PERMENTER v. ECLINICAL WORKS LLC

-2-

Richard Bernardo of Skadden, Arps, Slate, Meagher & Flom, LLP, and Geoffrey Wyatt of Kirkland & Ellis, LLP.¹This order corrects those erroneous findings.

I. PART I

It is not unusual for a litigant with resources to retain consultants and expert witnesses on the same subject matter. But it is unusual for the work of a consultant and the work of an expert witness to overlap. The reason, of course, is that the work product of the consultant generally is not discoverable while the expert witness has significant disclosure obligations. Thus, prudent lawyers build a stout wall between the consultant and the expert witness, particularly when the consultant's work product, if disclosed, would be damaging. Here, the need for that wall seemed critical. The consulting work confirmed some of the Relator[s'] allegations and, in part, differed from Wortman's conclusions. Yet inexplicably, eCW assigned its consultant to work with Wortman (Sygnia, a cybersecurity and technology services company, employed both). Even more inexplicably, Wortman incorporated the consultant's work product into his expert report, claiming it as his own. But eCW insisted that the consultant had been "walled off" from Wortman, that Wortman had not relied on the consultant's work, and that it had produced everything that Wortman had relied on. Why a sophisticated litigant like eCW went down this fraught path is unclear. What is clear is that eCW went to extraordinary, and improper, lengths to maintain the fiction that the wall was solid, and thus it had no duty to disclose the "consulting work." The truth is that there was no wall at all.

. . .

The Sygnia consulting work ended in May 2023.[²] ECF 358-4 at 2. Wortman . . . completed his expert report in April 2024. ECF 300-7 at 2; 237 at 120:25-121:5. Before deposing Wortman, the Relators sought assurances that eCW had produced all documents upon which Wortman had relied and that the consultants and Wortman had not overlapped. ECF 210-3 at 2-4. eCW's counsel [Bernardo] responded:

Mr. Wortman did not provide consulting services, and we provided you with everything he considered in the formulation of his expert opinion. Other individuals (who were walled off

-3-

from Mr. Wortman) from Sygnia assisted Geoff [Wyatt] and me in understanding the technical issues raised in Relators' complaint, separate from our work with Mr. Wortman. Id. at 4. In short, eCW assured the Relators that eCW had discharged its disclosure obligations, and the Sygnia consultants, who had educated eCW's lawyers, played no part in Wortman's work as an expert witness. At his August 15, 2024, deposition, Wortman testified that Sygnia was hired to provide both expert testimony and litigation consulting services. ECF 237 at 49:3-11. Wortman explained that Sygnia employee Dan Litwak

"conducted tests [on the Relators' allegations] at [Wortman's] request" and that Litwak was "the one who was hands on keyboard with all of the[] [testing] tools." Id. at 52:18-53:18, 67:5-68:12, 72:7-11. He clarified that where the methodology section of his expert report states that his independent opinions are "based on … independent testing and code review of the ECW software performed by my team operating fully under my supervision and direction," he is referring to Litwak's testing. Id. at 67:23- 68:7; ECF 300-7 ¶ 16. Wortman further testified that the testing was done

"in the early part of Q1 of 2024." ECF 237 at 70:1-11. Thus, according to Wortman's sworn testimony, the testing that constituted his methodology was done by Litwak under Wortman's direct supervision in early 2024, and Wortman was "isolated" from the consulting team. Id. at 245:1-2. But eCW had not disclosed Litwak's testing before Wortman's deposition. Given that, the Relators asked eCW to produce documentation of Litwak's testing. ECF 210-4 at 4-5. eCW represented that Wortman was unable to locate any documents responsive to the Relators' request. Id. at 3. On October 30, 2024, the Relators moved to exclude some of Wortman's opinions based on eCW's failure to produce Litwak's testing and the Relators' then-sketchy suspicion that Wortman had relied on the Sygnia consulting team's work. ECF 209 at 2. eCW responded, "Relators' speculation that eCW might be withholding testing results generated by the Sygnia consulting team is baseless." ECF 264 at 16 n.7. Nevertheless, Wortman began to distance himself from the testing that, in his report, he said he directly supervised and relied on. In a November 19, 2024, sworn declaration filed with eCW's response, Wortman claimed that although his report identifies four testing tools used in his "methodology," "with one exception, … [he] did not rely on the results of these tools in connection with the formulation of [his] opinions in this case." ECF 264-3 ¶¶ 2-8. Thus, Wortman largely disclaimed his methodology while conceding that he relied on Litwak's testing in part.

At the June 4, 2025, hearing on the Relators' motion to exclude, eCW insisted, contrary to Wortman's testimony that Litwak did the "hands on"

-4-

testing under Wortman's direct supervision, that "Mr. Wortman is neither parroting an opinion of Mr. Litwak nor relying on anything that Mr. Litwak did." ECF 334 at 35:7-8 (emphasis added). The Court denied the Relators' motion to exclude without prejudice but allowed the Relators to convene Litwak's deposition. Id. at 40:14-25. At his July 23, 2025, deposition, Litwak testified that he used the four tests identified in Wortman's report as Wortman's methodology to test the Relators' allegations and that, during the consulting phase, he drafted a report for eCW's counsel that included screenshots and a discussion of his testing results. ECF 354 at 39:18-40:1, 57:7-58:11. Litwak also confirmed that he alone assisted Wortman in preparing his expert report and that the only testing Litwak provided Wortman was done during the consulting phase—that is, before eCW retained Wortman.[³] Id. at 41:20-25, 43:16-21, 65:8-25, 67:21-25. On July 28, 2025, the Relators informed the Court that Litwak's testimony did not resolve the Relators' concerns but instead exacerbated them. Wortman, they claimed, relied on Litwak's consulting work, and eCW failed to disclose that testing. ECF 357-1. Three days later, eCW produced a 47- page Sygnia consulting report discussing Litwak's testing results. Id.; see ECF 357-3. Now convinced that eCW had improperly withheld critical evidence, the Relators filed a summary of relevant events and the Sygnia report. The Court construed that as a renewed motion to exclude Wortman's testimony. ECF 357.

In its response, eCW stuck to its adamant denial that Wortman relied on anything Litwak did. That alone was odd—Litwak, the "hands-on" tester working under Wortman's direct supervision, was rubbed out of Wortman's report. But it got odder—eCW dropped a telling footnote. Wortman now claimed that "[a]fter being apprised of Relators' allegations … [he] realized that he had inadvertently failed to recall at the time he executed his [November 19, 2024] declaration in support of eCW's Opposition that his opinion [regarding authentication bypass] … relied on [Litwak's] testing using BurpSuite" and "now withdraws that opinion." ECF 363 at 7 n.5. In short, after months of denials that Sygnia's consulting work and Wortman's work as an expert witness overlapped, eCW admitted that, in at least one respect, Wortman had used and, as it turned out, copied Litwak's consulting work, including images from the PowerPoint Litwak gave to eCW's lawyers. This was the Court's reaction to that footnote:

I see no excuse for Mr. Wortman, assisted by [counsel], sitting down, crafting that [November 19, 2024] declaration to

-5-

respond to these very issues, and then say something that is not true. And the excuse that 'I forgot' is not credible and I don't believe it. … [I]f that kind of excuse was good enough at that stage of a dispute, when all eyes are on everything, … lawyers could get away with anything.

ECF 496 at 2-7.

The Part I Order then worked through the various lines of defense concocted by eCW's lawyers, which the Court likened to a defense-in-depth approach, meaning admitting, when caught, "minor" misrepresentations in the hope that the probing would stop. Here are the highlights. eCW falsely represented that Wortman was "walled off"

from the consulting team and that Wortman did not "parrot[] an opinion of Mr. Litwak []or rely[] on anything that Mr. Litwak did." ECF 264 at 14; 334 at 35:7-8. When that proved false, Wortman, with the close assistance of Bernardo and others, submitted a carefully crafted sworn declaration. ECF 264-3. This November 19, 2024, declaration was both telling and false. Telling, because Wortman said he did not, as his report represented,

"direct" or "supervis[e]" the described "independent" testing of eCW's software in early 2024. Id.; see ECF 300-7 ¶¶ 16-18. Thus, he effectively disavowed his stated methodology, which was in fact Litwak's. See ECF 237 at 72:7-11. False, because although he admitted that in a small way he had parroted Litwak, that was only the beginning of his parroting. As more parroting was discovered, Wortman "remembered"

more. ECF 363 at 7 n.5. Then, when eCW produced Litwak's May 9, 2023, one and only report,⁴eCW moved to what the Court hoped would be its final line of defense,

which the Court described in the Part I Order:

Caught and cornered, eCW moved to full mitigation mode and resorted to option one—tell the truth, or something closer to the truth. eCW argued that Wortman's reliance on Litwak was minor relative to the expansive scope of

-6-

Wortman's opinions, that "the bulk of Mr. Wortman's opinions rely on independent work he personally conducted," and that Wortman should be permitted to testify regarding the work he did do and the opinions he formed. Id. at 5, 7. The Court is not convinced that "bulk" is the best descriptor, based on what the Court knows so far. But the argument, though tainted and tardy, has some validity, and the Court agrees that excluding all of Wortman's opinions (other than those withdrawn by eCW) is not, at this point, an appropriate sanction.

ECF 496 at 13.

While hopeful, the Court was not naïve. In the Part I Order, the Court ordered eCW to produce Sygnia's work product. Id. Finally, the Court raised a broader concern:

[W]hat can the Court do to ensure that eCW will not continue to misbehave?

