I think punishing the engineer would be much less practical than the CEO. There will always be an engineer (perhaps a remote contractor) who will build this.
Of course. I wouldn't really ever consider engineers to be to blame - they could whistleblow of course, but the people that inked the deal and brought it to the engineers should be held responsible.
If we can't hold the tech industry responsible for this, what hope do we have holding them responsible for murkier issues like privacy/data collection?
edit: by "developers" in my parent post, I meant "the EHR company"
The person who ended up pushing opioids as a treatment for ∀y is very likely not an engineer.