Altered medical records: how to spot them, prove them and preserve the evidence

The question in these disputes is rarely whether the chart changed. It is whether the change was disclosed. Every entry at a Medicare-participating hospital is measured against 1 sentence:

"All patient medical record entries must be legible, complete, dated, timed, and authenticated in written or electronic form by the person responsible for providing or evaluating the service provided, consistent with hospital policies and procedures."

"Dated" and "timed" mean the moment the entry was written, which is not always the moment of care. Late entries live in that gap, and so do alterations. The same section also requires the hospital to "ensure that unauthorized individuals cannot gain access to or alter patient records" (42 CFR 482.24(b)(3)). The word "alter" is in the regulation itself.

The vocabulary

AHIMA, the health information management profession's body, uses "amendment" as the umbrella term and splits it into kinds. The definitions below follow its 2012 toolkit.

Amendment

Any change after the original was completed and signed. AHIMA says changes before the first signature should be tracked too.

Late entry

An entry missed or not written in time, added later with the current date and time, the reason and the author's signature, and labeled as late inside the entry.

Addendum

New information attached to an earlier entry, separately dated, timed and signed.

Correction

A fix to an inaccuracy after signing that leaves the original intact beside the revision.

Retraction

An erroneous entry hidden from general view, with the original kept in the prior version. AHIMA advises it should not print in the legal health record.

Deletion

Permanent removal with no prior version kept. AHIMA recommends systems never allow it.

Alteration

Not a proper practice at all. The lawyers' word for a change that hides the original or misstates its timing.

The 4-question test

Every changed entry you find can be run through 4 questions. Is it labeled as a change? Is it dated and timed when it was written? Does it name its author? Is the original still readable? A change that passes all 4 can still be weak or self-serving, and a jury can weigh that. A change that fails any 1 is where alteration arguments start.

No single federal statute defines "altered medical record" for civil litigation. What exists is a stack of rules written for certification, payment, privacy and licensing that together describe a proper change. Experts measure against this stack, and so should you.

The chapter 4 manual entry is the closest thing to an official checklist, and it is short enough to quote whole:

"The UPIC shall evaluate the medical record for evidence of alterations including, but not limited to, obliterated sections, missing pages, inserted pages, white out, and excessive late entries. The UPIC shall not consider undated or unsigned entries handwritten in the margin of a document."

Notice what the list includes: "excessive late entries". Late entries are legitimate. A pattern of them is not something CMS ignores, and neither should you.

What people get wrong about the rules

Definitions are easier to hold onto with a real-looking note in front of you. Below is the same nursing progress note as it appears in 3 places in a hypothetical file. Chapter 6 walks the full case; this chapter is about reading the note itself.

Reading the 3 columns

Version 1 is a clean contemporaneous note, created 25 minutes after the event and signed 6 minutes later. It holds 2 facts that hurt the hospital: the bed alarm was off, and the last rounding was at 23:00.

The addendum passes the 4-question test. It is labeled, timed when written, names the window it covers, is signed, and leaves version 1 intact. Its weakness is timing and content: written 2 days later, after the CT, it adds exactly the 2 facts that would answer the fall-risk case. A jury can weigh that. Nobody can call it concealment, because it announced itself.

Column 3 is the one that should stop you. The header still says signed at 02:41, but 2 sentences now contradict version 1 and nothing on the page says a change was made. Before you call it alteration, rule out the print view: some EHRs print only the current revision under the original signature line, with the edit tracked in the history. That still breaks the rule that the original stays viewable, but it is a different problem from a forged page. Only the metadata in chapter 8 tells the 2 apart.

Most reviewers never see an original chart. They see a PDF of a printout, or a scan of a fax of a copy. That limits what can be seen on the page, and it is worth being honest about which signs survive that chain and which need the original paper or the EHR metadata.

No single sign proves alteration. A late signature on 1 note in a 2,000-page chart is noise. Late signatures on the 3 notes about the hour before the injury, and on nothing else that shift, deserve a closer look.

A modern EHR note is assembled more than written. That fact produces a steady stream of false alarms in altered-records review, and it also gives real alterations somewhere to hide.

The study covered 1 academic medical center, so shares will differ elsewhere. The direction will not: a reviewer who flags every repeated sentence will drown.

