# EHR audit trail in medical malpractice: request and read it

> How an EHR audit trail works in a medical malpractice case: the rules behind it, how to preserve and request it, how to read the export, and where AI helps.

Canonical page: https://medrecords.ai/guides/ehr-audit-trail-medical-malpractice/

---
New — **Missing Records Detection:** flags every visit, provider, and date missing from the file. [See how →](https://medrecords.ai/product/missing-records-identification/)
Field guide, September 2026. 14 chapters.

## EHR audit trails in medical malpractice: the field guide

For plaintiff and defense counsel, paralegals and legal nurse consultants who need the audit trail preserved, produced in a usable form and read without overclaiming. Includes a preservation letter, a 30(b)(6) topic list and a worked labor and delivery example.

By [Ahmed Jemaa](https://medrecords.ai/authors/ahmed-jemaa/), Co-Founder and CEO, Medrecords AI. Published 25 September 2026.

An EHR audit trail is the system log of every action on a patient's electronic chart: who viewed, created, edited, signed or printed each entry, when, and from which workstation. In a medical malpractice case it is often the only evidence of when a note was actually written, as opposed to the time the note claims. It usually has to be requested separately in discovery.

The printed chart tells you what a note says. The audit trail tells you when it was started, changed and signed, who opened the chart afterward, and from which machine. In a malpractice case those 2 stories do not always agree, and the second one is the one most teams forget to ask for.

This guide is built from the HIPAA Security and Privacy Rules, the ONC certification criteria, the information blocking definitions, the CMS hospital Conditions of Participation, the Federal Rules of Civil Procedure and 2 published decisions. Every hypothetical is labeled. Nothing here is legal or medical advice. State discovery rules and record retention laws vary, so check the rules where your case is pending.

9 numbers

### The audit trail in 9 numbers

6 years
HIPAA Security Rule documentation retention
45 CFR 164.316(b)(2)(i)
5 years
minimum hospital record retention, Medicare CoP
42 CFR 482.24(b)(1)
5 tests
legible, complete, dated, timed, authenticated: every hospital entry
42 CFR 482.24(c)(1)
30 days
to act on a patient access request, 1 extension allowed
45 CFR 164.524(b)(2)
6 years
accounting of disclosures lookback; internal views excluded
45 CFR 164.528(a)(1)
30 days
to respond in writing to a federal request for production
FRCP 34(b)(2)(A)
2 tiers
of remedies for lost ESI: cure prejudice, or sanctions on intent
FRCP 37(e)(1) and (e)(2)
2011
HHS proposes a patient access report; never finalized
76 FR 31426
2016
a New York court compels an audit trail over a fishing objection
Gilbert v. Highland Hospital, 52 Misc. 3d 555
Chapter 1 Everyone

### What an EHR audit trail records

An EHR audit trail is a log. Each row is 1 event on 1 patient's chart: a user opened a flowsheet, created a note, changed it, signed it, printed or released it. The row carries who, their role, when, what they did, to which object, and from where. Systems call it an access log, audit log or activity report, and health information management or the privacy office usually runs it.

Epic, Oracle Health (formerly Cerner), Meditech and the smaller platforms all keep audit data, because certified EHR software has to. They do not share vocabulary. One installation logs "Note filed", another a 4-letter code that means nothing without the hospital's data dictionary.

#### The 3 clocks on every note

Most timing disputes come down to 3 timestamps that the printed chart collapses into 1:

1. **Service time.** The time the note says the care happened. The author picks it, and it prints on the note.
2. **Create time.** When the user began writing. The system sets it.
3. **Sign time.** When the author finalized the entry. Any later change should produce a new version, an addendum or a modify event.

Service time 19:40, create 19:58, sign 20:04 is ordinary charting. The same note created 2 days later tells a different story, and only the audit trail shows it.

**Anatomy of an audit trail report** — hypothetical — Illustration. Field names vary by system and installation
Chart access audit report Encounter 4471-03
Report parameters
Date range — 03/14 00:00 to 06/30 23:591
Time zone — Server local, UTC-52
Row 7 of 1,218
User — RN-44713
Role — Registered nurse, L&D
Timestamp — 03/14 23:41:304
Action — SIGN (after MODIFY)5
Object — Nursing note 88213, version 26
Workstation — LD-NS-WS017
DEF 004411
1. 1
**Date range** Should run from admission through the date of production. Views and edits after the injury are often the rows that count.
2. 2
**Time zone** If the header does not state it, ask. A UTC export makes an ordinary 19:58 entry look like 00:58.
3. 3
**User ID** A login, not a person. You need a roster mapping IDs to names and roles on that date.
4. 4
**Timestamp** Set by the server clock. Compare it with the service time printed on the note.
5. 5
**Action code** Meaningless without the data dictionary. Get the legend in writing.
6. 6
**Object and version** The note ID ties the row to a page. A version number means earlier versions exist, and their text can be requested.
7. 7
**Workstation** A unit computer, a nurses' station or a remote login. A VPN device on a clinical edit deserves a question.

Every column answers a different question. A flattened PDF summary that drops columns answers fewer.

#### Event types and what each one proves

| Event | What it tells you | What it does not tell you |
| --- | --- | --- |
| View or access | Who opened the chart or a specific note, and when | What they read, or why |
| Create | When a note or flowsheet entry was first started | Whether the author was at the bedside |
| Modify or revise | That a saved entry changed, by whom, when | The old and new text |
| Sign or attest | When the author finalized the entry | Why signing was late |
| Addend or late entry | That content was added to an existing entry | Whether the addendum was proper or self-serving |
| Print, export or release | When the chart was printed or released, and often to whom | Which version of each note was in that printout |
| Emergency access override | That a user outside the care team broke in, with a stated reason | Whether the stated reason was true |

If you remember one thing
Every disputed note has 3 clocks: service time, create time and sign time. The printed chart shows 1 of them. The audit trail shows all 3.

