chevron-down Created with Sketch Beta.

Tort, Trial & Insurance Practice Law Journal

TIPS Law Journal Winter 2023

An Attorneys Guide to Understanding Medical Records in the Digital Age

Samuel Hodge Jr

Summary

  • Most malpractice claims will depend upon the quality of the medical documentation.
  • The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its regulations impose stiff monetary penalties and possible criminal charges for unlawful disclosure of protected health information.
  • Physicians may violate the 21st Century Cures Act if they knowingly engage in conduct that impedes the exchange, access, and use of electronic health records, even if no harm occurs.
  • Artificial intelligence is incorporated into many medical decision-making processes, including detecting abnormalities in diagnostic imaging and assisting robotically in the operating room.
An Attorneys Guide to Understanding Medical Records in the Digital Age
sturti via Getty Images

Jump to:

“Breakthroughs happen when limiting thoughts and behaviors are challenged.”

—Fabienne Fredrickson

Medicine has dramatically changed over the past few decades with “the increasing gap between what doctors have traditionally been trained to do and the realities of modern clinical practice.” Recently, this metamorphosis has been overshadowed by COVID-19 and other infectious diseases that have caused more than six million deaths worldwide. However, electronic medical records (EMR) have replaced paper charts, artificial intelligence (AI) is used to make a clinical diagnosis, surgery is performed robotically, and the government has enacted legislation to protect confidentiality and to ensure medical records availability. Patients even have access to their diagnostic tests through their cell phones and can obtain the results before their physicians are notified of the outcomes. These developments have also affected the legal profession. Detailed HIPAA forms have superseded the single-paragraph medical release, there is uncertainty concerning the cost to retrieve medical records, and treatment notes involving drug or alcohol abuse will not be provided unless the consent form contains exacting language about these conditions.

This article will examine these developments from a medical and legal point of view and provide some clarity to this complex and confusing area. Attention will be paid to the recent legislation involving a patient’s medical chart, how medical records are organized, the nuances of the electronic medical records, and how artificial intelligence has changed the practice of medicine.

The Medical Record

Reasons for Maintaining a Patient’s Chart

A crucial component of a patient’s care is the medical chart, and it is a key part on which nearly all medico-legal disputes are decided. Most malpractice claims will depend upon the quality of the medical documentation. Afterall, the medical chart is a legal record, and a host of rules and regulations apply such as requirements for the recording of information, file retention, privacy considerations, and disclosure. Because of their recent conversion to an electronic record keeping format, they have become much more complex.

These documents establish a systematic medical and legal narrative of a person’s health with attendant rights and requirements to prevent their unauthorized disclosure. They detail events and interactions between patients and health care providers. Recording the patient’s history of illness, course of treatment, and prognosis has always been an essential component of the patient’s treatment. This task, however, has grown in importance “where the government ties reimbursement to the quality of the medical record.” Medicare even influences the contents of the patient’s chart. A claim for Medicare benefits will only be recognized if adequate documentation in the file corroborates that the treatment rendered was “reasonable and necessary and mandated the level of treatment billed. Insufficient documentation will result in a rejection of a claim.

The medical chart details the treatment provided to the patient and permits other health care providers to ascertain the care rendered so that the physician “can continue to provide the best possible treatment for each individual.” Proper record keeping helps minimize the probability of a successful lawsuit for professional negligence by providing the necessary documentation to demonstrate the course of treatment. Afterall, physicians are so overwhelmed with patient care and paperwork that they will have trouble recalling their thought process concerning the treatment or a diagnosis of a patient from years earlier. A well-documented file will assist the health care provider in reconstructing what transpired at that earlier visit. One must also remember that a medical record is maintained to fulfill the various legal and ethical requirements imposed by the government, regulatory agencies, accrediting bodies, and hospital administration. Finally, these records provide the necessary patient information for reimbursement purposes.

Electronic Medical Records

The earliest medical records can be traced back to ancient societies such as Egypt, Greece, and Rome. In fact, Greek and Roman medical record keeping was first established more than 2,000 years ago. The precursor to the modern medical chart first surfaced in Paris and Berlin by the early nineteenth century. It was not until the twentieth century, however, that the medical record was transformed into a helpful resource “for direct patient care in hospital and ambulatory settings.” Healthcare providers recognized that clear and succinct medical record documentation is important to offering patients proper treatment, guaranteeing correct and timely payment for medical services, reducing malpractice risks, and assisting physicians to access and plan the patient’s care and preserve the gamut of treatment. This knowledge stimulated physicians to encourage their healthcare organizations to maintain patient records regularly, a system that is known as health information management.

These records were maintained in a paper format and were stored in the physician’s office or a medical records department at a hospital. No expensive training was needed to manage these charts, and paper records were modified to fit the needs of each health care provider without any technical overhaul. Patient files, however, were often cumbersome, disorganized, illegible, and information was lost, mainly because there was no backup file.

The health care industry was turned upside down in 2009 with the passage of the Health Information Technology for Economic and Clinical Health Act (HITECH). This legislation mandated the meaningful transition of the patient’s chart to an electronic format by January 1, 2014, for the physician and hospital to remain eligible to receive Medicaid and Medicare reimbursement. The purpose for this conversion was to “improve quality, safety, efficiency, and reduce health disparities, engage patients and family, improve care coordination, and population and public health [and to] maintain privacy and security of patient health information.”

An electronic medical record (EMR) is a digital version of the paper chart and represents “a patient’s medical health information securely documented digitally. It contains sensitive and protected information such as their medical history, medications, and test reports that only authorized users can access.” Unlike the paper chart, which could not be instantly shared with other health care providers, electronic medical records allow others to access the system, to view patient medical records at any time. The EMR also fosters efficiency, improves patient care, and provides the individual with a level of self-directed care, and home supervision, that makes it simpler for patients to manage sicknesses and chronic illnesses. Currently, about ninety percent of office-based physicians use electronic medical record systems. However, several drawbacks to the use of EMR can hinder the physician’s ability to focus on patients, hamper communication, and negatively affect the patient-doctor relationship.

