Parts of a medical record: what each section is, what the law requires and how to tell if a file is complete

A medical record is the documentation of a patient's care kept by a provider: who the patient is, why they came, what was found, what was ordered and done, how they responded and where they went next. Federal hospital rules put the purpose in 1 sentence: the record must justify admission and continued stay, support the diagnosis, and describe the patient's progress and response to medications and services.

In practice there is no single record. A hospital stay produces a chart in the electronic health record, results in laboratory and imaging systems, monitor data in device systems, and bills in a billing system. The ambulance service, the outpatient clinic, the pharmacy and the insurer each keep their own. When a lawyer, a claims reviewer or a patient asks for "the medical records", what arrives depends on which of these the provider counts as the record.

That is why the 2 formal definitions matter. The legal medical record is what a provider treats as its official business record of care and produces on request. The designated record set is the HIPAA term for everything a patient has a right to see, and it is wider.

Terms you will meet

Chart

The everyday name for a patient's medical record at 1 provider.

Legal medical record

The records a provider defines, by its own policy, as its official record of care and produces in response to requests and subpoenas.

Designated record set

The HIPAA term for medical and billing records, and any other records used to make decisions about a patient (45 CFR 164.501).

Encounter

1 visit, admission or contact. A record is built from many encounters.

Face sheet

The first page of a hospital record: demographics, insurance, admission and discharge dates, diagnoses.

Source system

The system where a record was created, such as the lab system, the imaging system or the ePCR software.

Custodian of records

The person who certifies that a production is a true copy of the provider's records.

Authentication

A signature, electronic or written, identifying who is responsible for an entry.

The mock index below is the table of contents of a produced hospital record. The order is invented; every hospital's print order differs. The 9 marked parts appear in almost every inpatient record, and each has its own guide.

What each part answers

The 2 definitions answer different questions. The legal medical record answers "what does this provider stand behind as its official record of care?" Each organization defines it in its own policy, and that policy decides what a custodian of records certifies and produces. The designated record set answers "what can the patient see?" HIPAA defines it:

"The medical records and billing records about individuals maintained by or for a covered health care provider ... Used, in whole or in part, by or for the covered entity to make decisions about individuals."

Because the designated record set includes billing records and anything used to make decisions, it is usually wider than the legal medical record. A patient's HIPAA access request can reach records that a subpoena answered under the provider's legal record policy may not produce.

Records that often sit outside the chart

Some records are kept in other systems or by other organizations. They are often left out of a standard production unless requested by name. Whether each falls inside a given provider's legal record or designated record set depends on its policy and how the record is used, so ask for them specifically.

For hospitals, the Medicare Conditions of Participation set the baseline for what a record must contain, how entries are signed and how long records are kept. HIPAA sets the patient's right to see them. The rules of evidence set when a court treats them as reliable.

CMS guidance explains what "complete" means for a record and for each entry in it:

"A medical record is considered complete if it contains sufficient information to identify the patient; support the diagnosis/condition; justify the care, treatment, and services; document the course and results of care, treatment, and services; and promote continuity of care among providers."

Other settings have their own rules. Nursing homes, home health agencies and ambulance services each have separate federal and state requirements, and physician offices are governed mostly by state law. The specific guides cover the rules for each record type: the EMS guide covers Medicare's ambulance documentation rules, and the UB-04 guide covers claim forms.

Records are written quickly, by many hands, with templates and copied text. Errors are common enough that every part needs a second source. The largest study of what patients find when they read their own notes surveyed patients at 3 US health systems with open notes. Of 22,889 patients who had read at least 1 note in the past year, 4,830 (21.1%) reported a mistake, and 42.3% of those called it serious. When the researchers categorized the very serious mistakes, the most common involved diagnoses and medical history:

Studies of specific record types point the same way. Each record-type guide covers its own evidence:

None of this makes a record unreliable as a whole. It means a single entry is weak evidence on its own, and the strongest facts are the ones 2 independent parts of the record agree on.

