athenahealth

In January 2021 athenahealth agreed to pay $18.25 million to resolve allegations that it paid illegal kickbacks to sell its EHR. DOJ described three programs. It flew prospective and existing customers to events such as the Masters and the Kentucky Derby with travel, lodging, meals and alcohol. It paid existing customers up to $3,000 per new client referred. And it paid exiting competitor vendors to steer their clients to athenahealth, with payments scaled to the number of practices converted. These are allegations with no determination of liability. Unlike the eCW, Greenway and NextGen cases, DOJ did not allege a software-certification defect. Separately, athenahealth's current privacy policy says the company 'sold personal information' in the prior 12 months and may share identifiers and internet activity for cross-context behavioral advertising.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-15

Primary source. www.justice.gov/archives/opa/pr/electronic-health-records-technology-vendor-pay-1825-million-resolve-kickback-allegations — Unverified - heuristic first draft.

Arbitration

Unknown - athenahealth's terms-of-use and legal pages returned HTTP 403 to automated retrieval, and customer agreements are not public.

Data sharing

The privacy policy (Sept 24, 2026) says 'we have sold personal information' in the preceding twelve months and 'may have shared' identifiers and internet activity 'for cross-context behavioral advertising purposes'. It describes a Facebook pixel on non-patient-facing sites and uploads of email addresses to Facebook Custom Audiences. It also discloses de-identified data (HIPAA safe-harbor or expert-determination method) to third parties such as service providers, licensees and academic researchers, where customer contracts and HIPAA permit. Opt-outs are available. Compare the pixel rulings recorded at hipaa-aha-v-becerra-2024.

Contacts

Privacy contact. Chief Compliance Officer (by mail); consumer requests via www.athenahealth.com/consumer-privacy-request; CA residents 888-807-2076

Legal notice. athenahealth, Inc., Attn: Chief Compliance Officer, Boston Landing, 80 Guest Street, Boston, MA 02135. This is the address printed in the vendor's privacy notice, which is not necessarily the registered agent for service of process. For formal legal notice, check the notice clause in the practice's signed customer agreement and the Secretary of State registered-agent record in the state of incorporation.

Mailing address. Not recorded.