Never has the Court thrice-sanctioned a party for withholding evidence. At this point, the Court is not sure.

Id.

II. PART II

The Court begins by discussing the documents produced in response to the Part I Order and summarizing eCW's representations as of October 25, 2025, the date of the last Wortman hearing before the entry of the Part I Order. As discussed below, those representations are divided into two groups based on their subject matter. A third group consists of representations made after the entry of the Part I Order. By October 25, 2025, Sygnia's consulting work, Wortman's involvement in and reliance on it, and the truthfulness of testimony and representations regarding Sygnia's work had been aggressively probed and even more aggressively defended. The probing began with the April 2024 disclosure of Wortman's expert report when the Relators, before deposing Wortman, sought assurances that all relevant information, including the extent of Wortman's involvement in and reliance on consulting work, had been disclosed. ECF 210-3 at 2-4. eCW's "walled off" and "no parroting" narrative began with

-7-

Bernardo's July 11, 2024, response to those concerns. Id. at 4. On notice that those issues would be addressed at Wortman's deposition, Bernardo and other eCW lawyers spent dozens of hours preparing Wortman for his August 15, 2024, deposition. ECF 526-2; 532 at 169:25-170:3.

Coincidentally, or perhaps fatefully, on October 10, 2024, the Court entered its first two rulings sanctioning eCW for withholding evidence. ECF 185. More will be said about those rulings, but they are mentioned now to make a point that should not be, but clearly is, necessary to make. The first two sanctions orders, which were entered from the bench, starkly and painfully reminded eCW and its lawyers of their discovery obligations and their duty of candor.

On October 30, 2024, the Relators filed their first motion to exclude Wortman's testimony. ECF 209. Since that first motion to exclude was filed, the parties have filed over a dozen briefs, letter briefs, and supplemental filings, nine declarations, and hundreds of documents; four hearings totaling over sixteen hours have been convened. In other words, Wortman and Sygnia's consulting work has been under a microscope for nearly two years.

A. The Documents Produced in Response to the Part I Order

The documents produced in response to the Part I Order (ECF 496) are mostly emails and reports from the files of eCW's lawyers, as well as emails to and from eCW's Chief Financial Officer, Mark Speyer, and Associate General Counsel, Whitney Horrell, both of whom have given sworn declarations in support of some of eCW's positions in the current sanctions dispute.⁵ECF 510-8; 510-9. Speyer's and Horrell's involvement is

-8-

also relevant because eCW's mitigation mode has now moved to "blame its lawyers."

ECF 532 at 122:22-123:1, 240:23-241:21. The sins are the sins of eCW's lawyers, the argument goes. eCW is pure and should not be punished for its lawyers' misconduct. But Speyer and Horrell were parties to many communications that disprove representations made by their lawyers to the Relators and the Court.⁶ After the Court ordered eCW to produce the Sygnia consulting team's work product on January 15, 2026, eCW's lawyers withheld from production 28 documents containing email communications on the grounds of privilege and work product protection. ECF 525-1. On March 12, 2026, the Court ordered eCW to produce to Relators' counsel "(1) all Sygnia time and billing records and (2) all communications regarding time and billing for Project Eucalyptus submitted to eCW or its counsel." ECF

516. Following the March 24, 2026, hearing, the Court ordered eCW to produce the withheld emails for an in-camera inspection on April 6, 2026. ECF 535. The Court ruled that for some withheld email communications, eCW waived privilege and work product protection to the extent either applied. ECF 554. Those email communications are discussed in this order.

The documents produced in response to the Court's January, March, and April 2026 orders are collectively referred to as the "Court-ordered production."

-9-

B. Group I Representations: Wortman was not involved with Sygnia's consulting work. He did not know what was done, who did it, or how many hours Sygnia's consultants worked.

As described in the Part I Order, Wortman's total separation from the consulting team was the foundation of eCW's lawyers' stout wall. The lawyers claimed not only were the consultants "walled off" from Wortman, their only role and sole assignment in their brief (February 2023 to May 9, 2023) involvement was to help Bernardo and Wyatt

"in understanding the technical issues raised in the Relators' complaint, separate from our work with Mr. Wortman." ECF 210-3 at 4. By the time of the October 23, 2025, hearing, that wall had narrow, but substantively significant, fissures—Wortman had in fact relied on some of Sygnia's consulting work. However, eCW's lawyers had produced no documents suggesting that Wortman had otherwise been involved in any way with Sygnia's consulting work. Thus, eCW represented that the stout wall, save for those few

"trivial" fissures, still stood between Wortman and Sygnia's consulting work. At the October 23, 2025, hearing, Bernardo believed he could safely represent to the Court:

[Wortman] didn't know what they [the consulting team] were doing. He didn't know the composition of the team. He didn't know the scope of what [sic] anything that they were doing. He just knew that that was done because when we initially reached out to him, we asked if there was another group of people who can assist us in understanding this. And during the time that they worked, he had no involvement with or otherwise didn't communicate with them substantively about eCW matters.

ECF 482 at 39:2-9.

Similarly, in eCW's November 2024 brief in response to the first motion to exclude Wortman's opinions, the lawyers adopted and repeated Wortman's statement that "he was not aware of the work Mr. Litwak performed as part of the consulting arrangement, or even the identities of the other team members." ECF 264 at 14. The

-10-

lawyers' representation was true on its face; the carefully prepared Wortman said just that at his August 15, 2024, deposition.⁷ECF 300-8 at 245:16-246:13. Wortman also testified:

When we [he and eCW's lawyers] discussed the request for expert testimony and also the need for litigation support independent of each other, we immediately set up a different team with a different person responsible for that level of -- that work effort and I was totally removed from that process and cannot speak to the type of work, the work product, or anything else was done in that respect.

Id. at 50:3-11. When asked whether the consulting team or litigation support team would send separate invoices to Skadden for their work, Wortman responded:

That is correct. Those invoices would have been sent either by our finance team or Mr. Sambira directly. That was a separate project code.[⁸] It stood up as a separate engagement entirely in our finance systems and everywhere else, and I would have no idea how much that engagement totaled or whose hours or anything else related to it. Id. at 59:6-15.

The Court-ordered production establishes that the Group I Representations are false.

Sygnia, Skadden, and eCW executed a Services Agreement for the Eucalyptus Project on January 11, 2023. ECF 503-5. Wortman, as it turns out, was Sygnia's

"engagement/relationship partner" for all Sygnia's services, which included both the consulting work and Wortman's expert witness services. ECF 510-3 ¶ 17. Initially, the technical testing of the Relators' allegations, led by Litwak, was the only active Eucalyptus project. See ECF 361 at 101:14-25.

-11-

On May 15, 2023, after delivery of the May 9 Litwak report, Wortman emailed Bernardo regarding "Catch up and [i]nvoicing contact." ECF 526-3 at 3. Wortman requested a meeting to "catch up on the engagement progress, discuss next steps, and check in on the approval for the additional hours," and asked to whom Sygnia's invoice for the consulting services should be sent. Id. The next day, Bernardo agreed that a meeting was appropriate. Id. He added, "I did raise with [eCW] the fact that there would be additional hours, and they understand that that is necessary in light of the additional work we asked for." Id. Bernardo asked Wortman to send a copy of the invoice to him and Wyatt, and Wortman responded: "Estimate still seems to be holding true. The current number of consumed [consulting] hours is 468 and I understand we are in the home stretch of this phase of work."⁹Id. at 2-3. Wortman said he would instruct Sygnia to send the invoice to Bernardo and Wyatt for their review before sending it to eCW. Id. at 2. On May 18, Bernardo informed Wortman that the invoice for the consulting work should be sent to Speyer. Id.

When Sygnia invoiced eCW (Wortman was copied) on May 23, 2023, problems arose—eCW wanted a more detailed invoice. That day, Horrell reminded Bernardo that he said he would "take a look through this to determine the accuracy of the invoice. Can you let me know if this seems about the amount of time spent with skadden?"

ECF 554-2 at 1 (emphasis added). On June 7, 2023, Bernardo asked Wortman about the status of the revised invoice. ECF 526-4 at 2. Bernardo then emailed Horrell:

I spoke with Oren and he understood the need and said he already had the level of detail he thinks we want. He said he would send me a revised bill, but I have not seen it. I just emailed him to find out the status and to make sure I didn't miss something. Will follow-up with you once I hear from him.

-12-

ECF 554-3. On June 14, 2023, Sygnia sent Speyer and Horrell a revised invoice (Wortman was copied) and a spreadsheet showing "more elaborated data." ECF 510-10 at 6. Speyer wasn't satisfied; in two emails on June 14, he asked for more details, copying Wortman on both. ECF 510-10 at 5-7.

In separate June 15 emails, Wortman first emailed Speyer and Horrell, then Bernardo and Wyatt. Here is his email to Speyer and Horrell. Mark, My sincerest apologies, the report that Liran sent is not the standard report we send to clients looking for more granular breakdown of hours and was simply a raw output from our finance system. The hours themselves are correct in aggregate but as you noted correctly below, one person clearly did not work 50+ hours in 1 day and the level of detail is not sufficient for review. Due to different resources from different departments being allocated to the effort some were presented in the aggregate while others were daily. We do have a more granular report format available which will provide you with the per resource per task breakdown you have requested. Avi, copied here, is the client lead on my team working most closely with the ECW and Skadden stakeholders throughout this effort and has pulled the data for final formatting. Please give us until COB tomorrow to have this sent over to you. On your final request relating to the services agreement please find the fully executed tripartite attached. Thank you for the understanding and again, apologies for any confusion. Regards, Oren ECF 510-10 at 5. Here is the email to Bernardo and Wyatt.

