Hundreds of computer servers worldwide that store patient X-rays and MRIs are so insecure that anyone with a web browser or a few lines of computer code can view patient records. One expert warned about it for years.

This article was first published on Tuesday, September 17, 2019 in ProPublica.

By Jack Gillum, Jeff Kao and Jeff Larson

Medical images and health data belonging to millions of Americans, including X-rays, MRIs and CT scans, are sitting unprotected on the internet and available to anyone with basic computer expertise.

The records cover more than 5 million patients in the U.S. and millions more around the world. In some cases, a snoop could use free software programs — or just a typical web browser — to view the images and private data, an investigation by ProPublica and the German broadcaster Bayerischer Rundfunk found.Bottom of Form

We identified 187 servers — computers that are used to store and retrieve medical data — in the U.S. that were unprotected by passwords or basic security precautions. The computer systems, from Florida to California, are used in doctors' offices, medical-imaging centers and mobile X-ray services.

The insecure servers we uncovered add to a growing list of medical records systems that have been compromised in recent years. Unlike some of the more infamous recent security breaches, in which hackers circumvented a company's cyber defenses, these records were often stored on servers that lacked the security precautions that long ago became standard for businesses and government agencies.

"It's not even hacking. It's walking into an open door," said Jackie Singh, a cybersecurity researcher and chief executive of the consulting firm Spyglass Security. Some medical providers started locking down their systems after we told them of what we had found.

Our review found that the extent of the exposure varies, depending on the health provider and what software they use. For instance, the server of U.S. company MobilexUSA displayed the names of more than a million patients — all by typing in a simple data query. Their dates of birth, doctors and procedures were also included.

Alerted by ProPublica, MobilexUSA tightened its security last week. The company takes mobile X-rays and provides imaging services to nursing homes, rehabilitation hospitals, hospice agencies and prisons. "We promptly mitigated the potential vulnerabilities identified by ProPublica and immediately began an ongoing, thorough investigation," MobilexUSA's parent company said in a statement.

Another imaging system, tied to a physician in Los Angeles, allowed anyone on the internet to see his patients' echocardiograms. (The doctor did not respond to inquiries from ProPublica.)

All told, medical data from more than 16 million scans worldwide was available online, including names, birthdates and, in some cases, Social Security numbers.

Experts say it's hard to pinpoint who's to blame for the failure to protect the privacy of medical images. Under U.S. law, health care providers and their business associates are legally accountable for securing the privacy of patient data. Several experts said such exposure of patient data could violate the Health Insurance Portability and Accountability Act, or HIPAA, the 1996 law that requires health care providers to keep Americans' health data confidential and secure.

Although ProPublica found no evidence that patient data was copied from these systems and published elsewhere, the consequences of unauthorized access to such information could be devastating. "Medical records are one of the most important areas for privacy because they're so sensitive. Medical knowledge can be used against you in malicious ways: to shame people, to blackmail people," said Cooper Quintin, a security researcher and senior staff technologist with the Electronic Frontier Foundation, a digital-rights group.

"This is so utterly irresponsible," he said.

The issue should not be a surprise to medical providers. For years, one expert has tried to warn about the casual handling of personal health data. Oleg Pianykh, the director of medical analytics at Massachusetts General Hospital's radiology department, said medical imaging software has traditionally been written with the assumption that patients' data would be secured by the customer's computer security systems.

But as those networks at hospitals and medical centers became more complex and connected to the internet, the responsibility for security shifted to network administrators who assumed safeguards were in place. "Suddenly, medical security has become a do-it-yourself project," Pianykh wrote in a 2016 research paper he published in a medical journal.

ProPublica's investigation built upon findings from Greenbone Networks, a security firm based in Germany that identified problems in at least 52 countries on every inhabited continent. Greenbone's Dirk Schrader first shared his research with Bayerischer Rundfunk after discovering some patients' health records were at risk. The German journalists then approached ProPublica to explore the extent of the exposure in the U.S.

Schrader found five servers in Germany and 187 in the U.S. that made patients' records available without a password. ProPublica and Bayerischer Rundfunk also scanned Internet Protocol addresses and identified, when possible, which medical provider they belonged to.

ProPublica independently determined how many patients could be affected in America, and found some servers ran outdated operating systems with known security vulnerabilities. Schrader said that data from more than 13.7 million medical tests in the U.S. were available online, including more than 400,000 in which X-rays and other images could be downloaded.

The privacy problem traces back to the medical profession's shift from analog to digital technology. Long gone are the days when film X-rays were displayed on fluorescent light boards. Today, imaging studies can be instantly uploaded to servers and viewed over the internet by doctors in their offices.

In the early days of this technology, as with much of the internet, little thought was given to security. The passage of HIPAA required patient information to be protected from unauthorized access. Three years later, the medical imaging industry published its first security standards.

Our reporting indicated that large hospital chains and academic medical centers did put security protections in place. Most of the cases of unprotected data we found involved independent radiologists, medical imaging centers or archiving services.

One German patient, Katharina Gaspari, got an MRI three years ago and said she normally trusts her doctors. But after Bayerischer Rundfunk showed Gaspari her images available online, she said: "Now, I am not sure if I still can." The German system that stored her records was locked down last week.

We found that some systems used to archive medical images also lacked security precautions. Denver-based Offsite Image left open the names and other details of more than 340,000 human and veterinary records, including those of a large cat named "Marshmellow," ProPublica found. An Offsite Image executive told ProPublica the company charges clients $50 for access to the site and then $1 per study. "Your data is safe and secure with us," Offsite Image's website says.

The company referred ProPublica to its tech consultant, who at first defended Offsite Image's security practices and insisted that a password was needed to access patient records. The consultant, Matthew Nelms, then called a ProPublica reporter a day later and acknowledged Offsite Image's servers had been accessible but were now fixed.

"We were just never even aware that there was a possibility that could even happen," Nelms said.

In 1985, an industry group that included radiologists and makers of imaging equipment created a standard for medical imaging software. The standard, which is now called DICOM, spelled out how medical imaging devices talk to each other and share information.

We shared our findings with officials from the Medical Imaging & Technology Alliance, the group that oversees the standard. They acknowledged that there were hundreds of servers with an open connection on the internet, but suggested the blame lay with the people who were running them.

"Even though it is a comparatively small number," the organization said in a statement, "it may be possible that some of those systems may contain patient records. Those likely represent bad configuration choices on the part of those operating those systems."

Meeting minutes from 2017 show that a working group on security learned of Pianykh's findings and suggested meeting with him to discuss them further. That "action item" was listed for several months, but Pianykh said he never was contacted. The medical imaging alliance told ProPublica last week that the group did not meet with Pianykh because the concerns that they had were sufficiently addressed in his article. They said the committee concluded its security standards were not flawed.