Obtaining Medical Records—HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal mandate that establishes national criteria to safeguard sensitive patient health information from being revealed without the patient’s approval or awareness. The legislation also provides patients with the ability to inspect and obtain a copy of their medical file and request corrections to their medical records. In turn, the U.S. Department of Health, and Human Services (HHS) published the HIPAA Privacy Rule (Rule) to carry out the requirements of HIPAA. This Rule discusses the application and release of a patient’s protected health information or PHI by entities covered by the Privacy Rule. These organizations are dubbed “covered entities.” The Rule created national standards on how covered entities, health care clearinghouses, and business associates disclose and store PHI with the primary goal to safeguard patients’ records while rendering health care services.

The Privacy Rule also includes standards for patients to comprehend and determine how their medical records are used. A controlling goal of the Privacy Rule is to ensure that patients’ health information is adequately safeguarded while permitting the movement of health data required to supply and advance superior healthcare, and to protect the public’s health and well-being. The Rule further facilitates the important use of this confidential information while protecting the privacy of those who pursue medical treatment.

Allowing patients to obtain or access their records easily allows them to be in better control of decisions about their health and welfare. Obviously, those who can review or obtain their medical records are in a better position to monitor chronic illnesses, obey treatment regimens, discover and correct mistakes in their health records, and track their progress with disease management initiatives. Placing patients “in the driver’s seat” concerning their health is a key element of health reform and “the movement to a more patient-centered health care system.”

The ability of counsel to obtain a patient’s medical records under HIPAA will depend upon whether the attorney represents the patient or is defense counsel in a lawsuit. Plaintiff’s counsel merely has to use an authorization signed by the client that complies with HIPAA’s requirements and appropriate state laws. Defense counsel, however, has a much tougher row to hoe. Health care providers may request a subpoena or court order from defense counsel before allowing access to specific medical information. While a subpoena cannot be ignored, covered entities are cautioned not to produce PHI without safeguarding a patient’s privacy and confidentiality. The consequences of responding improperly to a subpoena can be even more significant than disregarding the subpoena altogether. HIPAA and its regulations impose stiff monetary penalties and possible criminal charges for unlawful disclosure of PHI. Even unintentional violations can trigger corrective action, significant fines, Office of Civil Rights investigations, and loss of business. HIPAA, however, has limits when it comes to punitive action. As noted in Somerset v. University of Medicine and Dentistry, it is well-established that HIPAA does not provide a private right of action for patients. However, the legislation does not prevent a state licensing board from disciplining a physician for violating the law.

A vital component of the legislation is that a covered entity may only disclose the “minimum necessary” information to comply with the request for medical data. This privacy requirement means that a covered entity must take reasonable steps to employ, divulge, and request “only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.” However, the term “minimum necessary” is vague, thereby causing confusion. This ambiguity leaves it up to a covered entity to ascertain what records to release and the labors that should be exerted to limit the release of information to no more than necessary. The covered entity’s determination as to what constitutes the minimum necessary information should be supported by a reasonable justification standard; it should be based upon the technical abilities of the covered entity and be premised upon privacy and security concerns. This means that someone who requests the production of “any and all records” concerning a patient may receive an objection from the health care provider since this type of request does not identify the information in a specific and meaningful fashion.

A covered entity is required to produce the requested records no later than thirty days after receiving the request. If the information cannot be produced within this time, the health care provider may extend the period for another thirty days, but it must offer a written justification for that extension. However, only one such extension is permitted. Counsel should be aware that HHS is contemplating reducing these time limits to fifteen calendar days and wants covered entities to create written guidelines for prioritizing urgent or other priority requests to restrict the ability to use fifteen-day extensions.

The Chart’s Organization

Electronic Medical Records

HIPAA has placed its imprimatur on the organization and release of medical records. The legislation requires standardized designs for saving and disclosing patient data that “preempts all state requirements with respect to electronic medical data and supersedes any contrary state law that mandates a paper-based medical record system.” Therefore, the electronic medical chart should be the same as the traditional paper file and should contain various sections that record the pertinent facts gleaned from patient encounters and telephone calls. However, some elements will be combined, repeated, or not printed out. The printed version of the EMR will also not be identical to what is displayed on the computer screen, and the layout of the records may vary based upon the physician’s specialty and software utilized.

Most record-keeping systems are devised for a specific health care provider, so they will not be uniform, and each has a distinctive operator interface for retrieving a chart. In fact, there are at least 179 IT vendors of electronic medical record software with each offering different layouts and functions. This variety makes it difficult for an attorney to obtain a comfort level when reading a digital chart. Therefore, one must understand the elements of an electronic medical record “so that a check can be conducted to make sure the entire file has been received.” One may also not assume that the records maintained by the different units of a health care provider will be the same. An electronic record copying system may vary based upon the needs of a department or medical specialty. For example, the emergency room may use different software than other departments in the medical facility, and the staff may employ a system unlike the one used by physicians.

With the conversion to a digital medical record format, the days of reading a doctor’s illegible handwriting should be over. Unfortunately, that is not always the case. Not all health care practitioners had transitioned to electronic medical record keeping, and older medical records remain handwritten. Doctors also classically author notes that are understandable mainly to themselves, and they are not attentive to how others may construe them. Obviously, these illegible notes can have profound implications involving a patient’s health and unfavorable medico-legal consequences. These risks can include False Claims Act and quality assurance issues, risk management concerns, accreditation problems, increased audit risks from public and private payers, and medical malpractice issues. This practice can also delay treatment, result in unneeded tests and improper medication dosing that, in turn, can cause discomfort and death. In this regard, the National Academy of Medicine has noted that physician’s illegible notes cause about 7,000 deaths each year. This alarming number accentuates how hazardous illegible handwriting can be in the health care arena. Some jurisdictions have remedied this problem by enacting laws to curb this practice. For instance, Pennsylvania has enacted a regulation that requires a health care provider to “maintain medical records for patients which accurately, legibly, and completely reflect the evaluation and treatment of the patient.” Another consideration is that an illegible medical record can result in the court’s denial of a compensation claim.