As discussed a couple of weeks ago I am attaching for your records and review a complete breakdown of hours by resource, by task, by day for the litigation support to date. A heads up that I've already sent this to Mark and Whitney after a bit of a mishap with our finance team sending out an invoice reminder with a totally insufficient and unusable report on hours (although it was accurate in the aggregate). I am attaching that as well just so you can understand that the output from our finance system was correct but just not what we normally use for providing clients hourly detail. Unfortunately, one of our resources also had his time entered in the aggregate to the finance system so that was likely very confusing for Mark. I've apologized to Mark for the confusion, and he should now have what he was looking for. Please let me know if you think anything else is needed on this front. I also understand from the team that there is a new request around some research on breach statistics. We are having our research / threat intel team looking

-13-

into that request to understand feasibility. We will revert early next week with feedback. Talk to you both soon, Oren

ECF 503-10 at 2 (emphasis added). On June 16, 2023, Wortman followed up with Speyer and Horrell.

Mark, Again, let me offer my apologies for the wrongly formatted and insufficiently detailed report being sent to address your request for hourly breakdown by resource, by day, by task. Attached please find the report which should address the request with the appropriate level of granularity. You will see that the breakdown of hours all line up to the output from our finance system. The challenge was that for some reason our resource,

Elroy, fell behind on some of his reporting into finance and so his hours were entered into the finance system in the aggregate rather than the usual daily method. We did have his granular hourly breakdown in our Project Management tracking system. Appreciate the understanding. Please reach out to me directly should you have any questions or concerns. We look forward to continuing to support the ECW and Skadden team going forward. Regards, Oren

ECF 510-10 at 4 (emphasis added). On June 19, Horrell asked Bernardo to "take a look at this spreadsheet Sygnia sent to us and let me know if the time and details are accurate?" ECF 554-5 at 1. Bernardo responded, "These entries are consistent with what I would expect, both in terms of amounts and timing. In some instances, for some folks, they are a little lower than I would have expected given their mastery of the issues." Id. Speyer, on June 28, with a copy to Horrell and Wortman, informed Sygnia that payment would be processed. ECF 510-10 at 2.

Wortman's disclosure of resource "Elroy," his defense of Elroy's work, and his breakdown of the work of the consulting team and Bernardo's confirmation to Horrell that the work was appropriate (while noting "their mastery of the issues") are significant, and elaboration is necessary. Elroy Dayan's name first surfaced for the Relators in Litwak's July 23, 2025, deposition, and Litwak relegated him to a bit part—he "was supposed to validate some of the allegations and run some testing, but it didn't work,

-14-

and I took over." ECF 361 at 45:12-14. It was Dayan's work, billed in the aggregate, that concerned Speyer and that Wortman endeavored to explain and that Bernardo justified. Through May 2023, Dayan billed more than any other Sygnia consultant, including Litwak, and documented his findings in a "Final Report" (ECF 503-7).¹⁰He billed 130 hours for "Claims Verification," 130 hours for "Penetration Testing and vulnerability research," three hours for "Complet[ing] AT [Penetration Testing] documentation - evidence and screenshots collection," and twelve hours for "Verify[ing] the findings and updat[ing] remediation." ECF 356-4 at 2. Of the 468.25 hours billed in the May 23, 2023, invoice, 281.25 hours were recorded by Dayan. Id. His Final Report was first produced in response to the Court-ordered production.¹¹ECF 503-7. Dayan's testing, as documented in his report, largely validated the Relators' allegations that eCW's EHR software contained significant vulnerabilities. For example, Dayan confirmed that 11 of 18 claims were "True." ECF 503-7 at 2.

-15-

The Court-ordered production also revealed the previously undisclosed Eucalyptus consulting assignment—called the "Public Research Project"—that culminated with the "October 2023 Breach Report." This project was also covered by the January 11, 2023, Services Agreement, and Wortman was the responsible engagement/relationship partner. The project began on June 9, 2023, when Bernardo, with a copy to Wyatt, emailed Sygnia to schedule a meeting "to discuss another project we would like to discuss with you in connection with the eCW case to help us frame our defense." ECF 503-9. Wortman addressed the new project in his June 15, 2023, email to Bernardo and Wyatt: "I also understand from the team that there is a new request around some research on breach statistics. We are having our research / threat intel team looking into that request to understand feasibility. We will revert early next week with feedback." ECF 503-10 at 9 at 2. On August 15, 2023, Bernardo and Wyatt received approval from Horrell to proceed with the Public Research Project "in order for [eCW's] testifying expert [Wortman] to provide context of the external environment in which plaintiffs' claims are made." ECF 554-7 at 1.

The Public Research Project also involved a billing dispute, and Wortman managed that dispute as well. The invoice in question was first submitted on November 7, 2023, and Speyer immediately responded: "We'll need the detailed line items that make up these hours. Please include date, hours and a description of the work so we can review accordingly." ECF 503-14 at 2-3. When Sygnia provided "a breakdown of the work" on November 13, Wyatt emailed Wortman (Bernardo was copied) to request a meeting to discuss the matter. ECF 526-5. Wortman didn't respond, and on November 22, Wyatt (Bernardo was copied) emailed another Sygnia employee:

-16-

I do have a question about this invoice and have been trying to connect with Oren on it and we just keep missing each other. Will follow up with you when we've had a chance to discuss. Adding my colleague Rich Bernardo for his awareness.

ECF 518-3 at 3. Wortman responded the same day.

So sorry for being unresponsive last couple of weeks, been travelling back- to-back and then was out for a few days. Agree, we need to get our next call on the calendar to keep the ball moving forward. Can we look to either late in the day next Thursday 11/30 or Friday 12/1 afternoon? Tue, Wed, Thu I am travelling again � Also understand that you had a question about the last invoice. This was for the last "research" project that we did at your request. Can confirm with Avi once I better understand the question. Last, we still need to get an official statement of work together for the workstream that I am currently working on. Started getting questions on this internally. ECF 526-7 at 2. On November 23, Wortman provided Wyatt a detailed explanation of the charges, but now Wortman wasn't happy.

On another note, I really do not want to run into the same issue regarding the new workstream[¹²] that I am on. My time is extremely limited and valuable, and I do not want to get into a back and forth with ECW on every invoice. Further, we do not even have a proper SOW in place yet nor do we have any approval for hours in writing which given Mark [Speyer's] pushback on each invoice puts the effort to date at risk. ECF 503-16 at 3.

To summarize, when Bernardo and his team spent dozens of hours preparing Wortman for his deposition, the "critical" point was to convince the Relators, and ultimately the Court, that Wortman was completely isolated from and knew nothing about the consulting work, including the identities of the consultants.¹³ECF 532 at

-17-

169:25-170:7, 170:23-171:15. Hence, Wortman testified he "was totally removed from that process and cannot speak to the type of work, the work product, or anything else was done in that respect"; that he "would have no idea how much that engagement totaled or whose hours or anything else related to it"; and that he didn't "even know the entire makeup of that team. I was isolated from it." ECF 300-8 at 50:3-11; 59:6-15, 246:1-5. That sworn testimony was not true. Bernardo and Wyatt, who worked closely with Wortman as the engagement partner for the consulting projects and acted as intermediaries in the acrimonious billing disputes between Wortman and Speyer, knew¹⁴ that Wortman testified falsely, yet they again and again relied on that false testimony. Finally, Wortman, with the assistance of eCW's lawyers, reviewed the transcript of his deposition and made numerous changes. After making those changes, he certified that the transcript of his deposition was "true and correct." ECF 237 at 265. Wortman did not correct his misstatements about his involvement in Sygnia's consulting, and he testified at the March 24, 2026, hearing that eCW's lawyers never raised the issue while helping him prepare his errata sheet, or at any other time during or after his deposition. ECF 532 at 217:10-24.

But Bernardo doubled down on Wortman's false testimony at the October 23, 2025, hearing. By then, the issue had reached fever pitch. eCW's defense-in-depth was the concerns raised by the Relators before the deposition about Wortman's possible overlap with Sygnia's consulting and Bernardo's insistence that Wortman had been "walled off" from the consulting, that issue clearly was a "focus" of Bernardo's preparation of Wortman for his deposition. In short, when Wortman testified falsely about his separation from the consulting work, he was supporting Bernardo's

"walled off" narrative.

-18-

in trouble. Clearly, eCW thought it necessary to construct a final line of defense to deflect further probing. The Group II Representations—the consulting work concluded on May 9, 2023, and the May 9 report was the only consulting report—were the principal bases for that line of defense, but Wortman's total separation from the consulting teams was also a critical element. Bernardo's lengthy presentation at the hearing had been meticulously prepared (eCW's lawyers and support staff recorded at least 172.1 hours in October 2025¹⁵). Clearly, Bernardo was in command of the facts by then. Yet, he vouched for Wortman and told the Court

[Wortman] didn't know what they [the consultants] were doing. He didn't know the composition of the team. He didn't know the scope of what anything that they were doing. He just knew that that was done because when we initially reached out to him, we asked if there was another group of people who can assist us in understanding this.

