Author: enigmaforensics

Trade Secret Theft and Misappropriation in the Food Industry

Rarely do we hear about trade secret theft and misappropriation in the food industry. It happens! Read about this high profile case involving a famous food celebrity chef!

America’s Test Kitchen (ATK) sues Christopher Kimball for Misappropriation of Trade Secrets

Here is another example of trade secret theft. Check out this blog to see how business and personal emails played a role in the misappropriation of trade secrets. Yes, there is trade secret theft in the food industry!

Who isn’t a fan of cooking shows?

Have you ever watched American’s Test Kitchen (ATK) on public television? In addition to the show, ATK is a multimedia company that has holdings in public television programs such as America’s Test Kitchen, Cook’s Country, cooking magazines and books, and several websites? Who knew? We love watching celebrity chefs like Christopher Kimball and other specialized professionals test the great American recipes like meatloaf, roast chicken, and apple pie!

Trade Secret Missappropriation Lawsuit or Foodie Divorce?

Christopher Kimball was the face and personality behind America’s Test Kitchen and Cook’s Country. In November 2015, Kimball left ATK’s program and started his own program called Christopher Kimball’s Milk Street. When two parties split it’s called a divorce, well, you guessed it, ATK sued Christopher Kimball, the co-founder, part owner, celebrity chef, and the former host of its TV shows. Almost a year later, America’s Test Kitchen Inc. filed a lawsuit on October 31, 2016, as the Plaintiff. They wanted Kimball to change his business model. We call this a foodie divorce.

ATK said Kimball duplicated what he did on the show on Milk Street and that he misappropriated its trade secrets and breached his fiduciary duty to the company. In addition, they claimed that while Kimball was working at ATK as he actively created his new company Milk Street. According to ATK, Kimball stole its collection of recipes, TV show ideas, media contacts, and subscriber information. As a result, ATK sought damages against Kimball and wanted a large sum of all profits that he has derived through the use of the trade secrets he allegedly misappropriated from America’s Test Kitchen.  Other defendants named were Melissa Baldino, Kimball’s wife and a former executive director of ATK, Christine Gordon, and Deborah Broide. ATK claimed they aided and abetted Kimball’s breach of his fiduciary duties.

Non-Compete Agreement between ATK and Kimball

It seems that ATK and Kimball did not have a formal non-compete agreement in place. To protect intellectual property, corporations use a non-compete agreement where the employee agrees not to enter into competition with the employer during or after employment. If an employee departs and takes intellectual property without permission that’s considered trade secret theft and misappropriation.

It’s all in the Email!

This case is an example of where most evidence of trade secret misappropriation can be found. It’s all in the email! A variety of emails were attached to the complaint that included notes between Gordon and real estate brokers, between Kimball and an IT consultant covering such issues as how to copy and store tons of recipes. There were emails discovered between Broide and Kimball regarding the media lists; between Gordon and the ATK help desk about whether company scanners would keep copies of documents she scanned.

The Foodie Divorce finally settled!

To all our fellow foodies the good news is that both parties settled. Kimball agreed to return his ATK shares to the company for an undisclosed price. In the end, they agreed to business terms that will allow America’s Test Kitchen and Kimball’s company, Milk Street to co-exist. Giving us foodies the benefit of watching both shows!

Enigma Forensics is a computer forensic company with litigation experts that partner with attorneys to represent plaintiffs and defendants to help prove their case. We dig for evidence of trade secret theft or misappropriation of intellectual property. Most of all we are foodies! We found this story about trade secret theft and misappropriation in the food industry fascinating and wanted to share.

To learn more about Trade Secret Misappropriation

Top Things That Will Protect Company Trade Secrets

Electronic Medical Records Manipulated Post Lawsuit

Hiring an expert in electronic medical records (EMR’s) will help uncover record manipulation that will assist law professionals in winning medical malpractice cases for their clients. Check out this blog to see how a Kentucky woman waged a monumental fight against the medical system that failed her!

