Tag: emr expert

Lee Neubecker: Expert in Cyber Forensics & Investigations

Curriculum Vitae Lee Neubecker

P‌DF Updated as of 3/21/2025

‌BIOGRAPHY

Lee Neubecker is the President and CEO of Enigma Forensics, Inc., a Chicago and Fort Lauderdale based Computer Forensics and Cyber Investigation consultancy. Neubecker assists Fortune 500 clients, government agencies, and private organizations with cyber-related investigations involving theft of electronic data, authentication of digital evidence, electronic medical records, fraud, counterfeiting, and online identity unmasking.

Neubecker also is the founder of IT Security Blog leeneubecker.com. Before starting Great Lakes Forensics, Neubecker had served as CISO for HaystackID and following the acquisition of Envision Discovery and Inspired Review by HaystackID, Neubecker was promoted to serve as CIO over the combined entities. Neubecker was named one of the top Global Computer Forensics and Cyber security experts by Who’s who Legal in 2018, 2019, 2020, 2021, 2022, 2023 and 2024 and many years prior to that.

During 2016 and 2017, Neubecker assisted the U.S. Federal Government in discovering important security compromises including, the compromise of NIST.gov wildcard certificate (boudicca.nist.gov) using deprecated encryption (December 2016), compromise of time.gov NIST time servers (December 2016), compromise of NIST NSRL Hash Set download page (December 2016) and leaked email usernames and passwords from U.S. Intelligence Agency email account credentials onto public sandbox websites such as pastebin.com. (December 2016 and January 2017). Neubecker has a track record of uncovering Cyber Data Breaches and has performed investigations on the State and Federal Government Agency levels.

Neubecker’s has performed extensive research pertaining to hardware based vulnerabilities and exploits including, Serial Peripheral Interface – chip stored malware that has been impacting individuals, companies and government agencies in the wild following the leak of

U.S. Cyber weapons cache. Neubecker identified and reported the hack of chicagoelections.com website, that resulted in millions of Chicago resident (and former resident) voting records being disseminated online. Neubecker also provided important intelligence collection and analysis services that helped bring the perpetrators of the Boston Marathon Bombing to justice. Prior to founding Enigma Forensics, Neubecker founded Forensicon, Inc. and sold the company to QDiscovery, a national eDiscovery services provider. While managing Forensicon, Mr. Neubecker provided consulting services in the areas of computer forensics, electronic discovery, data recovery and litigation support to a diverse range of clients. Mr. Neubecker has worked on both Plaintiff and Defense sides, and has served as a regular speaker on topics in the computer forensics and electronic discovery fields for Midwestern legal bar associations, Professional Associations and National Legal Conferences. Mr. Neubecker has been appointed a special master in civil litigation matters by the courts. Mr. Neubecker has been cited in the appellate court as an expert witness in the case, Liebert Corp. v. Mazur. The published opinion of Justice Wolfson, Circuit Court of Cook County, regarding Mr. Neubecker’s testimony can be found at the following link: https://caselaw.findlaw.com/il-court-of-appeals/1063543.html

Prior to founding Forensicon, Inc., Mr. Neubecker founded BuzzBolt Media, a web development and Search Engine Optimization consultancy which later became Forensicon, Inc. Before moving to Chicago in 2000, Mr. Neubecker led the online communities’ product

‌development and programming initiatives for the Lycos Network, a pioneering Web media model that included three Top 10 Web sites and was one of the most visited hubs on the Internet during Neubecker’s tenure. Neubecker was responsible for creating, launching and managing chat, instant messaging, message boards, and online games across the Lycos network. In this role, Mr. Neubecker led the company’s response to legal inquiries from law enforcement personnel and personally oversaw complicated international investigations involving transcontinental Cyber attacks against company servers and users.‌

Before joining Lycos and graduating with an MBA focused in technology, Mr. Neubecker launched and successfully managed Innovative Consulting, Inc., an information technology consulting company. Mr. Neubecker’s company deployed network management, contact management, sales automation and ERP solutions to small and mid-tier organizations. Prior to Innovative Consulting, Neubecker held operations and finance analyst positions with Ford Motor Company and Comerica Bank. Mr. Neubecker has experience in securities valuation and accounting from his position at Comerica Bank, where he served as a Trust Fund finance analyst. While serving at Ford Motor Company as an intern, Neubecker was integral in automating important processes and bringing financial forecasting methodologies online, resulting in more timely and accurate quarterly financial forecasts.

Mr. Neubecker graduated magna cum laude from Babson College with a Masters of Business Administration, focusing on Technology. Mr. Neubecker also holds an undergraduate degree in Finance, magna cum laude, from Eastern Michigan University.

‌NOTABLE CASES OF RECORD AS A COMPUTER FORENSICS EXPERT WITNESS

LESEAN DOBY v. ZIDAN MANAGEMENT GROUP, INC.

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

Case No. 1:23-cv-16602

Provided affidavit regarding the analysis of a biometric fingerprint lock in support of the defendant as it relates to the Illinois Biometric Information Protection Act.

JAQUAN SHORTER v. ADVOCATE HEALTH AND HOSPITALS ) CORPORATION, ET. AL.

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS

COUNTY DEPARTMENT, LAW DIVISION

Case No. 2023L012024

Filed affidavit regarding user authentication to the defendant’s Electronic Medical Record system and the origins of the logon activities when accessing the patient’s health provider’s EMR system.