ECF 482 at 39:2-7. And Bernardo defended himself: "I was not misrepresenting anything. It is absolutely correct that the consulting team was walled off from Mr. Wortman." Id. at 59:3-4. Bernardo's Context Exhibit drove the point home, stating as a

"Fact": "Mr. Wortman did not know the scope of the consulting work or its purpose." ECF 503-4 at 5.

The truth is that Wortman, the Eucalyptus relationship/engagement partner, knew there were multiple consulting projects, he knew the scope of each consulting project, and he knew which members of Sygnia were involved and the tasks they performed. But even after the Court-ordered production, eCW's lawyers and Wortman tried to minimize his knowledge of the consulting work. In his March 5, 2026, declaration, he swore: "My knowledge of the work conducted by the Sygnia Technical Consultancy was

-19-

limited to the general information presented in the invoices and the fact that Mr. Litwak had run certain tests, screenshots of which I used in my April 27, 2024 Expert Report."

ECF 510-3 ¶ 8. At the hearing on March 24, 2026, Wortman admitted this was not true. Q. My question is, that everything that you knew about the work performed by the Sygnia consultancy was not limited to the general information in the invoices; isn't that true?

A. Based on these emails, I would have known about the hours consumed prior to the invoices.

…

Q. And 19 days ago, eClinicalWorks submitted a declaration from you, under oath, that said that your knowledge was limited to the information presented in the consulting invoices, and that was not true; correct?

A. I apparently had knowledge of hours prior to the invoice being issued. ECF 532 at 150:19-151:18.

C. Group II Representations: The Sygnia consulting work ended on May 9, 2023, and Wortman's expert work began in August 2023. Litwak's May 9, 2023 report is the only consulting report, and thus, all consulting reports and testing were produced.

In its concerted effort to convince the Court that a stout wall separated Sygnia's consulting work from Wortman's work as an expert, eCW's lawyers represented to the Court "numerous times"¹⁶that Sygnia's consulting work ended in May 2023, and that the May 9, 2023, PowerPoint prepared by Litwak was the only consulting report. Temporal separation was a key part of Bernardo's presentation at the October 23, 2025, hearing. Again, eCW's defense of Wortman's expert witness work was then in deep trouble. Wortman's and Bernardo's representations of no reliance on or parroting of

-20-

Sygnia's consulting work had proven false. "Caught and cornered," eCW was in what the Court hoped and believed was "full mitigation mode." ECF 496 at 13. Accordingly, Bernardo set out to convince the Court that Sygnia's consulting work had already concluded before Wortman's expert witness work began. "[T]o show [the Court] where the consulting project was, which was back in . . . February through May of 2023, and where the expert work begins" (ECF 482 at 59:14-17), he tendered this chronology¹⁷:

ECF 503-4 at 4. Noting that he doubted the Relators "would disagree on the contents of this" (ECF 482 at 59:11-14), Bernardo emphasized what the chronology was clearly intended to show: Litwak's consulting work ended in May 2023, and Wortman did not begin his expert work until August 2023. ECF 482 at 60:3-5.

Bernardo's Context Exhibit then stated as a "Fact": "Mr. Litwak's consulting work was completed by May 2023." ECF 503-4 at 5. Based on evidence eCW had produced

-21-

to that point, neither the Relators nor the Court could "disagree" with Bernardo, and the Court accepted that representation as true, hence the noted factual finding in the Part I Order that "the Sygnia consulting work ended in May 2023." ECF 496 at 4. Litwak, in his July 2025 deposition and after hours of preparation with eCW's lawyers (ECF 537 at 14; 526-2), said the same thing:

Q. After you put together the [May 2023] report that had the results of some of your testing, did you prepare any additional reports that were provided to eClinicalWorks or their counsel?

A. No.

…

Q. Okay. So you did the testing in March or so of 2023. You drafted a report. After that you didn't do any additional substantive work for the litigation support team; is that correct?

A. That's correct.

ECF 361 at 56:12-16, 64:18-22. Of course, if Sygnia's consulting work ended on May 9, 2023, it necessarily followed that Litwak's May 9 report was the only Sygnia consulting report. Accordingly, in its final brief, eCW represented: "The end result of this work was a 48-slide 'report' that was submitted to Skadden on May 9, 2023." ECF 363 at 9. Litwak emphatically swore to this in his deposition:¹⁸

Q. . . . Other than the report that you drafted in March or April 2023 that was sent to eClinicalWorks' lawyers, is there any other document that you are aware of that summarizes your findings of any testing or analysis that you did during the litigation support phase?

A. No. That was the only document.

ECF 361 at 115:21-116:2.

-22-

Bernardo's Context Exhibit from the October 23, 2025, hearing was even more emphatic: "The only testing materials created during the Sygnia consultancy were some screenshots / excels." ECF 503-4 at 7.

The Court-ordered production establishes that the Group II Representations are false.

Throughout June and July 2023, Bernardo and others revised Litwak's May 9, 2023, report. ECF 518-4; 518-5. The report, or, as Bernardo has stressed, a mere PowerPoint, addressed only the allegations in the Relators' complaint. Recall also that this is the report that Wortman "parroted," setting in motion the cascade of events that have occupied the Relators and the Court for nearly two years. In early August 2023, Wyatt and Bernardo expanded Litwak's assignment. On August 4, 2023, the Relators served a 92-page interrogatory response that provided considerably more detail about the alleged vulnerabilities in eCW's EHR software. ECF 556-4. Wyatt discussed the interrogatory response with Litwak and then sent the response to Sygnia for analysis (Bernardo and Katz were copied). ECF 503-1 at 3-4. Sygnia began work and on August 15 reported to Bernardo and Wyatt:

We have completed our first high level review of the report and added a few comments, see link below, specifically on the existing items. We will need more time to review the new items on that report and a couple of findings which require more technical validation.

Id. at 3. This email provided a link to the revised and supplemented report titled "Sygnia Powerpoint 202308014 Revision+ Supplemental Response Analysis.zip." Id. Wyatt responded on August 21 (Litwak, Bernardo, and Katz were copied). This is very helpful, thanks. As you preview in your comment below, there appear to be at least two issues where further testing would be needed to run the issue to ground in the latest draft. Could you please complete that

-23-

work and update the presentation as needed? Then we can set a time to resume our discussions about the presentation. Thanks! Id. (emphasis added). Sygnia immediately replied: "We are hoping to complete the

testing this week with an updated report by early next week." Id. at 2 (emphasis added).¹⁹By September 6, Litwak had completed his updates and revisions, and Sygnia informed Wyatt (Litwak, Bernardo, and Katz were copied) that the "report is located in the external share. Same password as before." Id.

More importantly, Elroy Dayan's much more comprehensive report was completed, according to Litwak, around May 2023.²⁰ECF 558 at 78:25-79:6. In the meantime, as discussed in detail above, Bernardo and Wyatt gave the Eucalyptus Project another consulting assignment—the Public Research Project— in August 2023. That resulted in yet another consulting report—the October Breach Report. Then, in December 2023, eCW assigned Eucalyptus a final consulting task when it asked Litwak to set up eCW's JIRA server. ECF 503-8. Litwak created two different JIRA servers, one of which included the APPSEC tickets. ECF 361 at 49:18-20-50:11. In summary, Bernardo presented the Group II Representations at the October 23, 2025, hearing. Clearly, eCW then thought it necessary to construct a final line of defense to put an end to further probing. Wortman had been damaged—he had done some parroting, his deposition had been problematic, he had sworn falsely in his first declaration, and eCW had withdrawn portions of his expert report because of his parroting and false declaration. But eCW hoped to salvage as many of his opinions as it

-24-

could and eCW's lawyers laboriously assembled what they hoped would be their final line of defense at the October 23, 2025, hearing. eCW built that defense primarily on two "undisputed" facts: The consulting ended on May 9, 2023, and Litwak's May 9 report was the only consulting report. ECF 482 at 59:11-60:11, 57:7-12, 66:4-8. If the Court found those facts to be undisputed, there would be nothing left to probe. In truth, Sygnia's consulting did not end on May 9, 2023, and Litwak's May 9, 2023, report was far from the only consulting report.

D. Group III Representations: The Public Research Project had nothing to do with Wortman. Any similarities between that report and Wortman's April 2024 expert report are coincidental.

The Part I Order directed eCW to "immediately produce the Sygnia consulting team's work product." ECF 496 at 13. Documents produced in response to that order revealed, as discussed above, the Public Research Project. The Public Research Project, according to eCW counsel, was a "review of publicly available sources to identify public instances of breaches and security vulnerabilities of other companies for counsel's consideration in connection with eCW's defense of the case." ECF 510-2 ¶ 33; 510-6 ¶ 22. eCW's lawyers' efforts to distance Wortman from the Public Research Project led to the Group III Representations.

By January 2026, Bernardo and Wyatt had repeatedly represented that Sygnia's consulting work ended on May 9, 2023, well before Wortman's expert work began on August 4, 2023. But as Bernardo and Wyatt put it in their March 3, 2026, declarations, the Part I Order prodded counsel to review their "communications with Sygnia." ECF 510-2 ¶ 33; 510-6 ¶ 22. In other words, Bernardo and Wyatt finally looked at their own files. When they did that, "counsel were reminded" that they had given Eucalyptus

-25-

another consulting assignment. Id. Having been reminded, counsel produced the

"October Breach Report" which memorialized the findings of the Public Research Project. However, Bernardo and Wyatt swore in their March 5, 2026, declarations that they did not "consider" that work to be the "same consultancy" and that work was not "in any way related to Mr. Wortman's work or to Relators' prior requests with respect to Mr. Wortman or Sygnia." ECF 510-2 ¶ 34; 510-6 ¶ 23. Wortman, in his March 5, 2026, declaration, swore that he "was never informed of, received, or reviewed any of the research" for that project. ECF 510-3 ¶ 13. Nevertheless, as Wortman acknowledged, his expert report and the October Breach Report include two identical references. eCW and Wortman chalk that up to mere coincidence. See ECF 510.