Types of Medical Records

Most attorneys and insurance professionals investigating a claim will request the appropriate physician and hospital records. Therefore, it is essential to understand how these documents are organized so one may better ascertain whether the complete chart has been produced.

Physician Records

Physician records will not be uniform and may vary by office. However, they should contain certain information, including the intake form, progress notes, diagnostic studies, correspondence, and miscellaneous notes. The patient intake form should be the first document in a physician’s file. Some say this form is “the most important part of any medical clinic’s patient interaction cycle.” It provides the first contact with the patient and will create the infrastructure for the file and data storage. This document is usually a preprinted form that solicits the patient’s demographics, insurance information, and patient’s health history. It may be a one-page form or be very detailed consisting of several pages of questions. The document’s driving force is to learn in a summary fashion more information about the patient’s past medical and family history, genetics, hospitalizations, surgeries, current medications, and the purpose for the visit. Some forms even ask about the person’s sexuality, when they last engaged in sexual relations and came in contact with another person’s bodily fluids.

The second section of the chart is the progress notes. These chronological entries provide a snapshot of each office visit and are usually the most extensive section of the file. Their function is to document the medical facts and clinical impressions and serve as a summary of the patient’s condition at a specific point in time. Some physicians may detail an office visit with loosely worded paragraphs, or they will utilize the Subjective, Objective, Assessment and Plan (SOAP) format to provide a uniform recording system. This acronym refers to a predetermined method for physicians to document a patient’s visit and “stands for subjective data (the patient’s complaint/concern), objective data (the findings from the physical assessment), the physician’s assessment of the situation (the diagnosis or impression), and the plan for treatment (medication, physical therapy, diagnostic testing, or consultation with a specialist).” This section may also include statistical data detailing the patient’s vital signs, height, and weight.

The SOAP format has been criticized because it fails to document “changes over time” adequately. A patient’s condition will usually not remain consistent over weeks or months, necessitating a physician to reevaluate the medical impression and treatment plan. The SOAP format fails to incorporate “time into its cognitive framework.” This gap has led some to suggest an alteration of the acronym to SOAPE, with the letter “E,” for “education,” serving as a prompt to review how the patient has progressed under the treatment plan.

From a claims point of view, it is helpful to review the progress notes for “consistency of complaints over time and among healthcare providers.” This analysis allows for the uncovering of discrepancies in complaints and impressions between physicians for examinations close in time. For instance, a claimant should not go to a physician and claim to be suffering from acute back pain and go to another doctor later in the day and assert that his back pain in minimal. These variances can then be used at deposition or trial to demonstrate inconsistencies in the narrative, thereby casting doubt on the claimant’s allegations.

The third section of the chart involves laboratory and diagnostic testing and will include blood tests, urine analyses, and diagnostic imaging results. These materials offer valuable information about other potential reasons for a complaint or reveal a pre-existing condition. For instance, a car accident claimant may complain of continued muscle aches and fatigue when the person has Lyme’s disease that is revealed in a blood test. The symptoms of an accident victim who alleges paresthesia and radiculopathy involving a foot may suffer from diabetic neuropathy and a pre-accident MRI may disclose a herniated disc or spinal abnormality unrelated to trauma.

The fourth portion of the record involves the correspondence section. If the patient was seen by a physician other than the treating doctor, this specialist will frequently send a letter to the referring doctor detailing the results of their examination and proposed treatment. Counsel investigating a claim should not overlook the correspondence in this section since it can provide a treasure trove as to other health issues or causes for a problem. For instance, a pre-accident examination by an orthopedic surgeon for neck pain may demonstrate an undisclosed problem inculpating the musculoskeletal system.

The last segment of the chart is reserved for miscellaneous items that cannot be placed neatly into one of the other categories. Examples of information in this section include subpoenas in other cases, correspondence from an attorney, or even a statement by the claimant, which may contain helpful information about the lawsuit.

The Hospital Record

Federal law and accrediting principles mandate that a hospital maintain a medical record for every patient, whether the treatment is rendered during a hospitalization or on an outpatient basis. These documents must be accurately transcribed, completed promptly, adequately maintained, and readily accessible. The hospital is also mandated to employ a system for scrivener identification and chart upkeep that guarantees authentication and safeguards the “security of all record entries.” These requirements result in a more formal and uniform record, which will usually be maintained by a records custodian or medical records department. While the order of the materials may vary from facility to facility, most sections of the chart are the same.

The patient’s chart will usually consist of the following sections:

  • Emergency room record
  • Patient admission
  • History and physical
  • Progress notes
  • Consultations
  • Laboratory and diagnostic test results
  • Nurses’ notes
  • Medication sheets
  • Physician orders
  • Operative notes
  • Discharge summary
  • Incident reports
  • Consent and other miscellaneous documents

Regardless of whether these records are kept electronically or in some other format, they must include the patient’s name and identification number.

Emergency Room Record

An emergency room records review should start by ascertaining if the patient was brought to the hospital by ambulance. This detail is usually provided at the very start of the chart. Suppose an emergency vehicle were involved in the patient’s transport. In that case, a record will be made by the crew of their observations and physical examination of the patient. A copy of this document may be attached to the emergency room record, and it can contain useful comments by a neutral observer. For instance, the patient’s condition at the scene of an accident will be documented in an objective fashion. Statements about the accident or incident by the patient may be recorded, and her physical status will be noted. The document may also list the names of witnesses and the timing of the events. These writings can be compared with a patient’s allegations at a subsequent time. For instance, an accident victim may say in discovery that she was rendered unconscious in the collision. However, the ambulance notes may reflect that the person was observed walking around at the accident scene in no acute distress and was awake, alert, and oriented.