Pianykh said that misses the point. It's not a lack of standards; it's that medical device makers don't follow them. "Medical-data security has never been soundly built into the clinical data or devices, and is still largely theoretical and does not exist in practice," Pianykh wrote in 2016.

ProPublica's latest findings follow several other major breaches. In 2015, U.S. health insurer Anthem Inc. revealed that private data belonging to more than 78 million people was exposed in a hack. In the last two years, U.S. officials have reported that more than 40 million people have had their medical data compromised, according to an analysis of records from the U.S. Department of Health and Human Services.

Joy Pritts, a former HHS privacy official, said the government isn't tough enough in policing patient privacy breaches. She cited an April announcement from HHS that lowered the maximum annual fine, from $1.5 million to $250,000, for what's known as "corrected willful neglect" — the result of conscious failures or reckless indifference that a company tries to fix. She said that large firms would not only consider those fines as just the cost of doing business, but that they could also negotiate with the government to get them reduced. A ProPublica examination in 2015 found few consequences for repeat HIPAA offenders.

A spokeswoman for HHS' Office for Civil Rights, which enforces HIPAA violations, said it wouldn't comment on open or potential investigations.

"What we typically see in the health care industry is that there is Band-Aid upon Band-Aid applied" to legacy computer systems, said Singh, the cybersecurity expert. She said it's a "shared responsibility" among manufacturers, standards makers and hospitals to ensure computer servers are secured.

"It's 2019," she said. "There's no reason for this."

How Do I Know if My Medical Imaging Data is Secure?

If you are a patient:

If you have had a medical imaging scan (e.g., x-ray, CT scan, MRI, ultrasound, etc.) ask the health care provider that did the scan — or your doctor — if access to your images requires a login and password. Ask your doctor if their office or the medical imaging provider to which they refer patients conducts a regular security assessment as required by HIPAA.

If you are a medical imaging provider or doctor's office:

Researchers have found that picture archiving and communication systems (PACS) servers implementing the DICOM standard may be at risk if they are connected directly to the internet without a VPN or firewall, or if access to them does not require a secure password. You or your IT staff should make sure that your PACS server cannot be accessed via the internet without a VPN connection and password. If you know the IP address of your PACS server but are not sure whether it is (or has been) accessible via the internet, please reach out to us at medicalimaging@propublica.org.

This story was co-reported with the German public broadcaster Bayerischer Rundfunk.

Doris Burke contributed reporting. Additional reporting by Hakan Tanriverdi, Maximilian Zierer, Steffen Kühne and Oliver Schnuck of Bayerischer Rundfunk.

Do you have access to information about health care data breaches that should be public? Email jack.gillum@propublica.org. Here's how to send tips and documents to ProPublica securely.

To protect their networks and bottom lines, health insurers don't aggressively pursue widespread fraud, making it easy for scammers. Then they pass the costs off to consumers.

This article was first published on Tuesday, September 10, 2019 in ProPublica.

Like most of us, William Murphy dreads calling health insurance companies. They route him onto a rollercoaster of irrelevant voice menus, and when he finally reaches a human, it's a customer service rep who has no idea what he's talking about. Then it can take days to hear back, if anyone responds at all.

The thing is, Murphy isn't a disgruntled patient. He prosecutes medical fraud cases for the Alameda County District Attorney's Office in Oakland, California. And when he calls insurers, he's in pursuit of criminals stealing from them and their clients. But, he said, they typically respond with something akin to a shrug. "There's no sense of urgency, even though this is their company that's getting ripped off."

It's not just Murphy. I called health care fraud prosecutors across California to ask what insurers were doing to help bring cases against those plundering health care dollars. More than one simply burst out laughing. "Not much," one prosecutor said.

It seems counterintuitive. Escalating health care costs are one of the greatest financial concerns in the United States. And an estimated 10% of those costs are likely eaten up by fraud, experts say. Yet private health insurers, who preside over some $1.2 trillion in spending each year, exhibit a puzzling lack of ambition when it comes to bringing fraudsters to justice.

Like much of what happens behind the scenes in the health insurance industry, the insurers' tepid response to fraud typically goes unexamined. But this year, I dove into the crazy tale of a Texas personal trainer who didn't have a medical license but was easily able to claim he was a doctor and bill some of the nation's most prominent health insurers for four years — walking away with $4 million. David Williams, who was also a convicted felon, discovered stunning weaknesses in the system: that when he applied for a National Provider Identifier, the number required to bill health insurance plans, no one would verify whether he was a doctor; and that when he billed insurers as an out-of-network "doctor," they wouldn't check either and would keep paying him even long after they learned of his fraud. He was later convicted of health care fraud and is now in federal prison.

Williams' scam raised the eyebrows of even my most jaded health care sources. It prompted a half-dozen Democratic senators to write to the federal agency that administers the NPIs and ask what it was doing to plug the "loopholes."

But it also got me thinking: As journalists, we are peppered with press releases touting the fraud enforcement successes in Medicare and Medicaid, the government health plans. The federal Department of Justice and state Medicaid Fraud Control Units file thousands of criminal and civil cases a year (and still are accused of not being as aggressive as they could be). Clearly, their goal is to let folks know they will be prosecuted.

But we rarely hear about the fraud enforcement efforts of private health insurers. These companies manage the plans of about 150 million Americans who get their health benefits through their employers. They're sitting on a massive trove of claims data that can help identify scammers, and problems are routinely flagged by their members. And experts, including investigators who once worked for the insurers, tell me there's rampant fraud against the private plans.

The bottom line is significant: If a con artist, or a corrupt medical professional, makes off with health care dollars, those losses are not necessarily the insurers'. They will be passed on to people covered by the plans in the form of higher monthly premiums and out-of-pocket costs as well as reduced benefits.

So, what's up?

I wasn't going to find out from the insurers. Aetna, Cigna, UnitedHealthcare and others ignored or refused my many requests to interview their fraud investigators or responded with assurances about their fraud-fighting efforts, with few specifics.

A United spokesperson said I couldn't speak to a fraud investigator because "we do not want to make information public that would make it easier for those intent on engaging in fraud to commit these crimes." She said the insurer uses analytics to flag potentially fraudulent billing and, in some cases, physically verifies that medical offices exist.

With that scant response, I plunged into the daunting thicket of agencies that are supposed to oversee the fight against health care fraud, each divided by region and responsibility. I contacted insurance regulators in every state and interviewed more than 50 other experts, including prosecutors, claims analysts and a dozen former investigators for the internal fraud units of private insurers.

What I found has troubling implications, especially for employers and workers who get their health plans through the big insurers. Far from being fierce guardians of your health care dollars, experts told me, the big-name insurers — who sell their own plans or are paid to manage employers' — pick and choose their battles. And, for a variety of reasons, fraud is not a top priority.

