EHR audit trails in medical malpractice: the field guide

An EHR audit trail is a log. Each row is 1 event on 1 patient's chart: a user opened a flowsheet, created a note, changed it, signed it, printed or released it. The row carries who, their role, when, what they did, to which object, and from where. Systems call it an access log, audit log or activity report, and health information management or the privacy office usually runs it.

Epic, Oracle Health (formerly Cerner), Meditech and the smaller platforms all keep audit data, because certified EHR software has to. They do not share vocabulary. One installation logs "Note filed", another a 4-letter code that means nothing without the hospital's data dictionary.

The 3 clocks on every note

Most timing disputes come down to 3 timestamps that the printed chart collapses into 1:

1. Service time. The time the note says the care happened. The author picks it, and it prints on the note.
2. Create time. When the user began writing. The system sets it.
3. Sign time. When the author finalized the entry. Any later change should produce a new version, an addendum or a modify event.

Service time 19:40, create 19:58, sign 20:04 is ordinary charting. The same note created 2 days later tells a different story, and only the audit trail shows it.

Event types and what each one proves

The HIPAA Security Rule requires an audit trail in 1 sentence.

"Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information."

The same section's integrity standard, 164.312(c)(1), requires policies "to protect electronic protected health information from improper alteration or destruction." Neither says how long logs are kept or what fields they hold. The software certification rules fill that in.

What certified EHR software must do

The ONC certification criteria at 45 CFR 170.315(d)(2) require certified health IT to record actions on electronic health information, on by default, with disabling limited to a few users. 2 lines are worth reading aloud in a meet and confer: recorded actions "must not be capable of being changed, overwritten, or deleted by the technology," and the technology "must be able to detect whether the audit log has been altered."

Paragraph (d)(3) covers the report you want: certified software must "enable a user to create an audit report for a specific time period and to sort entries." A claim that producing one is technically impossible runs against the criteria the software was certified under.

The content standard at 45 CFR 170.210(e)(1) points to sections of ASTM E2147-18, an industry standard for audit logs, and ties the recorded date and time to a clock standard at 170.210(g). If the data elements become contested, your expert should work from the standard itself.

What the hospital must put in the record

The Medicare hospital Conditions of Participation at 42 CFR 482.24(c)(1) require that "all patient medical record entries must be legible, complete, dated, timed, and authenticated." A note's printed time is supposed to be true, and the audit trail is how anyone checks it. The same section sets a 5-year floor for keeping medical records.

Retention: the number people get wrong

The 6-year rule quoted in many requests comes from 45 CFR 164.316(b)(2)(i). It covers the Security Rule's written policies and procedures and the records of actions, activities and assessments the rule requires to be documented, kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later." It does not name a separate retention period for raw audit log data. Hospitals set log retention by policy, often move older data to slower archive storage, and state retention laws add their own periods.

Pre-suit, most teams send a HIPAA authorization. That gets the chart. It almost never gets the audit trail, and the reasons are in the definitions.

A patient's right of access under 45 CFR 164.524 runs to the designated record set. 45 CFR 164.501 defines that set as the medical and billing records a provider maintains and records "used, in whole or in part, by or for the covered entity to make decisions about individuals." Clinicians do not decide care from an access log, so most providers treat it as outside the set. The 30-day access deadline covers the chart, not the metadata about it.

The accounting of disclosures under 45 CFR 164.528 looks back 6 years but excludes treatment, payment and operations, and a nurse or risk manager opening the chart is a use, not a disclosure.

HHS tried to close that gap. In May 2011 it published a proposed rule, 76 FR 31426, that would have given patients a right to an access report showing who had accessed their electronic record. It was never finalized, and the federal regulatory agenda lists the proposal for withdrawal (RIN 0945-AA00). No federal rule lets a patient demand a list of who viewed their chart.

The 21st Century Cures Act information blocking rules do not change this for audit data. The regulation defines electronic health information at 45 CFR 171.102 by reference to the designated record set, and it excludes "information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding." The information blocking rules help you get the chart quickly and electronically. They do little for the log.

