareness of this requirement;
• explain to employees the limits of their personal responsibility and the impossibility of avoiding punishment for following illegal instructions.

Medical workers, for their part, should:

• verify the accuracy of all information before entering it into the EHCS;
• not record services that they did not actually provide;
• not transfer their qualified electronic signatures to any third parties;
• refuse to comply with requests to enter false data, even if such requests come from management.

Conclusions

Incorrect entry of information into the EHCS poses  a serious legal risk, potentially resulting in criminal liability for both healthcare facility managers and medical personnel. In addition to personal sanctions, such violations can cause significant financial and reputational damage to the facility itself.

Preventing such situations is only possible with a comprehensive approach: a combination of internal controls, regular staff training, adherence to the principle of good faith, and awareness by each participant in the process of their personal responsibility for the data entered into the EHCS and certified by an electronic signature.