Criminal risks of entering inaccurate information into the EHCS: liability of managers and medical professionals

The information entered into the EHCS is used to generate reports, on the basis of which the NHSU pays for medical services. Accordingly, any errors or deliberate distortion of data in the system directly affect budget payments. If the records in the EHCS do not correspond to the medical care actually provided, this may lead to the receipt of funds without proper legal grounds.

Recent court practice shows that law enforcement agencies are increasingly treating the entry of inaccurate information into the EHCS not as a formal violation of discipline or internal procedures, but as an act that may constitute a criminal offense. Risks arise for both healthcare facility managers and doctors and other medical personnel.

Criminal proceedings as an illustration of current approaches

A telling example is a criminal case that began in 2023 against employees of a regional healthcare facility. In 2022–2023, this facility entered into contracts with the National Health Service of Ukraine (NHSU) to provide medical services under the “Mobile palliative care for adults and children” package.

During this period, payment for this package was made at a global rate. This mechanism provides for the payment of a fixed amount each month during the term of the contract. The global rate was determined based on the number of patients that the institution declared as eligible for assistance and the established tariff for the service.

Although the actual number of patients could exceed the planned number, the monthly payment amount did not change. At the same time, the data entered into the ESOS was crucial for determining the planned cost of contracts for subsequent periods. The NSZU also has the authority to adjust the cost of the contract during the year if the system shows that the agreed volumes have been exceeded.

Thus, the volume of services recorded in the EHCS directly affects the financial indicators of contracts with the NHSU.

The essence of the suspected violations

According to the investigation, for about two years, medical workers systematically entered information into the EHCS that did not correspond to the actual volume of care provided. This involved both recording services that were not actually provided and significantly overstating their number.

Among the circumstances identified were: entering records for patients who were abroad; recording regular visits and consultations that in reality were limited to occasional telephone contacts; including in the records persons who did not need palliative care and were not informed of their status.

As a result, the EHCS formed inflated indicators of the volume of services provided. Such data was used to calculate the planned cost of medical services for subsequent periods, which, according to the investigation, led to an unjustified increase in budget financing. The approximate amount of damage caused is estimated at more than four million hryvnias.

The investigation pays particular attention to the role of the head of the institution. According to the prosecution, he was not only aware of the nature of the data entered, but also organized and controlled the relevant processes. Medical workers, in turn, certified the false records with their own qualified electronic signatures.

Potential legal consequences

The case is currently under judicial review. Given the number of episodes, the volume of financial documentation, the conduct of forensic economic examinations, and the need to question a large number of witnesses, the process may take quite a long time.

The actions of the defendants are classified under articles of the Criminal Code of Ukraine, in particular, those providing for liability for misappropriation of budget funds through abuse of official position, as well as for unauthorized actions with information in automated systems by a person who has access to them.

The penalties under these articles are severe and may include many years of imprisonment, a ban on holding certain positions or engaging in professional activities, as well as confiscation of property. In addition to personal liability, negative consequences may also arise for the healthcare institution itself in the form of compensation for damages, loss of business reputation, and complications in relations with the National Health Service of Ukraine.

Practical recommendations for healthcare institutions

An analysis of similar cases allows us to formulate a number of practical measures that can reduce legal risks.

It is advisable for the management of institutions to:

• introduce systematic internal control over data entry into the EHCS;
• regularly conduct training and briefings for staff on the rules for working with the EHCS and the legal consequences of inaccurate records;
• set realistic targets without putting pressure on medical staff;
• clearly prohibit the transfer of qualified electronic signatures and record staff awareness of this requirement;
• explain to employees the limits of their personal responsibility and the impossibility of avoiding punishment for following illegal instructions.

Medical workers, for their part, should:

• verify the accuracy of all information before entering it into the EHCS;
• not record services that they did not actually provide;
• not transfer their QES to any third parties;
• refuse to comply with requests to enter false data, even if such requests come from management.

Conclusions

Incorrect entry of information into the EHCS is a serious legal risk that may result in criminal liability for both healthcare facility managers and ordinary medical workers. In addition to personal sanctions, such violations can cause significant financial and reputational damage to the facility itself.

Preventing such situations is only possible with a comprehensive approach: a combination of internal controls, regular staff training, adherence to the principle of good faith, and awareness by each participant in the process of their personal responsibility for the data entered into the EHCS and certified by an electronic signature.