The pre-suit copy is a snapshot of the chart on a known date. If the defense production later shows different text for the same note, you have 2 versions and a window for the change: the specific basis courts look for when a defendant calls the request a fishing expedition. The companion guide on getting medical records for a lawsuit covers the pre-suit request in detail.

In federal court the starting point is FRCP 26(b)(1): any nonprivileged matter "relevant to any party's claim or defense and proportional to the needs of the case." Rule 34(a)(1)(A) reaches electronically stored information including "data or data compilations," which describes an audit log exactly. Rule 34(b)(1)(C) lets the requesting party "specify the form or forms" of production. Most malpractice cases are in state court, where the words differ (New York asks what is "material and necessary") but relevance and burden still drive the answer.

The decision most often cited here is a New York trial court ruling. The plaintiff alleged a patient was discharged from an emergency department without a physician evaluation, and the chart did not show whether an attending reviewed it. The hospital called the request a fishing expedition and argued no audit trail was due without an authenticity dispute. Justice Daniel J. Doyle granted the motion and ordered production within 30 days.

"The audit trail is a document that shows the sequence of events related to the use of and access to an individual patient's EHR."

The lesson travels: the plaintiff tied the request to a factual question the log could answer (did a doctor review the chart before discharge), and no authenticity dispute was needed. Frame the request around that question, not around suspicion.

Common objections and the usual responses

Courts decide these fights case by case. Some order the full encounter log, some limit it to named notes and a short window. None of this predicts your case.

Audit data is not permanent in practice. Hospitals archive and sometimes purge it on their own schedules, revision history may have a shorter life than the log, and device data from fetal monitors, pumps and anesthesia systems lives elsewhere. The longer you wait, the more comes from archive and the stronger the burden objection gets.

Federal Rule 37(e) sets the consequence when electronically stored information is lost after the duty to preserve arises.

"If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court: (1) upon finding prejudice to another party from loss of the information, may order measures no greater than necessary to cure the prejudice; or (2) only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation may" presume the information was unfavorable, instruct the jury accordingly, or dismiss or enter default.

The harsh remedies need a finding of intent, which is rare. The analysis starts with whether the party took reasonable steps once it anticipated litigation, and a specific preservation letter makes that easy to test. State spoliation doctrines differ.

Our view: send the preservation letter as soon as the case is signed, and name the audit data. A generic "preserve all records" line invites the answer that the hospital preserved the chart.

[DATE]

[HOSPITAL OR PRACTICE NAME]
Attn: Risk Management / Legal Department / Health Information Management
[ADDRESS]

Re: Preservation of electronic health record data
Patient: [NAME], DOB [DATE]
Encounters: [ADMISSION / VISIT DATES, ENCOUNTER NUMBERS IF KNOWN]

This office represents [CLIENT] regarding care provided at your facility
on [DATES]. We anticipate litigation. Please preserve, and suspend any
routine deletion, archiving or overwriting of, the following data for the
period [FIRST DATE OF CARE] through the date of final resolution:

1. The complete audit trail (access log, audit log, activity log) for the
   patient's electronic chart, including every view, create, pend, modify,
   sign, addend, print, export, release, delete and emergency access event.
2. For each event: user ID, user name, role or credential, date and time
   with time zone, action or event code, event description, object or
   document ID, version number, workstation or device ID, department or
   module, and patient and encounter ID.
3. The revision history (the saved text of every version, draft and
   addendum) of all notes, flowsheet entries, orders and results for the
   encounters above.
4. The data dictionary or legend defining every event code in the export.
5. Data from connected systems for the same period: fetal monitoring,
   pumps, anesthesia, secure messaging and paging, downtime records.
6. The user roster mapping user IDs to names and roles on those dates.
7. Your audit log retention and archiving policy in effect on those dates.

[AFTER FILING, ADD:] Under [FRCP 34 / STATE RULE], we request production
of items 1 to 7. Please produce items 1, 2 and 5 in native or delimited
text (CSV) format with all fields populated, not as a PDF summary.