As for the emergency record itself, it will contain a triage worksheet, which refers to “the sorting of injured or sick people according to their need for emergency medical attention.” A listing will also be provided of the patient’s vital signs, chief complaints, physical status, physician’s impressions, and disposition. Medications administered and diagnostic tests ordered will be listed. These entries are usually unbiased observations of the events, and the emergency room nurses and doctors will record the patient’s complaints and note if any injuries are observed. For instance, a trauma victim who claims to be in a great deal of discomfort should not be observed freely moving about, strolling the halls, or casually talking on the phone for extended periods. Similarly, there may be a note about the smell of alcohol emanating from the patient.

Patient Admission

A person may be admitted to the hospital for various reasons, such as having a baby or undergoing surgery. They may also be transferred from the emergency room for an inpatient stay or be admitted on a prearranged date. Regardless, an admitting physician will start the process by contacting the appropriate hospital personnel to ascertain room availability. Admission is not guaranteed and will depend upon room availability, the patient’s medical condition, abnormal test results, diagnosis, and prognosis.

The admission record itself will contain a face sheet with “demographic materials, insurance information, next of kin, and the chief complaint or reason the patient is seeking treatment.” The section will also contain the necessary informed consent document, advanced directives, and assignment of benefits forms.

Following completion of the admission process, the patient will be transported to the appropriate room based upon what form of treatment is to be rendered. For instance, a cardiac patient will be brought to the telemetry or intensive care unit, and a surgical patient will be transferred to the surgical wing.

History and Physical

Specific governmental programs, such as Medicare and Medicaid, require that a physician conduct an exam after a patient has been admitted to the hospital. This is usually done as part of the History and Physical (H & P), which is contained in this section of the chart and details why the patient is seeking medical care. The line entitled “Chief Complaint” (CC) will set forth the patient’s primary problem and will be recorded in the person’s own words. For example, the patient under “CC” may say, “I have had pain in my neck for three months, and the doctor told me that I need a cervical fusion.” This entry is followed by the physician’s recording of any other relevant information about the patient’s background, medical history, prior hospitalization, and allergies.

Based on a preprinted checklist, a review of systems (ROS) will then be performed. The doctor will inquire about things such as the musculoskeletal, circulatory, respiratory, and gastrointestinal systems. This review will be followed by a physical examination and recording of vital signs such as blood pressure, pulse, and respiration. The physician will document both objective and subjective symptoms detected during the exam about the patient’s health.

As a practice tip, counsel should always review this section of the chart to ascertain the patient’s physician status at that point in time. For instance, counsel may be defending a claim involving long-standing back pain. However, the physical exam conducted during an unrelated hospitalization for thyroid surgery may find that the person’s musculoskeletal exam is normal without any complaints of back pain.

Progress Notes

The progress notes will record physician contact with the patient after the history and physical section. These chronological entries summarize the doctor’s observations, clinical status, and impressions. Their function serves “as the repository of medical facts and clinical thinking and are intended as a concise vehicle of communication about a patient’s condition for those who access the health record.”

Other written documents completed by the physician during a hospital stay include doctor orders, consultation reports, discharge instructions, and discharge summaries.

Nurses’ Notes

Nurses have the most patient contact of any health care professional in the hospital. They usually record their impressions of each patient encounter. These notes will document the patient’s status, alterations in condition, pain observations, the nurse’s treatment plan, and other information needed to foster continuity of support among the health care team. Based upon the person’s condition, nurses are required to monitor the patient’s status and vital signs every four hours for those who are stable. This timetable is accelerated to every two hours for those who are unstable. Other entries include the nursing history and admission assessment, a listing of the patient belongings, shift assessments, vital signs, intake and output, and activities of daily living (ADLs).

Operative Report

Any surgical procedure performed upon a patient requires the physician to complete an operative report setting forth the details of the intervention and what transpired in the operative suite. This statement must include a preoperative and postoperative diagnosis and a listing of the procedures performed. This information is used to support the medical necessity for the intervention, for the results of the operation, and for reimbursement.

The Joint Commission mandates that the report be completed immediately following an operation or other high-risk procedure. This period is defined as “upon completion of the procedure, before the patient is transferred to the next level of care.” After all, this information is needed for the post-operative management of the patient by those other than the surgeon.

From a medico-legal perspective, on the one hand, the operative report details the various actions undertaken during the operation. It is also a valuable tool to ascertain how long a procedure took and whether any complications were encountered. Surgery usually increases the value of a claim. However, if the procedure only took fifteen minutes to perform and there were no complications, the defense may use this information to mitigate the claim. On the other hand, entries indicating unforeseen complications, excessive blood loss, or a procedure that took much longer than anticipated are helpful in maximizing the seriousness of the procedure.

Discharge Summary

The discharge summary is the primary document that explains a hospitalization and is prepared by a physician following a hospital stay or series of treatments. It often serves as the only record that follows the patient to the next health care provider. The Joint Commission wants each discharge summary to discuss the reason for the hospitalization, significant findings, procedures, and treatment rendered, the condition of the patient on discharge, patient instructions, and be signed by an attending doctor.

This document is also one of the most frequently requested records by counsel concerning a hospital admission. However, an attorney must understand that it is the least accurate document in the chart. For example, studies have found that one-third of all discharge summaries contain medication errors when compared to the actual chart. The task of writing this narrative is often left to a junior member of the staff and will be cursory. It may also not be dictated for some time after the patient’s discharge so the physician’s recollection of events may no longer be fresh, and the summary must be reconstructed from the hospital record. Adverse consequences suffered by the patient may also be slanted by the physician to contain “exculpatory statements not otherwise contained in the chart.”

