# Altered medical records: red flags, spoliation and AI review

> How to tell a labeled late entry from an altered medical record: red flags, version comparison, audit trail requests, spoliation law and where AI helps.

Canonical page: https://medrecords.ai/guides/altered-medical-records/

---
New — **Missing Records Detection:** flags every visit, provider, and date missing from the file. [See how →](https://medrecords.ai/product/missing-records-identification/)
Field guide, September 2026. 14 chapters.

## Altered medical records: how to spot them, prove them and preserve the evidence

For plaintiff and defense attorneys, paralegals and legal nurse consultants who suspect a chart changed after the fact. You walk away with the rules, the red flags, a version comparison worksheet and a preservation letter.

By [Ahmed Jemaa](https://medrecords.ai/authors/ahmed-jemaa/), Co-Founder and CEO, Medrecords AI. Published 25 September 2026.

Altered medical records are chart entries changed after the fact in a way that hides the original: backdated notes, overwritten text, inserted or removed pages, or additions made without a late-entry label. A late entry or addendum that is labeled, dated, timed, signed and leaves the original readable is not alteration. In litigation, alteration can support spoliation sanctions, an adverse inference or, in some states, punitive damages.

A medical chart is allowed to change. Nurses add late entries, physicians write addenda, and coders ask for corrections, and all of it is proper when the change is labeled, dated, signed and leaves the original readable. An altered record is the other kind of change: the one built to make the chart look as if it always said the new thing.

This guide is built from the hospital Conditions of Participation at 42 CFR 482.24, the HIPAA amendment rule at 45 CFR 164.526, Federal Rule of Civil Procedure 37(e) and its 2015 committee note, the Medicare Program Integrity Manual (chapters 3 and 4), AHIMA's *Amendments in the Electronic Health Record Toolkit* (2012), California Penal Code 471.5 and Business and Professions Code 2262, 18 USC 1035 and 1519, the Ohio Supreme Court's decision in *Moskovitz v. Mt. Sinai Medical Center* (1994), and a 2017 JAMA Internal Medicine study of 23,630 progress notes. Every case example is a labeled hypothetical. Nothing here is legal or medical advice. Spoliation law, records law and professional discipline rules vary by state; check your jurisdiction.

8 numbers

### Altered records in 8 numbers

5 years
minimum a hospital must keep records, original or legally reproduced
42 CFR 482.24(b)(1)
30 days
after discharge for a hospital to complete the medical record
42 CFR 482.24(c)(4)(viii)
60 days
to act on a patient's amendment request, with 1 extension of up to 30
45 CFR 164.526(b)(2)
5 signs
of alteration Medicare fraud contractors are told to look for
Medicare PIM, chapter 4, 4.7.4
2 tiers
of remedy for lost ESI; the harsh tier requires intent to deprive
FRCP 37(e)(1) and (e)(2)
46%
of the text in a typical inpatient progress note was copied
Wang et al., JAMA Intern Med, 2017, 23,630 notes
$1 million
punitive damages left standing for altered records after remittitur
Moskovitz v. Mt. Sinai, Ohio, 1994
20 years
maximum federal sentence for falsifying a record to obstruct a federal matter
18 USC 1519
Chapter 1 Everyone

### Late entry, addendum, correction or alteration

The question in these disputes is rarely whether the chart changed. It is whether the change was disclosed. Every entry at a Medicare-participating hospital is measured against 1 sentence:

"All patient medical record entries must be legible, complete, dated, timed, and authenticated in written or electronic form by the person responsible for providing or evaluating the service provided, consistent with hospital policies and procedures."

"Dated" and "timed" mean the moment the entry was written, which is not always the moment of care. Late entries live in that gap, and so do alterations. The same section also requires the hospital to "ensure that unauthorized individuals cannot gain access to or alter patient records" ([42 CFR 482.24(b)(3)](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24) ). The word "alter" is in the regulation itself.

#### The vocabulary

AHIMA, the health information management profession's body, uses "amendment" as the umbrella term and splits it into kinds. The definitions below follow its 2012 toolkit.

AmendmentAny change after the original was completed and signed. AHIMA says changes before the first signature should be tracked too.
Late entryAn entry missed or not written in time, added later with the current date and time, the reason and the author's signature, and labeled as late inside the entry.
AddendumNew information attached to an earlier entry, separately dated, timed and signed.
CorrectionA fix to an inaccuracy after signing that leaves the original intact beside the revision.
RetractionAn erroneous entry hidden from general view, with the original kept in the prior version. AHIMA advises it should not print in the legal health record.
DeletionPermanent removal with no prior version kept. AHIMA recommends systems never allow it.
AlterationNot a proper practice at all. The lawyers' word for a change that hides the original or misstates its timing.
| Change | What a proper one looks like | When it becomes a problem |
| --- | --- | --- |
| Late entry | Labeled "late entry", dated and timed when written, names the time of the event it describes, signed | Written to look contemporaneous, or created after the outcome, a claim or a records request without saying so |
| Addendum | Attached to the original note, separately dated, timed and signed, states why it was added | Adds self-serving detail days or weeks later, after the bad outcome was known |
| Correction | Original readable (a single line through on paper, a version history in the EHR), reason stated, initialed and dated | Original obliterated with white-out, scribbled over, overwritten or deleted |
| Retraction | Wrong-patient or erroneous entry hidden from routine view, prior version retained, annotation visible to clinicians | Used to remove an accurate entry that hurts the provider |
| Alteration | None. There is no proper form | Backdating, page substitution, inserted pages, removed entries, rewritten vital signs, new text under an old signature time |

#### The 4-question test

Every changed entry you find can be run through 4 questions. Is it labeled as a change? Is it dated and timed when it was written? Does it name its author? Is the original still readable? A change that passes all 4 can still be weak or self-serving, and a jury can weigh that. A change that fails any 1 is where alteration arguments start.

If you remember one thing
A labeled late entry is disclosure. An unlabeled change is concealment. Most of the work in these cases is proving which one you are looking at.