Please confirm in writing within [14] days that a hold is in place and
identify the person responsible for it.

[SIGNATURE BLOCK]

A good audit trail request reads like a data specification an EHR analyst can run without a phone call. Vague requests come back as 3-column PDFs missing the columns you needed. The 10 fields are in the letter in chapter 5 and the anatomy in chapter 1.

What sits outside the main log

Ask for these by name, because a request for "the audit trail" will not reach them:

• Revision history. Only the saved versions show what changed.
• Device and interface logs. Fetal monitoring, pump and anesthesia systems keep their own records. The time a value appears in the EHR may be an interface time.
• Secure messaging and paging. The only way to test "MD notified at 19:45". A phone call leaves no EHR trace.
• Downtime records. Paper charting during an outage. The scan date is not the care date.
• Release and print logs. Which version went out in the pre-suit copy, and when.
• Ambient AI scribe drafts. Ask how drafts are logged, whether they are kept, and whose ID signs the final note.

• Patient, encounters and a date rangefrom first care through the date of production
• All 10 columns namedso none are dropped from the export
• Native or CSV formatspecified under Rule 34(b)(1)(C) or the state rule
• Time zone stated in the export headeror in a written stipulation
• Data dictionary for every event codewithout it the action column is guesswork
• Revision history for named notesthe text of every version
• User rosterIDs mapped to names and roles on the dates of care
• Device and monitoring datafetal monitor, pumps, anesthesia, as the case needs
• Messaging and paging logsfor any "notified" claim in a note
• Release and print logwhich version went out, and when
• Retention and archiving policyto test any "no longer available" answer
• Protective order offeredtakes the staff privacy objection off the table

0 of 12 checked

The export below is hypothetical: 1 nursing note and the events around it from the chapter 8 example, cut to 12 rows. A real encounter export runs to thousands of rows, mostly care-team views. The job is finding the few that count.

A reading procedure that holds up on cross

1. Confirm the time zone. Get it in writing, and check for a daylight saving change inside the window.
2. Pin the anchor events. The adverse event, delivery or transfer, the first records request, the preservation letter, the complaint.
3. Filter to named notes. Pull every event on each disputed note from creation onward.
4. Line up the 3 clocks. For each disputed note, write the service time, create time and sign time side by side and compute the gaps.
5. Look for clusters. 10 notes signed within 10 minutes at shift change is batch signing. 1 note reopened hours or weeks later is different.
6. Check who and where. Map IDs with the roster. Note roles outside the care team and off-unit workstations.
7. Tie every row to a page. Match note IDs to Bates numbers so every claim cites both the row and the page.
8. Write down the innocent explanation first. For each flag, state the benign reading before the bad one. Chapter 9 lists them.

Rows 3 and 7 are the heart of it. Version 1 of note 88213 was signed at 20:04, version 2 at 23:41, well after the cesarean order. The log proves the change and its time, not its content. That takes the revision history.

The 05/19 rows need a different question. A nurse adding to a note from a remote connection 7 days after the preservation letter may have an ordinary reason, such as a risk manager asking her to record her recollection as a labeled addendum. Either way it is a deposition topic, not a conclusion.

The team does 3 passes: the printed record into a clinical timeline, the 2 productions against each other, then the audit trail against both.

The 2 versions side by side

The defense copy of note 88213 differs from the 04/22 print. The revision history, produced after a meet and confer, confirms 2 signed versions.

What each record shows, and what to do next

Note what the team did not do: write "the nurse altered the record" in a brief. Nurses often catch up on notes after a cesarean because they were in the operating room, and a version 2 that adds a notification can be an honest recollection, charted late and labeled badly. What the team has is a dated discrepancy, a list of records that would confirm or refute it, and 3 witnesses to ask. The guides on altered medical records and birth injury records go further on each.

Most audit trail flags have a boring explanation: batch signing, charting after an emergency, a time zone offset, an interface delay, a routine risk management review. The side that finds it first controls the deposition. An expert who calls a batch signature "suspicious" and learns on cross that policy requires signing at shift change has lost credibility on everything else.