The lookalikes and how to tell them apart

Ambient AI scribes change the evidence

With an ambient AI scribe, there may be a recording or transcript, a machine draft and a signed note. The differences between them are pre-signature edits, which are ordinary, though AHIMA says those should be tracked too. If the case turns on what was said in the room, the draft and transcript may be the best contemporaneous evidence, and they may sit in a vendor system with its own retention clock. Our view: name the scribe's drafts, transcripts and retention settings in the preservation letter. Default retention varies, which is the reason to ask early.

Steps 1 to 3: intake, chronology, late entry

Production A is stamped PL on receipt, logged and saved untouched with a SHA-256 hash. Production B later gets its own prefix and log line. The 2 sets are never merged before comparison, because deduplication would treat the 2 versions of note #88121 as near-duplicates and might drop 1. A medical chronology of Production A sorted by event time shows the rounding gap at once, and that gap becomes the case theory. The labeled addendum goes on the red-flag list as "settled by the page": a question for the late-entry policy and the deposition, not for a forensic expert.

Step 4: Production B and the 3 differences

Comparing the 2 productions note by note (chapter 7) produces 3 differences:

1. Note #88121 text changed. 2 sentences replaced, signature time unchanged, no addendum and no revision marker. DEF 000702 versus PL 000644.
2. Flowsheet rows appeared. DEF 000668 shows rounding rows at 00:00 and 01:00 that are absent from PL 000610. If the print view includes a "filed" column, it may show when those rows were entered; this one does not.
3. The addendum disappeared. PL 000645 has no counterpart in Production B. Possible explanations include a retraction, a print setting that excludes addenda, or a merge of the addendum text into the note.

Steps 5 and 6: the request, and what is proven so far

Each difference maps to a metadata request: the audit trail and every saved revision of note #88121 and the rounding flowsheet, the retraction history, the release log for Production A, and the bed alarm's own event log. Chapter 8 shows what that might return. At this point the file proves that 2 productions disagree about the hour before the fall. It does not prove who changed what, when or why, and it does not prove intent, which in federal court separates a curative measure from an adverse inference (chapter 9).

Version comparison is slow, careful work, and it is still mostly done by people. Here is the sequence that holds up when a reviewer is later asked, under oath, how they found the difference.

1. Freeze every production as received. Own prefix, logged source, date, page count and Bates range, an untouched copy and a hash. The hash answers "how do we know your copy is the same" for good. See Bates numbering for prefixes.
2. Index before you read. Date, time, author, type and note ID for every document. The note ID is the best key, because titles and dates shift between print views.
3. Pair across productions. Work from the index, not page order. Anything without a partner goes on its own list. The Bates mechanics are in reconciling a defense record production.
4. Diff the pairs that count. Every document within 48 hours of the event, every one the defense expert relies on, and every labeled late entry. Record each difference with both page cites.
5. Separate format from content. A new header or print date is usually innocent. A changed finding, time, dose or plan is content, and only content goes into the metadata request by name.
6. Write the change list. 1 line per content difference. It drives the audit trail request and the deposition outline.

VERSION COMPARISON WORKSHEET
Matter: [CASE NAME / FILE NO.]          Reviewer: [NAME]      Date: [DATE]

DOCUMENT
  Type / title:            [e.g. Nursing progress note]
  Note or order ID:        [ID if printed, else "none shown"]
  Author (as printed):     [NAME, ROLE]
  Event the note covers:   [DATE TIME]

VERSIONS FOUND
  Version A:  Production [A]  Bates [PL 000000]  received [DATE]
              Created [DATE TIME]   Signed [DATE TIME]   Print date in footer [DATE]
  Version B:  Production [B]  Bates [DEF 000000]  received [DATE]
              Created [DATE TIME]   Signed [DATE TIME]   Print date in footer [DATE]
  Other:      [Addendum / late entry / retraction notice, with Bates]

DIFFERENCES (1 line each)
  #  Type (format / content)  Version A text            Version B text            Cites
  1  [content]               "[exact words]"           "[exact words]"           [PL / DEF]
  2  [format]                [header, font, footer]    [header, font, footer]    [PL / DEF]

4-QUESTION TEST FOR EACH CHANGE
  Labeled as a change?        [Y / N]
  Dated and timed when made?  [Y / N]
  Author identified?          [Y / N]
  Original still readable?    [Y / N]