Chapter 2 Everyone

### The rules a changed entry is measured against

No single federal statute defines "altered medical record" for civil litigation. What exists is a stack of rules written for certification, payment, privacy and licensing that together describe a proper change. Experts measure against this stack, and so should you.

| Source | What it requires | Why a litigator uses it |
| --- | --- | --- |
| Hospital Conditions of Participation, 42 CFR 482.24 | Entries legible, complete, dated, timed and authenticated; records protected from unauthorized alteration; record completed within 30 days of discharge; retained at least 5 years | The baseline for any Medicare-participating hospital. A note signed 45 days after discharge is a completion problem under (c)(4)(viii), whatever else it is |
| Medicare Program Integrity Manual, chapter 3, 3.3.2.5 | Services are expected to be documented when rendered; the date and author of any amendment, correction or delayed entry should be identifiable, and the change "clearly and permanently denoted" | CMS's own statement of how a delayed entry must look, current as revised in 2024 |
| Medicare Program Integrity Manual, chapter 4, 4.7.4 | Fraud contractors evaluate records for alterations and ignore undated or unsigned margin notes | A federal agency's working list of alteration signs, quoted below |
| HIPAA right to amend, 45 CFR 164.526 | Patient may request an amendment; covered entity acts within 60 days (1 extension of 30); an accepted amendment is appended or linked, not written over | Even a change the patient asks for is added beside the original, never in place of it |
| AHIMA, Amendments in the EHR Toolkit (2012) | Lock notes after final signature; control who can reopen them; the original entry "should be viewable" with date, time, author and reason for the change | The professional standard health information managers apply, and the source of the definitions in chapter 1 |
| Facility policy | Sets the late-entry window, who may amend, when notes lock, how retractions work | The policy in force on the date of care is the yardstick for "late". Ask for it by date |
| State licensing and criminal law | Varies. California makes fraudulent alteration unprofessional conduct for physicians and a misdemeanor for anyone (chapter 9) | Tells you whether the conduct carries consequences outside the civil case |

[](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24) [](https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/pim83c03.pdf) [](https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/pim83c04.pdf) [](https://www.law.cornell.edu/cfr/text/45/164.526) [](https://www.ahima.org/media/r2dc4xhg/amendments-in-the-electronic-health-record_axs.pdf)
The chapter 4 manual entry is the closest thing to an official checklist, and it is short enough to quote whole:

"The UPIC shall evaluate the medical record for evidence of alterations including, but not limited to, obliterated sections, missing pages, inserted pages, white out, and excessive late entries. The UPIC shall not consider undated or unsigned entries handwritten in the margin of a document."

Notice what the list includes: "excessive late entries". Late entries are legitimate. A pattern of them is not something CMS ignores, and neither should you.

#### What people get wrong about the rules

MythA late entry proves a cover-up.
RuleAHIMA and CMS both treat labeled late entries as proper practice. What counts is the label, the timing and the content.
MythIf the EHR let the nurse edit the note, the edit was allowed.
RuleSystem permission is not policy. AHIMA expects signed notes to lock and reopening to be controlled and audited.
MythThe printed chart is the whole chart.
RuleAHIMA advises that retracted entries not print in the legal health record. Prior versions and access history sit outside the print view.
MythWhen a patient asks for a correction, the hospital rewrites the note.
Rule45 CFR 164.526(c)(1): the amendment is appended to the record or linked to it.
MythA signature weeks after discharge means the note was faked.
RuleIt breaches the 30-day completion rule if it runs past 30 days. It proves a delinquency, not what the note said before.
If you remember one thing
Ask for the facility's documentation and late-entry policies in force on the date of care. "Late" and "improper" mean whatever that policy says, and experts on both sides will measure against it.

Chapter 3 Everyone

### 3 versions of 1 note: a proper addendum and a silent overwrite

Definitions are easier to hold onto with a real-looking note in front of you. Below is the same nursing progress note as it appears in 3 places in a hypothetical file. Chapter 6 walks the full case; this chapter is about reading the note itself.

**Hypothetical.** An 81-year-old patient on an anticoagulant, admitted for pneumonia, is found on the floor of a medical-surgical unit at 02:10 on 14 March 2025. A head CT later that morning shows a subdural hematoma. The patient, the nurse ("RN A"), the hospital and the page numbers are invented. PL numbers come from the pre-suit copy (Production A); DEF numbers come from the defense production in discovery (Production B).

**Progress note #88121 as it appears in 3 places** — hypothetical — Illustration
**Version 1** PL 000644 — signed 03/14 02:41
RN A, Med-Surg 4. Created 03/14/2025 02:35
0210 Pt found on floor beside bed, R side.
Bed alarm found off on arrival.
Last rounding documented 2300.
Alert, oriented x2 (baseline). C/o R hip pain.
Small hematoma L forehead.
On apixaban. MD paged 0215, orders received.
Neuro checks q1h started.
Electronically signed RN A 03/14/2025 02:41
**Addendum** PL 000645 — written 03/16 15:05
LATE ENTRY for 03/14/2025 0000 to 0200
Late entry. Pt rounded on at 0000 and 0100.
Pt asleep, call light in reach, bed low.
Entry late due to unit acuity that shift.
Electronically signed RN A 03/16/2025 15:07
**As produced** DEF 000702 — signed 03/14 02:41
RN A, Med-Surg 4. Created 03/14/2025 02:35
0210 Pt found on floor beside bed, R side.
Bed alarm found off on arrival.
Bed alarm on and sounding on arrival.
Last rounding documented 2300.
Hourly rounding current, last 0100.
Alert, oriented x2 (baseline). C/o R hip pain.
Small hematoma L forehead.
On apixaban. MD paged 0215, orders received.
Neuro checks q1h started.
Electronically signed RN A 03/14/2025 02:41. No addendum. No revision marker.
The addendum is proper in form and weak in substance. The third column is the problem: new facts, the old signature time, and no label.

#### Reading the 3 columns

Version 1 is a clean contemporaneous note, created 25 minutes after the event and signed 6 minutes later. It holds 2 facts that hurt the hospital: the bed alarm was off, and the last rounding was at 23:00.

The addendum passes the 4-question test. It is labeled, timed when written, names the window it covers, is signed, and leaves version 1 intact. Its weakness is timing and content: written 2 days later, after the CT, it adds exactly the 2 facts that would answer the fall-risk case. A jury can weigh that. Nobody can call it concealment, because it announced itself.

Column 3 is the one that should stop you. The header still says signed at 02:41, but 2 sentences now contradict version 1 and nothing on the page says a change was made. Before you call it alteration, rule out the print view: some EHRs print only the current revision under the original signature line, with the edit tracked in the history. That still breaks the rule that the original stays viewable, but it is a different problem from a forged page. Only the metadata in chapter 8 tells the 2 apart.

If you remember one thing
Call it what it is until the metadata says more: "2 inconsistent versions of note #88121, DEF 000702 versus PL 000644." Precise language survives the deposition. An accusation you cannot yet prove does not.