A site visit by an expert pays off, a Computer Forensic Expert Finds the Smoking Gun in the Electronic Medical Record (EMR) audit trail!

Kim Johnson noticed a lump on her right breast and because her mother died of breast cancer she feared the worst. In January 2015, she went to Fleming County Hospital in Flemingsburg, Kentucky, to get a mammogram. When she received a letter from the hospital that proved she had “no evidence of cancer”, this Kentucky mother of eight breathed a huge sigh of relief. Several months had passed and the lump continued to grow so she decided to get a second opinion. She was horrified to learn she has stage 4 cancer.

Sadly, Fleming County Hospital had sent the wrong letter, giving Johnson the all-clear instead of directing her to return for a follow-up examination. In September 2016, Johnson filed a lawsuit against the hospital claiming doctors misdiagnosed her, and that two employees deleted evidence of the letter saying she didn’t have cancer. How did she know this?

She hired a digital forensic expert!

Ms. Johnson and her lawyer’s hired a digital forensic expert skilled in examining EMR audit trails. During a court-ordered on-site visit, they found employee EMR entries that edited the history and deleted the evidence of the erroneous letter claiming that she was cancer-free.

In the wake of the misdiagnosis by the hospital, Ms. Johnson is left with a long battle with cancer. If her cancer would have been recognized at an earlier stage her quality of life would have been different as a result. She trusted the system and it failed her.

Who protects the patient? The HIPPA law ensures accountability

Required by the Health Insurance Portability and Accountability Act (HIPAA), hospitals and healthcare providers are to maintain an audit trail of all access, entry, and modification of the patient’s EMR to ensure accountability. Hiring a computer forensics expert that has experience with examining Health Information Systems (HIS) and the related EMR audit trails that can make or break your case. Call Enigma Forensics staff today if you think you may have a case requiring similar assistance. 312-668-0333.

To Learn More About EMR Audit Trails

EMR Audit Trails

Top Things That Will Protect Company Trade Secrets

Trade Secret theft = loss in revenue. Use your spider sense when someone from your team departs the company. They can unsuspectedly upload electronic data to the Cloud for later use that will drain your company of future revenue and present an immediate loss! Be aware-hire an expert to forensically image the departed employees hard drive. It will save you money and headaches!

Every company will have an employee leave but how do you protect the company’s trade secrets from leaving with them?

It is more common that you know for employees to leave for a competitor. On their way out the door, they will take with them proprietary data that can result in great harm to an organization including; loss of employees, customers, and important revenue streams. If someone on your team recently left your company and is suspected of having joined a competitor, it is vitally important to take immediate steps to protect your organization’s electronic assets.

What types of data do departed employees take?

Enigma Forensics has seen it all!
1. Client Lists
2. Blueprints
3. Historical quotations
4. Programming files
5. Source Code
6. Rebate levels offered from various vendors
7. Supply Chain information
8. Business protocols that competition can replicate

Hire an Expert!

When investigating departed employees the first step is to create a forensic image of the past employee’s hard drive. We recommend NOT to ask an internal employee to perform this task but most importantly hire a qualified computer expert from outside your company. This avoids any underlying loyalty current employees may have for the departed team member. An expert is trained to ensure the chain of custody is preserved so that it can be presented during a trial. Many have learned that hiring an expert is worth every dime!

What are the benefits?

Enigma Forensics computer experts will look for all types of activity that took place, including websites visited, files accessed, files transferred to external media, files uploaded to DropBox or other cloud accounts, concealment activities; encryption, and deletion of electronic evidence.

If your company is on the other side of a trade secret misappropriation litigation, we encourage you to hire an expert that will perform an initial assessment of the new employee’s activities. This will provide you with the benefit of knowing if the employee did something that could prove harmful to your company. It’s not uncommon that misappropriated trade secrets are done without the new employer’s knowledge. Yet, the new employer can be named in litigation as a co-defendant! Ouch!