The Court-ordered production establishes that the Group III Representations are false at least in part.

Here, the Court can be brief. The relevant documents were produced after Bernardo's and Wortman's March 2026 declarations and after Wortman's testimony at the March 24, 2026, hearing. Bernardo and Wyatt swore in their March 2026 declarations that the Eucalyptus Public Research Project was not "in any way related to Mr. Wortman's work." ECF 510-2 ¶ 34; 510-6 ¶ 23. They swore to those facts even though they knew then the contents of the documents they had listed on their privilege log.

In Bernardo's August 15, 2023, email, he made clear the purpose of the then- latest phase of Eucalyptus Project's consulting: "for our testifying expert [Wortman] to provide context of the external environment in which plaintiffs' claims are made." ECF 554-7 (emphasis added). After Bernardo and Wyatt received the October

-26-

Breach Report, they planned to discuss "how Oren can leverage." ECF 554-8 (emphasis added).

The similarities between the October Breach Report and Wortman's expert report have little substantive significance. The graphics and text in question address general matters, not analysis specific to eCW's EHR software. Even in the abstract, though, it is difficult to accept eCW's representation that Wortman and the Sygnia consultants, working separately, just happened to produce the same content. But given eCW's serial false representations and Wortman's aversion to the truth, it's impossible for the Court to accept now the mere coincidence explanation. Undeniably, Wortman was familiar with the Public Research Project; he defended it. The October Breach Report was available well before he finalized his expert report in April 2024. Rather than a coincidence, it is far more likely that Wortman saw content he wanted to use in his own report and, with slight modifications, he parroted again.

Bernardo and Wyatt's declarations are far more concerning. Their bookend emails make clear that the Project was designed for Wortman's use, was approved for that purpose, and was intended to be used by Wortman as leverage. Why, then, would they swear on March 5, 2026, that the Project had nothing to do with Wortman? The likely explanation is that they did not think the Court would take the time to look at the withheld documents. But when the Court took the time, they clearly recognized the problem. This is from the letter transmitting the withheld documents for in-camera inspection.

Finally, we have highlighted two emails within the email chains at Tabs 7 and 8 that raise the possibility that the Public Research Summary would be shared with Mr. Wortman. Counsel ultimately decided against that, however. Counsel have validated through multiple sources (including Tab

-27-

12) that they never shared the Public Research Summary with Mr. Wortman until 2026 (in connection with Mr. Wortman's declaration). Mr. Wortman affirmed in his March 5, 2026 declaration (and at the March 24, 2026 hearing) that he did not see it before then. Therefore, he could not have relied on or considered it in relation to his expert opinions in this case. ECF 554-9. At this point, the Court is not willing to credit any affirmation, sworn or otherwise, from Wortman. But if Bernardo and Wyatt did change their minds and decided Wortman didn't need the leverage of the report commissioned for his use, why didn't they just say that in their declarations? The only conclusion the Court can reach is that Bernardo and Wyatt, consistent with their calculus throughout this matter, figured the cause would be better served by a false representation rather than the truth.

E. The Explanation

1. Background Before the current round of sanctions, the Court twice sanctioned eCW for withholding evidence. Before turning to the explanation for the current crop of misrepresentations—for the most part, no defense on the merits has been raised—it is enlightening to look at the prior misconduct.

First, eCW failed to produce information about the work of its APPSEC unit. ECF 185 at 7-63. The APPSEC unit's mission was to document security vulnerabilities in eCW's electronic health record software. That alone makes clear that the evidence should have been produced. But it was worse than that. eCW produced the evidence to the Government on a JIRA²¹server, and then eCW's lawyers repeatedly represented to the Relators that eCW had produced to them exactly what it had produced to the Government—the entire JIRA server. That was false; the server produced to the

-28-

Relators did not include the APPSEC unit's work. eCW claimed that "an inquiry by one of eCW's experts in February 2024 caused me [Bharat Satyanarayan] to realize that the APPSEC project would have included Jira tickets responsive to relators' discovery."

ECF 171-14 ¶ 2. Bernardo's explanation at the October 10, 2024, hearing, though not credible, is relevant.²²

MR. BERNARDO: So, Your Honor, I first want to state out of the gate, and I think we said that in our brief, we have acknowledged from the very beginning that we made a mistake. And I also want to say, Your Honor, I take responsibility for that mistake. I've been doing this for 35 years. I've overseen discovery in major national litigation. And I take that role very, very serious. I am probably more of a micromanager than most. And I just want to represent and have Your Honor hear it from me that at every step of this process we tried to do what we thought was the right way to respond to discovery.

ECF 185 at 46:11-21 (emphasis added). The Court's ruling from the bench explained why the "mistake" explanation was not credible.

THE COURT: eCW's explanation for why it failed to produce the AppSec file is simply not credible. I don't believe it. I believe that some lawyers were surprised when they learned of it, but on -- in the whole, and as we look at the facts[] we've walked through this morning, it's simply not credible to me that eCW should not have recognized that this clearly discoverable information had not been produced. The best light that you can put on it is recklessness almost beyond comprehension. But that's the best light. I don't know, obviously, precisely what happened, but we all have the benefit of hindsight. And with hindsight, I think everybody recognizes this was a huge foul-up. There is no way it should have happened. There's no possible way that teams of attorneys and experienced clients, particularly experienced with litigation of this sort, would not have recognized that this information had not been produced.

Your expert -- one of your experts obviously recognized the significance of it. A cynical person would say that, well, once he scoped it out and told [eCW] that he knew about [the APPSEC files], the decision was made, well, we've got to come clean. A cynic would say that. I am not concluding that. All I am saying is the explanation is not credible, and the best light you can put on it is that it was reckless to the extreme.

-29-

ECF 185 at 86:10-87:8. In other words, eCW "c[a]me clean" only when a retained expert inquired about the missing evidence. The experts were Wortman and Litwak. ECF 185 at 28:2-5. As noted, one of Litwak's undisclosed consulting assignments involved the JIRA server. The Court's hypothetical cynic's suspicions, then, seem to have been proven correct. Litwak and Wortman asked about the missing evidence while preparing Wortman's expert report. Knowing that Wortman would soon be deposed, eCW had no choice but to come clean.

Second, the Court sanctioned eCW because it withheld evidence that could reasonably be interpreted as an effort by eCW to intimidate Quandary Peak Research, a company tasked to oversee eCW's compliance with a corporate integrity agreement ("CIA") between eCW and the Department of Justice. The CIA arose from a prior FCA action that also involved allegations that eCW improperly obtained certification of its EHR software.²³After Quandary Peak repeatedly found serious faults and deficiencies in eCW's compliance with the CIA, eCW charged Quandary Peak with "ethnic bias."

See ECF 266-106; 266-107. Quandary Peak refused eCW's demands to resign, and the Department of Justice, after reviewing eCW's allegations, rejected eCW's request to fire Quandary Peak. ECF 266-108; 266-109. Undaunted, eCW pursued civil claims against Quandary Peak, which eventually led to a settlement requiring Quandary Peak to replace key team members, including the team leader. ECF 266-41 at 6-12. Further, eCW required that Quandary Peak refuse to disclose the settlement to the government. Id. at 15. eCW's attorneys then hid the settlement agreement from the Relators, a tactic

-30-

almost certain to fail in a discovery-intensive case. Sure enough, the Relators learned of eCW's ethnic bias allegations and raised the issue with the Court. After a hearing, the Court ordered the production of the settlement agreement and sanctioned eCW. ECF 185 at 87:9-89:22.

With regard to the Quandary Peak settlement agreement, the good news is it's a smaller issue [compared to the APPSEC issue]. The bad news is, my gosh, it's a worse issue in terms of the look. I disagree that the settlement agreement was not within the scope. I mean, you've got an agency charged with the responsibility, as a result of a significant settlement with the government, of monitoring and recommending and discovering whether eCW is doing what it's supposed to and reporting if they're not. And the look is, to any reasonable person, that eCW didn't like what they were doing, and they took the action they took. And that look is reinforced by the fact that it wasn't produced.

. . .

So, it was a bad decision. It was a breach of eCW's discovery obligations. Id. at 88:12-24, 89:21-22.