California is known for sunshine, surf and health care scams. It's so rife with suspicious bills and kickbacks that the feds based a Medicare Fraud Strike Force in its ground zero for schemes, Los Angeles. The state's Medicaid Fraud Control Unit in the attorney general's office is among the busiest in the nation.

With almost 40 million residents, California is also one of the largest markets for commercial health insurance in the country. Commercial health insurers covered about 14.4 million Californians in 2018. If there's anywhere private health insurers should be beating back fraud, flagging suspicious cases and referring fraudsters to the authorities, it's the Golden State.

Like any rip-off, there are two ways to publicly hold perpetrators accountable and deter others: Prosecute them or sue to recoup the money. I called the district attorneys' offices in California's 14 largest counties, which cover about 80% of the state's population, or 32 million people. How often, I asked, did a fraud case referred by a commercial health insurer lead to criminal charges in 2017 and 2018?

All told, prosecutors in those counties filed charges in just 22 such cases in the two years.

To put that record in context, take a look at the state's Medicaid program, which covers about 13 million low-income people. During fiscal 2017 and 2018, the program's fraud unit filed criminal charges against 321 fraudulent medical providers. It garnered 65 civil settlements and judgments and recovered more than $93 million, according to the state attorney general's office.

A rigorous search for civil lawsuits filed by private health insurers over fraud in California turned up just one case in 2017 and 2018. Experts said insurers rarely sue over fraud because of the high cost of litigation.

I asked the commercial insurers in California for the case numbers of any civil lawsuits they'd filed in those years. Most didn't respond. United said it had filed "more than a dozen civil arbitrations and lawsuits across the country" over "the past couple of years." It included a list of four lawsuits in which the company won, or is seeking, tens of millions of dollars from medical providers. That's not reassuring. United is a behemoth with more than $226 billion in revenue in 2018. Yet it only rarely pursued reimbursement in court.

I called up a former federal fraud prosecutor who'd worked with both Medicare and private insurers. He said my calls to the prosecutors exposed alarming differences in the way fraud is enforced in the private and government health plans. The Medicaid fraud units are "staffed and actively engaged," said Michael Elliott, who ran about 100 fraud investigations when he worked for the Department of Justice in Texas from 2008 to 2015.

Private insurers, he said, simply don't make fraud enforcement a big enough part of their mission. "At the end of the day, it shows their priorities are elsewhere," he said.

Jennifer Lentz Snyder, who heads health care fraud prosecutions for the Los Angeles County District Attorney's Office, said insurers should be grateful she's pursuing fraudsters. But she said that when she asks for even basic information, like the number of times patients were treated at a location, they make it difficult.

"They want us, a criminal agency, to submit questions to their civil lawyers, to examine if there's a 'problem' with the questions," Snyder said. "It suggests we are not on the same page in terms of enforcement and protecting the integrity of the system."

I wondered if perhaps private insurers worked better with egulators, whom they are bound by law to obey.

Michael Marben quickly quashed that notion. Marben, director of the Commerce Fraud Bureau in Minnesota, suspects health insurers in his state are breaking the law. They are required to send his office any case where they have a "reasonable belief" there's been fraud. That allows his office to spot trends, assist with investigations and warn other insurers.

In 2017, insurers in the state referred just two cases of suspected fraud. In 2018, they referred five.

That's not because everyone there is "Minnesota nice." During the same time period, the state's Medicaid fraud unit conducted 596 investigations and netted 134 indictments.

And it wasn't an issue of the profit-driven sector not wanting to cooperate with regulators. In the auto insurance market, for example, the state's Fraud Bureau had more than 2,200 referrals, most of them from insurers.

There's "conscious underreporting" by health insurers, Marben said. "You can't have a company that doesn't experience fraud."

The public doesn't realize that the unregulated fraud has a cost, he said. "This has a direct impact on consumers."

Fraud involving the programs of private insurers has long been flagged as a problem. About three dozen states have similar reporting requirements, based on model legislation developed in the 1990s by the Coalition Against Insurance Fraud. The laws require all insurers to notify state regulators about potential scams. But no one seems to believe the health insurers actually do. "Everyone I visit says the same thing. In some states they receive basically no referrals from health insurers," said Dennis Jay, executive director of the coalition, a nonprofit group of private insurers, government agencies and consumer groups that fights fraud.

Incompetence may also be part of the problem. The California Department of Insurance found in recent audits that the investigators for two major health insurers needed more training because they "missed opportunities" for identifying what the auditors thought could be fraud, an official told me.

But as I began calling around, the dearth of cases was truly remarkable. What was happening to people who were defrauding the insurers? What was happening to the doctors billing for services they didn't provide? And who was watching the money?

Georgia regulators said only three of the state's top 10 health insurers reported any suspected fraud cases in 2017 and 2018.

The Arizona Department of Insurance got 32 referrals in 2017. That seemed low, so the regulator reminded the companies about its fraud reporting law. The next year the number more than quadrupled to 133. Paul Hill, the department's chief law enforcement officer, speculated that companies don't report fraud because they "don't want the publicity."

In Washington, the Office of the Insurance Commissioner only got one report in 2017 from Premera Blue Cross, one of the state's largest insurers. A Premera official told me the company doesn't report potential fraud unless it finds criminal intent. Instead it deals with most cases internally as "abusive billing," which means the company "educates" the perpetrators. Only if the billing issues continue does it become suspected fraud.

Apparently, Premera is a great educator. The company's investigations have led to only one fraud conviction since 2014, the official said.

Steve Valandra, a spokesman for the Washington regulator, doesn't buy the Premera official's explanation for the low number of referrals. The state's reporting law doesn't say insurers have to prove intent to refer a case, he said. It says they need to report any case where they have a "reasonable belief" there may be fraud.

Jay, director of the fraud-fighting coalition, said regulators need to use their authority to crack down on the insurers who don't report suspected fraud. "Fine them," he said.

States only regulate the fully insured health plans, in which people pay monthly premiums and the insurer pays their bills. But more than half of working Americans are covered under self-funded plans, in which their employer is paying the bills and hires an administrator, typically an insurance company, to run things.

Self-funded plans are regulated by the federal Department of Labor, but it barely looks at fraud. The Labor Department oversees plans covering tens of millions of people, but it opened just 359 health-related criminal cases in 2017 and 2018 and filed charges in 185, a spokesman said in an email.

The Department of Justice, which oversees the FBI and federal prosecutors, also investigates and prosecutes fraud in employer-sponsored health plans. But its spokesman said it doesn't track how many cases involve commercial health plans.

Elliott, the former federal fraud prosecutor, said the Justice Department is more focused on policing fraud against the government health plans. When he was a federal prosecutor in North Texas, Elliott said he had about 15 cases involving government plans for every one involving a private one.