Chapter 2 Everyone

### The federal rules that make the log exist

The HIPAA Security Rule requires an audit trail in 1 sentence.

"Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information."

The same section's integrity standard, 164.312(c)(1), requires policies "to protect electronic protected health information from improper alteration or destruction." Neither says how long logs are kept or what fields they hold. The software certification rules fill that in.

#### What certified EHR software must do

The ONC certification criteria at [45 CFR 170.315(d)(2)](https://www.law.cornell.edu/cfr/text/45/170.315) require certified health IT to record actions on electronic health information, on by default, with disabling limited to a few users. 2 lines are worth reading aloud in a meet and confer: recorded actions "must not be capable of being changed, overwritten, or deleted by the technology," and the technology "must be able to detect whether the audit log has been altered."

Paragraph (d)(3) covers the report you want: certified software must "enable a user to create an audit report for a specific time period and to sort entries." A claim that producing one is technically impossible runs against the criteria the software was certified under.

The content standard at [45 CFR 170.210(e)(1)](https://www.law.cornell.edu/cfr/text/45/170.210) points to sections of ASTM E2147-18, an industry standard for audit logs, and ties the recorded date and time to a clock standard at 170.210(g). If the data elements become contested, your expert should work from the standard itself.

#### What the hospital must put in the record

The Medicare hospital Conditions of Participation at [42 CFR 482.24(c)(1)](https://www.law.cornell.edu/cfr/text/42/482.24) require that "all patient medical record entries must be legible, complete, dated, timed, and authenticated." A note's printed time is supposed to be true, and the audit trail is how anyone checks it. The same section sets a 5-year floor for keeping medical records.

#### Retention: the number people get wrong

The 6-year rule quoted in many requests comes from [45 CFR 164.316(b)(2)(i)](https://www.law.cornell.edu/cfr/text/45/164.316). It covers the Security Rule's written policies and procedures and the records of actions, activities and assessments the rule requires to be documented, kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later." It does not name a separate retention period for raw audit log data. Hospitals set log retention by policy, often move older data to slower archive storage, and state retention laws add their own periods.

MythHIPAA requires hospitals to keep audit logs for 6 years, so the log for a 2021 admission must exist.
Rule164.316 sets 6 years for Security Rule documentation. Log retention is a hospital policy. Ask for the policy in discovery rather than assuming it.
MythThe audit trail is part of the medical record, so a HIPAA authorization gets it.
RuleAccess runs to the designated record set. Most providers treat audit data as system metadata outside it. Chapter 3 explains why.
If you remember one thing
164.312(b) makes the log exist, 170.315(d)(3) makes a sortable date-range report something the software can produce, and 482.24(c)(1) makes the printed time on a note something that has to be true. Cite all 3 in the request.

Chapter 3 Deciding

### Why a HIPAA request will not get you the audit trail

Pre-suit, most teams send a HIPAA authorization. That gets the chart. It almost never gets the audit trail, and the reasons are in the definitions.

A patient's right of access under [45 CFR 164.524](https://www.law.cornell.edu/cfr/text/45/164.524) runs to the designated record set. [45 CFR 164.501](https://www.law.cornell.edu/cfr/text/45/164.501) defines that set as the medical and billing records a provider maintains and records "used, in whole or in part, by or for the covered entity to make decisions about individuals." Clinicians do not decide care from an access log, so most providers treat it as outside the set. The 30-day access deadline covers the chart, not the metadata about it.

The accounting of disclosures under [45 CFR 164.528](https://www.law.cornell.edu/cfr/text/45/164.528) looks back 6 years but excludes treatment, payment and operations, and a nurse or risk manager opening the chart is a use, not a disclosure.

HHS tried to close that gap. In May 2011 it published a proposed rule, [76 FR 31426](https://www.federalregister.gov/documents/2011/05/31/2011-13297/hipaa-privacy-rule-accounting-of-disclosures-under-the-health-information-technology-for-economic), that would have given patients a right to an access report showing who had accessed their electronic record. It was never finalized, and the federal regulatory agenda lists the proposal for withdrawal ([RIN 0945-AA00](https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201804&RIN=0945-AA00) ). No federal rule lets a patient demand a list of who viewed their chart.

The 21st Century Cures Act information blocking rules do not change this for audit data. The regulation defines electronic health information at [45 CFR 171.102](https://www.law.cornell.edu/cfr/text/45/171.102) by reference to the designated record set, and it excludes "information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding." The [information blocking rules](https://www.healthit.gov/topic/information-blocking) help you get the chart quickly and electronically. They do little for the log.

HIPAA access request
Who can send it — The patient or their personal representative, or counsel with an authorization
What comes back — The designated record set: notes, orders, results, billing
Deadline — 30 days, 1 extension of up to 30
Audit trail — Usually not included
Best use — The pre-suit baseline copy of the chart, with its print date
Discovery request
Who can send it — A party, once the case is filed and discovery is open
What comes back — Anything relevant and proportional, including metadata and logs
Deadline — 30 days to respond under FRCP 34, or the state equivalent
Audit trail — Requestable by name, in a specified form
Best use — The audit trail, revision history and data dictionary
The pre-suit copy is a snapshot of the chart on a known date. If the defense production later shows different text for the same note, you have 2 versions and a window for the change: the specific basis courts look for when a defendant calls the request a fishing expedition. The companion guide on [getting medical records for a lawsuit](https://medrecords.ai/guides/how-to-get-medical-records-for-a-lawsuit/) covers the pre-suit request in detail.