Enigma Forensics has worked for both the plaintiff and defendant in trade secret litigation. Our experts are CISSP certified, what is CISSP? Certified Information Systems Security Professional. This advanced level of certification is considered the gold standard in the field of information security. It is a globally recognized certification offered by (ISC)2. (ISC)2 is known to be the world’s leading organization specializing in certifications and training for professionals in the cybersecurity domain. Click here to learn more about ICS2. https://www.isc2.org/

Call Enigma Forensics at 312-668-0333 for a complimentary consultation.

To Learn More about Trade Secret Theft

Tesla’s Latest Trade Secret Theft Lawsuit

Filters Used to Withhold the Complete Electronic Medical Records

The universal implementation of electronic medical records (EMRs) has become the single most important piece of evidence used in medical malpractice litigation. In response to an EMR Discovery request, healthcare providers use various filters to create useless or hard to read data. Hire an expert to help you weed through the audit trail and to present Discovery requests relevant to the case.

Healthcare providers use filters to withhold electronic medical data when complying with a court order and producing EMR audit trails. During the discovery period, EMR audit trails are commonly used as the single most important piece of evidence in medical malpractice litigation. Knowing evidence is in the details, has led to a chess game of filters proving “Not all electronic medical records (EMRs) productions are created equal!” Figuring out how electronic medical records (EMRs) are filtered is a game changer!

Follow the filters!

When counsel requests a patient’s electronic medical records (EMRs) to review for evidence, the production is often delivered in non-electronic limited formats, such as; scan documents, PDF, or image files. Filters provide limited format productions of (EMRs) therefore it becomes extremely difficult to read and find evidence. Are hospitals and healthcare facilities doing this on purpose? Are they filtering their production to include irrelevant information with very little details about the event in question? They are not making it easy that’s for sure. In truth, they are complying with the court order and producing files that include the electronic health records of the plaintiff. They’re just not providing data information in its completeness. Using filters to produce audit trails is fairly common, but for the injured party and representing counsel these tactics are extremely excruciating. Requesting electronic medical records (EMR’s) is now a challenging game of filtering chess!

Forensic Experts know how to request data essential to your case.

It is quite common that hospitals and healthcare facilities use a variety of filters that will result in an incomplete production. When forensic experts study the production headers they uncover filters that were used to produce an incomplete EMR audit trail. Experts know how to ask for relevant data and dig deeper to find evidence.

Filters, Filters, and More Filters!

  1. Date filters that are applied could exclude alteration of records after the event took place. We suggest the best practice is to use the earliest known date prior to the medical event as a starting point and place the end date the same as the current date of the request. Pushing the end date to reflect the current date will show who looked at the record post-event.
  2. Department filters will only return records that are from one particular department, such as radiology or another department.
  3. Employee filters include specific employees of the healthcare facility. If an EMR record only shows entries related to a physician’s user IDs this can be problematic. It’s important to know all of the names and user IDs of all healthcare providers that visited the patient.
  4. Workstation filters are specific to desktops and/or workstations and could be the cause of incomplete production.
  5. Location filters are used by healthcare providers to limit the full scope of production. It is not uncommon for physicians to access important medical records remotely. This could cause manipulation of data by remote access and filter out data after the event in question.

Enigma Forensics has years of experience developing requests for electronic medical records (EMRs). Our experts know how to ask the right question to retrieve the necessary data to be used as evidence. Save yourself time and expense and hire an expert! Our experts are CISSP certified (Certified Information Systems Security Professional) that provide testimony as a professional witness in a court of law.

Please call Enigma Forensics at 312-669-0333 for a complimentary consultation.

How important are Electronic Medical Records (EMR)?

Have you or someone you know been involved in medical injury or accident? Do you want to win your case? Or…If you’re an attorney and have questions about a case involving medical malpractice, read this blog and contact Enigma Forensics for the “W”.