INNOCENT EXPLANATIONS TO RULE OUT
  [ ] Printed before signature (pended note)
  [ ] Different print view or template
  [ ] Current-revision-only print of a tracked edit
  [ ] Imported values refreshed on reprint
  [ ] Copy-forward from another date

METADATA NEEDED (fill when received)
  Audit trail rows for this ID:     [requested DATE / received DATE / Bates]
  Revision history (all versions):  [requested / received]
  Print / release log:              [requested / received]

STATUS
  [ ] Settled by the page   [ ] Needs metadata   [ ] Refer to expert
  Summary (2 sentences, with cites):
  [TEXT]

A PDF can tell you that 2 versions disagree. It cannot tell you when the text was typed, who typed it, or what the note said in between. Those answers live in system data that a standard records release does not include. AHIMA says it plainly: audit trails are part of the metadata and are discoverable for use in litigation.

Here is what a filtered audit trail for the chapter 6 hypothetical might return. Real exports carry dozens of columns and thousands of rows; event names and codes differ by vendor and installation, which is why you ask for a data dictionary with the export.

Read in order, the rows sharpen the story without finishing it. The 00:00 and 01:00 flowsheet rows were filed 2 days late, 3 minutes before the addendum, which explains DEF 000668. The modify event on 19 June explains DEF 000702 and puts the change after the preservation letter. What the log cannot say is why. That is for RN A, the records custodian and an informatics expert who can explain what "Modify" means in this installation.

Using AI on an audit trail export

An audit trail export is a spreadsheet problem before it is an AI problem. Filter to the note IDs, sort by timestamp, and highlight events after the adverse event and after notice of the claim. A general-purpose large language model can help write filter formulas or explain vendor event codes, but only inside a tool covered by a business associate agreement, and every row it summarizes has to be checked against the raw export. A model that summarizes 40,000 rows will sometimes invent a row that is not there. The full request and reading method is in the EHR audit trail guide.

When to ask

Ask in the first discovery request, before the deposition. When the author testifies the note was written at 02:41, you want the log already in hand. Name the note IDs, run the date range from admission to the latest production, and ask for native or CSV format with a data dictionary. A narrow request is harder to resist on burden.

Spoliation is the destruction, alteration or failure to preserve evidence when litigation is pending or reasonably foreseeable. For a hospital the duty can attach before suit: a serious adverse event, a risk review, a law firm's records request or a preservation letter can each show foreseeability. When it attached is for the court, under the law of the jurisdiction.

Federal court: Rule 37(e)

In federal court, lost electronically stored information is governed by FRCP 37(e), rewritten in the 2015 amendments. The rule applies when ESI that should have been preserved is lost because a party failed to take reasonable steps, and it cannot be restored or replaced through additional discovery. It then sets 2 tiers:

"(2) only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation may: (A) presume that the lost information was unfavorable to the party; (B) instruct the jury that it may or must presume the information was unfavorable to the party; or (C) dismiss the action or enter a default judgment."

Below that tier, under (e)(1), a court that finds prejudice may order only "measures no greater than necessary to cure the prejudice". The 2015 committee note adds that the rule "does not call for perfection": reasonable steps suffice. 3 practical consequences follow for altered-records cases:

• Restored or replaced means no 37(e) remedy. If the prior version of a note survives in the revision history, the ESI is not lost, and the fight moves to what the edit means rather than what was destroyed. That is another reason to ask for revision history early.
• Intent is the hinge. An adverse inference instruction in federal court needs a finding of intent to deprive. Negligent loss, even prejudicial, gets a curative measure.
• 37(e) is about ESI. Altered paper records and physical evidence are handled under other rules and the court's inherent authority.

State court, where most of these cases are

Most medical malpractice cases are in state court, and state spoliation law differs on at least 3 points: when the duty to preserve arises, what level of fault supports an adverse inference instruction, and whether spoliation is only a sanctions issue or also a separate tort. Some states recognize an independent tort for intentional spoliation; many do not. Check your jurisdiction before you plead or brief it.

Ohio is the clearest example of how seriously a state court can treat deliberate alteration by a physician. In Moskovitz v. Mt. Sinai Medical Center, 69 Ohio St.3d 638 (1994), the Ohio Supreme Court held:

"An intentional alteration, falsification or destruction of medical records by a doctor, to avoid liability for his or her medical negligence, is sufficient to show actual malice, and punitive damages may be awarded whether or not the act of altering, falsifying or destroying records directly causes compensable harm."