If you remember one thing
Get the chart early under HIPAA and keep the copy untouched with its print date. Get the audit trail in discovery. Neither route substitutes for the other.

Chapter 4 Deciding

### Is the audit trail discoverable? A decision path

In federal court the starting point is [FRCP 26(b)(1)](https://www.law.cornell.edu/rules/frcp/rule_26): any nonprivileged matter "relevant to any party's claim or defense and proportional to the needs of the case." [Rule 34(a)(1)(A)](https://www.law.cornell.edu/rules/frcp/rule_34) reaches electronically stored information including "data or data compilations," which describes an audit log exactly. Rule 34(b)(1)(C) lets the requesting party "specify the form or forms" of production. Most malpractice cases are in state court, where the words differ (New York asks what is "material and necessary") but relevance and burden still drive the answer.

The decision most often cited here is a New York trial court ruling. The plaintiff alleged a patient was discharged from an emergency department without a physician evaluation, and the chart did not show whether an attending reviewed it. The hospital called the request a fishing expedition and argued no audit trail was due without an authenticity dispute. Justice Daniel J. Doyle granted the motion and ordered production within 30 days.

"The audit trail is a document that shows the sequence of events related to the use of and access to an individual patient's EHR."

The lesson travels: the plaintiff tied the request to a factual question the log could answer (did a doctor review the chart before discharge), and no authenticity dispute was needed. Frame the request around that question, not around suspicion.

**What to request, and from whom** — decision path — FRCP 26, 34, 45; state rules vary
1
**Is the hospital or practice that kept the chart a party?**
YesRequest for production under Rule 34 or the state equivalent, served on the party.
NoSubpoena under [Rule 45](https://www.law.cornell.edu/rules/frcp/rule_45) or the state equivalent. Expect a burden fight.
2
**Do you have a specific timing question?**
YesName the notes, users and hours. Ask for every event on them through production, plus the revision history.
NoStill ask for encounter-level access and edit events, tied to the care and the production dates.
3
**Did the producing party send a PDF summary?**
YesMeet and confer for the native export and legend, citing the form you specified under 34(b)(1)(C).
No responseMeet and confer, then move to compel under the local procedure.
4
**Is the objection "not reasonably accessible"?**
Recent dataPoint to 170.315(d)(3): a date-range report is a standard function. The burden argument is weak.
Archived dataUnder 26(b)(2)(B) the producing party must show the burden. The court can still order it for good cause, with conditions.
Ask for the log in the first set of requests, tied to a question it can answer. Every later step is easier with that on the record.

#### Common objections and the usual responses

| Objection | Typical argument | Responses often made |
| --- | --- | --- |
| Burden | Pulling and reviewing audit data is costly and disproportionate | Narrow to named notes, users and dates. Certified software produces date-range reports as a standard function |
| Proprietary or staff privacy | Codes are vendor confidential; the log exposes employee activity | Offer a protective order. Limit to this patient's chart and the code legend |
| Not the legal health record | Metadata falls outside the record the hospital certifies | Discovery scope is set by relevance and proportionality, not by the hospital's release policy |
| Fishing expedition | No specific basis to suspect alteration | Point to concrete facts: 2 versions of 1 note, a late-entry label, a gap between the printed time and a known event |
| Authenticity not disputed | The records are accurate, so metadata adds nothing | Timing and access can be relevant without any authenticity dispute. Gilbert rejected this argument |

Courts decide these fights case by case. Some order the full encounter log, some limit it to named notes and a short window. None of this predicts your case.

If you remember one thing
The strongest audit trail request names a question the log can answer. "Did the attending open the fetal tracing before 20:30?" gets granted more often than "all metadata for all records".

Chapter 5 Building

### Preservation: the letter you send before you need the log

Audit data is not permanent in practice. Hospitals archive and sometimes purge it on their own schedules, revision history may have a shorter life than the log, and device data from fetal monitors, pumps and anesthesia systems lives elsewhere. The longer you wait, the more comes from archive and the stronger the burden objection gets.

Federal Rule 37(e) sets the consequence when electronically stored information is lost after the duty to preserve arises.

"If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court: (1) upon finding prejudice to another party from loss of the information, may order measures no greater than necessary to cure the prejudice; or (2) only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation may" presume the information was unfavorable, instruct the jury accordingly, or dismiss or enter default.

The harsh remedies need a finding of intent, which is rare. The analysis starts with whether the party took reasonable steps once it anticipated litigation, and a specific preservation letter makes that easy to test. State spoliation doctrines differ.

Our view: send the preservation letter as soon as the case is signed, and name the audit data. A generic "preserve all records" line invites the answer that the hospital preserved the chart.

Step 1 — **Preservation letter** — Names the audit data, versions, device data and date range
Step 2 — **Written confirmation** — The hold confirmed in writing, with a named custodian
Step 3 — **First requests** — Audit trail, versions and legend in the first set, native or CSV
Step 4 — **Meet and confer** — Fields, format and range agreed before anyone argues burden

##### 1. Audit trail preservation and request letter

Send with or soon after the first records request, and adapt the discovery paragraph once the case is filed. Review against your jurisdiction's rules before sending.