What each flag means

1. An order with no administration record. The zolpidem order is in the production, but the MAR that would show whether and when it was given is not.
2. A part that stops early. The MAR ends on 02/04. 482.24(c)(4)(vi) lists medication records as required content, so the gap points to a production problem, not a charting one, until shown otherwise.
3. A 6-hour nursing gap. Either pages are missing or no one charted. The audit trail and the flowsheet export can tell the difference.
4. The bill fills a hole. The itemized bill is in the designated record set and shows the dose was charged on 02/05. It is not proof of administration, but it tells you what to request.
5. A summary that leaves out the event. The discharge summary describes a hip repair without the fall. Chapter 6 of the discharge summary guide covers how to read a summary against the chart.

The same case on 1 timeline

The method works for a hospital, clinic or nursing home production. Do it before summarizing anything. Our guides on getting medical records for a lawsuit and organizing medical records cover the steps on either side.

1. Fix the frame. Admission and discharge dates and times from the face sheet and the bill.
2. List the parts present. Against 482.24(c)(4) for an inpatient stay, or the provider's own index.
3. Check each part's date range. Every daily part (nursing, MAR, vital signs, progress notes) should cover every day of the stay.
4. Match orders to their results. Every lab, imaging and drug order should have a result or an administration entry.
5. Look for references to absent records. "See consult", "per EMS", "strip reviewed", "images reviewed".
6. Remove duplicates. Repeated pages inflate the count and hide the gaps.
7. Compare the bill with the chart. Charges for drugs, imaging or procedures with no matching record.
8. Request by name. List each missing part with dates, and ask for records outside the chart specifically.

Is this production complete enough to build on?

MEDICAL RECORDS REQUEST
Patient: [NAME / DOB]   Dates of service: [FROM] to [TO]
Provider: [HOSPITAL]    Account / MRN: [ ]

Please produce, for the dates above:
[ ] Face sheet and registration record
[ ] History and physical and update notes
[ ] All orders, including verbal and telephone
[ ] Physician and practitioner progress notes
[ ] Consultation reports
[ ] Nursing assessments, notes and flowsheets
[ ] Vital signs and intake/output records
[ ] Medication administration record (all days)
[ ] Laboratory, pathology and radiology reports
[ ] Consent forms, anesthesia and operative records
[ ] Discharge summary and discharge instructions
[ ] Itemized bill and UB-04
[ ] EMS / ambulance records received
[ ] Monitor data and strips (specify)
[ ] Imaging studies (the images as well as reports)
[ ] EHR audit trail (if timing is at issue)

COMPLETENESS LOG
Patient: [ID]   Stay: [ADMIT] to [DISCHARGE]
Production: [PAGES]   Received: [DATE]

Part | Present? | Dates covered | Pages | Gap / question

Examples:
MAR     | Yes | 02/03 to 02/04 | 171-200
        | Missing 02/05 to 02/12
Nursing | Yes | 02/03 to 02/12 | 81-170
        | No entries 02/06 00:00-06:00 (p. 113)
Bill    | Yes | 02/03 to 02/12 | 397-402
        | Zolpidem 02/05 not in produced MAR

Before you build a timeline

• Admission and discharge times are fixedFrom the face sheet and the bill.
• Every required part is presentChecked against 482.24(c)(4) or the provider's index.
• Daily parts cover every dayNursing, MAR, vital signs, progress notes.
• Duplicates are removedSo page counts and gaps are real.
• The bill is compared with the chartFor services with no matching record.
• Records outside the chart are requestedEMS, images, monitor data, outside providers, audit trail.

0 of 6 checked.

For productions from the other side of a case, see reconciling a defense record production. For duplicates, see deduplicating medical records. For abbreviations you will meet in every part, see medical abbreviations for legal professionals.

Chapter 7's method is simple and slow. A single admission can run to thousands of pages across a dozen parts, with duplicates, out-of-order printing and records from several providers mixed together. Checking that every daily part covers every day, and that every order has its result, is exactly the kind of work that gets skipped.

AI medical record review can sort a production into its parts, remove duplicates, and put every dated entry onto 1 AI medical chronology with a page-level citation. Gaps in a part's date range, orders with no matching administration, and references to records that are not in the file become visible without reading every page in order.

The same caution applies as with any large language model (LLM). A model can misread a date, merge 2 encounters or miss a page. Hallucination and omission are both risks, which is why every line needs its page and a human in the loop checks it. Whether a gap is a missing page or missing care is a question for the custodian, the audit trail and, often, an expert.