Were you or a loved one involved in a medical accident or injury? Are you an attorney who is representing an injured client?

If the answer is yes, take immediate action and file a Discovery request or subpoena to access all of your Electronic Medical Records (EMR). Why is this important? In order to prove injury or malpractice and win your case it’s imperative to discover what took place and the actions that caused an event. Your electronic medical records or EMR audit trail will document what transpired. EMR audit trails will include prescriptions, tests, treatments, transfers, operation notes, nurse practitioners and doctors notes and a ton more. Electronic Health Records (EHR) are rich with data information describing the care that was provided and decisions that were made good or bad. Some medical record systems such as Epic have sticky notes that are traditionally not part of the formal patient permanent electronic record. Those sticky notes are required to be stored by the Health Insurance Portability and Accountability Act (HIPPA), but are not part of the discharge report showing the patient electronic medical record history. The data does exist and working with a qualified medical record forensic expert can help you to gain a more complete record of the patient encounter with the health care provider.

What else does Electronic Medical Records (EMR) include?

Electronic Medical Records and the patient medical record audit trail include the original record and will note any modifications. It will also preserve dates, times, who accessed the record and whether the record was printed, viewed, deleted or otherwise modified. Many of the systems today, such as; Epic, Cerner, Meditech, All Scripts and others have reports that can be downloaded to reveal vital information about who has authorization to access and audit electronic health records.

Medical dictations are another vital piece to the puzzle. Dictation files are sometimes sent to third party transcription service providers as raw audio files called WAV files. After the WAV files are received they are typically transcribed to text files and fed back into the electronic health record software system. When modification of the patient medical record occurs after an injury or malpractice took place, comparing the transcription WAV files to the produced chart may help reveal alteration to the patient medical records.

Patient Electronic Medical Charts are often Incomplete. You could lose your case!

When electronic medical record discovery requests are made by plaintiffs to healthcare providers, it is common that the production lacks the complete patient medical record history. Healthcare providers facing litigation commonly provide a minimal amount of data in an often useless format. The form of production is often scanned copies of previously printed our documents or charts. Codewords for health care providers, departments and procedures often make interpretation even more challenging. Having an experience EMR computer forensics expert can help provide a more accurate interpretation of the complete Electronic Health Record (EHR) for the harmed patient.

The Health Insurance Portability and Accountability Act of 1996, or HIPAA is a federal law which requires your medical records to be retained for six years at a federal level. However, most states also have their own medical retention laws which can be more stringent than HIPAA stipulates. Check out this government website to learn about how different states interpret this governance. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html

How important are faxes? This could win your case!

In some cases, Electronic Medical Records (EMR) are faxed to outside providers either to or from your primary physician. Software vendors such as Forward Advantage provide automated faxing capabilities integrating with the existing health care information management systems and patient medical records. It’s vital you request all communication between facilities to help prove or disprove what and when medical knowledge was presented to the provider to make an informative decision relatable to an event.

Let’s say you have already requested an EMR audit trail for a patient. Did you know that the Electronic Medical Records (EMR) audit trail you received contains cryptic codes that you will not be able to comprehend. It’s extremely helpful to request all of the underlying data dictionaries that will provide the definition of the codes used referring to the friendly name, including, the healthcare provider’s name, department, computer used to access the EMR, procedures, treatments, tests ordered, drugs prescribed and lab results.

Did you know that medical data is required to be retained for six years?

Do you want to to win your case! You need Enigma Forensics experts on your team! Hire a professional forensic expert to assist in writing a Discovery request to obtain, preserve and analyze ALL of the electronic medical records and to help you obtain the complete EMR audit trail. We can help uncover the truth of what took place and help tell the court the story about what happened to you or your client.

Call Enigma Forensics at 312-668-0333 to schedule a complimentary phone call to discovery how we can assist.