When private insurers pitched the occasional case, Elliott said, prosecutors had to weigh whether the insurer would fully cooperate with the investigation. Federal prosecutors dig into the details when they get referrals, he said. They might want to broaden a case, which could create more work for the insurer, or sully its reputation. Or, prosecutors might find out the insurer was not doing its job. "Certain things they wanted you to know about and certain things they didn't want you to know about," he said.

The private insurers, Elliot said, seemed to prefer to close cases quietly, cutting off the fraudster and pursuing repayment. But, he said, that allows the scammer to go on cheating others. That's not fraud enforcement, he said. It's an "accounting mechanism."

I tracked down a dozen or so investigators who once worked for insurers, and they all said the same thing: Insurers don't police fraud as much as they could because it hurts the bottom line.

When Dan Bowerman worked as a medical director for Independence Blue Cross in Philadelphia, he said it was easy to spot apparent fraud. But Bowerman, who is a chiropractor as well as a fraud investigator and expert in billing codes, said it takes a lot of work to show criminal intent. A medical provider can say a staffer made an honest mistake, he said. Or a doctor could claim to be trying a novel treatment, a gray area that medical policies allow. And medical providers can also produce records, bogus or not, to substantiate claims, he said. "There are very few providers that willingly agree that they committed health care fraud," said Bowerman, who worked at the plan for about a decade, leaving in 2012, and is now semiretired.

Michael Crowley investigated fraud for more than a decade for three companies, including Humana and United. The flood of fraud was so great, he said, that investigators ignored suspect claims worth less than $300. Investigating those, the companies determined, would cost more than what they could recover, he said.

But those small claims add up. Williams, the personal trainer from Texas, billed insurers in increments of $300 and under for more than four years, and it added up to about $25 million. "If you're a provider, you're going to figure out that threshold real quick and stay under it," Crowley said.

Crowley and other investigators say targeting suspect medical providers and facilities puts the insurers in a dilemma. They need a certain number of doctors and hospitals in their networks to make plans attractive to employers. They also must ensure patients have access to the care they need.

So apparently, I learned, there's a calculation that goes on: If, for instance, you're the only neurologist in town, your fraud may be forgiven.

"Commercial payers have relationships they are trying to keep intact," said Jennifer Warren, who worked in payment integrity and fraud investigations for the insurance giants Optum, a subsidiary of United, and Cigna. She left the insurance industry in late 2017 to work for a vendor that helps employers reduce pharmacy spending.

At Optum, she said, the payment integrity team would require some suspect providers to provide records substantiating their claims. Or, she said, they would require everyone who billed for certain procedures to provide documentation. But if the providers complained enough, she'd be told to remove the hurdle. It's a balancing act, she said. "They don't want that provider out of the network, even though they're obviously billing incorrectly," she said.

Some insurers say they participate in a voluntary Medicare-led program called the Healthcare Fraud Prevention Partnership that analyzes claims data to look for fraud. But Medicare won't say which insurers had actually shared data, or whether that information had been used to help convict scammers.

Several former fraud investigators said the first step was always to school suspected fraudsters on their misbehavior. That means months of letters ending with the admonition: "Don't do this anymore." Meanwhile, the former investigators said, a river of suspicious bills flowed through the payment system.

"If you talk to anyone who works in the special investigation units and cares about what they're doing, they're frustrated," Warren said.

Louise Dobbe worked as an attorney for United and advised its fraud unit for more than a decade. She believes fraudsters know they are less likely to be prosecuted by private plans. Billing data showed that people cheating United on the commercial side played it straight with Medicare, said Dobbe, who left United in 2014 and stressed she is not speaking on its behalf.

If a doctor fleeces Medicare, the agency can block that person from billing it — a crushing blow. "We don't have the hammer on the private side or the commercial side that Medicare does," she said.

And Dobbe said referring cases to law enforcement is harder than it sounds. "They want it on a silver platter," she said. An insurer might have nailed a $3,000 claim as fraud "dead to rights," but the authorities will pass. "They want the bang for their buck," she said.

Snyder, the Los Angeles County prosecutor, said insurers rarely send her any cases, and there's no excuse. It is "incredibly easy to make a fraud report."

Private insurers, she said, weigh fraud enforcement by its "return on investment," when their priority should be the integrity of the health care system.

"The crime itself is stupid simple," she said. "You lie about something to get something you're not entitled to."

Doris Burke contributed to this report.

Neurologist Laura Boylan suffered from tremors and loss of balance that she attributed to a cyst in her brain. Why didn't her doctors believe her?

This article was first published on Friday, August 23, 2019 in ProPublica.

By David Armstrong

 Once it was called "hysterical" movement disorder, or simply "hysteria." Later it was labeled "psychogenic." Now it's a "functional disorder."

By any name, it's one of the most puzzling afflictions — and problematic diagnoses — in medicine. It often has the same symptoms, like uncontrollable shaking and difficulty walking, that characterize brain diseases like Parkinson's. But the condition is caused by stress or trauma and often treated by psychotherapy. And, in a disparity that is drawing increased scrutiny, most of those deemed to suffer from it — as high as 80% in some studies — are women.

Whether someone has Parkinson's or a functional disorder can be difficult to determine. But the two labels result not only in different treatments but in different perceptions of the patient. A diagnosis of Parkinson's is likely to create sympathy, but a functional diagnosis can stigmatize patients and cast doubt on the legitimacy of their illness. Four in 10 patients do not get better or are actually worse off after receiving such a diagnosis and find themselves in a "therapeutic wasteland," according to a 2017 review of the literature by academic experts.

"This is the crisis," said University of Cincinnati neurologist Alberto Espay, the author of guidelines on diagnosing functional movement disorders. "It shouldn't be stigmatized but it is. No. 1, patients are wondering if it is real. 'Does my doctor think I am crazy?' Secondly, doctors can approach it in a way that implies this is a waste of their time."

A study published last year in a leading neurological journal stoked the growing controversy. Of patients diagnosed with functional symptoms, 68% were women. This finding, the authors wrote, "suggests that female sex may be an independent risk factor for the development" of functional symptoms.

The study prompted a furious letter to the journal's editor from Dr. Laura Boylan, a New York City neurologist. She argued that the study's results might demonstrate instead that symptoms thought to be psychogenic were actually the result of Parkinson's, and that doctors were slow to identify the brain disease in women. "Disparities in healthcare for women are well established," she wrote, adding, "Women commonly encounter dismissal in the medical context."

For Boylan, the issue was more than a professional debate. It was personal. She had been diagnosed with Parkinson's-like symptoms that her doctors, all top caregivers at some of the world's leading medical institutions, largely believed to be psychogenic or side effects of medication. Most of her doctors were men, but two were women. Boylan, herself a brilliant neurologist, disagreed vehemently with them. She attributed her problems to a physiological cause, a tiny cyst in her brain, and grew despondent when other neurologists doubted her theory. She gave up her medical practice, became housebound and contemplated suicide. Even today, her case remains a mystery.

The first sign that something was wrong came in 2008.