Chapter 4 Building

### Red flags you can see in paper and PDF records

Most reviewers never see an original chart. They see a PDF of a printout, or a scan of a fax of a copy. That limits what can be seen on the page, and it is worth being honest about which signs survive that chain and which need the original paper or the EHR metadata.

| Sign | How it shows in a PDF | Common innocent explanation | What settles it | Needs metadata or original? |
| --- | --- | --- | --- | --- |
| Different ink, pen pressure or handwriting inside 1 entry | Often lost in a black and white scan; sometimes visible as stroke weight | A 2nd clinician co-signing, a pen running out | Paper original examined by a forensic document examiner | Original |
| Text squeezed into margins, between lines or above the signature | Visible | A labeled correction written where there was room | Whether it is dated, timed and initialed; CMS ignores unsigned margin notes | No |
| White-out, obliteration, overwriting | Partly visible as blotches or overprinted characters | Almost none for clinical content; proper corrections leave the original readable | Paper original, sometimes under oblique or infrared light | Original |
| Different font, header, footer or template on pages of the same note | Visible | Printed from a different module, or the print template changed between productions | Print dates in footers; print events in the audit trail | Partly |
| Late entry or addendum written long after the event, or after the outcome | Visible when labeled | Busy shift, dictation backlog | Facility late-entry policy; the author's usual pattern | No |
| A note timed before the event it describes, or entries running backward | Visible in a sorted chronology | Device clock drift, a wrong time typed, a late entry without a label | Create and modify times in the audit trail | Yes |
| Page "3 of 7" with no page 4, a Bates gap, extra pages in a later production | Visible | Copying or scanning error, a new document type added | A written request for the named page; page counts compared across productions | No |
| Vital signs that disagree across flowsheet, narrative and monitor strip | Visible | Device values validated later; a manual recheck entered separately | Monitor data; flowsheet filed times versus value times | Yes |
| Signature or authentication time after discharge | Visible in the signature block | Batch signing; physician catching up on deficiencies | Whether it breaches the 30-day completion rule; what changed before signing | Partly |
| Copy-forward text carrying a stale fact | Visible across notes | Routine copy-forward (chapter 5) | Whether the stale fact appears only near the event | No |
| 2 versions of 1 note across productions | Visible if you compare | Pre-suit copy printed before the note was signed; different print view | Revision history and print log | Yes |

##### You can see it on the page

A PDF is enough to raise it

- Late-entry and addendum labels, with written time versus event time
- Margin text, overwriting, white-out marks
- Page numbering breaks and Bates gaps
- Different fonts, headers or print dates within 1 note
- Entries out of chronological order
- Signature times after discharge
- 2 versions of the same note, if you have 2 productions

##### Only metadata or the original can show it

A PDF cannot settle it

- When the text was actually typed, versus when it was signed
- What a note said before it was edited
- Who opened, edited, printed or retracted it, and from which workstation
- Retracted entries that do not print
- Flowsheet rows filed hours or days after their value time
- Ink, paper stock and indentation on a handwritten page

No single sign proves alteration. A late signature on 1 note in a 2,000-page chart is noise. Late signatures on the 3 notes about the hour before the injury, and on nothing else that shift, deserve a closer look.

If you remember one thing
Mark each red flag with the page it came from and one of 2 labels: "settled by the page" or "needs metadata". The second list becomes your discovery request.

Chapter 5 Everyone

### Copy-forward, templates and ambient AI scribes: the lookalikes

A modern EHR note is assembled more than written. That fact produces a steady stream of false alarms in altered-records review, and it also gives real alterations somewhere to hide.

**Where the text in a typical inpatient progress note came from** — n = 23,630 notes, 460 clinicians — Wang, Khanna and Najafi, JAMA Internal Medicine, 2017. Bars scaled to 50%.
Fewer than 1 word in 5 of a typical note was typed fresh for that note. Identical text across days is the norm, not a sign of tampering.

The [study](https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/2629493) covered 1 academic medical center, so shares will differ elsewhere. The direction will not: a reviewer who flags every repeated sentence will drown.

#### The lookalikes and how to tell them apart

| Lookalike | What it looks like in the record | How to tell it from alteration |
| --- | --- | --- |
| Copy-forward | Whole paragraphs identical from day to day, including facts that stopped being true ("drain in place" after removal) | Stale facts repeat on many days in both directions. An alteration tends to change the note nearest the event and nothing else |
| Imported data | Vitals, labs and medication lists that update themselves inside a note | A reprint can show newer values than the original print. Compare import timestamps, not narrative |
| Templates and smart phrases | Normal findings documented in the same words for every patient | Default normals are a documentation quality issue, not a change after the fact. See charting by exception |
| Ambient AI scribe drafts | A note drafted by software from the recorded visit, then edited by the clinician before signing | Edits before signature are normal. The question is whether the draft and the edit history are retained, and in which system |
| Dictation and transcription | A report dated days after the visit | AHIMA does not treat a dictated report typed outside the facility's time frame as a late entry. Check dictation and transcription times |
| Pended notes | A pre-suit copy shows a shorter note than the final version | The pre-suit copy may have been printed before signing. The print time versus the sign time settles it |

[](https://medrecords.ai/guides/charting-by-exception/)

#### Ambient AI scribes change the evidence

With an ambient AI scribe, there may be a recording or transcript, a machine draft and a signed note. The differences between them are pre-signature edits, which are ordinary, though AHIMA says those should be tracked too. If the case turns on what was said in the room, the draft and transcript may be the best contemporaneous evidence, and they may sit in a vendor system with its own retention clock. Our view: name the scribe's drafts, transcripts and retention settings in the preservation letter. Default retention varies, which is the reason to ask early.

If you remember one thing
Repetition is normal. A single sentence that changes only in the note closest to the adverse event is not. Look for the change that breaks the pattern.

Chapter 6 Building

### Worked example: the post-fall note, start to finish

**Hypothetical.** This continues the invented case from chapter 3. It shows the sequence of work, not the outcome of any real matter. Every date, page number and person is made up.

**From the fall to the 2nd production** — hypothetical — Illustration
1. 03/13 21:30
**Fall risk assessed high**
Fall risk score documented as high. Bed alarm and hourly rounding ordered.

Nursing assessment, PL 000598
2. 03/13 23:00
**Last rounding entry**
Hourly rounding flowsheet: pt asleep, bed alarm on.

Rounding flowsheet, PL 000610
3. 00:00 to 02:00
**No rounding entries**
The flowsheet in Production A has no rows between 23:00 and 02:15.

PL 000610 to PL 000611
4. 03/14 02:10
**Found on floor**
Progress note created 02:35, signed 02:41: bed alarm found off, last rounding 23:00.

Progress note #88121, PL 000644
5. 03/14 09:40
**Head CT**
Acute subdural hematoma. Transfer to ICU.

Radiology report, PL 000702
6. 03/16 15:05
**Late entry addendum**
Labeled late entry: rounding at 00:00 and 01:00, pt asleep. Written 2 days after the fall and after the CT.

Addendum, PL 000645
7. 04/02
**Records request**
Request for the complete chart under the patient's HIPAA authorization.