Electronic Medical Records Practice Tips

Anyone who has read or worked with electronic medical records knows they are not without their problems. Not only are there significant costs involved to convert to and maintain this electronic format, but privacy and security concerns are presented. For instance, it is foreseeable that about 150 people will have access to a patient’s chart during a hospitalization. The vast number of these individuals are authorized to examine the record as a part of the patient’s treatment, but “there is a paucity of laws that regulate who these people are, what information they may access, and what they are able to do and not do with the patient’s information once they have viewed it.” These records are also vulnerable to security breaches by unauthorized individuals with nefarious motives despite the protections mandated by HIPAA.

Dissatisfaction with Electronic Medical Records

Many legal professionals who have reviewed electronic medical records are not fans of this digital format. As Isaac Kohane, chair of the Department of Biomedical Informatics at Harvard Medical School, noted: “Medical records suck.” There is an inability for the software systems to produce data effortlessly and routinely when needed according to a dependable “network without political, technical, or financial blocking.” As revealed in a Harris Poll, the average physician spends about thirty minutes on each patient with more than sixty percent of that time devoted to interacting with the patient’s digital chart. Health care providers grumble about cumbersome interfaces and timewasting data entry. Some duties, such as decreasing the amount of a steroid, were unusually challenging across the board. Doctors had to manually gauge the taper amounts, which consumed somewhere from two to three minutes and mandated twenty to forty-two clicks.

Specific Issues

Failure to Convert the Paper Chart into an Electronic Format

Discovery of the paper medical chart was relatively simple because they existed solely on paper. A request for the chart would be satisfied by making a photocopy of the document. Any alternations and comments were easily discovered from scratch-outs, and discovery was uncomplicated. Obtaining electronic medical records, however, creates distinctive challenges not faced with the paper record. Afterall, one would expect the electronic medical file to contain the same materials found in a patient’s paper file. However, that is not always the case. Some elements of the digital file will be combined, and other sections will not be printed. Equally as important, the patient’s paper chart may not have been converted in the first place, and some of the previous files may be missing. Therefore, counsel would be best served when requesting records to demand that all paper records and electronic files be produced. Counsel should also ask for the “private health information (PHI) disclosure log.” This is a HIPAA-mandated accounting of where, when, what, and to whom a medical record has been provided. This disclosure log will help the lawyer in determining which healthcare providers and lawyers have accessed the patient’s file and discovering other copies of the chart for comparison.

Metadata

It is essential for counsel to understand “metadata” in evaluating a patient’s digital chart. This term is defined in Gilbert v. Highland Hospital, as “‘secondary information,’ not apparent on the face of the document ‘that describes an electronic document’s characteristics, origins, and usage.” From a legal point of view, metadata encompasses information that lists the features, origins, handling, and authenticity of electronic evidence. To be more concise, “metadata is, ‘data about data,’” and the term encompasses important information like audit trails, pop-up warnings, and “preliminary questions and checkboxes.” A computer printout of the digital file is inherently unlike the electronic version viewed on a computer and may not include the metadata. This excluded information may be relevant to counsel’s investigation of a claim, so understanding what metadata reveals is important.

It is simple to alter a digital record without leaving any obvious signs that the document has been changed. HIPAA compels all those who employ a computerized system to maintain an audit trail listing all electronic entries and every access to the chart. For instance, an audit trail provides a listing of who has opened a file, when that access was accomplished, and what actions were performed. Consider an orthopedic surgeon who performs a fusion in the low back and makes a diagnosis of an unstable herniated discs at L4/L5 and L5/S1 that is posted in the patient’s digital chart. The audit trail will show the date and time the results were entered and the name and time of any individual who accesses the chart to review the report.

When necessary, counsel can review the specific EMR system employed by the health care provider to ascertain if the vendor has certified that the system makes available audit reports by examining the Office of the National Coordinator for Health Information Technology’s Certified Health IT Product List. This list will reveal whether the vendor has certified that the system delivers “authentication and access controls and clinical quality measure data.”

The audit trail is important to review if there is any consideration that a chart may have been altered. However, it is not routinely produced when a patient’s file is requested since it is not considered a “patient record.” Instead, counsel must explicitly demand it, and the legitimacy of the request (if challenged) will be reviewed by the court based upon a showing of good cause.

For example, in Vargas v. Lee, the plaintiff brought a malpractice action because of surgery to his foot that resulted in an amputation. Plaintiff claimed that the defendants “failed to timely and properly manage and treat [the injured] plaintiff’s ischemic injury following [the] surgery.” During discovery, the plaintiff requested the audit trail claiming that it was pertinent to “the timing and substance of [the injured] plaintiff’s care following [that] surgery.” The defense countered that the request was “overreaching, overbroad, unduly burdensome and beyond the scope of discovery.” The court ordered the production of the document because it was relevant to the assertions of negligence and would offer information on the post-operative care rendered to the patient.

Defendants have even refused to disclose the audit trail claiming it is part of the peer review process and constitutes work product. In Hall v. Flannery, the plaintiff sought to discover all manuals and instructional materials about the alleged modification of the patient’s chart. The court agreed that the information was relevant and not part of any peer review privilege. It noted that the audit trail is not made in anticipation of litigation. Rather, it is a part of the electronic medical record that is automatically created as an element of the software. It does not implicate an attorney’s work product, or the “mental impressions, conclusions, opinions, or legal theories of a party’s attorney or other representative concerning the litigation.”

As a caveat, an audit trail cannot show how a record was altered or what the document said before any modification. However, without the production of this document, the medical record can be changed with “impunity.” Chronologies can be altered or deleted, or a new narrative can be created. These modifications may or may not demonstrate an intentional distortion of a medical record, but it is impossible to know without an audit log to authenticate any changes.

There is not unanimous support that the audit trail offers the protection to ensure the accuracy of the file. Detractors maintain that the correctness of an audit trail may be diluted by the capability of the healthcare provider to switch off the audit function, alter the software, or make revisions either intentionally or because of an error. Therefore, counsel should use the discovery process to ascertain whether the audit trail is a comprehensive and precise representation of a person’s medical chart.