At the time, Boylan was busy with a successful career that included work as a teacher, researcher and clinician. She was an assistant professor of neurology at the New York University School of Medicine; the director of the behavioral neurology clinic for the VA in New York City; and an attending physician at a hospital in Pennsylvania. She was married to another neurologist, Daniel Labovitz, who is a professor at the Albert Einstein College of Medicine and practices at Montefiore Medical Center in the Bronx.

It was while driving at night on a Pennsylvania highway that Boylan experienced a vivid hallucination. She saw a cartoonish chipmunk on the steering wheel, smiling and waving at her. Another time, two blue men with red hats appeared on either side of her. She knew the images were not real, but she couldn't make them go away.

Her doctors at the time blamed the hallucinations on side effects of psychiatric medicine Boylan took for her long-diagnosed bipolar disorder. Her bipolar condition would later add another element of uncertainty to the debate over her Parkinson's-like symptoms. Studies show that people with preexisting psychiatric disorders are more likely to develop Parkinson's — or have a functional disorder with similar symptoms. Boylan said she sees a psychiatrist for the bipolar disorder, but it's "just not a big deal in my life."

Over time, her health continued to worsen. In early 2011, during a tai chi class, she had difficulty balancing on her right leg. Later, she also noticed muscle twitching in her feet and legs.

Boylan was worried that some of her symptoms mirrored those found in patients with amyotrophic lateral sclerosis, or ALS, a rare and degenerative neurologic disease that affects the ability of muscles to function. ALS, also known as Lou Gehrig's disease, was ruled out by a specialist, but an imaging scan performed as part of that exam revealed a small cyst on the front right side of her brain. The location and type of cyst are considered rare. At the time, Boylan and the neurologist she consulted didn't believe the cyst was causing her movement problems and chalked it up as an "incidental" finding not to be concerned about.

In the fall of 2013, Boylan experienced a three-day bout of double vision that forced her to miss work. The episode was disturbing because it left her, for the first time, unable to perform her duties as a doctor.

About a week later, she went to see Janet Rucker, then a neuro-ophthalmologist at Mount Sinai Medical Center. Rucker diagnosed convergence insufficiency, a condition in which the eyes are unable to work together to focus on close by objects. Rucker thought it unlikely the brain cyst was causing the vision problem and believed it was more likely related to medication Boylan was taking, according to her notes.

Boylan returned home unconvinced by Rucker's opinion. Her vision improved enough to allow her to research the condition herself. She said she found instances where levodopa, a medication used to treat Parkinson's that she had prescribed many times for her own patients, helped alleviate the vision problem.

She decided to take her treatment into her own hands and took levodopa she prescribed for herself. Boylan knew the decision to test her own theory was a direct challenge to Rucker's competence. While legal, self-prescribing medication is considered an unsound practice by some in the medical establishment. Physicians who treat themselves risk removing the objectivity usually present in a doctor-patient relationship, which can lead to poor decisions.

Within an hour of taking the levodopa, Boylan's eyes converged and the vision problem cleared. That wasn't all. Involuntary tremors and twitches stopped. She later wrote that she "felt years younger" and "moved much better" immediately after taking the drug. For Boylan, the experience with levodopa confirmed what she had come to suspect; that the cyst in her brain thought to be harmless was in fact causing her Parkinson's-like symptoms. (In Parkinson's, nerve cells in the brain that help control body movements break down or die.) If she had a functional disorder, the drug should have no effect. She excitedly dashed off an email to Rucker reporting her success and attached a video showing her eyes working properly.

"That is a pretty impressive effect," Rucker replied. She wrote that she rarely recommended the drug for convergence insufficiency, but given Boylan's improvement, "perhaps I'll recommend it more often."

Rucker, however, didn't appear to think the cyst was responsible for Boylan's double vision, calling it the "least likely" of options, according to her notes of the case. More likely, she wrote, it was related to other medications Boylan was taking. Boylan didn't learn about the contents of the medical notes from her visit until later. Boylan, who believed her recovery proved that the cyst was the origin of her double vision, was insulted.

"That I solved this problem with levodopa, documented it, and returned to work the next day might be taken as evidence of my skill rather than having a screw loose," she later wrote to Rucker, who declined comment for this story.

Levodopa is a potent drug used to control tremors and stiffness in Parkinson's patients. The development of the drug, and what it revealed about how the brain works, was an important breakthrough that won one of the researchers involved the Nobel Prize in medicine in 2000. But levodopa can also produce side effects that include involuntary movements, from tics to sudden, jerky body motions, different from those that it had alleviated in Boylan.

Boylan decided to continue taking the drug, but wanted another neurologist to help manage her situation. She chose Elan Louis, a neurologist who had been just ahead of her in the Columbia residency program. Boylan told him she was serving as her own neurologist and that her situation was "getting acutely worse." The two doctors saw each other at the occasional reunion, but they were not close. Boylan largely knew of Louis by reputation. He is considered one of the leading experts on movement disorders and is the editor of Merritt's Textbook of Neurology, a standard clinical guide in the field. He practiced at Columbia when Boylan first began seeing him in late 2013 but was recruited to Yale University in 2015 to serve as chief of the movement disorders division in the neurology department.

Louis had not treated a specialist in his own field before. The relationship proved challenging. Boylan has a combination of intelligence and passion that attracts devoted friends. Louis described Boylan as "super smart" and someone who was constantly digging into the medical literature to learn as much as she could about her symptoms and the cyst in her brain.

She could also be blunt and confrontational. Boylan was one of several people arrested a decade ago for refusing to leave a U.S. senator's office as part of a sit-in advocating for single-payer health care. She was also an early proponent of limiting the perks that pharmaceutical companies give doctors to encourage them to prescribe their drugs, a stance that irked some colleagues but also won her admirers. Boylan was not hesitant to challenge her own doctors' assessments, as she had done with Rucker. With a mix of pride and contrition, she describes herself as a difficult patient.

In one email exchange in 2015, Boylan appeared miffed that Louis did not believe that a bout of heart palpitations and dizziness was related to her brain cyst. "I wish you'd responded earlier when you found my questions odd/unreasonable," Boylan chided Louis. "At present I know more about this area than you and yet seem crazier because of it."

At least 10% of the patients who seek help for movement disorders at the Yale clinic are determined to have a psychogenic, or functional condition, Louis said. At other neurology clinics, the number is as high as 20% and second only to headaches as the reason for seeking help. To determine if a condition is functional, neurologists identify symptoms that don't match with physiological movement disorders. In Boylan's case, the cyst was on the right side of her brain, which meant it should only cause symptoms on the left side of her body. The right leg weakness she experienced at tai chi, for instance, didn't fit with this.