The court also recognized that "a cause of action exists in tort for interference with or destruction of evidence". It reinstated punitive damages against the physician, with a remittitur of $2 million from the jury's $3 million punitive award, leaving $1 million. That is 1 state's law from 1994. It shows the ceiling of the risk, not the norm everywhere.

Licensing and criminal law

Other states have their own rules. None of these are remedies a civil litigant controls, but they explain why a clinician asked about a changed note at deposition may be advised not to answer.

Suspicion is cheap and accusations are expensive. The path below runs from the cheapest step that can settle the question to the most expensive. Whether to take each step is a decision for counsel.

The order of the first 2 moves

A preservation letter puts the provider on notice. It also tells the provider which notes you care about. Many plaintiff lawyers get a complete pre-suit copy under the patient's HIPAA right of access first, then send the letter the same week. We think that order is right: a baseline obtained after the letter is worth less. The routes are in how to get medical records for a lawsuit. For defense counsel and risk managers, the mirror image: once a claim is foreseeable, lock the chart, suspend purges and document the hold.

[FIRM LETTERHEAD]

[DATE]

VIA [EMAIL AND CERTIFIED MAIL]
[Custodian of Records / Risk Management / General Counsel]
[FACILITY NAME AND ADDRESS]

Re:  Preservation of evidence
     Patient: [NAME], DOB [DATE], MRN [IF KNOWN]
     Dates of care: [ADMISSION DATE] through [DISCHARGE DATE]

Dear [NAME]:

This firm represents [CLIENT] regarding care provided at [FACILITY]
during the dates above. We anticipate litigation. We ask that you
preserve, and suspend any routine deletion, purge, overwrite or log
rotation of, the following, from [ADMISSION DATE] to the present:

1. The complete electronic health record for the encounter in native
   format, including every saved version of every note, order,
   flowsheet row and addendum, and the revision history of each.
2. Audit trails and access logs for the chart: create, view, modify,
   sign, addend, retract, delete, print and release events, with
   user, role, timestamp and time zone, and workstation, plus the
   data dictionary for event codes.
3. Retracted, "entered in error", deleted or hidden entries, with
   their original text and reason codes.
4. Release-of-information and print logs showing each production of
   this record and its date.
5. Specifically, and without limiting the above:
   [NOTE TYPE, DATE, TIME, NOTE ID IF KNOWN]
   [FLOWSHEET NAME, DATE RANGE]
6. Data from systems outside the EHR: [bed and chair alarms, nurse
   call, telemetry, fetal monitoring, infusion pumps, anesthesia
   records, glucometers], in native form.
7. Ambient documentation or scribe data, if used: audio, transcripts,
   machine drafts and edit history, and the vendor's retention
   settings.
8. Imaging in DICOM format, in addition to reports.
9. Paging, secure messaging and nurse call logs for [UNITS, SHIFTS].
10. Staffing and assignment records for [UNITS, SHIFTS].
11. Policies in force on the dates of care on documentation, late
    entries, addenda, corrections, retractions and record locking.
12. Paper originals of any handwritten or downtime records, not
    copies, so ink and paper can be examined.

Please confirm in writing within [NUMBER] days that a hold is in
place and identify the person responsible for it. This letter does
not waive any right to seek additional evidence.

Sincerely,
[ATTORNEY NAME]
[BAR NUMBER, CONTACT DETAILS]

Before the letter goes out

• Pre-suit copy in hand, stamped and hashedIt is the baseline for every later comparison.
• Chronology sorted by event timeShows the gaps you will name in item 5.
• Red-flag list with page citesEach flag marked "settled by the page" or "needs metadata".
• Note IDs for the disputed entriesSpecific requests are harder to object to.
• Devices and standalone systems identifiedAlarm, monitor and pump logs often sit outside the EHR and rotate fast.
• Ambient scribe use confirmed or ruled outDrafts may have their own retention clock.
• Paper and downtime records identifiedOriginals, not copies, for ink examination.
• Correct recipient namedRecords custodian and risk management or counsel, as well as the release desk.
• Date range runs to the presentEdits after the event are the point.
• Delivery method you can proveThe date of notice may decide when the duty attached.