More about Electronic Medical Records

EMR or EHR what is the difference?

Tesla’s Latest Trade Secret Theft Lawsuit

Enigma Forensics experts investigate, preserve and recovery data to prove or disprove Trade Secret Theft. We have assisted many clients in financially recovering what was stolen from them or to help clear their name. Are you interested in learning more about trade secret theft? Check out Tesla’s latest law suit against a former software engineer.

A large portion of our business is forensically recovering and preserving data that is vital in proving or disproving trade secret theft. Enigma Forensics experts love to follow Tesla! We love the look of their beautifully engineered electric cars and we’re very interested in Elon Musk, the controversial character behind the engineering. Who is now labeled the most wealthiest man in the world. Our interest was piqued when we heard about Tesla’s latest lawsuit and that prompted us to write this blog.

On January 22, Tesla filed a lawsuit against Alex Khatilov, a former software engineer over Trade Secret Theft and Breach of Contract. Tesla contends that within days after Khatilov started his position on December 28, 2019, he began stealing thousands of highly confidential software files from Tesla’s secured internal network, transferring them to his personal cloud storage account on Dropbox to which Tesla has no access or visibility.

How did Tesla discover this trade secret theft or misappropriation of data?

On January 6, Tesla’s information security personnel detected Khatilov’s unauthorized download of a complete set of all the automation scripts produce by the Quality Assurance Engineering team for WARP Drive over the last twelve years! He was confronted the next day via Microsoft video chat due to Khatilov working remotely because of COVID-19 restrictions. Khatilov claims he installed a Dropbox desktop application to his Tesla issued laptop to allow him to upload administrative files to his personal Dropbox. He swore over and over that he only transferred administrative documents and then when he finally shared his screen with Tesla investigators he could be seen deleting the Dropbox files while on video chat confirming he had willfully destroyed evidence.

Why all the fuss?

How important are these scripts? These scrips are unique to Tesla and run on WARP Drive, the backend software for much of Tesla’s business. These files consisted of “scripts” of proprietary software code that Tesla has spent years of engineering time to build. When executed, these scripts automate a broad range of functions throughout Tesla’s business and only a few select employees have access to these files. It gets better! This is the good part…Khatilov contends he forgot about downloading thousands of confidential files!

The reality of this trade secret theft or misappropriation of confidential data is that Tesla has no way of knowing whether Khatilov copied the scripts onto a thumb drive, a mobile device, or a cloud based storage or most importantly sent them to another individual. To understand more thoroughly how important these “scripts” or trade secrets are…They map out Tesla’s innovations! Making them extremely valuable and beneficial to any competitor.

What measures ensure against trade secret theft or misappropriation?

  1. Tesla limited the “scripts” access to only members of the Quality Assurance Engineering team in which Khatilov was one of forty employees to have access. The engineers that have access are not permitted to download scripts to the cloud or personal devices. This makes us wonder how Khatilov was able to download data!
  2. Only eight people within the Tesla company are approved to grant access to these scripts.
  3. Each engineer signs an extensive employment agreement and agrees to policy conditions of their employment with includes a non-disclosure agreement (NDA), that holds each employee to the strictest confidence of proprietary information, technical data, trade secrets so on and so forth.
  4. The NDA also states that upon termination or departure each employee will immediately return to the company all original document electronic or hard copies.
  5. Each physical facility has restricted access to only authorized personnel that are monitored by security guards and cameras.
  6. All visitors must check in with security, sign a NDA, submit to a photograph and be escorted by an employee.
  7. Tesla also used password-protected and firewall-protected networks and servers that are only accessible to current Tesla employee with the proper credentials.

Moral of this story is…

Even high level technology companies has issues with trade secret theft. If your company suspects something like this, immediately hire a computer forensics expert to electronically preserve data of soon to be departing or a departed employee that has already left the company. Enigma Forensics can analyze data that was misappropriated or stolen to help clients recover financial loss.