Then there are a series of tests that can help determine if movements are genuinely involuntary. One group of tests is designed to distract a patient. A patient with a left arm tremor, as was the case with Boylan, might be asked to extend that arm out and then use the hand on the other arm to tap out a sequence of numbers. As the neurologist calls out for one tap, four taps, two taps and so on, he or she is watching to see if the tremor on the left side stops as the patient focuses on the tapping.

When Louis performed these tests on Boylan, she knew exactly what he was assessing. She administered the same tests to her own patients. To Boylan, the fact Louis was even doing the tests meant he had already concluded some of her symptoms were psychogenic. "I knew I was going to fail," she said later, adding that the tests are not always a valid indicator. "I tried so hard to do things properly that it can look extreme." Louis observed that Boylan's tremor stopped when she was distracted. "If something is truly involuntary, it should persist whether someone is paying attention or not," Louis told me. He agreed with Boylan that the tests are not foolproof, but said that they are useful in evaluating a case.

In his initial assessment of Boylan, Louis referenced the brain cyst and possible medication-induced effects as well as the possibility that "something else is going on here." The difficulty, he noted, was "piecing it all together."

To help solve this puzzle, with Louis' encouragement, Boylan consulted two neurosurgeons. The first, at Columbia Presbyterian, wrote the cyst might be playing a role in her tremors but warned surgery should only be considered as a "last resort." The second, at Mount Sinai, was skeptical the cyst was playing a role, writing, "It is difficult for me to pin the presence of this cystic lesion on her worsening symptoms."

After the appointments with the surgeons, Boylan returned to see Louis on Nov. 14, 2013. Louis told her he saw some "psychiatric overlay" in her symptoms and said there may be something "organic beneath a lot of overlay," according to his notes. He estimated that perhaps 70% of her symptoms were psychiatric in nature. He doubted the brain cyst was causing her rapidly worsening symptoms. It "doesn't fit," he wrote. He noted Boylan "was not happy about this but seems to have accepted it during subsequent emails/phone calls."

Louis told me that Boylan's case was "very complicated" because some of her symptoms and the cyst in her brain were rare. "Her syndrome is difficult to neatly put in one box," he said. "That is why she has defied diagnosis and had a difficult time." A psychogenic diagnosis, he said, is hard for patients because "there is a feeling with people that it is not real, it is all in our head and imaginary and undervalues and devalues what they are going through. No one wants that."

While Parkinson's is treated with medications such as levodopa, patients determined to have a functional or psychogenic condition are often prescribed psychological regimens such as cognitive behavioral therapy. Louis said he has worked successfully with a Columbia psychiatrist to treat functional patients. "We have had patients unable to walk who were walking out two weeks later," he said. Louis said he discussed Boylan's case with her psychiatrist to share his evaluation of her situation and to coordinate medications. Her psychiatrist referred her to behavior therapy, Boylan said. "I did a round," she said. "It helped me tolerate problems but did not change them."

The more Boylan tried to convince others that the cyst was causing her problems, the more she felt she was viewed with suspicion. It became an obsession. Louis once remarked to Boylan that no one in the world knew as much about the square inch of brain where the cyst was located as she did.

Despite their clashes, Boylan respected Louis. When he delivered his diagnosis, it caused her to second-guess her theory about the cyst. She also believed that some of her doctors used her bipolar disorder to cast doubt on her complaints. Her symptoms worsened and the stress overwhelmed her. On Dec. 9, she was admitted to the emergency room at St. Luke's Hospital with severely elevated blood pressure and stress-induced cardiomyopathy, a heart muscle disease that makes it harder to pump blood. When a cardiologist inquired if she was under stress, Boylan tearfully told her, "My doctors think I am hysterical."

As 2014 wore on, Boylan needed increased doses of levodopa to get the relief she first experienced when self-treating her double vision. It was a vicious circle. She needed the medicine to help with her with her lack of balance, which was causing her to fall, as well as her vision and left arm tremor. But the side effects from the medicine were severe.

On a Sunday afternoon in September 2014, Boylan stumbled out of a taxicab onto the sidewalk in front of the emergency room at NewYork-Presbyterian/Columbia University Medical Center. A couple of ambulance workers noticed she was having difficulty and helped her into a wheelchair.

Boylan was gaunt. She had lost more than 30 pounds since the beginning of the year. In the preceding days she slept little. Her body was twisting up in uncomfortable and unusual positions, making it hard to walk. Her head jerked and her knees pushed together as she bent forward. She was unable to control the movements. In a brief video taken after she was admitted to the hospital, Boylan leaned against a wall with her head slumped awkwardly to the side as she waited to use a bathroom.

To the doctors who attended to Boylan, her condition was disturbing. They knew her as an accomplished neurologist who trained and mentored a new generation of doctors. She was a familiar face at Columbia, having done her medical residency there in the late 1990s. On this day, Boylan appeared paranoid and agitated. She argued with doctors about medication and their assessment of her condition. She complained that her husband thought she was crazy.

Her case defied an easy diagnosis. "She is a quite complicated movement disorders patient," one of the treating physicians at Columbia noted.

The attending neurologist at the hospital that weekend thought Boylan was suffering from "mild psychosis" with contributing factors that included fatigue and the side effects of medication. The doctors noted Boylan recently received a distressing email about a former patient who was dying; the implication was that this was a possible source of a psychogenic effect. Louisa Gilbert, a friend of Boylan's, said that when she arrived at the hospital she found doctors treating Boylan as a "psych case."

Boylan left the hospital after one night. In the following weeks, her condition worsened. She stopped working and was largely homebound. Her diet was poor, consisting primarily of ice cream and grapefruit juice, and she continued to lose weight. She was again having trouble reading and developed severe writer's cramp that she attributed to the brain cyst.

Boylan grew dependent on others to take care of her, including Gilbert, whom she first met at boarding school. A professor of social work at Columbia University, Gilbert always admired Boylan for her resiliency. Boylan went through her last two years of medical school while a single parent. She never missed work. Now there were days when Gilbert would show up at Boylan's apartment and find her friend writhing on the floor, unable to get up.

"It was so bewildering," Gilbert said. "What the hell is going on?"

By December, Boylan was spending hours lying on the floor of her apartment while sipping orange juice to speed up the absorption of the levodopa she was taking to stave off muscle spasms. She was now separated from her husband; they would later divorce. Alone and unable to work, Boylan despaired and made plans for suicide. "I had and am still having emotional meltdown over this loss of profession/vocation/self-definition," she wrote in an email to her brother, Ross, in California.

Ross and Laura Boylan were the only children of a corporate lawyer and a homemaker. For most of their youth they lived in an apartment near the Metropolitan Museum of Art on Manhattan's Upper East Side. Their mother suffered from severe mental illness and was hospitalized a number of times. Their father was an alcoholic. The couple often argued. Laura was happiest when she was out of the apartment, and she often spent summers away from the city.