0 of 10 checked

Altered-records work has 2 halves. The first half is finding: reading every page, noticing the late-entry label on page 645 and the near-identical note on page 702, and putting entries in order by when they were written. The second half is judging: deciding whether a change hid something, and why. AI tools are good at a large part of the first half and should not be trusted with the second.

What a large language model does well here

• Finding every labeled late entry and addendum. Clinical natural language processing picks out "late entry", "addendum" and "entered in error" across thousands of pages.
• Surfacing near-duplicate notes that differ. Pairing 2 nearly identical notes and showing the changed sentences, the tedious part of chapter 7.
• Ordering by event time. An AI medical chronology with written and signed times alongside makes out-of-sequence entries and gaps visible.
• Catching date inconsistencies. A note dated before admission, a signature after discharge.

Where it fails

• OCR on faxes. Optical character recognition can read "0210" as "0710", and a time error is the worst error in this work.
• Handwritten notes. Ambiguous handwriting still needs someone who knows the unit's abbreviations.
• What a scan cannot carry. Ink color, pen pressure and paper stock do not survive a black and white PDF.
• Copy-forward dates. A copied sentence attributed to the wrong day can look like an alteration that is not there.
• Hallucination. Ask a chatbot "was this altered?" and generative AI may write a confident story. Filling gaps is the opposite of what a spoliation analysis needs.
• Metadata and intent. A tool reading PDFs cannot see create times or unprinted retractions, and no tool can say why someone changed a note.

Why page-level citations are the whole game

In litigation, a flag you cannot trace to a page is worthless. A flagged late entry helps only if you can open both versions. Grounded, page-level citations make that 1 click; the human-in-the-loop reviewer decides addendum or alteration. The court side makes the point sharply. In Mata v. Avianca, Inc. (S.D.N.Y. 2023), lawyers were sanctioned under Rule 11 after filing a brief with case citations a chatbot had fabricated. The same duty to verify applies to a chronology an expert relies on, or to a spoliation motion that quotes a note. Check every cited line at the page before it goes into a filing.

Choosing legal AI tools for this work

The market for AI document review and technology assisted review is crowded, and agentic AI tools now promise to run whole review workflows. For altered-records work, rank the requirements in this order:

For the wider question of how AI review compares to a person on accuracy, see is AI accurate enough for court and HIPAA-compliant AI medical record review.

Medrecords AI is medical record review software. You upload the records; it drafts a cited chronology and flags, every line linked to its source page. On a chart where alteration is a question, it flags these signals in the uploaded record, each cited to its page:

• Labeled late entries and addenda, with the written time next to the event time they cover.
• Near-duplicate notes that differ, shown side by side from the PDFs, through record alteration detection.
• Date inconsistencies: an entry dated before admission, a signature after discharge, an entry that contradicts the time of the event it describes.
• Entries out of chronological order in a cited medical chronology sorted by event time.
• Undated pages, kept in their own bucket by undated document flagging.
• Records that should exist and are missing, such as a gap in hourly rounding, through missing records identification.
• Low-confidence OCR pages, including faxes and handwriting, marked for a person to read through OCR and handwritten record extraction.

Flags are signals, not verdicts. A near-duplicate that differs may be a pended note, a print view difference or a real alteration, and the software cannot tell which. A human decides.

What it does not do: it does not read EHR system exports or access history, so it cannot tell you when text was typed. It does not build a page-by-page map between 2 productions; chapter 7 describes how a person does that. It does not judge intent, decide whether spoliation occurred, give legal advice, or retrieve records from providers. It works on the files you upload, under SOC 2 and HIPAA with a signed BAA (see security and HIPAA). Self-Service bills 10 cents a deduplicated page, down to 5 cents at volume, duplicates free; Enterprise On-Prem is an annual license.

What counts as an altered medical record?

A chart entry changed after the fact in a way that hides the original or misstates when the change was made: backdated notes, text overwritten under an old signature time, inserted or removed pages, white-out, or additions without a late-entry label. A labeled, dated, timed and signed late entry or addendum that leaves the original readable is not alteration.

Is a late entry in a medical record legal?

Yes, when it is done properly. AHIMA and CMS both treat late entries as legitimate if they are labeled as late, bear the date and time they were written, identify the author and leave the original intact. Facility policy sets how late is too late. A pattern of late entries clustered around an adverse event is something CMS fraud contractors are told to look for.