Firm correspondence log
8. 05/06
**Production A received**
1,284 pages, stamped PL 000001 to PL 001284 on receipt. File hashed and stored unaltered.

Intake log
9. 05/12
**Preservation letter sent**
Names note #88121, the rounding flowsheet, versions, access history and bed alarm data.

Firm correspondence log
10. 2026 01/20
**Production B in discovery**
1,391 pages. Note #88121 reads differently under the original 02:41 signature. The flowsheet now shows rows at 00:00 and 01:00. The addendum does not appear.

DEF 000668, DEF 000702

The 2 productions disagree about the hour before the fall, and only the earlier one was obtained before anyone expected a claim.

#### Steps 1 to 3: intake, chronology, late entry

Production A is stamped PL on receipt, logged and saved untouched with a SHA-256 hash. Production B later gets its own prefix and log line. The 2 sets are never merged before comparison, because deduplication would treat the 2 versions of note #88121 as near-duplicates and might drop 1. A [medical chronology](https://medrecords.ai/guides/how-to-write-a-medical-chronology/) of Production A sorted by event time shows the rounding gap at once, and that gap becomes the case theory. The labeled addendum goes on the red-flag list as "settled by the page": a question for the late-entry policy and the deposition, not for a forensic expert.

#### Step 4: Production B and the 3 differences

Comparing the 2 productions note by note (chapter 7) produces 3 differences:

1. **Note #88121 text changed.** 2 sentences replaced, signature time unchanged, no addendum and no revision marker. DEF 000702 versus PL 000644.
2. **Flowsheet rows appeared.** DEF 000668 shows rounding rows at 00:00 and 01:00 that are absent from PL 000610. If the print view includes a "filed" column, it may show when those rows were entered; this one does not.
3. **The addendum disappeared.** PL 000645 has no counterpart in Production B. Possible explanations include a retraction, a print setting that excludes addenda, or a merge of the addendum text into the note.

#### Steps 5 and 6: the request, and what is proven so far

Each difference maps to a metadata request: the audit trail and every saved revision of note #88121 and the rounding flowsheet, the retraction history, the release log for Production A, and the bed alarm's own event log. Chapter 8 shows what that might return. At this point the file proves that 2 productions disagree about the hour before the fall. It does not prove who changed what, when or why, and it does not prove intent, which in federal court separates a curative measure from an adverse inference (chapter 9).

If you remember one thing
The pre-suit copy is the baseline everything else is measured against. Without Production A, column 3 of chapter 3 would read as a normal note.

Chapter 7 Building

### How to compare 2 versions of a record by hand

Version comparison is slow, careful work, and it is still mostly done by people. Here is the sequence that holds up when a reviewer is later asked, under oath, how they found the difference.

Step 1 — **Freeze** — Keep each production separate, stamped and hashed as received. Never merge first.
Step 2 — **Index** — List every document by date, time, author, type and note ID, per production.
Step 3 — **Pair** — Match the same note across productions. Unmatched items are findings too.
Step 4 — **Diff** — Compare text, times, signature block and page count. Record both page cites.
1. **Freeze every production as received.** Own prefix, logged source, date, page count and Bates range, an untouched copy and a hash. The hash answers "how do we know your copy is the same" for good. See [Bates numbering](https://medrecords.ai/guides/what-is-bates-numbering/) for prefixes.
2. **Index before you read.** Date, time, author, type and note ID for every document. The note ID is the best key, because titles and dates shift between print views.
3. **Pair across productions.** Work from the index, not page order. Anything without a partner goes on its own list. The Bates mechanics are in [reconciling a defense record production](https://medrecords.ai/guides/reconciling-defense-record-production/).
4. **Diff the pairs that count.** Every document within 48 hours of the event, every one the defense expert relies on, and every labeled late entry. Record each difference with both page cites.
5. **Separate format from content.** A new header or print date is usually innocent. A changed finding, time, dose or plan is content, and only content goes into the metadata request by name.
6. **Write the change list.** 1 line per content difference. It drives the [audit trail request](https://medrecords.ai/guides/ehr-audit-trail-medical-malpractice/) and the deposition outline.

##### 1. Version comparison worksheet

Use 1 worksheet per disputed note. Fill it from the PDFs only; leave the metadata rows blank until the audit trail and revision history arrive.

VERSION COMPARISON WORKSHEET
Matter: [CASE NAME / FILE NO.] Reviewer: [NAME] Date: [DATE]

DOCUMENT
 Type / title: [e.g. Nursing progress note]
 Note or order ID: [ID if printed, else "none shown"]
 Author (as printed): [NAME, ROLE]
 Event the note covers: [DATE TIME]

VERSIONS FOUND
 Version A: Production [A] Bates [PL 000000] received [DATE]
 Created [DATE TIME] Signed [DATE TIME] Print date in footer [DATE]
 Version B: Production [B] Bates [DEF 000000] received [DATE]
 Created [DATE TIME] Signed [DATE TIME] Print date in footer [DATE]
 Other: [Addendum / late entry / retraction notice, with Bates]

DIFFERENCES (1 line each)
 # Type (format / content) Version A text Version B text Cites
 1 [content] "[exact words]" "[exact words]" [PL / DEF]
 2 [format] [header, font, footer] [header, font, footer] [PL / DEF]

4-QUESTION TEST FOR EACH CHANGE
 Labeled as a change? [Y / N]
 Dated and timed when made? [Y / N]
 Author identified? [Y / N]
 Original still readable? [Y / N]

INNOCENT EXPLANATIONS TO RULE OUT
 [ ] Printed before signature (pended note)
 [ ] Different print view or template
 [ ] Current-revision-only print of a tracked edit
 [ ] Imported values refreshed on reprint
 [ ] Copy-forward from another date

METADATA NEEDED (fill when received)
 Audit trail rows for this ID: [requested DATE / received DATE / Bates]
 Revision history (all versions): [requested / received]
 Print / release log: [requested / received]

STATUS
 [ ] Settled by the page [ ] Needs metadata [ ] Refer to expert
 Summary (2 sentences, with cites):
 [TEXT]
If you remember one thing
Never deduplicate 2 productions into 1 file before you compare them. The near-duplicate you delete may be the evidence.