Chinese Suspects: Li Xiaoyu and Dong Jiazhi charged with trade secret theft

Has your cell phone been lost or stolen?

Enigma Forensics offers step by step advice on what to do if you cell phone has been lost or stolen.

Enigma Forensics has recently received many calls regarding lost or stolen cell phones. So we put together 7 easy steps on what to do. You may have been involved in a crime where someone stole your phone or you could have lost or misplaced your phone. Either way, you know the feeling, it’s a sinking panic in the pit of your stomach. There’s no doubt it can be devastating! Here are some easy steps you can take to avoid this monumental headache. First a foremost DON’T PANIC. Take a deep breath and think logically through these steps.

Step 1 – You’ve discovered your cell phone has been lost or stolen – ask a friend or someone close to use their phone to call your number. If that doesn’t work try to locate your phone on another device that is connected to your Mobile App. Then text your phone. If it’s lost someone might be a good samaritan and want to return the phone. If you were involved in a crime contact the police department and file a report.

Step 2 – Check out your Mobile App or your phone’s native “find my phone” feature. If you have other devices in your home, log on, and try to use the locator.

Step 3 – Call your cell phone provider to inform them of a lost or stolen phone. They can assist you in what actions you need to take next. If you have insurance on your phone you will be able to replace it with minimal cost.

Step 4 – If you have any banking, or other important financial Apps on your phone contact them immediately to let them know your predicament. Most banks allow you to pause your financial cards while you locate your phone. Notify the credit reporting agencies to put a freeze on new accounts being opened in your name.

Step 5 – Always back up your cell phone. We know, this is easier said than done! You can make it easy on yourself if you schedule a calendar date and set a reminder.

Step 6 – If you lock your phone and rotate your passwords this could help avoid most of the headaches involved.

Step 7 – Have your cell phone carrier revoke your old SIM card to prevent any outside party from texting your contacts from your cell phone or another cell phone they may use with your SIM card.

Finally, keep calm and face each step with determination to resolve the matter.

Russian Hacker’s Latest Hack Or Did They?

Will 2021 become the year of heightened cyber security? What will it take for the U.S. Government get their act together? Here we are reported yet another cyber attack that gained entry through a supply chain. 2021 Year of Cyber Security!


As a Cyber Security company, Enigma Forensics is always interested in the 4W’s and 1H of a Cyber Attack. We would be remiss if we didn’t write a post about the most recent SolarWinds Hack allegedly by the Russians. Did the Russians time this cyber attack at precisely the moment in time when the United States is preoccupied? Amidst the Coronavirus shutdowns, the election results, the holidays, and the COVID-19 relief plan, it’s almost as if this particular Russian Hack completely flew under the radar.

What happened?

The attackers gained entry by using a software update sent out by Texas-based software company SolarWinds, which counts multiple U.S. government agencies as customers. In early December 2020, the news media reported at least 200 organizations, including U.S. government agencies and other companies around the world, have been hacked as part of this suspected Russian cyber attack.

Government’s response

The New York Times reported on December 13, 2020, “The Trump administration acknowledged on Sunday that hackers acting on behalf of a foreign government almost certainly a Russian intelligence agency, according to federal and private experts — broke into a range of key government networks, including in the Treasury and Commerce Departments, and had free access to their email systems.” We can’t find any reporting on what information was stolen.

Who raised the alarm?

It looks like FireEye, a computer security firm first raised the alarm about the Russian cyber attack after its own systems were compromised back in early Spring of 2020. What perfect timing to stage an attack considering the whole country is preoccupied with the rise of the pandemic! FireEye discovered a supply chain attack that was accessed through SolarWinds Orion business software updates in order to distribute malware that they called “SUNBURST.” Experts agree this is the work of highly-skilled actors and was performed with significant operational security. But, the real issue is why didn’t the government cyber protection agencies that are sworn to protect recognize the breach? It took an outside company to inform them of the cyber attack.