The Boylan siblings both attended boarding school at Phillips Academy in Andover, Massachusetts, but rarely interacted there. Ross was two years older and each of them moved in their own circles. Laura returned to New York City to attend Barnard College. Ross went on to Harvard University and then moved permanently to the west coast.

In her December 2014 email to her brother, Boylan wrote "bad news" in the subject line. She said the brain cyst was causing "more and more problems." She shared that she gave up clinical practice because of "fatigue, stamina, vision and other problems." She said there was a "small possibility of neurosurgery" but she wasn't sure it was worth the risk, and she doubted any surgeon would take the chance anyway. She said her symptoms were getting progressively worse and there was no cure.

Ross Boylan responded with a short note that ended with a touch of optimism. "The future is not written," he wrote.

The email from his sister caught Ross Boylan off guard. "I thought she was doing OK," he said in an interview. "Then she sends me this email, oh by the way every single sphere of my life is collapsing." The doctors she consulted seemed to be uniform in their view that her brain cyst was irrelevant and that removing it would be pointless and probably dangerous, Ross Boylan said. "It's impossible to operate, and nothing could be done about it," he said. Most concerning, it seemed to him that the "fight had gone out" of his sister.

Ross Boylan is a research statistician at the University of California, San Francisco, and his department frequently works with doctors at the medical school there. Among all the specialists at the university, he figured there must be one who could help his sister. He didn't tell Laura that he was going to try to help. He was afraid she would tell him not to bother, and he didn't want to get her hopes up in the event his efforts failed.

On a webpage for the university neurology department, Boylan came across a group photo that included his boss. It turned out his boss had done some statistical work for the research team of neurosurgeon Michael Lawton. An introduction was made. Ross Boylan gave Lawton what information he had about is sister's condition, and within days Laura Boylan was in contact with the surgeon by phone and email.

"My hunch is that operating on the cyst will help and I am ready to proceed," Lawton wrote her. "You can appreciate that we surgeons like to be certain that our efforts are going to be curative, and in your case I can't be sure. Nonetheless, I think this operation will be safe and I am ready to move forward whenever you are."

Boylan decided to go ahead with the surgery and booked a flight to San Francisco.

Lawton told me that the cyst was located in an area of brain circuitry that is disturbed in Parkinson's patients and could be the cause of her movement disorders and double vision. "It fits," he said. "It's right where that kind of lesion would produce those symptoms." Nonetheless, he said he cautioned Boylan the procedure could be done perfectly with no complications yet have no therapeutic effect.

Louis said he wasn't certain if the surgery was a good idea. "I deferred to the surgeon," he said. "There was little margin of error, and that made it a very complex decision." Others close to Boylan were concerned about the speed in which the decision to operate was made and that Boylan decided to go ahead before even meeting with Lawton in person. Boylan herself confessed in an email to a colleague days before the operation that she felt "in over my head" in arranging the surgery and was "beginning to think this is not a good idea."

On Jan. 9, 2015, Lawton and his team performed a nearly five-hour craniotomy on Boylan in which part of the bone in her skull was removed to expose her brain. The cyst was drained and a piece cut out to prevent it from accumulating fluid in the future.

Boylan was worse off in the weeks after the surgery. The awkward, twisting movements persisted. She couldn't use her right arm. She didn't know if she would recuperate to a life worth living.

About a month after the surgery, Boylan saw neurologist Rebecca Gilbert at NYU Langone Medical Center. Boylan arrived for the appointment wearing an eye patch and an arm sling.

Gilbert's notes of the encounter make it clear she thought Boylan's symptoms, even after the surgery, might be psychogenic. A right side tremor was "inconsistent" and abnormal movements were "variable and erratic" and only "present during the formal exam." In contrast, when "patient is telling her story, there are no abnormal involuntary movements." Gilbert wrote that she was "very concerned that at least part of this neurologic picture is psychogenic in nature."

By mid-March, just a month later, Boylan's condition improved significantly. On March 21, she sent an email to Lawton with the subject line "have turned a corner." She said her symptoms were improving and she was "back out and about in the world." She told him he had "given me my life back." She also criticized those who questioned the wisdom of her decision to undergo the operation. "I confess that, in accord with my own pre-existing bias, some neurology pals have thought I must have found a cowboy who took a lucky long shot," Boylan wrote. "I correct them carefully in detail."

Ten days later, Boylan saw Gilbert for a follow up appointment. Gilbert wrote that Boylan "returns looking very well. She feels well neurologically and psychiatrically. She attributes her improvement to the surgery." Gilbert declined comment on Boylan's case.

By June, Boylan was back to work.

On a Sunday morning this spring, Boylan sits at a conference table in the neurology department at Bellevue Hospital in Manhattan, the country's oldest public hospital. The room is sparse save for a large, formal portrait of the former head of neurosurgery. The painting does not escape Boylan's notice. Like many of the leading figures in neurology, the former official is a white male.

Boylan, 57, is dressed casually in black pants and a flower-print blouse. A lanyard with a Bellevue identification tag hangs from her neck. On this morning, she is the attending neurologist, overseeing medical residents. In addition to Bellevue, Boylan does part-time stints at a hospital in Duluth, Minnesota, and a VA facility in Albany. She has regained the weight she lost when her illness was at its worst, as well as the mental sharpness that dulled during that time.

Across the table, a resident briefs her about a woman who arrived in the emergency room the day before. The exchange is thick with medical terms, but there is a clear point to the back and forth: They are trying to determine if the woman's symptoms are functional. The patient complained of a generalized burning sensation. That's the type of vague complaint that could point to a psychogenic diagnosis. On the other hand, the resident said the patient reported having problems with her coordination, but not with her strength. People with functional disorders might also indicate they were weak, because they tend to have a wide array of complaints.

When the resident pulls up a scan of the woman's brain on a screen mounted on the wall, Boylan points to an area that she describes as a "little bent" with a "kink in it." This is potential evidence, she says, of a cerebral fluid leak. The woman recently underwent an epidural injection and fluid leaks are a known complication of the procedure. Boylan talks to the patient and comes away confident a leak is the problem. The remedy is intense rehydration. The patient improves, and is released the next day.

Afterward, Boylan said her own experience has prompted her to evaluate cases more carefully. She said she also has to guard against failing to recognize cases that may, in fact, be psychogenic. "I have to be careful not to lead the patient," she said.

After her surgery, Boylan requested copies of her medical records from most of the doctors who treated her over the prior five years. She was angered to find that several of them highlighted her history of bipolar disorder — in some cases it was the first item entered — and discounted the role of the brain cyst in her symptoms. Boylan believes that many of her doctors discounted the brain cyst because of a predisposition toward diagnosing psychogenic conditions in women, and that her case is symptomatic of gender bias in the field of neurology.