Chapter 8 Building

### What only metadata can answer, and how to ask for it

A PDF can tell you that 2 versions disagree. It cannot tell you when the text was typed, who typed it, or what the note said in between. Those answers live in system data that a standard records release does not include. AHIMA says it plainly: audit trails are part of the metadata and are discoverable for use in litigation.

| Question | Where the answer lives | Ask for |
| --- | --- | --- |
| When was this text typed, as opposed to signed? | EHR audit trail | Create, modify, sign and addend events for the named note IDs, with user, role, timestamp and time zone, workstation |
| What did the note say before? | Revision or version history | The full text of every saved version of each named note, including superseded ones |
| What was hidden? | Retraction and deletion records | A list of retracted or "entered in error" items for the encounter, with their text and the reason code |
| What version went out, and when? | Release-of-information and print logs | Print and release events for the chart, with the date of each production |
| When were flowsheet values entered? | Flowsheet audit | Value time and filed time for each row in the disputed window |
| What did the devices record? | Standalone systems | Bed alarm, nurse call, telemetry, fetal monitoring, infusion pump and anesthesia logs, in native form |
| Who looked after the event? | Access log | View events by users outside the care team, including risk management, after the adverse event |

Here is what a filtered audit trail for the chapter 6 hypothetical might return. Real exports carry dozens of columns and thousands of rows; event names and codes differ by vendor and installation, which is why you ask for a data dictionary with the export.

Audit trail export, note #88121 and rounding flowsheet, hypothetical — 9 rows
| Timestamp | User | Action | Object | Workstation |
| --- | --- | --- | --- | --- |
| 2025-03-14 02:35:12 | RN A | Create | Progress note #88121 | MS4-WS12 |
| 2025-03-14 02:41:07 | RN A | Sign | Progress note #88121 | MS4-WS12 |
| 2025-03-14 09:52:40 | MD B | View | Progress note #88121 | ICU-WS03 |
| 2025-03-16 15:02:18 | RN A | File rows 00:00, 01:00 | Rounding flowsheet 03/14 | MS4-WS07 |
| 2025-03-16 15:05:44 | RN A | Addend (late entry) | Progress note #88121 | MS4-WS07 |
| 2025-03-16 15:21:09 | Risk mgmt user | View | Progress note #88121 | ADM-WS22 |
| 2025-04-04 08:31:55 | HIM user | Print (release) | Full chart, encounter | HIM-WS02 |
| 2025-06-19 10:14:33 | RN A | Modify (revision 2) | Progress note #88121 | MS4-WS07 |
| 2025-06-19 10:15:02 | RN A | Sign | Progress note #88121 | MS4-WS07 |

Hypothetical. The print on 04/04 is the version that became Production A. The edit on 06/19 comes after the preservation letter of 05/12, and the note in Production B still prints the 02:41 signature time.
Read in order, the rows sharpen the story without finishing it. The 00:00 and 01:00 flowsheet rows were filed 2 days late, 3 minutes before the addendum, which explains DEF 000668. The modify event on 19 June explains DEF 000702 and puts the change after the preservation letter. What the log cannot say is why. That is for RN A, the records custodian and an informatics expert who can explain what "Modify" means in this installation.

#### Using AI on an audit trail export

An audit trail export is a spreadsheet problem before it is an AI problem. Filter to the note IDs, sort by timestamp, and highlight events after the adverse event and after notice of the claim. A general-purpose large language model can help write filter formulas or explain vendor event codes, but only inside a tool covered by a business associate agreement, and every row it summarizes has to be checked against the raw export. A model that summarizes 40,000 rows will sometimes invent a row that is not there. The full request and reading method is in the [EHR audit trail guide](https://medrecords.ai/guides/ehr-audit-trail-medical-malpractice/).

#### When to ask

Ask in the first discovery request, before the deposition. When the author testifies the note was written at 02:41, you want the log already in hand. Name the note IDs, run the date range from admission to the latest production, and ask for native or CSV format with a data dictionary. A narrow request is harder to resist on burden.

If you remember one thing
The audit trail tells you when and who. The revision history tells you what. Ask for both, by note ID, in the same request.

Chapter 9 Deciding

### Spoliation: the federal rule, state law and criminal exposure

Spoliation is the destruction, alteration or failure to preserve evidence when litigation is pending or reasonably foreseeable. For a hospital the duty can attach before suit: a serious adverse event, a risk review, a law firm's records request or a preservation letter can each show foreseeability. When it attached is for the court, under the law of the jurisdiction.

#### Federal court: Rule 37(e)

In federal court, lost electronically stored information is governed by [FRCP 37(e)](https://www.law.cornell.edu/rules/frcp/rule_37), rewritten in the 2015 amendments. The rule applies when ESI that should have been preserved is lost because a party failed to take reasonable steps, and it cannot be restored or replaced through additional discovery. It then sets 2 tiers:

"(2) only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation may: (A) presume that the lost information was unfavorable to the party; (B) instruct the jury that it may or must presume the information was unfavorable to the party; or (C) dismiss the action or enter a default judgment."

Below that tier, under (e)(1), a court that finds prejudice may order only "measures no greater than necessary to cure the prejudice". The 2015 committee note adds that the rule "does not call for perfection": reasonable steps suffice. 3 practical consequences follow for altered-records cases:

- **Restored or replaced means no 37(e) remedy.** If the prior version of a note survives in the revision history, the ESI is not lost, and the fight moves to what the edit means rather than what was destroyed. That is another reason to ask for revision history early.
- **Intent is the hinge.** An adverse inference instruction in federal court needs a finding of intent to deprive. Negligent loss, even prejudicial, gets a curative measure.
- **37(e) is about ESI.** Altered paper records and physical evidence are handled under other rules and the court's inherent authority.

#### State court, where most of these cases are

Most medical malpractice cases are in state court, and state spoliation law differs on at least 3 points: when the duty to preserve arises, what level of fault supports an adverse inference instruction, and whether spoliation is only a sanctions issue or also a separate tort. Some states recognize an independent tort for intentional spoliation; many do not. Check your jurisdiction before you plead or brief it.

Ohio is the clearest example of how seriously a state court can treat deliberate alteration by a physician. In [Moskovitz v. Mt. Sinai Medical Center](https://www.courtlistener.com/opinion/6877020/moskovitz-v-mt-sinai-medical-center/), 69 Ohio St.3d 638 (1994), the Ohio Supreme Court held:

"An intentional alteration, falsification or destruction of medical records by a doctor, to avoid liability for his or her medical negligence, is sufficient to show actual malice, and punitive damages may be awarded whether or not the act of altering, falsifying or destroying records directly causes compensable harm."

The court also recognized that "a cause of action exists in tort for interference with or destruction of evidence". It reinstated punitive damages against the physician, with a remittitur of $2 million from the jury's $3 million punitive award, leaving $1 million. That is 1 state's law from 1994. It shows the ceiling of the risk, not the norm everywhere.