Where was the Cyber Attack aimed?

In this case, the U.S. government agencies seemed to be the target. As noted before, the hack was done through what is called a “supply chain attack,” in which malicious code is hidden in legitimate software updates and meant to target third parties. Could it have been the Chinese masquerading as the Russians? President Trump laid claim that there was potential it could have been the Chinese and not the Russians.

When was the Attack Noticed?

As reported by the New York Times, in a statement after a briefing for committee staff members, Senator Ron Wyden of Oregon, who has often been among the sharpest critics of the National Security Agency and other intelligence agencies, said that the Treasury Department had acknowledged that “the agency suffered a serious breach, beginning in July, the full depth of which isn’t known.” But no one will say just how serious the breach was!

Today, as reported in the Hill, the headline reads, “Intel vice chair says government agency cyber attack ‘may have started earlier’.” Sen. Mark Warner (D-Va.), the vice-chairman of the Senate Intelligence Committee, said on Wednesday, December 30, 2020, that the cyberattacks on U.S. government agencies reported at the beginning of the month may have begun earlier than previously believed.

How did the Hackers Hack?

The hackers used malicious code inserted into legitimate software updates for the SolarWinds Orion software. This allowed the hacker to remotely access the victim’s electronic environment. In order to avoid detection, they used a very small footprint and went to significant lengths to lay low and blend in. Very stealth-like in nature! The malware attacked slowly and moved with precision, covering its tracks and using tools that were hard to detect. Does this sound familiar?

Check out another Enigma Blog

Chinese Suspects: Li Xiaoyu and Dong Jiazhi charged with trade secret theft

https://www.forbes.com/sites/thomasbrewster/2021/01/26/google-warning-north-korean-hackers-breach-windows-and-chrome-defenses-to-attack-security-researchers/?utm_source=newsletter&utm_

EMR or EHR what is the difference?

EMR or EHR are synonymous. Both are medical records. The electronic medical records or EMR reveal an audit trail of what transpired during a medical or health visit. Each record is unique and tells a story about the patient. We are experts that can assist you to win your case!

Electronic data records are taking the place of the old school hard copy files and completely revolutionizing the way data is gathered and stored. Electronic Health Records (EHR) or Electronic Medical Records (EMR) are synonymous with each other. (EHR) is data that includes the patient’s vital information such as an address, medical history, allergies, immunizations, lab tests results, radiology images, and vital signs, also, personal statistics like age, weight, sexual orientation, and insurance information. (EMR) is an individual’s private health data that is stored in a protected database only accessible to medical personnel in compliance with The Health Insurance Portability and Accountability Act (HIPAA) regulations. EHR’s or EMR’s make patient charting easier and results in fewer errors and keeps this delicate personal information private and secure.

Medical data can be manipulated!

Medical data can be altered and inserted into EMR systems and made to look like it was there all the time or not there at all. Medical malpractice lawyers rely on EMR audit trails to tell the story of either side of a case; the plaintiff or the defendant. Medical records are marked by metadata or raw data. This data is developed separately from the EMR system making manipulation detection visible by reviewing the raw data and the database logs. Metadata can also be described as underlying data, like a digital footprint that creates an audit trail. In order to analyze raw data, you will need to hire Enigma Forensics; we are experts in the field of electronic medical records (EMR) or (EHR).

During a forensic review of EHR’s or EMR’s, we can authenticate or reveal backdating, back charting, data editing, or falsification of records. We have been on both sides of medical malpractice cases and almost always save our client a considerable sum of money. We work closely with the attorneys involved to help with eDiscovery verbiage and assist with what to look for.

When to Select A Computer Forensic Expert
Electronic Medical Records
eDiscovery
Electronic Health Records and eDiscovery

Complete list of eDiscovery Questions For Electronic Medical Records

Enigma Forensics are experts in collecting and understanding electronic medical records or the EMR audit trail. Check out this blog to view our list of EMR Discovery Questions.