A second form of metadata are “pop-up” screens or alerts to help health care providers with tasks such as medication dosing, dangerous drug incompatibility, and meeting core measures. Pop-up warnings are provided to better patient care, eliminate mistakes and unfavorable outcomes, and increase efficiency. For example, a medication alert can inform a physician of an adverse interaction with another medication the patient is taking before the new drug is prescribed.

Studies demonstrate, however, that physicians frequently ignore these warnings because of alert fatigue. A study in Applied Clinical Informatics discovered that doctors in large teaching hospitals disregarded ninety-five percent of drug alerts. Other research revealed that these alerts were overridden forty-nine to ninety-six percent of the time. The systems can also cause physicians to make mistakes. For example, an elderly woman was seen by a physician for sinus problems. The doctor wanted to prescribe Flonase nasal spray for the condition. The patient used the medication as directed. Fourteen days later, the patient experienced dizziness and went to the emergency room. At this time, the emergency room physician ascertained that the woman was taking Flomax, a drug employed to treat an enlarged prostate, which has a known side effect of causing hypotension. The original treating doctor had typed “FLO” in the medication order screen, and the software system automatically chose Flomax. Not detecting the error, the physician selected the listed medication. It should be noted, however, that pop-up alerts are not infallible. Research shows that they fail to identify up to thirty-three percent of medication errors.

In the event of a medication error or adverse event, counsel should discover what pop-up alerts were utilized with a particular software system and request a printout of what prompts were issued and whether they were reviewed or ignored by the physician.

Requests for the Chart

Some health care providers do not believe a general request for medical records encompasses electronic data and will not provide the electronic medical chart. To minimize any misunderstandings between counsel and the health care provider when requesting electronic medical records, inclusive language should be used in the discovery request. For instance, one should request “printouts of all patient records kept in electronic and [paper] form or on computers, including all electronic medical records and electronic health records.”

Copy and Paste Function

The adoption of electronic medical records has altered how clinical data is recorded. These software systems have created various techniques for assisting with documenting a patient’s condition, including a “copy and paste” function. Anyone who has reviewed an electronic medical record will often spend time reading the same material because it has been replicated multiple times in the produced record. More troubling is the misuse of the copy and paste function. Many physicians routinely copy and paste materials from a previous entry into the medical record. This practice is viewed by healthcare providers as helpful and timesaving. However, the copy and paste function can result in duplicate, incorrect, or incomprehensible patient record documentation.

It is believed that sixty-six to ninety percent of physicians regularly employ the copy and paste function. However, a study published in Applied Clinical Informatics found that this practice resulted in 2.6% of all diagnostic errors. Research from the University of California San Francisco Medical Center reported that physicians copied up to eighty percent of the material in a progress note and that this practice undermined the accuracy of the information. This custom is based upon the premise that a patient’s narratives remain the same from visit to visit. For instance, physicians tend to copy and paste information like medical histories and discharge summaries from prior patient notes to conserve time. While the copy and paste component was designed to enhance the proficiency of clinical documentation and permit clinicians to spend more time with patients, the copy and paste function jeopardies the integrity of the medical record.

In a medical malpractice context, attorneys for injured plaintiffs like to highlight these errors in the medical record, regardless of whether the mistake caused an injury. Counsel’s argument is simple: if the physician was imprudent in documenting the file with inaccurate information, then the probability is that the health care provider was also negligent in the treatment in question.

Admissibility of Electronic Health Records

Traditionally, medical records were viewed as hearsay and inadmissible in court. However, the Federal Rules of Evidence and the Uniform Rules of Evidence modified the business records exception to the hearsay rule, thereby permitting medical health records to be admitted at trial. An essential element to this exception is to demonstrate that the medical record was made and kept in accordance with Federal Rule of Evidence 803(6). This Rule requires the individual who certifies the record for trial to be knowledgeable with the procedures employed to guarantee the accuracy of the file. However, when used in conjunction with Federal Rule of Evidence 902 (11), it is possible to self-authenticate the material.

Rule 902 requires a party desiring to admit an electronic medical record to provide notice to the opponent along with the ability to examine both the certification and the underlying record. These requirements can be accomplished by sending the document to the other side through discovery and enumerating it on the list of exhibits. In the alternative, the attorney may send a letter to opposing counsel disclosing the intent to use the document at trial. If counsel does nothing in response to the correspondence, the medical record is admissible without further authentication.

The admissibility of an electronic medical record in state court is much more varied and necessitates an examination of each jurisdiction’s rules of evidence. Several states, however, have enacted laws on the issue. Indiana provides an example. It has passed the Hospital Medical Record Electronic Data or Electronic Image Processing Statute. This statute specifies that entries contained in the hospital chart may be authenticated by showing that:

  1. the electronic-data-processing equipment is standard equipment in the hospital;
  2. the entries were made in the regular course of business at or reasonably near to the happening of the event or order, opinion, or other information recorded;
  3. the security of the entries from unauthorized access can be demonstrated through the use of audit trails; and
  4. records of all original entries and subsequent access to the information are maintained.

This Rule provides that an electronic hospital record is deemed an original written record and a copy will be considered an original record for evidentiary purposes. However, two considerations may affect the admissibility of the file: whether the entry is medically germane to the treatment and whether the entry is one of fact or opinion. Similarly, North Dakota notes that an electronic medical record, regardless of its form, will constitute an original record for determinations of its admissibility into evidence.

A few other jurisdictions do not explicitly discuss the issue but have enacted statutes requiring electronic medical records be handled the same as a paper chart. North Carolina allows for the formation of an electronic version of a paper record, but it must be maintained in a legible and retrievable form and the law permits authorization by a written or digital signature instead of a signature in ink. The legal privileges and obligations regarding records produced or preserved in an electronic format shall be treated similarly to those medical records represented in paper or other media. The law of Louisiana is applicable to digital technology in general and provides that an electronically digitized copy, when properly authenticated, will be treated the same as an original, and shall be allowed into evidence.