#### Licensing and criminal law

| Law | What it covers | Consequence |
| --- | --- | --- |
| California Penal Code 471.5 | Anyone who alters or modifies a medical record, or creates a false one, with fraudulent intent | Misdemeanor |
| California Business and Professions Code 2262 | Physicians and podiatrists who alter a record or create a false one with fraudulent intent | Unprofessional conduct, plus a $500 civil penalty per violation |
| 18 USC 1035 | Knowingly and willfully falsifying or covering up a material fact, or using a false document, in a matter involving a health care benefit program, in connection with delivery of or payment for care | Up to 5 years in prison, a fine, or both |
| 18 USC 1519 | Knowingly altering, destroying or falsifying a record to impede a federal investigation or matter | Up to 20 years in prison, a fine, or both |

[](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=471.5) [](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=2262) [](https://www.law.cornell.edu/uscode/text/18/1035) [](https://www.law.cornell.edu/uscode/text/18/1519)
Other states have their own rules. None of these are remedies a civil litigant controls, but they explain why a clinician asked about a changed note at deposition may be advised not to answer.

If you remember one thing
In federal court, the harsh remedies for lost ESI need a finding of intent to deprive. Build the timeline that shows when the change happened relative to notice, because timing is how intent usually gets argued.

Chapter 10 Deciding

### What to do when you suspect alteration

Suspicion is cheap and accusations are expensive. The path below runs from the cheapest step that can settle the question to the most expensive. Whether to take each step is a decision for counsel.

**From suspicion to motion** — decision path — Illustration
1
**Do you have 2 versions of the same entry?**
YesRun the version comparison worksheet (chapter 7) and write the change list.
NoGo to 2. If you have only 1 production, consider whether a pre-suit copy or the patient's own portal printouts exist.
2
**Do red flags cluster around the adverse event?**
YesList each flag with its page and "settled by the page" or "needs metadata".
NoScattered late signatures and copy-forward are noise. Note them and move on.
3
**Is any change unlabeled, or does it fail the 4-question test?**
YesRequest the audit trail, revision history, retraction list and print log by note ID.
NoA labeled late entry is a deposition topic: timing, policy and content. Not a forensic issue.
4
**Does the metadata show an edit after notice of the claim, or a paper page that looks inserted?**
YesRetain the matching expert: an informatics expert for EHR logs, a forensic document examiner for paper and ink.
NoThe change may be innocent. Use it at deposition if at all.
5
**Did the expert confirm a change that hid the original, with timing that supports intent?**
YesCounsel weighs a spoliation motion, an adverse inference instruction request, or state-law claims such as punitive damages where available.
NoKeep the change list for cross-examination. Do not overstate it.
Each step costs more than the one before. Most suspected alterations end at step 2 or 3, and that is a good outcome: it means the file is cleaner than you feared.

#### The order of the first 2 moves

A preservation letter puts the provider on notice. It also tells the provider which notes you care about. Many plaintiff lawyers get a complete pre-suit copy under the patient's HIPAA right of access first, then send the letter the same week. We think that order is right: a baseline obtained after the letter is worth less. The routes are in [how to get medical records for a lawsuit](https://medrecords.ai/guides/how-to-get-medical-records-for-a-lawsuit/). For defense counsel and risk managers, the mirror image: once a claim is foreseeable, lock the chart, suspend purges and document the hold.

##### 2. Preservation letter for medical records and EHR data

A starting draft for counsel to adapt. Names the categories most often lost. Adjust to your jurisdiction and your facts.

[FIRM LETTERHEAD]

[DATE]

VIA [EMAIL AND CERTIFIED MAIL]
[Custodian of Records / Risk Management / General Counsel]
[FACILITY NAME AND ADDRESS]

Re: Preservation of evidence
 Patient: [NAME], DOB [DATE], MRN [IF KNOWN]
 Dates of care: [ADMISSION DATE] through [DISCHARGE DATE]

Dear [NAME]:

This firm represents [CLIENT] regarding care provided at [FACILITY]
during the dates above. We anticipate litigation. We ask that you
preserve, and suspend any routine deletion, purge, overwrite or log
rotation of, the following, from [ADMISSION DATE] to the present:

1. The complete electronic health record for the encounter in native
 format, including every saved version of every note, order,
 flowsheet row and addendum, and the revision history of each.
2. Audit trails and access logs for the chart: create, view, modify,
 sign, addend, retract, delete, print and release events, with
 user, role, timestamp and time zone, and workstation, plus the
 data dictionary for event codes.
3. Retracted, "entered in error", deleted or hidden entries, with
 their original text and reason codes.
4. Release-of-information and print logs showing each production of
 this record and its date.
5. Specifically, and without limiting the above:
 [NOTE TYPE, DATE, TIME, NOTE ID IF KNOWN]
 [FLOWSHEET NAME, DATE RANGE]
6. Data from systems outside the EHR: [bed and chair alarms, nurse
 call, telemetry, fetal monitoring, infusion pumps, anesthesia
 records, glucometers], in native form.
7. Ambient documentation or scribe data, if used: audio, transcripts,
 machine drafts and edit history, and the vendor's retention
 settings.
8. Imaging in DICOM format, in addition to reports.
9. Paging, secure messaging and nurse call logs for [UNITS, SHIFTS].
10. Staffing and assignment records for [UNITS, SHIFTS].
11. Policies in force on the dates of care on documentation, late
 entries, addenda, corrections, retractions and record locking.
12. Paper originals of any handwritten or downtime records, not
 copies, so ink and paper can be examined.

Please confirm in writing within [NUMBER] days that a hold is in
place and identify the person responsible for it. This letter does
not waive any right to seek additional evidence.

Sincerely,
[ATTORNEY NAME]
[BAR NUMBER, CONTACT DETAILS]

#### Before the letter goes out

- **Pre-suit copy in hand, stamped and hashed** *It is the baseline for every later comparison.*
- **Chronology sorted by event time** *Shows the gaps you will name in item 5.*
- **Red-flag list with page cites** *Each flag marked "settled by the page" or "needs metadata".*
- **Note IDs for the disputed entries** *Specific requests are harder to object to.*
- **Devices and standalone systems identified** *Alarm, monitor and pump logs often sit outside the EHR and rotate fast.*
- **Ambient scribe use confirmed or ruled out** *Drafts may have their own retention clock.*
- **Paper and downtime records identified** *Originals, not copies, for ink examination.*
- **Correct recipient named** *Records custodian and risk management or counsel, as well as the release desk.*
- **Date range runs to the present** *Edits after the event are the point.*
- **Delivery method you can prove** *The date of notice may decide when the duty attached.*

**0** of 10 checked

If you remember one thing
Get the baseline, then give notice. A preservation letter that names specific note IDs and devices is harder to ignore and easier to enforce.

Chapter 11 Everyone

### AI medical record review on a changed chart: where it helps and where it fails

Altered-records work has 2 halves. The first half is finding: reading every page, noticing the late-entry label on page 645 and the near-identical note on page 702, and putting entries in order by when they were written. The second half is judging: deciding whether a change hid something, and why. AI tools are good at a large part of the first half and should not be trusted with the second.