[DATE]

[HOSPITAL OR PRACTICE NAME]
Attn: Risk Management / Legal Department / Health Information Management
[ADDRESS]

Re: Preservation of electronic health record data
Patient: [NAME], DOB [DATE]
Encounters: [ADMISSION / VISIT DATES, ENCOUNTER NUMBERS IF KNOWN]

This office represents [CLIENT] regarding care provided at your facility
on [DATES]. We anticipate litigation. Please preserve, and suspend any
routine deletion, archiving or overwriting of, the following data for the
period [FIRST DATE OF CARE] through the date of final resolution:

1. The complete audit trail (access log, audit log, activity log) for the
 patient's electronic chart, including every view, create, pend, modify,
 sign, addend, print, export, release, delete and emergency access event.
2. For each event: user ID, user name, role or credential, date and time
 with time zone, action or event code, event description, object or
 document ID, version number, workstation or device ID, department or
 module, and patient and encounter ID.
3. The revision history (the saved text of every version, draft and
 addendum) of all notes, flowsheet entries, orders and results for the
 encounters above.
4. The data dictionary or legend defining every event code in the export.
5. Data from connected systems for the same period: fetal monitoring,
 pumps, anesthesia, secure messaging and paging, downtime records.
6. The user roster mapping user IDs to names and roles on those dates.
7. Your audit log retention and archiving policy in effect on those dates.

[AFTER FILING, ADD:] Under [FRCP 34 / STATE RULE], we request production
of items 1 to 7. Please produce items 1, 2 and 5 in native or delimited
text (CSV) format with all fields populated, not as a PDF summary.

Please confirm in writing within [14] days that a hold is in place and
identify the person responsible for it.

[SIGNATURE BLOCK]
If you remember one thing
Name the audit data in the preservation letter. A hold on "the medical record" can be honored without anyone touching the logs.

Chapter 6 Building

### What to ask for, field by field

A good audit trail request reads like a data specification an EHR analyst can run without a phone call. Vague requests come back as 3-column PDFs missing the columns you needed. The 10 fields are in the letter in chapter 5 and the anatomy in chapter 1.

#### What sits outside the main log

Ask for these by name, because a request for "the audit trail" will not reach them:

- **Revision history.** Only the saved versions show what changed.
- **Device and interface logs.** Fetal monitoring, pump and anesthesia systems keep their own records. The time a value appears in the EHR may be an interface time.
- **Secure messaging and paging.** The only way to test "MD notified at 19:45". A phone call leaves no EHR trace.
- **Downtime records.** Paper charting during an outage. The scan date is not the care date.
- **Release and print logs.** Which version went out in the pre-suit copy, and when.
- **Ambient AI scribe drafts.** Ask how drafts are logged, whether they are kept, and whose ID signs the final note.

- **Patient, encounters and a date range** *from first care through the date of production*
- **All 10 columns named** *so none are dropped from the export*
- **Native or CSV format** *specified under Rule 34(b)(1)(C) or the state rule*
- **Time zone stated in the export header** *or in a written stipulation*
- **Data dictionary for every event code** *without it the action column is guesswork*
- **Revision history for named notes** *the text of every version*
- **User roster** *IDs mapped to names and roles on the dates of care*
- **Device and monitoring data** *fetal monitor, pumps, anesthesia, as the case needs*
- **Messaging and paging logs** *for any "notified" claim in a note*
- **Release and print log** *which version went out, and when*
- **Retention and archiving policy** *to test any "no longer available" answer*
- **Protective order offered** *takes the staff privacy objection off the table*

**0** of 12 checked

If you remember one thing
Ask for the export, the legend and the versions together. An export without the legend cannot be read, and a modify event without the versions cannot be explained.

Chapter 7 Building

### Reading an audit trail export

The export below is hypothetical: 1 nursing note and the events around it from the chapter 8 example, cut to 12 rows. A real encounter export runs to thousands of rows, mostly care-team views. The job is finding the few that count.

**Filtered audit trail for 1 labor and delivery encounter** — hypothetical — Illustration. Not a real patient, hospital or export
Audit trail export, hypothetical, filtered to note 88213 and related events — 12 rows
| Timestamp | User | Role | Action | Object | Workstation |
| --- | --- | --- | --- | --- | --- |
| 03/14 19:41:07 | RN-4471 | RN | View | FHR flowsheet | LD-RM06-WS |
| 03/14 19:58:22 | RN-4471 | RN | Create | Nursing note 88213 (service time 19:40) | LD-RM06-WS |
| 03/14 20:04:51 | RN-4471 | RN | Sign | Nursing note 88213 v1 | LD-RM06-WS |
| 03/14 20:31:15 | MD-2290 | Attending | View | FHR flowsheet | LD-NS-WS02 |
| 03/14 20:55:40 | MD-2290 | Attending | Order | Cesarean delivery, emergent | LD-NS-WS02 |
| 03/14 23:40:09 | RN-4471 | RN | Modify | Nursing note 88213 v2 | LD-NS-WS01 |
| 03/14 23:41:30 | RN-4471 | RN | Sign | Nursing note 88213 v2 | LD-NS-WS01 |
| 03/15 02:10:44 | MD-2290 | Attending | Create | Progress note 88290 (service time 20:15) | LD-NS-WS02 |
| 03/15 08:05:12 | MD-2290 | Attending | Sign | Progress note 88290 | LD-NS-WS02 |
| 04/22 09:12:03 | HIM-0112 | HIM | Print, release | Encounter 4471-03, full (patient request) | HIM-WS14 |
| 05/19 16:47:55 | RN-4471 | RN | View | Nursing note 88213 | VPN-REMOTE-221 |
| 05/19 16:52:10 | RN-4471 | RN | Addend, late entry | Nursing note 88213 | VPN-REMOTE-221 |

Export header states server local time, UTC-5. Preservation letter received by the hospital 05/12. Key rows mark anchor events; flagged rows are signals to explain, not findings.
3 kinds of flag: a modify hours after signing, a view after the preservation letter, and a late entry from a remote connection.