Failure modes and the test for each

Ambient scribes deserve a separate word. When an ambient AI tool drafts a note and the clinician signs it later, create time and author can mean something different from a typed note. Ask the custodian how the installation records it first.

The custodian who certifies a chart usually knows little about audit logs. An EHR analyst or privacy officer does. Rule 30(b)(6) makes the organization pick the right witness.

"In its notice or subpoena, a party may name as the deponent a public or private corporation, a partnership, an association, a governmental agency, or other entity and must describe with reasonable particularity the matters for examination. The named organization must designate one or more officers, directors, or managing agents, or designate other persons who consent to testify on its behalf."

The parties must confer in good faith about the matters, and the designee testifies to information "known or reasonably available to the organization." State versions differ.

Our view on sequence: depose the system before the people. Once the organization has testified to how the log, codes, addenda and clocks work, a nurse or attending cannot wave off a timestamp as a system quirk without contradicting their employer.

MATTERS FOR EXAMINATION

Patient: [NAME]. Encounters: [DATES / NUMBERS]. Period: [DATES].

1.  The electronic health record system(s) in use on [UNITS] during the
    period, including version and any connected clinical systems
    (fetal monitoring, pumps, anesthesia, messaging, dictation).
2.  How the system records audit events, which event types are logged,
    and which are not (including copy forward and printing).
3.  The meaning of each event code and field in the audit trail export
    produced as [BATES RANGE], and the data dictionary for them.
4.  The time source for audit timestamps, the time zone of the export,
    and any clock synchronization or daylight saving handling.
5.  How the export was generated: by whom, when, with what parameters,
    filters and date range, and whether any rows or fields were omitted.
6.  Audit data retention, archiving and purge policies in effect during
    the period and since, and any data no longer available.
7.  The litigation hold for this patient: when it was issued, what it
    covered, who received it, and when audit data was preserved.
8.  How notes are created, pended, signed, modified and addended, and
    how the system labels late entries and preserves prior versions.
11. User account practices during the period: shared logins, generic
    accounts, remote access, emergency access overrides, and the
    identity and role of each user ID in the export.
9.  Workstation and device naming, including remote and VPN sessions.
10. How documentation drafted by scribes or ambient AI tools, if any,
    is recorded, attributed and retained.
12. Downtime events during the period and how paper records were
    later entered or scanned.
13. The release of information log for this chart: every print,
    export and release, the version released, and the recipient.

Serve a document request in time for the deposition: export, data dictionary, retention policy, hold notice, release log. Without them the designee answers "I'd have to check" to half the topics.

Split the problem in 2: the clinical record, thousands of PDF pages of notes, orders and results; and the audit trail, a table of events. AI does very different work on each. For the second it is still mostly manual work or a forensic informatics expert's job.

What AI does well on the clinical record

AI medical record review tools use a large language model (LLM), usually with retrieval-augmented generation, to read the produced pages and draft a chronology. Done well, an AI medical chronology gives every entry a page-level citation, so a reviewer can check each line in seconds. That helps audit trail work in 3 ways:

• Date and time gaps. Entries in service-time order show where the record goes quiet.
• Printed late-entry labels. "Late entry", "addendum" and "entered on" text on the page can be pulled into the chronology and cited, so you know which notes to name.
• Version differences between productions. Near-duplicate pages from the pre-suit copy and the defense production can be compared and the differences shown side by side.

Where it fails

• Hallucination. A generative AI model can state a time or a fact that is not on any page. A citation on every line is the control: if you cannot click to the source, do not use the line.
• OCR and handwriting. OCR can misread 19:45 as 18:45 on a fax, and handwritten notes from downtime are harder still. A tool should flag low-confidence pages; check every time you rely on.
• Copy-forward text. A 03/16 note carrying text from 03/14 puts the wrong date on a fact, and an LLM will repeat it.
• The metadata is not on the page. Create time, sign time and workstation are not in the printed record, so no AI reading the PDF can recover them.

Can AI read the audit trail export itself?