#### What a large language model does well here

- **Finding every labeled late entry and addendum.** Clinical natural language processing picks out "late entry", "addendum" and "entered in error" across thousands of pages.
- **Surfacing near-duplicate notes that differ.** Pairing 2 nearly identical notes and showing the changed sentences, the tedious part of chapter 7.
- **Ordering by event time.** An AI medical chronology with written and signed times alongside makes out-of-sequence entries and gaps visible.
- **Catching date inconsistencies.** A note dated before admission, a signature after discharge.

#### Where it fails

- **OCR on faxes.** Optical character recognition can read "0210" as "0710", and a time error is the worst error in this work.
- **Handwritten notes.** Ambiguous handwriting still needs someone who knows the unit's abbreviations.
- **What a scan cannot carry.** Ink color, pen pressure and paper stock do not survive a black and white PDF.
- **Copy-forward dates.** A copied sentence attributed to the wrong day can look like an alteration that is not there.
- **Hallucination.** Ask a chatbot "was this altered?" and generative AI may write a confident story. Filling gaps is the opposite of what a spoliation analysis needs.
- **Metadata and intent.** A tool reading PDFs cannot see create times or unprinted retractions, and no tool can say why someone changed a note.

Reviewer alone
Find late-entry labels — Read every page; easy to miss 1 in 2,000
Spot 2 near-identical notes — Only if you remember the first one 300 pages later
Order by written time — A spreadsheet built by hand
Decide what a change means — Reviewer, expert, counsel
With AI, human in the loop
Find late-entry labels — Listed with page cites, then checked
Spot 2 near-identical notes — Shown side by side, each cited to its page
Order by written time — Drafted chronology, every row linked to its page
Decide what a change means — Still the reviewer, expert, counsel

#### Why page-level citations are the whole game

In litigation, a flag you cannot trace to a page is worthless. A flagged late entry helps only if you can open both versions. Grounded, page-level citations make that 1 click; the human-in-the-loop reviewer decides addendum or alteration. The court side makes the point sharply. In *Mata v. Avianca, Inc.* (S.D.N.Y. 2023), lawyers were sanctioned under Rule 11 after filing a brief with case citations a chatbot had fabricated. The same duty to verify applies to a chronology an expert relies on, or to a spoliation motion that quotes a note. Check every cited line at the page before it goes into a filing.

#### Choosing legal AI tools for this work

The market for AI document review and technology assisted review is crowded, and agentic AI tools now promise to run whole review workflows. For altered-records work, rank the requirements in this order:

1 —

##### A citation on every line

Every flag, date and quote opens the source page. No citation, no use.

2 —

##### HIPAA compliant AI with a signed BAA

A business associate agreement before any record is uploaded. Consumer chatbots without one are out.

3 —

##### SOC 2 and no training on your data

An independent security report, and a written commitment that your records do not train the model.

4 —

##### Productions kept separate

The tool must not silently deduplicate 2 versions of the same note into 1.

5 —

##### An audit trail of AI use

A log of who uploaded, viewed and edited what, so you can answer chain-of-custody questions about your own work.

6 —

##### Flags labeled as signals

Output that says "near-duplicate, differs in 2 lines", not "altered". The verdict stays with people.

For the wider question of how AI review compares to a person on accuracy, see [is AI accurate enough for court](https://medrecords.ai/guides/is-ai-accurate-enough-for-court/) and [HIPAA-compliant AI medical record review](https://medrecords.ai/guides/hipaa-compliant-ai-medical-record-review/).

If you remember one thing
Use AI to find and cite. Use people to judge. A tool that says "this record was altered" is overstepping; a tool that says "these 2 notes differ in 2 lines, pages 644 and 702" is doing its job.

Chapter 12 Publisher

### What Medrecords AI flags, and what it does not

Medrecords AI is medical record review software. You upload the records; it drafts a cited chronology and flags, every line linked to its source page. On a chart where alteration is a question, it flags these signals in the uploaded record, each cited to its page:

- **Labeled late entries and addenda** , with the written time next to the event time they cover.
- **Near-duplicate notes that differ** , shown side by side from the PDFs, through [record alteration detection](https://medrecords.ai/product/record-alteration-detection/).
- **Date inconsistencies** : an entry dated before admission, a signature after discharge, an entry that contradicts the time of the event it describes.
- **Entries out of chronological order** in a [cited medical chronology](https://medrecords.ai/product/chronology/) sorted by event time.
- **Undated pages** , kept in their own bucket by [undated document flagging](https://medrecords.ai/product/undated-document-flagging/).
- **Records that should exist and are missing** , such as a gap in hourly rounding, through [missing records identification](https://medrecords.ai/product/missing-records-identification/).
- **Low-confidence OCR pages** , including faxes and handwriting, marked for a person to read through [OCR](https://medrecords.ai/product/ocr/) and [handwritten record extraction](https://medrecords.ai/product/handwritten-medical-record-extraction/).

Flags are signals, not verdicts. A near-duplicate that differs may be a pended note, a print view difference or a real alteration, and the software cannot tell which. A human decides.

What it does not do: it does not read EHR system exports or access history, so it cannot tell you when text was typed. It does not build a page-by-page map between 2 productions; chapter 7 describes how a person does that. It does not judge intent, decide whether spoliation occurred, give legal advice, or retrieve records from providers. It works on the files you upload, under SOC 2 and HIPAA with a signed BAA (see [security](https://medrecords.ai/security/) and [HIPAA](https://medrecords.ai/hipaa/) ). Self-Service bills 10 cents a deduplicated page, down to 5 cents at volume, duplicates free; Enterprise On-Prem is an annual license.

The offer

#### See it flag the late entries in a chart like yours.

Book a demo on a chart you have questions about, then run your first case free on us. Every line comes back cited to its source page. You review, you revise, you sign.

[Book a demo](https://medrecords.ai/demo/) [See record alteration detection](https://medrecords.ai/product/record-alteration-detection/)
Scheduling only. No records move from a public page.