Medrecords AI works this way on the files you upload. It removes duplicate pages, builds a cited medical chronology across every part, each entry linked to its page, and flags records that should exist but were not produced. You can ask "every medication order with no matching MAR entry" through cited Q&A, find each mention of a record or provider with record search, and surface statements of absence with negative findings detection. Flags are signals, not verdicts. It does not retrieve records from providers, parse audit trails or decide whether care met the standard. It runs under SOC 2 and HIPAA with a signed business associate agreement (see security and HIPAA). Self-Service bills 10 cents a deduplicated page, down to 5 cents at volume, duplicates free; Enterprise On-Prem is an annual license.

If you are comparing tools, our guide to medical record review covers what to ask any medical chronology software vendor. See how record review fits medical malpractice, personal injury, hospital risk management and expert witness work.

What are the main parts of a medical record?

For a hospital stay: face sheet, history and physical, orders, progress notes, consultations, nursing notes and flowsheets, the medication administration record, lab, pathology and radiology reports, consents, anesthesia and operative records, and the discharge summary.

What is the difference between the legal medical record and the designated record set?

The legal medical record is what a provider defines in its own policy as its official record of care. The designated record set is HIPAA's term for medical and billing records and any records used to make decisions about a patient. The designated record set is usually wider.

Are billing records part of the medical record?

They are part of the HIPAA designated record set by definition. Many providers exclude them from the legal medical record, so request the itemized bill and UB-04 separately.

How long must a hospital keep medical records?

At least 5 years under the Medicare hospital rules. State law, other federal programs and cases involving minors often require longer.

How long does a provider have to give a patient their records?

Under HIPAA, 30 days from the request, with 1 extension of up to 30 more days if the provider explains the delay in writing. Some states set shorter deadlines.

Are EMS reports and images part of the hospital record?

Often not in full. The ambulance service keeps the PCR, and imaging systems keep the images; the hospital chart may hold only a copy or a report. Request them by name.

What does "not documented, not done" mean?

It is shorthand for the idea that a missing entry is evidence the thing did not happen. Federal Rule of Evidence 803(7) allows the absence of an entry in a regularly kept record to be offered for that purpose.

Can AI tell if medical records are missing?

It can sort records into parts, show date gaps and flag orders or references with no matching record, each with page citations. Whether pages exist elsewhere is a question for the provider.

Is it HIPAA compliant to upload medical records to an AI tool?

It can be, with a vendor that signs a business associate agreement, holds a SOC 2 report and commits in writing not to train on your data. A consumer chatbot without a BAA is a different matter.

Regulations, the Federal Rules of Evidence and the CMS State Operations Manual were read in full text from primary sources in September 2026, and quoted text is verbatim. Study figures come from the published abstracts; figures for each record type are sourced in its own guide. The mock index, patient, hospital, dates and pages in chapters 2, 6 and 7 are hypothetical. Product facts come from this site's product pages. Nothing here is legal or medical advice.

• 42 CFR 482.24: hospital medical records services, form, retention and content.
• 45 CFR 164.501: HIPAA definitions, including designated record set.
• 45 CFR 164.524: the individual's right of access.
• Federal Rule of Evidence 803: exceptions to the rule against hearsay, paragraphs (6) and (7).
• CMS State Operations Manual, Appendix A: interpretive guidance at tags A-0438 and A-0450.
• Bell SK, Delbanco T, Elmore JG, et al., "Frequency and types of patient-reported errors in electronic health record ambulatory care notes", JAMA Network Open 3(6):e205867, 2020.
• Tam VC, Knowles SR, Cornish PL, et al., "Frequency, type and clinical importance of medication history errors at admission to hospital: a systematic review", CMAJ 173(5):510-515, 2005.
• Wang MD, Khanna R, Najafi N, "Characterizing the source of text in electronic health record progress notes", JAMA Internal Medicine 177(8):1212-1213, 2017.
• Carter AJ, Davis KA, Evans LV, Cone DC, "Information loss in emergency medical services handover of trauma patients", Prehospital Emergency Care 13(3):280-285, 2009.