#### A reading procedure that holds up on cross

1. **Confirm the time zone.** Get it in writing, and check for a daylight saving change inside the window.
2. **Pin the anchor events.** The adverse event, delivery or transfer, the first records request, the preservation letter, the complaint.
3. **Filter to named notes.** Pull every event on each disputed note from creation onward.
4. **Line up the 3 clocks.** For each disputed note, write the service time, create time and sign time side by side and compute the gaps.
5. **Look for clusters.** 10 notes signed within 10 minutes at shift change is batch signing. 1 note reopened hours or weeks later is different.
6. **Check who and where.** Map IDs with the roster. Note roles outside the care team and off-unit workstations.
7. **Tie every row to a page.** Match note IDs to Bates numbers so every claim cites both the row and the page.
8. **Write down the innocent explanation first.** For each flag, state the benign reading before the bad one. Chapter 9 lists them.

Rows 3 and 7 are the heart of it. Version 1 of note 88213 was signed at 20:04, version 2 at 23:41, well after the cesarean order. The log proves the change and its time, not its content. That takes the revision history.

The 05/19 rows need a different question. A nurse adding to a note from a remote connection 7 days after the preservation letter may have an ordinary reason, such as a risk manager asking her to record her recollection as a labeled addendum. Either way it is a deposition topic, not a conclusion.

Chapter 8 Building

### Worked example: a labor and delivery chart against its audit events

**Hypothetical.** A patient at 39 weeks is admitted on 03/14 for induction. The fetal tracing shows recurrent late decelerations in the evening. An emergent cesarean is ordered at 20:55; the infant is delivered at 21:19 and later treated for hypoxic-ischemic encephalopathy. The family's HIPAA request returns the chart printed 04/22 (PL 000001 to PL 001240). After suit come the defense production (DEF 000001 to DEF 004980) and the export in chapter 7. No real case, patient or hospital.

The team does 3 passes: the printed record into a clinical timeline, the 2 productions against each other, then the audit trail against both.

**The evening of 03/14: record entries against audit events** — hypothetical — Illustration built from the hypothetical export in chapter 7
1. 19:40
**Nursing note, service time**
Recurrent late decelerations, minimal variability. Oxytocin decreased, position change, oxygen applied.

Nursing note 88213, PL 000612
2. 19:45
**"Attending notified", per version 2 only**
No audit event for the attending until 20:31. The page and message logs have not been produced. A phone call would leave no EHR trace.

Note 88213 v2, DEF 002210; no matching audit row
3. 20:04
**Version 1 signed**
Created 19:58, 18 minutes after the service time: ordinary. This is the version in the 04/22 print, if the release log confirms it.

Audit row 3; PL 000612
4. 20:15
**Attending at bedside, per progress note**
The note stating this was created at 02:10 the next morning and signed at 08:05. The first attending audit event on the tracing is 20:31.

Progress note 88290, DEF 002231; audit rows 4, 8, 9
5. 20:31
**Attending views the tracing**
From the nurses' station, not the patient's room.

Audit row 4
6. 20:55
**Emergent cesarean ordered**
Decision time in the operative note is 20:52. A 3-minute gap between decision and order entry is unremarkable.

Audit row 5; operative note DEF 002240
7. 21:19
**Delivery**
24 minutes from order to delivery.

Delivery record DEF 002251
8. 23:40
**Note 88213 modified, version 2 signed**
Adds the 19:45 notification and a 19:50 bedside review. Written after the delivery, not labeled as a late entry.

Audit rows 6 and 7; DEF 002210

2 claims (notification at 19:45, bedside at 20:15) have no supporting audit event yet. That is a request list, not a finding.

#### The 2 versions side by side

The defense copy of note 88213 differs from the 04/22 print. The revision history, produced after a meet and confer, confirms 2 signed versions.

**Nursing note 88213, version 1 and version 2** — hypothetical — Illustration
**Version 1** — signed 03/14 20:04
Service time 19:40. Author RN-4471. FHR baseline 150s, minimal variability. Recurrent late decelerations x3 in 30 min. Oxytocin decreased to 6 mU/min. Left lateral. O2 via mask. Will continue to monitor.
**Version 2** — signed 03/14 23:41
Service time 19:40. Author RN-4471. No late-entry label. FHR baseline 150s, minimal variability. Recurrent late decelerations x3 in 30 min. Oxytocin decreased to 6 mU/min. Left lateral. O2 via mask. Attending notified at 19:45. Tracing reviewed with attending at bedside 19:50. Plan: continue labor, reassess.
Version 2 adds 2 facts about physician involvement, keeps the old service time and has no late-entry label. The audit rows date it after the delivery.

#### What each record shows, and what to do next

| Source | What it shows | Next step |
| --- | --- | --- |
| 04/22 print, PL 000612 | Version 1 of note 88213, no notification | Confirm with the release log that version 1 was current on 04/22 |
| Defense production, DEF 002210 | Version 2, with notification and bedside review | Ask why the production carries version 2 without a late-entry label |
| Audit rows 6 and 7 | Modify and sign at 23:40, after the delivery | Depose the nurse on what prompted the change |
| Audit row 4 | First attending view of the tracing at 20:31 | Request paging and secure message logs for 19:30 to 20:30 |
| Audit rows 11 and 12 | Remote view and addendum after the preservation letter | Produce the addendum text; 30(b)(6) topic on how addenda are routed |

Note what the team did not do: write "the nurse altered the record" in a brief. Nurses often catch up on notes after a cesarean because they were in the operating room, and a version 2 that adds a notification can be an honest recollection, charted late and labeled badly. What the team has is a dated discrepancy, a list of records that would confirm or refute it, and 3 witnesses to ask. The guides on [altered medical records](https://medrecords.ai/guides/altered-medical-records/) and [birth injury records](https://medrecords.ai/guides/hie-birth-injury-medical-records/) go further on each.

If you remember one thing
Build the timeline from the pages, compare the productions, then bring in the audit trail. Each pass narrows what you ask for next.