Finally, the Court's reaction at the October 23, 2025, hearing to an early Wortman falsehood is relevant to The Explanations. As discussed in the Part I Order, Wortman, in his November 19, 2024, declaration, swore that, with one exception, he did not rely on Litwak's testing. ECF 264-3 ¶¶ 2-8. That was a significant admission— Wortman "largely disclaimed his methodology while conceding that he relied on Litwak's testing in part." ECF 496 at 6. But it was not a complete admission. When Litwak's July 23, 2025, deposition testimony revealed that Wortman had otherwise relied on Litwak's consulting work, the Relators renewed their efforts to exclude Wortman. In its August 21, 2025, response, eCW again denied that Wortman had relied on Litwak's work. ECF

363. But a footnote in that brief told in part a different story: "After being apprised of Relators' allegations . . . Wortman realized that he had inadvertently failed to recall at

-31-

the time he executed his [November 19, 2024] declaration in support of eCW's Opposition that his opinion [regarding authentication bypass] … relied on [Litwak's] testing using BurpSuite" and "now withdraws that opinion." ECF 363 at 7 n.5. This was the Court's reaction at the October 23, 2025, hearing:

Let me tell you, I don't buy that he forgot. I cannot accept that. If courts accept an "I forgot" excuse at this -- at that stage of a dispute, we might as well give free rein to lawyers to do whatever they want. I see no excuse for Mr. Wortman, assisted by you and Mr. Wyatt, sitting down, crafting that declaration to respond to these very issues, and then say something that is not true. And the excuse that "I forgot" is not credible and I don't believe it. I'm sorry. And certainly we can imagine, if that kind of excuse was good enough at that stage of a dispute, when all eyes are on everything, you know, we -- lawyers could get away with anything.

ECF 482 at 76:5-17.

Here is the point. The Court has repeatedly told eCW and its lawyers that claims of mistakes and forgetfulness, even if credible, do not excuse discovery abuse, particularly abuse on the scale seen in this case.

2. The Explanation: "We All Forgot"

a. Litwak's post-May consulting and his September report

In the Court-ordered production, eCW produced, for the first time, Litwak reports dated August 14, 2023, and September 6, 2023 (the "September report"). Whereas Litwak's May 9, 2023, report addressed only the allegations in the Relators' amended complaint, these supplemental reports provided Litwak's assessments after reviewing the Relators' 92-page supplemental interrogatory response. eCW offered the following justification:

eCW's counsel did not recall that Sygnia made further edits to [Litwak's] PowerPoint months later in August or September, since the changes simply involved adding sentences to advise counsel that Relators' supplemental discovery response did not change Sygnia's conclusions, the time spent on

-32-

these revisions was so low (less than 3 hours) that Sygnia did not bill for it, and the PowerPoint was never completed, as evidenced by the line edits and comment bubbles in the September PowerPoint. . . . However, once eCW's counsel re-discovered those versions while collecting documents in response to the Court's January Order, eCW's counsel promptly contacted Relators and the Court about the existence of later versions. ECF 510 at 16.

Once again, eCW's legal team, from top to bottom, claims they forgot. The Court will not address in depth here eCW's attempt to invoke yet again the "We All Forgot"

excuse. As discussed below, it is not believable, and in any event, "forgetfulness" is no excuse for the gross misconduct here.

As for Litwak's September report, the parties dispute its significance. The Relators argue strongly that the September report provides additional support for their claims. For example, it includes this new conclusion: "[I]n the case of eCW, it is clear there is a lack of enforcement of both authentication and authorization checks." ECF 503-2 at 37. As the Relators put it: "A finding by eCW's own expert that the software did not check off on authentication and authorization of users is more than consequential— it will be a centerpiece of Relators' trial presentation." ECF 518 at 2. The Court need not resolve this dispute, except to note that the revised report clearly provides some helpful fodder for the Relators. But the overarching point is that the September report was withheld based on false representations. And while Sygnia did not bill for Litwak's review of the supplemental interrogatory response and his September report, that was because the project had been closed out.²⁴ECF 558 at 22:19-24. True, Litwak claimed that his time was minimal, just as he claimed he did no additional testing. But to the

-33-

extent that Litwak suggests, as Bernardo and Wyatt have claimed, that less billing excuses false swearing, the Court rejects that claim.

Finally, according to Skadden's document management system records, Wyatt accessed and "checked out" a file containing both the May and September reports on April 27, 2024—the day eCW produced Wortman's expert report. ECF 558 at 142:5-15. The implication needs little explanation. As the Relators put it: "at least on the day they sent us the report and several months before they started telling us they had nothing to do with each other, the lawyers were looking at both the May and September versions of the Litwak report." Id. at 142:24-143:3. At the May 7, 2026, hearing, Wyatt explained that he likely opened the combined PowerPoint "to see if all the topics were covered or refresh my recollection on some issue." Id. at 153:4-6. The Court asked if this reminded him that he asked Litwak "back in August to do the supplemental work as evidenced by the September report that was in the file you were looking at[.]" Id. at 153:12-16. Wyatt stated it had not. Id. at 153:17-19.

b. Dayan's testing and Final Report

eCW produced Dayan's Final Report with the Court-ordered production. As discussed above, Sygnia's billing records indicate that Dayan spent 281.25 hours testing the Relators' allegations. ECF 356-4. eCW explained its failure to previously produce Dayan's testing with March 5, 2026, declarations from counsel and Wortman. Bernardo swore:

While Mr. Dayan's name was included on a March PowerPoint that Sygnia created at the outset of the Sygnia Technical Consultancy, I do not recall ever meeting Mr. Dayan in connection with that consultancy or discussing his role in the consultancy prior to preparing Mr. Litwak for his deposition in July 2025.

-34-

In connection with Mr. Litwak's deposition, I learned that Mr. Dayan was originally supposed to do the validation testing but that Mr. Litwak took it over and did it or re-did it himself because Mr. Dayan did not work out and was not available to Mr. Litwak.

The only individuals at Sygnia I have any recollection of meeting or working with in connection with the Sygnia Technical Consultancy were Avi Sambira, Avi Ezer, and Dan Litwak.

The first time I ever saw or otherwise became aware of the Dayan Document was when it was provided by Sygnia in January 2026 in connection with compliance with the Order. It was not among Mr. Litwak's files, which we reviewed with him on a screenshare in preparation for his deposition.

ECF 510-2 ¶¶ 40, 41, 42, 43. Wortman swore:

My knowledge of the work conducted by the Sygnia Technical Consultancy was limited to the general information presented in the invoices and the fact that Mr. Litwak had run certain tests, screenshots of which I used in my April 27, 2024 Expert Report (my "Expert Report"), which have been discussed more fully at my deposition and in prior submissions to the Court. ECF 510-3 ¶ 8.

In several material respects, both declarations are false. Dayan's work was the subject of the first billing dispute, and Wortman addressed and defended that work on the strength of information far more detailed than information in the invoices. Wortman provided Speyer, Horrell, Bernardo and Wyatt the spreadsheet that broke down Dayan's

281.25 hours in detail. As discussed in the findings above, Wortman's knowledge of Dayan was not "limited to the general information presented in the invoices."

And when Horrell asked Bernardo in May 2023 if the invoice reflected "the amount of time spent with skadden" (ECF 554-2 at 1) and then asked him to "take a look at this spreadsheet Sygnia sent to us and let me know if the time and details are accurate?" (ECF 554-5 at 1), Bernardo responded: "These entries are consistent with what I would expect, both in terms of amounts and timing. In some instances, for some

-35-

folks, they are a little lower than I would have expected given their mastery of the issues." Id. Contrary to his declaration, Bernardo discussed Dayan's "role in the consultancy prior to preparing Mr. Litwak for his deposition in July 2025." ECF 510-2 ¶

40. And he knew from Wortman's spreadsheet that Dayan had done "validation testing."

Id. ¶ 41.

Worse still for Bernardo, Dayan's Final Report was in the files that Bernardo and his team reviewed with Litwak in preparation for Litwak's deposition. That is discussed in detail below.

As noted, Speyer and Horrell do not claim they forgot. As agitated as Speyer was about Sygnia's perceived excessive billing and Wortman's aggressive and detailed defense of that billing, it is difficult to imagine that Speyer would support Wortman's claim that he knew nothing about Sygnia's consulting work. Similarly, Horrell, in her declaration, did not support Bernardo's claim that he knew nothing about Dayan's work, and Bernardo's and Wyatt's claim that the Public Research Project had nothing to do with Wortman.

c. Wortman's involvement in the consulting work

Wortman testified at the March 24, 2026, hearing that he forgot about his role in the billing disputes related to the Sygnia technical consulting because he never reviewed his email communications with eCW or its counsel or the spreadsheet he sent listing the Sygnia consultants by name and task.

Q. [Y]ou knew, as you told us now, that this consulting team was a critical issue in your deposition . . . But yet, are you saying that when you took -- sat for your deposition in 2024 you had not reviewed your emails about your involvement at that billing level with the consulting team?

A. That's correct. I did not.

-36-

ECF 532 at 190:11-22. The Court asked Bernardo why he did not speak up when Wortman testified that he was unaware of the consulting work performed or of the identities of the team members. ECF 532 at 117:4-8. Bernardo responded:

Because the testimony about the consulting was a few sentences out of his whole transcript, the focus of which was on his expert opinions, which is where we had focused all of our time and preparation. We hadn't gone back to reconstruct any of this or to refresh on this. Id. at 117:9-13 (emphasis added). The Court pushed further:

THE COURT: And do you think your statement or the statement in the brief that "he was not aware of the work Mr. Litwak performed as part of the consulting arrangement, or even the identities of the team members" -- can you think of any set of facts, based upon what you know now--that is that he sent you this spreadsheet--that would make those two sentences accurate?

MR. BERNARDO: At the time he was deposed -

THE COURT: No, I am talking about the facts that you know today. I understand he said you didn't give it to him. Nobody showed it to him before his deposition, which is a real issue I think that would be of concern to somebody. But, Mr. Bernardo, can you not admit now that the facts that we know today are that Mr. Wortman did know the members of the team because he had this spreadsheet that he sent to you?

MR. BERNARDO: . . . I agree that if he had that information and had recalled that -- he had information available to him from which he knew that to be -- he would know who the people were. I agree with that. Id. at 224:23-225:17.