"I don't believe I would be treated this way if I was a man," she said. By sharing her experience publicly, Boylan is determined to counter what she views as an ingrained suspicion of symptoms reported by women that dates back to the use of the word "hysterical" to demean them as emotionally and physically weak and prone to exaggeration. She calls it a "pervasive and potentially lethal bias" in neurology.

Gender inequality is rife in neurology. Female neurologists were last in pay and had the biggest salary gap between men and women, in a 2016 survey of salaries by specialty and gender at medical schools.

The American Academy of Neurology has had only one female president in its 71-year history even though women now constitute 40% of the professional society's membership. Female neurologists are also disproportionately underrepresented in awards handed out by the academy, according to a study last year. In 24 of the 28 years studied, the recipients of the academy's lifetime achievement awards did not include a single woman.

The more difficult question is whether this inequality spills over to clinical practice. Boylan received care from both male and female specialists, and her medical records are devoid of outright indications of gender bias. Boylan said female neurologists are trained "in a paradigm of thinking generated by men for men" in which the same symptoms are viewed differently in men and women.

Louis said there was no gender bias in his evaluation of Boylan. He said functional disorders are "far more common" in women and "if a person is that gender I am more comfortable with that diagnosis." Still, gender is "only one of many, many pieces of information" used to make a diagnosis, he said.

Dr. Sarah Lidstone, a specialist in functional movement disorders at Toronto Western Hospital, said it is "impossible to say" that gender bias doesn't exist in diagnoses of this condition. "That does factor into that." Still, she said, there appear to be real gender differences. "We don't know why. It's complicated."

Researchers are working to figure out whether women are disproportionately diagnosed with functional disorders.

"We don't know what is right or the whole truth necessarily," said Dr. Mark Hallett, a senior investigator at the National Institute of Neurological Disorders and Stroke. He said one study underway is looking at whether women suffer more childhood trauma, particularly sexual abuse, than men and if that is a cause of functional disorders. He said he didn't believe that gender bias played a significant role in the fact that women receive the diagnosis more often than men, and he said other explanations may include hormonal differences between the sexes or that women may be more likely to seek treatment.

It's impossible to know for certain how Boylan got better. The workings of the mind are complex and our understanding of diseases of the brain and of psychology is constantly evolving. It may be that, as Louis suspected, a combination of factors was at work that include both a psychogenic component and the brain cyst.

"To me, where she is now is nothing short of a miracle," said Boylan's friend, Gilbert.

I asked Lawton if Boylan might have experienced a placebo effect from the surgery. While that can happen, he said, Boylan's relief and turnaround "was pretty significant to the point that it outlasted the typical duration of most placebo effects which I think run their course."

Louis said he believes the surgery "did do some good" and at a minimum removed a cyst that was in a dangerous position. But he is not persuaded it is the main reason for Boylan's turnaround. He suspects many of her symptoms were functional, and sometimes patients with that diagnosis get better over time.

Boylan is convinced her cyst and reactions to medicine to treat the symptoms caused by it were the primary sources of her illness. She views her story as a cautionary tale: She was a woman with means, a degree in medicine and a cyst in her brain. Still, she said, "that did not spare me from being cast as hysterical."

David Armstrong is a senior reporter at ProPublica specializing in health care investigations.

Last September, ProPublica examined Dr. Michael Holick's work as an expert witness for alleged abusers. In the wake of the article, his hospital notified Massachusetts' medical board that it restricted his privileges.

By David Armstrong

A Boston hospital has notified the Massachusetts medical board that it has restricted the work of a world-renowned endocrinologist criticized for espousing controversial theories as an expert witness for people accused of child abuse.

The action against Dr. Michael Holick is cited on his profile page on the board's website under "health care facility discipline." The listing is intended to alert members of the public who visit the site that Boston Medical Center, where Holick practices, has restricted his rights or privileges.Last September, ProPublica and The New Yorker reported that

Holick had testified in hundreds of child abuse cases worldwide and almost always blamed broken bones and other injuries on a rare genetic disorder. At the time, Boston Medical Center said that it had barred Holick from treating or evaluating children under age 13 beginning in May 2017. But Holick continued evaluating children in suspected abuse cases as part of an approved research project, and it now turns out that the discipline was not reported to the board until this past February.

A hospital spokesman, in an email last week, wrote that the filing with the medical board "is consistent with" the information it provided ProPublica last year. The spokesman, David Kibbe, also indicated that Holick is still allowed to evaluate children who participate in his research project.

The medical board requires hospitals to report disciplinary actions within 30 days of taking them. When asked about the 21-month gap between the hospital barring Holick from treating children and the report to the medical board, Kibbe responded, "We complied with our reporting obligations." He offered no further explanation.

A spokesman for the Massachusetts Board of Registration in Medicine said the details of the hospital action against Holick are confidential.

Holick, who did not respond to calls or emails seeking comment for this story, is best known in medical research circles for pioneering work related to vitamin D. He discovered the active ingredient in the vitamin, leading to treatments for bone disease in kidney patients. He also figured out that orange juice helps the body absorb vitamin D, a finding that led to the U.S. Food and Drug Administration approving vitamin D-fortified orange juice.

Earlier this decade, Holick began working as an expert witness in child abuse cases in the U.S. and abroad. He has consulted or testified in more than 300 cases, always on behalf of the accused. As of last September, he had never concluded that a child was abused, and he had almost always attributed the injuries to Hypermobile Ehlers-Danlos syndrome, a condition that affects the connective tissues of the skin, bones and joints and has been linked to bone fragility in adults.

The ProPublica-New Yorker article focused on a social services investigation in South Carolina that found that 3-week-old twins had allegedly been abused. The parents consulted Holick, who concluded that both babies had Ehlers-Danlos, and that fractures attributed to abuse could have been caused by bone fragility associated with the genetic condition. Nearly eight months later, one of the twins suffered a severe brain injury and the child's father was charged with abuse to inflict great bodily injury upon a child. That criminal case is pending.

"Thousands, if not tens of thousands," of parents worldwide have been falsely accused of fracturing their children's bones, Holick told ProPublica last year. "It's just terrible. I feel so sorry for these parents."

His work has drawn rebukes from other physicians who specialize in treating patients with the genetic disorder. They cite a lack of research supporting Holick's view that Ehlers-Danlos can cause broken bones in very young children. Holick has also been criticized for diagnosing the condition in children he didn't examine in person.

Boston Medical Center is the teaching hospital affiliated with Boston University School of Medicine, where Holick is a longtime faculty member. A spokeswoman for the medical school said Holick remains on the faculty.

Boston University has defended Holick's right to testify about his Ehlers-Danlos theory in court. The dean of the medical school, Karen Antman, in a letter to another physician critical of Holick, wrote that she didn't need to know the details of his expert defense work. "As a member of the Boston University School of Medicine faculty, academic freedom allows Dr. Holick to espouse his views without censorship from the University," she wrote.

David Armstrong is a senior reporter at ProPublica specializing in health care investigations.