Chapter 9 Everyone

### Innocent explanations and how to test them

Most audit trail flags have a boring explanation: batch signing, charting after an emergency, a time zone offset, an interface delay, a routine risk management review. The side that finds it first controls the deposition. An expert who calls a batch signature "suspicious" and learns on cross that policy requires signing at shift change has lost credibility on everything else.

#### Failure modes and the test for each

| Failure mode | How it shows up | How to test it |
| --- | --- | --- |
| UTC export | Every event looks 4 or 5 hours late | Check a known event, such as the delivery time, against its row |
| Daylight saving | An hour appears twice or disappears | Check whether the window spans the change date |
| Batch signing | Many notes signed within minutes | Count the notes in the cluster and compare with policy |
| Dictation | Create, transcribe and sign are 3 events hours apart | Ask for the dictation system's own timestamps |
| Shared login | 1 user ID on 2 units at once | Roster, badge or schedule data; ask the custodian about login practice |
| Device interface | Vitals file in batches, not in real time | Device archive timestamps against EHR filing times |
| Copy forward | Text repeats across days, dates inside the text are stale | Compare the text across notes; many systems do not log copy events |
| Ambient AI scribe | Note drafted by an integration or service account, signed by the clinician later | Ask how the draft is logged and whether the draft text is retained |
| Downtime | No EHR events for a period, then a burst of scanned documents | Ask for the downtime log and the paper originals |

Ambient scribes deserve a separate word. When an ambient AI tool drafts a note and the clinician signs it later, create time and author can mean something different from a typed note. Ask the custodian how the installation records it first.

If you remember one thing
Write the innocent explanation next to every flag before you show the flag to anyone. If you cannot rule it out, say so.

Chapter 10 Building

### Deposing the EHR custodian under Rule 30(b)(6)

The custodian who certifies a chart usually knows little about audit logs. An EHR analyst or privacy officer does. Rule 30(b)(6) makes the organization pick the right witness.

"In its notice or subpoena, a party may name as the deponent a public or private corporation, a partnership, an association, a governmental agency, or other entity and must describe with reasonable particularity the matters for examination. The named organization must designate one or more officers, directors, or managing agents, or designate other persons who consent to testify on its behalf."

The parties must confer in good faith about the matters, and the designee testifies to information "known or reasonably available to the organization." State versions differ.

Our view on sequence: depose the system before the people. Once the organization has testified to how the log, codes, addenda and clocks work, a nurse or attending cannot wave off a timestamp as a system quirk without contradicting their employer.

##### 2. Rule 30(b)(6) topics for the EHR custodian

Adapt to the system, the encounter and your state's rule. Describe each topic with enough particularity that the organization can prepare a witness.

MATTERS FOR EXAMINATION

Patient: [NAME]. Encounters: [DATES / NUMBERS]. Period: [DATES].

1. The electronic health record system(s) in use on [UNITS] during the
 period, including version and any connected clinical systems
 (fetal monitoring, pumps, anesthesia, messaging, dictation).
2. How the system records audit events, which event types are logged,
 and which are not (including copy forward and printing).
3. The meaning of each event code and field in the audit trail export
 produced as [BATES RANGE], and the data dictionary for them.
4. The time source for audit timestamps, the time zone of the export,
 and any clock synchronization or daylight saving handling.
5. How the export was generated: by whom, when, with what parameters,
 filters and date range, and whether any rows or fields were omitted.
6. Audit data retention, archiving and purge policies in effect during
 the period and since, and any data no longer available.
7. The litigation hold for this patient: when it was issued, what it
 covered, who received it, and when audit data was preserved.
8. How notes are created, pended, signed, modified and addended, and
 how the system labels late entries and preserves prior versions.
11. User account practices during the period: shared logins, generic
 accounts, remote access, emergency access overrides, and the
 identity and role of each user ID in the export.
9. Workstation and device naming, including remote and VPN sessions.
10. How documentation drafted by scribes or ambient AI tools, if any,
 is recorded, attributed and retained.
12. Downtime events during the period and how paper records were
 later entered or scanned.
13. The release of information log for this chart: every print,
 export and release, the version released, and the recipient.
Serve a document request in time for the deposition: export, data dictionary, retention policy, hold notice, release log. Without them the designee answers "I'd have to check" to half the topics.

Chapter 11 Everyone

### Using AI on an EHR audit trail: where it helps and where it fails

Split the problem in 2: the clinical record, thousands of PDF pages of notes, orders and results; and the audit trail, a table of events. AI does very different work on each. For the second it is still mostly manual work or a forensic informatics expert's job.

#### What AI does well on the clinical record

AI medical record review tools use a large language model (LLM), usually with retrieval-augmented generation, to read the produced pages and draft a chronology. Done well, an AI medical chronology gives every entry a page-level citation, so a reviewer can check each line in seconds. That helps audit trail work in 3 ways:

- **Date and time gaps.** Entries in service-time order show where the record goes quiet.
- **Printed late-entry labels.** "Late entry", "addendum" and "entered on" text on the page can be pulled into the chronology and cited, so you know which notes to name.
- **Version differences between productions.** Near-duplicate pages from the pre-suit copy and the defense production can be compared and the differences shown side by side.

#### Where it fails

- **Hallucination.** A generative AI model can state a time or a fact that is not on any page. A citation on every line is the control: if you cannot click to the source, do not use the line.
- **OCR and handwriting.** OCR can misread 19:45 as 18:45 on a fax, and handwritten notes from downtime are harder still. A tool should flag low-confidence pages; check every time you rely on.
- **Copy-forward text.** A 03/16 note carrying text from 03/14 puts the wrong date on a fact, and an LLM will repeat it.
- **The metadata is not on the page.** Create time, sign time and workstation are not in the printed record, so no AI reading the PDF can recover them.