Wortman explained that when he sat for his deposition, he forgot that he was involved in the billing dispute regarding Sygnia's technical consulting because it was

"fairly routine, and I would have no reason to really remember it." Id. at 168:10-15. However, he recalled at the time of his deposition that he was involved in the billing dispute regarding the Public Research Project. Id. at 178:24-179:5.

-37-

THE COURT: So, I want to follow up on that. You said that twice now. You do remember this November issue, but you understood that was outside the scope of your deposition?

THE WITNESS: That's correct.

THE COURT: You very much knew that the Eucalyptus Project, the consulting project that Mr. Litwak was involved in, was very much at issue in your deposition?

THE WITNESS: That's correct.

THE COURT: But you forgot about your involvement with the billing and the reconciliation and the resolution of the billing issues in that project?

THE WITNESS: That's correct.

THE COURT: All right.

Id. at 79:6-18. In sum, Wortman forgot about the billing dispute regarding the technical consulting, which he was specifically advised about before his deposition that he needed to be walled off from. This billing dispute, as recounted in detail above, required him to send separate emails apologizing to Horrell, Speyer, and eCW's outside counsel. Wortman remembered the billing dispute, which did not concern the technical consulting and required significantly less involvement and effort on his part. Contrary to Bernardo's representations, the true "focus" of Bernardo's and his team's lengthy preparation of Wortman for his deposition was to shape his testimony to conform to eCW's "walled off" narrative. Wortman made this clear at the March 24, 2026, hearing:

THE COURT: . . . You knew when you gave the deposition that there was a question or a potential issue as to whether the consulting work was separate from your work as an expert witness.

THE WITNESS: That is correct.

-38-

THE COURT: And since your deposition, you know that has become a very critical issue?

THE WITNESS: I do.

THE COURT: Okay. But you knew that when you were deposed as well?

THE WITNESS: That is correct.

BY MR. SNYDER:

Q. And you'd had conversation with the lawyers about the fact that the lawyers for the relators were trying to understand the separation between the teams and were likely to ask you questions about it; correct?

A. I believe that's correct, yes.

Id. at 170:23-171:15.

THE COURT: . . . "[T]o make that point -- that is, keeping the two teams separate, your expert team and this consulting team -- to make that point clear, you testified that you didn't even know the entire makeup of the team, you were isolated from it, you understood that Mr. Litwak may have assisted in parts of that effort. But when you gave that testimony, you knew for a fact that Mr. Litwak had done that because you had incorporated some of his work into your report that he did as a part of the consulting team; is that correct?

A. That is correct.

Id. at 191:23-192:7. In short, Wortman did not forget about his involvement with the Eucalyptus consulting. Rather, he was prepared to deny any involvement.

3. The "We All Forgot" Defense Fails As the Relators demonstrate, there have been numerous times during this protracted dispute when Bernardo and Wyatt, even if they had truly "forgot," would have been "reminded." ECF 518-10.²⁵In all events, the Court cannot accept that Bernardo, the "micromanager" who strives to find "the right way to respond to discovery" (ECF 185

-39-

at 46:11-21) would not have reviewed his files before his presentation at the October 23, 2025, hearing, and thus would have been "reminded" of the truth. Or even if he truly had not looked at his files, the Court does not believe that the bevy of lawyers assisting him in that elaborate presentation would also not have looked at their files. But perhaps the best example of the "We All Forgot" explanation's falsity is the preparation for Litwak's deposition by Bernardo and his team in July 2025. Notwithstanding his lengthy preparation, Wortman had faltered badly at his August 15, 2024, deposition. He was unable to answer basic questions about testing and the test results referenced in his expert report. That led to the Relators' first motion to exclude Wortman. To resolve the issue, the Court allowed the Relators to convene Litwak's deposition. ECF 334 at 37:19-38:6. Based on Bernardo's representations about Litwak's lack of involvement, the Court reasoned that "given the narrow role that Mr. Litwak played in this, simply let him be deposed, establish that, and the issue goes away." Id. at 38:3-6. Bernardo confidently predicted that he was "fairly certain nothing will come up" Id. at 38:7-9. In short, Litwak's deposition would resolve the dispute. In the Relators' notice setting Litwak's deposition, they requested the production of specific documents. It is undisputed that those requests called for the production of documents that eCW subsequently produced in the Court-ordered production. For example, the Relators requested "[a]ll communications (emails, texts, chats, instant messages, and any other written communications) between Mr. Litwak and Defendant eClinicalWorks and its counsel, relating to any testing of eCW's software by Mr. Litwak at any time, and for any purpose." ECF 490-5 at 5. With some specific exceptions, not now relevant, eCW, six days before the deposition, responded that "reasonable

-40-

searches" were conducted and responsive documents, besides the May 9, 2023, Litwak report, were not identified. Id.

At the March 24, 2026, hearing, the Court sought to understand why the documents produced in January 2026 were not produced when Bernardo and his team conducted their reasonable searches in response to the Litwak deposition notice. First, Bernardo agreed that Litwak's post-May 2023 documents and reports "were responsive to the [Litwak] deposition notice." ECF 532 at 80:3-5. Bernardo and Wyatt also admitted that the relevant documents were in their files. Id. at 79:2-6. They could not avoid that admission because they sent or received the emails and the relevant reports and documents attached to them. When the Court asked what the scope of the so-called

"reasonable search" was, Bernardo responded: "We asked Mr. Litwak . . . to go through his files to identify materials that could potentially be responsive." Id. at 80:6-9. That prompted this:

THE COURT: Why didn't you look at your own records?

MR. BERNARDO: Because we interpreted the request to Mr. Litwak as calling for what Sygnia had with respect to the testing that Mr. Litwak did, which would be the appropriate place to have it. We wouldn't expect that we would have something that Mr. Litwak didn't have.

Id. at 81:18-23.

That made no sense. For example, communications with eCW's lawyers were specifically requested. Clearly, those communications were in the lawyers' files. Why would lawyers restrict their "reasonable search" to someone else's files?

THE COURT: Are you -- is this how your firms handle document requests?

You don't look to see if you have documents responsive? You go to the client to see what they have that's responsive.

-41-

MR. BERNARDO: It depends upon what the document request is and what the circumstance is. If the document request is for testing conducted by Mr. Litwak, I wouldn't have anything that he doesn't have. Id. at 81:24-82:6. Of course, the document request was not limited to testing. In any event, the testing was also in Bernardo's files.

THE COURT: When did any of you first search your firm's records for these documents?

MR. BERNARDO: In connection with response to the Court's order of January 15th.

Id. at 82:7-10.

Bernardo and his team knew they had frequently communicated with Litwak and the Eucalyptus team, and that those communications were in their files. But, to them, a

"reasonable search" when responding to discovery, even discovery looking for "missing evidence" that Wortman could not account for, did not include looking at those communications. Rather, Bernardo claimed he conscripted Litwak to conduct that

"reasonable search." Accordingly, the Court ordered eCW "to bring to court at its expense Mr. Litwak as soon as that can be scheduled." Id. at 255:9-11. The Court reconvened on May 7, 2026, to hear Litwak's testimony.

One of the first questions for Litwak was why he repeatedly testified during his deposition that his consulting work ended in April or May 2023. ECF 558 at 12:24-13:2. Litwak acknowledged the testimony but would not say it was false. Rather, as he put it,

"I agreed that at the time that's what I had in my mind about the timeframe in which I participated for the consulting beat." Id. at 13:3-7. That needs unpacking. Unlike the lawyers, Litwak admitted that he had reviewed the supplemental interrogatory response and revised his May 9, 2023, report. Id. at 15:14-25. Why, then, did he testify that there

-42-

was only one report and that it was finalized on May 9, 2023? Litwak claimed that he

"just didn't remember that [his report] was updated in August and not in May." Id. at 18:7-8. How, then, could he explain this testimony at his deposition:

Q. . . . [I]s there any other document [other than the May 9, 2023 report] that you are aware of that summarizes your findings that any testing or analysis that you did during the litigation support phase?

A. No. That was the only document.

ECF 361 at 115:23-116:2. This was Litwak's explanation:

I thought it was the same report all the time. So, I—in my mind, when we were—when you were asking about if that was the only document, technically speaking it's two different documents on two different dates, but for me it's the same report.

ECF 558 at 19:2-6.

In short, May was the "timeframe" Litwak said he had in his mind, and in his mind, the two reports were one, and thus, he swore that the May 9, 2023, report was the final report. Meanwhile, the lawyers forgot completely that Litwak's work continued well beyond May, that they had asked Litwak to review, analyze, and test the allegations in the Relators' supplementary interrogatory response, and that Litwak had submitted a revised report in September.