How long after an event can a nurse write a late entry?

There is no single federal number. Facility policy defines the window, and AHIMA says organizations should set it. For hospitals, 42 CFR 482.24(c)(4)(viii) requires the medical record to be completed within 30 days of discharge. A late entry inside policy can still be challenged on timing and content, especially if written after the outcome was known.

Can a patient ask a hospital to change their medical record?

Yes. Under 45 CFR 164.526 a patient can request an amendment, and the covered entity must act within 60 days, with 1 extension of up to 30 days. It may deny a request if the record is accurate and complete. An accepted amendment is appended or linked to the record, never written over the original.

What is spoliation of medical records?

Destroying, altering or failing to preserve records once litigation is pending or reasonably foreseeable. Courts can respond with curative measures, adverse inference instructions or, in serious cases, dismissal or default. In federal court, FRCP 37(e)(2) requires a finding of intent to deprive for the harsh remedies on lost ESI. State standards vary, and some states recognize a separate tort.

Is altering medical records a crime?

It can be. California makes fraudulent alteration of a medical record a misdemeanor under Penal Code 471.5 and unprofessional conduct for physicians under Business and Professions Code 2262. Federal law reaches falsification in health care benefit matters (18 USC 1035) and alteration to obstruct a federal matter (18 USC 1519). Other states differ; check your jurisdiction.

Can AI detect altered medical records?

AI can find signals, not prove alteration. Software can list labeled late entries, surface near-duplicate notes that differ, and flag date inconsistencies and out-of-order entries, each cited to its page. It cannot see ink on a scan, read metadata that was never produced, or judge intent. A person reviews every flag and decides what it means.

Can AI read an EHR audit trail?

General AI tools can help sort, filter and explain a CSV audit trail export, and a large language model can draft filter formulas or explain event codes. Use only a tool covered by a business associate agreement, and check every summarized row against the raw export, because models can invent rows.

Is it HIPAA compliant to upload medical records to AI?

It can be, if the vendor signs a business associate agreement, protects the data with controls you can verify (such as a SOC 2 report), and does not use your records to train its models. Ask for the BAA before the first upload.

Can ChatGPT tell whether a medical record was altered?

Not reliably. A general chatbot reading a PDF cannot see metadata, ink or retracted entries, and it may produce a confident answer that is not supported by the pages. Check any factual claim it makes at the page before anyone relies on it.

What should a preservation letter for medical records include?

Every saved version of each note, audit trails and access logs, retracted entries, print and release logs, device data such as alarms and monitors, ambient scribe drafts if used, imaging in DICOM, messaging and staffing records, the policies in force, and paper originals. Name specific note IDs where you can.

Rules and statutes were checked against primary sources in September 2026, and quoted text is verbatim. AHIMA's toolkit is paraphrased except for 1 short phrase. Everything in the case example in chapters 3, 6 and 8 is hypothetical. Product facts come from this site's product pages. Nothing here is legal or medical advice.

• 42 CFR 482.24, hospital Conditions of Participation, medical record services: (b)(1), (b)(3), (c)(1) and (c)(4)(viii).
• 45 CFR 164.526, HIPAA right to amend.
• Federal Rule of Civil Procedure 37(e) and the 2015 committee note.
• Medicare Program Integrity Manual, chapter 3, section 3.3.2.5 (Rev. 12633, 2024).
• Medicare Program Integrity Manual, chapter 4, section 4.7.4 (Rev. 13879, 2026).
• AHIMA, Amendments in the Electronic Health Record Toolkit (2012).
• California Penal Code 471.5 and Business and Professions Code 2262.
• 18 USC 1035 (up to 5 years) and 18 USC 1519 (up to 20 years).
• Moskovitz v. Mt. Sinai Medical Center, 69 Ohio St.3d 638 (1994).
• Wang, Khanna and Najafi, "Characterizing the Source of Text in Electronic Health Record Progress Notes", JAMA Internal Medicine 177(8), 2017.
• Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023): Rule 11 sanctions for filing fabricated AI-generated case citations.

Related guides: EHR audit trails in medical malpractice, reconciling a defense record production, how to get medical records for a lawsuit, and medical malpractice record review.