Electronic Medical Records (EMR) can be tricky! In most cases, during eDiscovery, you get what you ask for and only what you ask for! Every Discovery request involving a healthcare provider has unique aspects that need to be considered.

Enigma Forensics is an established Computer Forensic Expert Witness firm that has been involved in many medical malpractice cases and specializes in interpreting electronic medical records (EMR) audit trail or audit logs. Our staff has extensive experience with numerous EMR applications and can assist you with navigating through the challenges of EMR Audit Trails and/or Audit Logs. Electronic Medical Record a.k.a., EMR audit trail or log is the answer to who knew what when, in essence, it tells the story about what took place during the treatment of that patient.

The following is a list of important questions to file for the demand for eDiscovery for Electronic Medical Records, in a medical malpractice case.

  1. Provide the name of all medical software applications utilized to store [Patient Name]’s Electronic Medical Records (EMR).
  2. For each medical software application that contains [Patient Name]’s EMR, please provide the specific version of the software as well as the name of the company that produces the software during the relevant time period beginning on [beginning date] through the present date.
  3. For each medical software application that contains [Patient Name]’s EMR, please indicate if any of the specified software applications were migrated off to a new platform and what the current status is of [Patient Name]’s EMR on the original system.
  4. For each medical software application that contains [Patient Name]’s EMR, please provide the application administrators that have full access to the stored data and audit trails.
  5. For each medical software application that contains [Patient Name]’s EMR, please provide all user and administrator manuals for each of the medical software applications.
  6. For each application that contains [Health Care Provider Name]’s EMR, please provide the current retention settings for the audit trail for all patient’s EMR. Are the privacy log retention settings sent to a secondary audit log (e.g., Fair Warning)? Is the secondary audit log retention configurable within the systems and/or applications?
  7. For each application that contains [Health Care Provider Name]’s EMR, please provide the earliest date that [Patient Name]’s EMR appears in the application’s audit trail.
  8. Please provide the complete EMR audit trail for [Patient Name] detailing any health care provider’s access, review, modification, printing, faxing, or deletion activities in a comma-delimited format with any and all corresponding native files that may relate to the Electronic Medical Record for [Patient Name] as required by the Health Insurance Portability and Accountability Act § 164.312(a)(1).  Such an audit trail should include the original values and new values for any alteration of the EMR and shall indicate the user making the change and the date and time of the change.
  9. Please provide the data dictionary for each software application containing  [Patient Name]’s EMR.  Such dictionary shall include the username key that maps the real names of individuals to their unique user login account IDs for each medical software application containing any EMR for [Patient Name] as required by the Health Insurance Portability and Accountability Act § 164.312(a)(2)(i). Additionally, any lab test, codes, or other short-form identifiers included in  [Patient Name]’s EMR Chart or EMR audit trail should be provided as part of the data dictionary production.
  10. Please provide any and all original voice transcription recordings that were made by [Health Care Provider Name], or any other staff that related to [Patient Name].
  11. Please provide any other native electronic files or emails that relate to  [Patient Name] in the native format with an index containing the original unmodified metadata for each of the native files or emails produced.
  12. Please provide any DICOM files that were captured as part of [Patient Name]’s treatment by [Health Care Provider].
  13. Please provide electronic records of any outbound faxes and/or other methods of communication that were utilized by [Health Care Provider Name] to [EMR Recipient], in its native form with a corresponding comma file listing containing all available metadata in a delimited format with the corresponding file path to the native file produced for each record.
  14. Please provide the name and title of the person most knowledgeable for the [Health Care Provider Name]’s software/auditing and compliance system. 
  15. What customizations and settings were active at the time when the plaintiff was admitted into the hospital? What privacy-related logging is in place for each such system and/or application? Are privacy log retention settings in place for each such system and/or audit log?
EMR Audit Trails