#### Can AI read the audit trail export itself?

General tools can help a person sort and filter a CSV or write spreadsheet formulas. 2 risks come with it. The export holds protected health information, so it belongs only in a HIPAA-compliant AI tool under a business associate agreement. And an LLM asked to "find suspicious rows" will return a confident list whether or not any are. Agentic AI tools that chain steps on their own show you less of each step. Human-in-the-loop review of every row you rely on is the minimum.

Courts have made the cost of skipping verification clear. In [Mata v. Avianca, Inc.](https://caselaw.findlaw.com/court/us-dis-crt-sd-new-yor/2335142.html) (S.D.N.Y. June 22, 2023), lawyers filed a brief citing cases that ChatGPT had fabricated, and the court imposed a $5,000 Rule 11 sanction. The same goes for facts: an unchecked date from AI output is your date, not the tool's.

Manual
Clinical timeline — Paralegal or nurse reads every page, types a chronology
Finding notes to name — Whatever the reader happened to notice
Comparing productions — Page by page, by eye
Audit trail export — Spreadsheet work and an informatics expert
With AI
Clinical timeline — Drafted chronology, every line cited to its page, checked by a person
Finding notes to name — Late-entry labels, gaps and missing records flagged with citations
Comparing productions — Near-duplicate pages that differ, shown side by side
Audit trail export — Still spreadsheet work and an informatics expert

#### A vendor checklist for legal AI tools on medical records

| Ask | Why |
| --- | --- |
| Will you sign a BAA? | Uploading records to a vendor without a business associate agreement is a HIPAA problem |
| SOC 2 report available? | Independent evidence of security controls |
| Is our data used to train models? | The answer should be no, in the contract |
| Is every output line cited to a source page? | The only practical defense against hallucination in a litigation file |
| Are low-confidence OCR pages flagged? | Faxes and handwriting are where dates get misread |
| Is there an audit trail of AI use on our files? | The same who-did-what question you are asking the hospital |
| Does the tool claim to read EHR audit logs? | Ask to see it on a real export with the data dictionary. A person still judges the result |

If you remember one thing
AI reads the pages: it can date the chart as printed and show you which notes to name. The audit trail is data about the chart that is not on any page, and reading it well is still a person's job.

Chapter 12 Publisher

### Where Medrecords AI fits

Medrecords AI is medical record review software that works on the PDFs you upload: the pre-suit copy, the defense production, supplements. It does not parse EHR audit trail exports, request records from providers, or decide whether a record was altered. It makes the clinical record fast to check, so your request names the right notes and your expert starts from a cited timeline.

1 —

##### Cited chronology

A [medical chronology](https://medrecords.ai/product/chronology/) in service-time order, every entry with a [citation to its source page](https://medrecords.ai/product/citations/).

2 —

##### Version differences

[Record alteration detection](https://medrecords.ai/product/record-alteration-detection/) shows near-duplicate pages that differ, such as a late amendment or an added line, side by side from the produced PDFs. A signal, not a verdict.

3 —

##### Missing records

[Missing records identification](https://medrecords.ai/product/missing-records-identification/) flags visits, providers and date ranges the file implies but does not contain, each flag cited to the page that implies it.

4 —

##### New productions compared

[Supplemental record review](https://medrecords.ai/product/supplemental-record-review/) shows what a new production agrees with, conflicts with or adds.

In the chapter 8 hypothetical, that covers the first 2 passes: the timeline, and the comparison of the 04/22 print with the defense production that surfaces 2 versions of note 88213. Reading the export is yours or your expert's. [OCR](https://medrecords.ai/product/ocr/) flags low-confidence pages, useful when key times sit on a fax.

Because the words overlap: the [chain of custody log](https://medrecords.ai/product/audit-trail-chain-of-custody/) is Medrecords AI's own record of who uploaded, viewed and edited your files in the platform. It is not a hospital EHR audit trail and does not analyze one. The platform runs under SOC 2 controls and HIPAA with a BAA; details are on the [security](https://medrecords.ai/security/) and [HIPAA](https://medrecords.ai/hipaa/) pages.

The output is a draft. You review, you revise, you sign.

The offer

#### Know which notes to name before you send the audit trail request.

Book a demo, then run your first case free on us. Every line comes back cited to its source page. You review, you revise, you sign.

[Book a demo](https://medrecords.ai/demo/) [See record alteration detection](https://medrecords.ai/product/record-alteration-detection/)
Scheduling only. No records move from a public page.

Chapter 13 Everyone

### Frequently asked questions

Is the audit trail part of the medical record?Usually not. Most providers treat audit data as system metadata outside the designated record set, so a HIPAA request does not return it. It has to be requested separately in discovery.
How do I request an audit trail from a hospital?In discovery, name the patient, encounters, date range and the specific notes at issue. Ask for all fields in native or CSV format, with a data dictionary and the revision history of the named notes. Chapter 5 has a letter.
Can an audit trail show a note was changed?It shows that a saved entry was modified, when and by whom, but often not the old and new text. Request the revision history alongside the log.
Does a late-entry label mean the record was falsified?No. Documentation standards allow properly labeled late entries and addenda. The label shows the note was written after the event. Whether it matters depends on timing, content and whether the original entry was kept.
How long do hospitals keep audit logs?It depends on hospital policy and state law. The HIPAA 6-year rule in 164.316 covers Security Rule documentation and 482.24 sets 5 years for records, but neither sets a period for raw audit log data. Ask for the policy and preserve early.
Can AI read an EHR audit trail?General AI tools can help a person sort and filter an export, but they cannot reliably judge batch signing, time zones or innocent explanations, and can report patterns that are not there. AI is better used on the printed record to find the notes worth naming.
Does Medrecords AI analyze audit logs?No. Medrecords AI works on the produced record: a cited chronology, date gaps, printed late-entry labels and near-duplicate pages that differ between productions. Reading the audit trail export is manual work or a forensic expert's.
Is it HIPAA compliant to upload medical records to AI?It can be, when the tool is HIPAA-compliant AI offered under a business associate agreement with appropriate security controls. Uploading records or audit exports to a consumer chatbot without a BAA is a different matter. Check the contract, not the marketing page.
Can ChatGPT summarize medical records for a lawsuit?It can summarize text, but without page citations you cannot verify each line, and without a BAA you may not be allowed to upload the records. Lawyers have been sanctioned for filing unchecked AI output, as in Mata v. Avianca.