General tools can help a person sort and filter a CSV or write spreadsheet formulas. 2 risks come with it. The export holds protected health information, so it belongs only in a HIPAA-compliant AI tool under a business associate agreement. And an LLM asked to "find suspicious rows" will return a confident list whether or not any are. Agentic AI tools that chain steps on their own show you less of each step. Human-in-the-loop review of every row you rely on is the minimum.

Courts have made the cost of skipping verification clear. In Mata v. Avianca, Inc. (S.D.N.Y. June 22, 2023), lawyers filed a brief citing cases that ChatGPT had fabricated, and the court imposed a $5,000 Rule 11 sanction. The same goes for facts: an unchecked date from AI output is your date, not the tool's.

A vendor checklist for legal AI tools on medical records

Medrecords AI is medical record review software that works on the PDFs you upload: the pre-suit copy, the defense production, supplements. It does not parse EHR audit trail exports, request records from providers, or decide whether a record was altered. It makes the clinical record fast to check, so your request names the right notes and your expert starts from a cited timeline.

In the chapter 8 hypothetical, that covers the first 2 passes: the timeline, and the comparison of the 04/22 print with the defense production that surfaces 2 versions of note 88213. Reading the export is yours or your expert's. OCR flags low-confidence pages, useful when key times sit on a fax.

Because the words overlap: the chain of custody log is Medrecords AI's own record of who uploaded, viewed and edited your files in the platform. It is not a hospital EHR audit trail and does not analyze one. The platform runs under SOC 2 controls and HIPAA with a BAA; details are on the security and HIPAA pages.

The output is a draft. You review, you revise, you sign.

Is the audit trail part of the medical record?

Usually not. Most providers treat audit data as system metadata outside the designated record set, so a HIPAA request does not return it. It has to be requested separately in discovery.

How do I request an audit trail from a hospital?

In discovery, name the patient, encounters, date range and the specific notes at issue. Ask for all fields in native or CSV format, with a data dictionary and the revision history of the named notes. Chapter 5 has a letter.

Can an audit trail show a note was changed?

It shows that a saved entry was modified, when and by whom, but often not the old and new text. Request the revision history alongside the log.

Does a late-entry label mean the record was falsified?

No. Documentation standards allow properly labeled late entries and addenda. The label shows the note was written after the event. Whether it matters depends on timing, content and whether the original entry was kept.

How long do hospitals keep audit logs?

It depends on hospital policy and state law. The HIPAA 6-year rule in 164.316 covers Security Rule documentation and 482.24 sets 5 years for records, but neither sets a period for raw audit log data. Ask for the policy and preserve early.

Can AI read an EHR audit trail?

General AI tools can help a person sort and filter an export, but they cannot reliably judge batch signing, time zones or innocent explanations, and can report patterns that are not there. AI is better used on the printed record to find the notes worth naming.

Does Medrecords AI analyze audit logs?

No. Medrecords AI works on the produced record: a cited chronology, date gaps, printed late-entry labels and near-duplicate pages that differ between productions. Reading the audit trail export is manual work or a forensic expert's.

Is it HIPAA compliant to upload medical records to AI?

It can be, when the tool is HIPAA-compliant AI offered under a business associate agreement with appropriate security controls. Uploading records or audit exports to a consumer chatbot without a BAA is a different matter. Check the contract, not the marketing page.

Can ChatGPT summarize medical records for a lawsuit?

It can summarize text, but without page citations you cannot verify each line, and without a BAA you may not be allowed to upload the records. Lawyers have been sanctioned for filing unchecked AI output, as in Mata v. Avianca.

Every rule quoted here was checked against its text in September 2026. The labor and delivery example, export, note versions, user IDs, workstations and Bates numbers are hypothetical. No figure comes from our own study. The procedures, opinions and templates are Medrecords AI's, for practitioners to adapt, and are not legal advice.

Related reading on this site: reconciling a defense record production, charting by exception, whether AI is accurate enough for court, HIPAA-compliant AI medical record review and medical malpractice record review.