Alaska simply provides that a health care provider may employ electronic medical records that safeguard the chart from unauthorized access and a paper copy need not be maintained. Similarly, Utah provides that its medical records may be kept in a digital format.

Correcting a Mistake in the Medical Record

Medical records are not always accurate, and incorrect information can damage a patient’s interests. Obviously, an incorrect diagnosis, missing lab work, mistaken allergy information, and medication errors can result in an incorrect medical evaluation and treatment. Mistakes can also affect the obtaining of life insurance or harm a personal injury claim. For instance, an emergency room record may indicate that the patient has a long history of chronic back complaints when the person never had a spinal issue before the accident. This medical record error cannot be eliminated because medical records constitute legal documents.

HIPAA provides a mechanism to remedy an error. Under federal law, a patient may request a doctor correct a perceived error, and the provider has up to sixty days to reply. The provider can also request a thirty-day extension. If the provider refuses to correct the record, the reason for that action must be specified in writing.

A health care provider may have a legitimate reason to deny the request to change the entry. For instance, a patient may ask that references to drug use, sexually transmitted diseases, violent actions, or other sensitive materials be deleted. However, most health care professionals will decline to delete this type of reference because it influences the patient’s health and medical care. If a patient is dissatisfied with a physician’s response, the individual may file an Addendum that provides additional material in relation to an entry. The Addendum offers information to clarify a specific situation or incident. A patient may also use a Clarification Note. This explanation is used to prevent an improper interpretation of material that has been previously written.

Developments in Obtaining Medical Records

The ability of patients to obtain their medical records has been made much easier because of the government’s mandate to convert paper charts into electronic medical records. This digitization, along with the pressures to offer virtual access to medical information, has forced health care providers to examine their policies concerning patient access to their records. Nevertheless, a patient’s ability to obtain their medical records was radically altered in 2016 with the passage of the 21st Century Cures Act (Cures Act) which prohibits “information blocking” by health care providers. This term is defined to mean any practice that is “likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.” Information blocking can take place in many contexts. Health care providers may encounter this type of prohibited conduct when trying to access patient records from other providers, linking their electronic health record systems to health information exchanges, changing from one record system to another, and connecting their digital system with a clinical data registry. Patients can also encounter information blocking when attempting to review or retrieve their medical records or when transmitting their files to another health care provider. Physicians my violate the Cures Act if they knowingly engage in conduct that impedes the exchange, access, and use of electronic health records, even if no harm occurs. Exceptions to the information blocking rule are permitted if access to patient records present data privacy or security concerns.

As a caveat, counsel may encounter a roadblock in obtaining medical records, even if a HIPAA compliant form is utilized. A health care provider may insist that individuals “use the entity’s own supplied form, provided use of the form does not create a barrier to or unreasonably delay the individual from obtaining access” to the medical records.

The Cures Act and its regulations provide unprecedented opportunities for patients to gain access to previously private health records information. One such measure that has been implemented by health care providers to make patient information readily available is the creation of patient portal websites. These portals “share clinical information with their patients” that can be accessed through patient portals. These portals are favorably viewed by healthcare providers as a method to enhance the safety and quality of healthcare treatment as well as ways to engage patients to better manage their health. Afterall, portals allow patients to view their lab test and diagnostic study results and visit summaries. Many differences in the abilities and functionality exist with these health portals. Most permit access to specific health information and allow patients to complete specific undertakings, such as the making of an appointment and prescription requests. This online ability is bolstered by the HIPAA Privacy Rule, which gives patients the legal right to obtain copies of their medical records.

As previously noted, HIPAA mandates healthcare providers to respond to a records request within thirty days. However, the Office of the National Coordinator for Health Information Technology (ONC) has determined that any delay in being able to examine medical records can interfere with a patient’s access to electronic health information. In fact, a proposed rule will require health care providers to produce the medical records “as soon as practicable,” but no later than fifteen days after obtaining a patient request, with the possibility of a one-day extension.

ONC declined to require physicians to “proactively” make their records accessible to patients through patient portals, but it noted that a “delay in making [electronic health information (EHI)] available through a ‘patient portal’ or an API (application programming interface) for patients could constitute an interference and thus implicate the information blocking regulations.” This interpretation has been construed to mean that individuals have the right to retrieve their medical records without delay. In effect, patients are now able to immediately see their medical records through patient portals when they log into the health care provider’s website.

Patient portals are an easy way for counsel to obtain a copy of a client’s medical records. The client can be asked to access their portals and print out the records. This information can then be forwarded to counsel.

Record Copy Rate for Patients

An issue with these developments is whether patients and their attorneys must pay a fee to obtain a copy of the medical records. Afterall, most states have statutory fee schedules for securing these documents. For example, Pennsylvania charges $1.55 per page for the first 20 pages, $1.15 for pages 21 through 60, the cost of shipping, and a retrieval fee of $23.04. However, the Office of Civil Rights has issued a ruling that supersedes state law and imposes a flat fee of $6.50 as the reasonable cost for a patient to obtain electronic medical records from a health care provider. If a provider wants to charge more than this fee, it must go through a series of complicated calculations to arrive at a price that takes into consideration a schedule of expenses premised upon the average allowable labor cost to fulfill the request. This calculation may not include fees related to verification, looking for and retrieving the personal health information, “recouping capital for data access, storage, or infrastructure; or other costs not listed above even if such costs are authorized by State law.”

The law also provides that a patient can direct their health care provider to send the medical data to another person or entity designated by the individual. This provision was used by claimants to have health care providers send the records directly to their attorney as the representative agent. This practice resulted in counsel for the patient claiming that they only had to pay $6.50 for the records, instead of the fees imposed by a record copy service or by state statute.