With that far from satisfying explanation, the inquiry turned to Litwak's deposition preparation and the "reasonable search" for documents responsive to the deposition notice. The preparation and search consisted of "several sessions, through the course of several weeks, [] in which we validated the files that I had in my computer." Id. at 30:7-9. Regarding the scope of the search, Litwak "understood back then that we wanted to search for emails to and from Mr. Wortman in relation to the consulting work that we did." Id. at 31:16-18. And he thought that the timeframe of the search "was

-43-

mostly related to March to May" because he "never remembered that [he] had the August hours and [he] didn't submit those hours." Id. at 34:21-23. However, he admitted that the searches would have pulled up emails later than May, such as those transmitting the August and September reports. According to Litwak, "we didn't pay attention because we were focused on specific[ally] May as it related to Mr. Wortman's report or anything that could have been shared with him." Id. at 35:4-7. Litwak also admitted that there were "a lot of emails," and "we couldn't review each and every one of them." Id. at 34:17-19. Whatever "reasonable search" may mean to eCW and Bernardo and his team, it does not mean a complete and honest search. But Litwak did not, as Bernardo represented to the Court, conduct the search by himself, and Litwak certainly did not make the decision about what documents would be produced. The search was done, Litwak said, "hand in hand with the eClinical Works lawyers." Id. at 51:5-12. Litwak shared his screen with the lawyers so that they could conduct their searches. Id. As Litwak put it, "we were doing these different searches together." Id. The lawyers made the decision about which documents to produce. Id. at 73:6-18. Together, they went through the folders in Litwak's computer, including folders that contained the May 9 report, the August and September reports, the Relators' supplemental interrogatory response, and Dayan's report. Id. at 57:6-9, 58:10-60:1, 68:9-20, 126:19-127:21. "I was sitting there, sharing the screen, and they were asking me -- we were reviewing the files, and they were telling me, 'please share this file.' And I shared some files." Id. at 73:15-18. Of course, Dayan's Final Report was within the self- imposed March to May timeframe that Litwak claims he and the lawyers limited themselves to. And clearly, Dayan's report addressed extensive testing. So, why was

-44-

Dayan's Final Report not produced? Again, Litwak claims the lawyers were making the decisions about what to produce, but Litwak said that he "did not find it relevant at the time." Id. at 129:19.

eCW did not produce any of Litwak's reports prior to his deposition. After the deposition, Bernardo, rather than producing the September 2023 report, produced to the Relators the May 9, 2023, report and, of course, thereafter eCW represented that the May 9 report was the final report.²⁶On direct examination of Litwak, Katz asked what seemed an odd question. Was Litwak responsible for producing the May 9 report?

Litwak responded that he "wouldn't know. I am not sure." ECF 558 at 101:19-102:4. That led the Court to ask Katz why the May 9 rather than the September report was produced. Katz responded:

So, my understanding is that, um, when the email was located on Mr. Litwak's screen share, that link did not obviously still work, since it was an expired link, and there was an instruction to a Skadden lawyer—I believe it was Mr. Winship—to go and find that document that would have been in that link. And he went on a Skadden document repository, found it, downloaded it, provided it to Mr. Bernardo or whoever it was that was doing the production, and it was produced to Relators' counsel that way. Id. at 114:11-22.

When the Court asked whether it would be necessary to bring Mr. Winship to testify, Bernardo stepped in: "If I wasn't clear before, [Winship] was specifically asked to provide the May 9th [report]." Id. at 150:6-7. Bernardo did that, he claimed, because he

"was well aware that we - [Wyatt] and I - had created subsequent versions of [Litwak's report] that had our internal edits." Id. at 150:7-9. Bernardo stated: "I remembered [the internal edits], and I remember the meetings with Mr. Litwak where we were going

-45-

through that." Id. at 150:15-17. Bernardo was referring to the revisions in June and July of 2023. So, though he was "well aware" of those revisions, neither he nor anybody else remembered Litwak's review of the Relators' supplemental interrogatory response or the September report.

In short, the "reasonable search" of Litwak's files and even Litwak's deposition was a sham, indeed, a fraud on the Court. Bernardo could represent to the Court before Litwak's deposition that he was "fairly certain nothing will come up" (ECF 334 at 38:7-8), because he would make sure nothing would come up. eCW's lawyers would not search their files, where the damning evidence lay. Then, at the March 24, 2026, hearing, which was supposed to be the final hearing, Bernardo blamed Litwak. Litwak, he told the Court, did the "reasonable search" that failed to yield the responsive documents. Clearly recognizing the significance of Dayan's work and the failure to produce the report, he swore in his March 5, 2026, declaration that he first learned that Dayan was to do the validation testing "in connection with Mr. Litwak's deposition." ECF 510-2 ¶¶ 40-43. Yet, he had in his files Wortman's June 2023 spreadsheet detailing Dayan's

281.25 hours, including the 260 hours Dayan spent validating and testing, and he had in his files his emails with Horrell vouching for Dayan's work. Then he swore that Dayan's Final Report was not in Litwak's files when he and his team prepared Litwak for his deposition. Id. ¶ 43. The truth surfaced only because the Court ordered eCW to bring Litwak.

F. Sanctions

A court has the inherent power to sanction a party who acts in bad faith, vexatiously, wantonly, or for oppressive reasons. See Chambers v. NASCO, Inc., 501

-46-

U.S. 32, 45-46 (1991). It may sanction parties, lawyers, or both. Byrne v. Nezhat, 261 F.3d 1075, 1121 (11th Cir. 2001), abrogated on other grounds as recognized by Jackson v. Bank of Am., 898 F.3d 1348, 1357 n.10 (11th Cir. 2018). "This power is derived from the court's need 'to manage [its] own affairs so as to achieve the orderly and expeditious disposition of cases.'" Id. at 1106 (quoting Chambers, 501 U.S. at 43 (alteration in original)). "Because of their very potency, inherent powers must be exercised with restraint and discretion." Chambers, 501 U.S. at 44. "A primary aspect of that discretion is the ability to fashion an appropriate sanction for conduct which abuses the judicial process." Id. at 44-45.

"In the context of inherent powers, the party moving for sanctions must show subjective bad faith." Hyde v. Irish, 962 F.3d 1306, 1310 (11th Cir. 2020) (emphasis in the original). Subjective bad faith may be established either "(1) with direct evidence of the attorney's subjective bad faith or (2) with evidence of conduct 'so egregious that it could only be committed in bad faith.'" Id. (quoting Purchasing Power, LLC, v. Bluestem Brands, Inc., 851 F.3d 1218, 1223 (11th Cir. 2017)). For all the reasons discussed, the Court finds that clear and convincing evidence shows that eCW's misconduct—its own and misconduct imputed from its lawyers—constitutes subjective bad faith.²⁷eCW repeatedly lied to the Relators and the Court for strategic gain. It forced the Relators

"repeatedly to appear before the court, seek relief from the court, and otherwise litigate matters that should have been resolved far more quickly." See In re Sunshine Jr. Stores, Inc., 456 F.2d 1291, 1305 (11th Cir. 2006).

-47-

The Court pondered the least severe sanction likely to deter future similar

misconduct in its conclusion to the Part I Order:

What can the Court do to ensure that eCW will not continue to misbehave?

Never has the Court thrice-sanctioned a party for withholding evidence. At this point, the Court is not sure.

ECF 496 at 13. The Court hoped its question was rhetorical. To that point, it had only ordered eCW to pay the Relators' attorneys' fees and expenses. But as the Court- ordered production has demonstrated, monetary sanctions will not stop eCW and its lawyers. That is not to say that more money will not be paid. Clearly, severe sanctions are necessary.

The Relators have aggressively pushed for, and the Court has carefully considered, the ultimate sanction of default. Given the longstanding, repetitive and pervasive misconduct here, default seems appropriate. However, the arguments of local counsel²⁸have been persuasive. That is not because eCW itself is not sufficiently culpable, as local counsel has argued. On the contrary, for all the reasons discussed, eCW was, in some measure, a participant in, not a victim of, its lawyers' transgressions. Chief Financial Officer Speyer and in-house lawyer Horrell knew Wortman's role in Eucalyptus's consulting work well, and they knew Wortman was not walled off from that work. Horrell was present at the June 24, 2025, hearing on the Relators' initial motion to exclude Wortman, when eCW's walled-off narrative was fully developed. As eCW's lawyer, she was clearly in a position to stop retained counsel's misrepresentations. In short, eCW is not sin-free.

-48-

More persuasive is the argument that the consequences of default militate against that ultimate sanction. The Relators believe they can prove actual damages totaling $106.2 million, plus civil penalties, treble damages, and costs. ECF 553-1 at 11. Given that, the Court has been persuaded that default is not an appropriate sanction. The Court recognizes that this rationale for rejecting default as a sanction is likely to be unfair to the Relators. If this were, say, a case with $1 million in damages, the Court would not hesitate to enter default as a sanction for the misconduct here. The Relators can argue convincingly that eCW should not avoid default simply because the consequences are more painful. Nevertheless, that is the Court's decision. And while it is small comfort, the Court will bear this in mind when it considers the appropriate monetary sanctions.

The Court GRANTS the Relators' third motion for sanctions (ECF 503) and assesses the following sanctions:

• Wortman and Litwak are excluded entirely from this matter.

• Sygnia's work product shall be available to the Relators for use at trial.

• At the appropriate time, the Court will assess severally monetary sanctions against Skadden, Arps, Slate, Meagher & Flom, eCW, and Kirkland & Ellis. The proceeds shall be used to further education and training in ethics and professionalism.

• The sanction of issue preclusion shall be addressed at the final pretrial conference. The potential issues for preclusion will include eCW's motion for judicial notice (ECF 508), motion for leave to

-49-

supplement (ECF 512), and motions in limine (ECF 388; 390; 392; 394; 396; 398; 399; 401; 403; 405; 407; 409; 411; 413).

• eCW shall continue to pay the Relators' attorneys' fees and expenses associated with their motion for sanctions.

SO ORDERED, this 3rd day of June, 2026. S/ Marc T. Treadwell

MARC T. TREADWELL, JUDGE

UNITED STATES DISTRICT COURT