Chapter 14 Everyone

### Sources and method

Every rule quoted here was checked against its text in September 2026. The labor and delivery example, export, note versions, user IDs, workstations and Bates numbers are hypothetical. No figure comes from our own study. The procedures, opinions and templates are Medrecords AI's, for practitioners to adapt, and are not legal advice.

| Source | What it supports |
| --- | --- |
| 45 CFR 164.312 | Audit controls standard (b) and integrity standard (c)(1) |
| 45 CFR 164.316 | 6-year retention of Security Rule documentation |
| 45 CFR 170.315(d)(2), (d)(3) | Certified EHR auditable events, tamper resistance, sortable audit reports |
| 45 CFR 170.210(e) | Audit log content by reference to ASTM E2147-18; clock standard |
| 42 CFR 482.24 | 5-year hospital record retention; entries dated, timed and authenticated |
| 45 CFR 164.501, 164.524, 164.528 | Designated record set; 30-day access deadline; 6-year accounting of disclosures |
| 76 FR 31426, RIN 0945-AA00 | 2011 access report proposal; never finalized, listed for withdrawal |
| 45 CFR 171.102, ONC information blocking | EHI definition tied to the designated record set; litigation exclusion; Cures Act context |
| FRCP 26, 30, 34, 37, 45 | Scope and proportionality; organizational depositions; ESI requests and form; failure to preserve; nonparty subpoenas |
| Gilbert v. Highland Hospital | 52 Misc. 3d 555 (Sup. Ct. Monroe County 2016): audit trail compelled |
| Mata v. Avianca, Inc. | S.D.N.Y. 2023: Rule 11 sanction for fabricated AI citations |

[](https://www.law.cornell.edu/cfr/text/45/164.312) [](https://www.law.cornell.edu/cfr/text/45/164.316) [](https://www.law.cornell.edu/cfr/text/45/170.315) [](https://www.law.cornell.edu/cfr/text/45/170.210) [](https://www.law.cornell.edu/cfr/text/42/482.24) [](https://www.law.cornell.edu/cfr/text/45/164.501) [](https://www.law.cornell.edu/cfr/text/45/164.524) [](https://www.law.cornell.edu/cfr/text/45/164.528) [](https://www.federalregister.gov/documents/2011/05/31/2011-13297/hipaa-privacy-rule-accounting-of-disclosures-under-the-health-information-technology-for-economic) [](https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201804&RIN=0945-AA00) [](https://www.law.cornell.edu/cfr/text/45/171.102) [](https://www.healthit.gov/topic/information-blocking) [](https://www.law.cornell.edu/rules/frcp/rule_26) [](https://www.law.cornell.edu/rules/frcp/rule_30) [](https://www.law.cornell.edu/rules/frcp/rule_34) [](https://www.law.cornell.edu/rules/frcp/rule_37) [](https://www.law.cornell.edu/rules/frcp/rule_45) [](https://law.justia.com/cases/new-york/other-courts/2016/2016-ny-slip-op-26147.html) [](https://caselaw.findlaw.com/court/us-dis-crt-sd-new-yor/2335142.html)
Related reading on this site: [reconciling a defense record production](https://medrecords.ai/guides/reconciling-defense-record-production/), [charting by exception](https://medrecords.ai/guides/charting-by-exception/), [whether AI is accurate enough for court](https://medrecords.ai/guides/is-ai-accurate-enough-for-court/), [HIPAA-compliant AI medical record review](https://medrecords.ai/guides/hipaa-compliant-ai-medical-record-review/) and [medical malpractice record review](https://medrecords.ai/solutions/medical-malpractice/).

### More guides

- [**Elder abuse and financial exploitation: the medical records that prove or disprove it** — How medical records prove or rebut elder financial exploitation and nursing home abuse: capacity timelines, 42…](https://medrecords.ai/guides/elder-abuse-financial-exploitation-records/)
- [**EMS patient care report: what each part means and how to read it against the ED chart** — What each part of an EMS patient care report means, NEMSIS times, Medicare ambulance rules, what handoff…](https://medrecords.ai/guides/ems-patient-care-report/)
- [**EMTALA violations: the emergency department records that prove or defeat the claim** — EMTALA claims under 42 USC 1395dd: the 3 duties, disparate screening, the 2-year limit, and the ED records and…](https://medrecords.ai/guides/emtala-violation-medical-records/)
- [**HIPAA and AI medical record review: what to verify** — A buyer checklist for HIPAA compliant AI medical record review: the agreements, encryption, data residency, and…](https://medrecords.ai/guides/hipaa-compliant-ai-medical-record-review/)
- [**History and physical: what each part means and how to test it against the chart** — What goes in a history and physical, CMS 30-day and 24-hour rules, what studies show about copied and templated…](https://medrecords.ai/guides/history-and-physical/)
- [**How much does medical record review cost?** — What medical record review and chronology work costs in 2026: per-page, per-hour, and per-case rates compared…](https://medrecords.ai/guides/medical-record-review-cost/)