A health care provider also can neither charge a fee to simply review a person’s medical records, nor is a healthcare provider permitted to deny access to records if the patient owes the physician money.

Rates Paid by Patient’s Counsel

In 2020, a national record copy service challenged the rule adopted by the United States Department of Health and Human Services (HHS) that limited what these services could charge third parties designated by a patient for delivering medical records. In Ciox Health, LLC v. Azar, the record copy service argued that the fee restrictions imposed by the “Patient Rate” only applied to requests for records made by the patient and not those made by commercial entities, like insurance companies and law firms. After going through the rule’s history and its interpretation under various legislative enactments, the court found in favor of the copy service. This ruling prompted the Office of Civil Rights to reverse its position and find that “the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual’s request for access to their own records, and does not apply to an individual’s request to transmit records to a third party.”

Smartphone Access

On March 9, 2021, the federal government took another step to simplify a patient’s access to their medical records. HHS determined that patients may download their electronic medical records to a smartphone. These records are to be made available at no cost and may be shared as the patient sees fit. This development would suggest that whether a claimant’s attorney must pay more than $6.50 to obtain medical records may be moot. The patient can merely download their medical records onto a smartphone and then transfer them to counsel.

Lab Work and Diagnostic Tests

The custom of patients apprehensively waiting before a doctor gets back to them with test results are over. On April 5, 2021, the Cures Act was amended to mandate patients be allowed to access their labs, diagnostic tests, biopsies, genetic studies, and imaging conclusions when they are finalized even if it means they see them before the ordering doctor. This development is related to the “information blocking” prohibition of the law. An exception is made if it is determined that the release “is reasonably likely to endanger the life or physical safety of the patient or another person.”

Unintended Results

The ease of obtaining medical records has led to some unintended consequences. At one time, physicians wrote whatever they deemed fit in a medical record, including cynical, caustic, or derogatory notes about a patient or other health care provider. Documentation and statements contained in medical records are now viewed by various people, so scriveners should perceive their entries as a communication to others. Therefore, these comments can lead to claims against the author for defamation, infliction of emotional distress, invasion of privacy, and negligence.

DeMarco v. Charlotte-Mecklenburg Hospital Authority provides an example. The plaintiff, a seventy-six-year-old disabled woman, underwent an annual physical for the continuation of her benefits. She requested a copy of her notes from the prior year’s visit only to discover that an erroneous entry noted that she had a “gonococcal infection (acute) of lower genitourinary tract,” which had resolved. The woman never had a sexually transmitted disease and demanded the entry be erased. The doctor noted that he could not fulfill this request. Therefore, the plaintiff filed suit for negligence, infliction of emotional distress, and defamation. The defendant moved to dismiss the complaint for failure to state a claim which was granted, and the patient appealed that dismissal.

The Circuit Court of Appeals found that pleading a HIPAA violation was sufficient to state a cause of action for the negligent preparation of the medical record. As for the infliction of emotional distress claim, it was reasonable to foresee that the erroneous note would cause the plaintiff severe emotional distress. However, it was proper for the court to dismiss the defamation allegation because there had been no publication of the false statement to a third person.

Artificial Intelligence in Medicine

Artificial intelligence (AI) has significantly impacted all walks of life, from self-driving cars to facial recognition technology. Some have even dubbed it the “fourth industrial revolution” with life-changing consequences. AI is universally accepted as “a field of study that combines computer science, engineering, and related disciplines.” The technology has the inherent ability to simplify the lives of all stakeholders by performing undertakings regularly done by people in a fraction of the time and at a greatly diminished cost.

This new technology is significantly changing the face of medicine, and it “will transform healthcare by ‘deriving new and important insights from the vast amount of data generated during the delivery of health care every day.’” It is estimated that eighty-six percent of physicians employ some type of artificial intelligence in their practices. Its uses in medicine are expansive and include detecting abnormalities on diagnostic imaging, making diagnosis, triaging patients in the emergency room, and assisting robotically in the operating room. One must also not overlook the large number of patient deaths caused by medical errors, which range from 210,000 to 400,000 each year. The accuracy of AI technology can assist in diminishing those deaths related to medical mistakes.

The recent use of electronic health records has dramatically enlarged the volume of clinical data. Using artificial intelligence to sort through health records has been a productive venture in many ways, from making predictions of the risk assessment of developing heart disease to using AI to read diagnostic imaging. Therefore when words appear in the medical records about robotic surgery, algorithms, machine or deep learning, precision medicine, neural networks, and choice architecture, counsel needs to appreciate that artificial intelligence was involved in the medical decision-making process.

Conclusion

An essential element of a patient’s treatment is the medical chart, and it is an integral part on which many medico-legal disputes are resolved. After all, the medical chart is a legal record, and various rules apply such as the mandate to record patient information, file retention, privacy considerations, and disclosure. These records also create a medical and legal narrative of a patient’s health with associated rights and obligations to avoid their unauthorized disclosure.

The health care industry was turned upside down not long ago with the enactment of the Health Information Technology for Economic and Clinical Health Act. This legislation mandates the meaningful transition of the patient’s paper chart to an electronic format. This change has brought with it an assortment of advantages and disadvantages. While the electronic medical record has certain inherent security risks and is not viewed favorably by some lawyers and physicians, the patient’s medical care has been made a lot simpler. In addition, this digital format allows the records to be easily shared among health care providers, and it provides for a more legible record that can be easily produced and transferred.

Additional federal mandates offer patients protection concerning the unwanted disclosure of their private health information, and they can easily access their records to monitor their health status. However, they have made an attorney’s job in prosecuting or defending a claim much more difficult. These mandates seem to represent an added layer of bureaucracy in obtaining patient records, and counsel and health care providers are often at odds over the production of the medical files. It is hoped that this article has provided some clarity and meaningful practice tips concerning the organization of a patient’s chart and the various laws concerning obtaining, understanding, and paying for medical records.

    Author