Chapter 13 Everyone

### Frequently asked questions

What counts as an altered medical record?A chart entry changed after the fact in a way that hides the original or misstates when the change was made: backdated notes, text overwritten under an old signature time, inserted or removed pages, white-out, or additions without a late-entry label. A labeled, dated, timed and signed late entry or addendum that leaves the original readable is not alteration.
Is a late entry in a medical record legal?Yes, when it is done properly. AHIMA and CMS both treat late entries as legitimate if they are labeled as late, bear the date and time they were written, identify the author and leave the original intact. Facility policy sets how late is too late. A pattern of late entries clustered around an adverse event is something CMS fraud contractors are told to look for.
How long after an event can a nurse write a late entry?There is no single federal number. Facility policy defines the window, and AHIMA says organizations should set it. For hospitals, 42 CFR 482.24(c)(4)(viii) requires the medical record to be completed within 30 days of discharge. A late entry inside policy can still be challenged on timing and content, especially if written after the outcome was known.
Can a patient ask a hospital to change their medical record?Yes. Under 45 CFR 164.526 a patient can request an amendment, and the covered entity must act within 60 days, with 1 extension of up to 30 days. It may deny a request if the record is accurate and complete. An accepted amendment is appended or linked to the record, never written over the original.
What is spoliation of medical records?Destroying, altering or failing to preserve records once litigation is pending or reasonably foreseeable. Courts can respond with curative measures, adverse inference instructions or, in serious cases, dismissal or default. In federal court, FRCP 37(e)(2) requires a finding of intent to deprive for the harsh remedies on lost ESI. State standards vary, and some states recognize a separate tort.
Is altering medical records a crime?It can be. California makes fraudulent alteration of a medical record a misdemeanor under Penal Code 471.5 and unprofessional conduct for physicians under Business and Professions Code 2262. Federal law reaches falsification in health care benefit matters (18 USC 1035) and alteration to obstruct a federal matter (18 USC 1519). Other states differ; check your jurisdiction.
Can AI detect altered medical records?AI can find signals, not prove alteration. Software can list labeled late entries, surface near-duplicate notes that differ, and flag date inconsistencies and out-of-order entries, each cited to its page. It cannot see ink on a scan, read metadata that was never produced, or judge intent. A person reviews every flag and decides what it means.
Can AI read an EHR audit trail?General AI tools can help sort, filter and explain a CSV audit trail export, and a large language model can draft filter formulas or explain event codes. Use only a tool covered by a business associate agreement, and check every summarized row against the raw export, because models can invent rows.
Is it HIPAA compliant to upload medical records to AI?It can be, if the vendor signs a business associate agreement, protects the data with controls you can verify (such as a SOC 2 report), and does not use your records to train its models. Ask for the BAA before the first upload.
Can ChatGPT tell whether a medical record was altered?Not reliably. A general chatbot reading a PDF cannot see metadata, ink or retracted entries, and it may produce a confident answer that is not supported by the pages. Check any factual claim it makes at the page before anyone relies on it.
What should a preservation letter for medical records include?Every saved version of each note, audit trails and access logs, retracted entries, print and release logs, device data such as alarms and monitors, ambient scribe drafts if used, imaging in DICOM, messaging and staffing records, the policies in force, and paper originals. Name specific note IDs where you can.

Chapter 14 Everyone

### Sources and method

Rules and statutes were checked against primary sources in September 2026, and quoted text is verbatim. AHIMA's toolkit is paraphrased except for 1 short phrase. Everything in the case example in chapters 3, 6 and 8 is hypothetical. Product facts come from this site's product pages. Nothing here is legal or medical advice.

- [42 CFR 482.24](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), hospital Conditions of Participation, medical record services: (b)(1), (b)(3), (c)(1) and (c)(4)(viii).
- [45 CFR 164.526](https://www.law.cornell.edu/cfr/text/45/164.526), HIPAA right to amend.
- [Federal Rule of Civil Procedure 37(e)](https://www.law.cornell.edu/rules/frcp/rule_37) and the 2015 committee note.
- [Medicare Program Integrity Manual, chapter 3, section 3.3.2.5](https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/pim83c03.pdf) (Rev. 12633, 2024).
- [Medicare Program Integrity Manual, chapter 4, section 4.7.4](https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/pim83c04.pdf) (Rev. 13879, 2026).
- [AHIMA, Amendments in the Electronic Health Record Toolkit](https://www.ahima.org/media/r2dc4xhg/amendments-in-the-electronic-health-record_axs.pdf) (2012).
- [California Penal Code 471.5](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=471.5) and [Business and Professions Code 2262](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=2262).
- [18 USC 1035](https://www.law.cornell.edu/uscode/text/18/1035) (up to 5 years) and [18 USC 1519](https://www.law.cornell.edu/uscode/text/18/1519) (up to 20 years).
- [Moskovitz v. Mt. Sinai Medical Center](https://www.courtlistener.com/opinion/6877020/moskovitz-v-mt-sinai-medical-center/), 69 Ohio St.3d 638 (1994).
- [Wang, Khanna and Najafi, "Characterizing the Source of Text in Electronic Health Record Progress Notes"](https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/2629493), JAMA Internal Medicine 177(8), 2017.
- *Mata v. Avianca, Inc.*, 678 F. Supp. 3d 443 (S.D.N.Y. 2023): Rule 11 sanctions for filing fabricated AI-generated case citations.

Related guides: [EHR audit trails in medical malpractice](https://medrecords.ai/guides/ehr-audit-trail-medical-malpractice/), [reconciling a defense record production](https://medrecords.ai/guides/reconciling-defense-record-production/), [how to get medical records for a lawsuit](https://medrecords.ai/guides/how-to-get-medical-records-for-a-lawsuit/), and [medical malpractice record review](https://medrecords.ai/solutions/medical-malpractice/).

### More guides

- [**Assisted living vs nursing home: the difference in care, rules and records** — Assisted living vs nursing home: who regulates each, which records exist, staffing and arbitration rules, and…](https://medrecords.ai/guides/assisted-living-vs-nursing-home-records/)
- [**Bedsore lawsuit records: how pressure injury cases are proven and defended** — The records that decide a bedsore lawsuit: NPIAP staging, F686 avoidability, Braden scores, turning logs, wound…](https://medrecords.ai/guides/pressure-injury-bedsore-lawsuit-records/)
- [**Blunt force trauma: how the injuries are classified, documented and used in court** — Blunt force trauma explained: abrasions, contusions, lacerations and fractures, how ER and forensic records…](https://medrecords.ai/guides/blunt-force-trauma-medical-records/)
- [**Can AI read DICOM imaging, not just the report?** — How AI reads full MRI, CT, and X-ray studies as native DICOM: a browser PACS viewer, 3D reconstruction…](https://medrecords.ai/guides/can-ai-read-dicom-imaging/)
- [**Can AI read handwritten medical records?** — Context-aware AI reads cursive notes, intake forms, and margin annotations into cited, structured fields, and…](https://medrecords.ai/guides/can-ai-read-handwritten-medical-records/)
- [**Charting by exception: how to read WDL entries and blank flowsheet cells in a nursing negligence case** — Charting by exception in nursing negligence cases: what WDL and a blank flowsheet cell mean, Lama v. Borras…](https://medrecords.ai/guides/charting-by-exception/)