EUGENE EVANS v. CORRECTHEALTH CLAYTON, LLC and PAMELA BLAHA, LPN

IN THE SUPERIOR COURT OF FULTON COUNTY STATE OF GEORGIA, Case No. 2023CV379078

Filed affidavit regarding electronic medical records.

MARVA BURNETTE v. RUSSELL P. NOCKELS, M.D., IGNACIO JUSUE-TORRES, M.D., and LOYOLA UNIVERSITY MEDICAL CENTER

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS COUNTY DEPARTMENT, LAW

DIVISION, Case No. 2023-L-000973

Filed affidavit regarding electronic medical records and audit trails.

CHRISTINE MCLAUGHLIN, CRYSTAL VANDERVEEN, JUSTIN LEMBKE, SCOTT HARDT, ET. AL. v. SELECT REHABILITATION LLC

UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF FLORIDA

JACKSONVILLE DIVISION

CLASS and COLLECTIVE ACTION Case No: 3:22-cv-00059-HES-MCR

Filed Declaration regarding the availability of EMR audit log records to show when staff were performing work.

‌CDL 1000, INC. v. SCOTT ROBERTSON

CIRCUIT COURT OF COOK COUNTY, ILLINOIS, Case No. 2022-CV-00415

Provided affidavit detailing the lack of compliance with the courts’ order requiring handover of Robertson’s personal smartphone and computer for forensic preservation and analysis relating to a departed employee investigation and alleged electronic trade secret misappropriation.

‌DEVIN ESTIME v. SOUTHERN CALIFORNIA PERMANENTE MEDICAL GROUP

SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF LOS ANGELES, Case No.: 22STCV06517

Filed affidavit regarding electronic medical records and audit trail productions.

‌ROBERT BRONSTEIN v. LATIN SCHOOL OF CHICAGO‌

‌IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS COUNTY DEPARTMENT, LAW DIVISION,

‌Case No. 2022-L-003763

‌Completed forensics analysis of iPhone, Macbook, and iPad of defendant in the case.

‌CONNIE & GARY ANDERSON v. PATIENT FIRST MARYLAND MEDICAL GROUP‌

‌IN THE CIRCUIT COURT FOR BALTIMORE COUNTY Case No. C-03-CV-21-001814‌

‌Provided affidavit related to EMR and audit trail logs.

‌PHOTOFAX, INC. v. JOSEPH BRADY CIRCUIT COURT OF KANE COUNTY, IL Case No. 21-CH-000167‌

Provided affidavit detailing the forensic examination of the PhotoFax issued laptop by the departed employee. Reported on the destruction of evidence and provided support for a motion to compel examination of the devices still used by Joseph Brady to look for sensitive company data and trade secrets.

JAMES ABRAHAM, successor Trustee of the JOHN A. ABRAHAM TRUST v. ELIZABETH CHAPMAN

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS COUNTY DEPARTMENT, MUNICIPAL DIVISION

Case No. 2020 M170426

Provided affidavit regarding the authenticity of alleged lease produced by the defendant relative to a forensic analysis of computing devices.

‌JOSEPH NICOLOSI ET. AL. v. STANDARD PARKING ET. AL.

‌CIRCUIT COURT OF COOK COUNTY, IL Case No. 20-L-007912.

Provided affidavit detailing EXIF photo metadata extracted from the Plaintiff’s production of alleged photos taken of damaged artwork and other effects. Identified photos that were edited after they were taken using Photoshop.

‌PATRICK T. MCKINNEY, BY AND THROUGH HIS LEGAL GUARDIAN, RONI S. MCKINNEY, AND RONI S. AND TIMOTHY C. MCKINNEY, INDIVIDUALLY AND AS THE PARENTS AND NATURAL GUARDIANS OF PATRICK T. MCKINNEY v. THE CLEVELAND CLINIC FOUNDATION AND THE CLEVELAND CLINIC HEALTH SYSTEM

‌COURT OF COMMON PLEAS OF CUYAHOGA COUNTY, OHIO Case No. CV-20-931-660.

Provided affidavit in support of a motion to compel for supervised on-site obtainment of the plaintiff’s full medical records. Involved Epic EMR software.

‌NIMISH SHAH, AS THE NATURAL SON OF PUSHPABEN C. SHAH, v. ST. LUKE’S EPISCOPAL PRESBYTERIAN HOSPITALS, D/B/A ST LUKE’S HOSPITAL, ET. AL. CIRCUIT COURT OF ST. LOUIS COUNTY, MISSOURI. Case No. 20SL-CC04023. Div. 8.‌

Signed an affidavit exhibiting deficiencies in Defense’s production and supporting a motion to compel for an on-site collection of the plaintiff’s medical records. Involved Cerner software.

‌MARC STRAUSS v. KATHLEEN VAN VALKENBURG, M.D. and SIGHT MEDICAL DOCTORS, P.L.L.C.

‌SUPREME COURT OF THE STATE OF NEW YORK, COUNTY OF NASSAU, Index No. 608054/2020.

Submitted an affidavit in support of a motion to compel for full medical records involving MyCare iMedicWare EMR software.

‌DEBORAH CARR v. HOSPITAL SISTERS HEALTH SYSTEM

‌IN THE CIRCUIT COURT OF THE SEVENTH JUDICIAL CIRCUIT SANGAMON COUNTY, ILLINOIS, Case No. 2020-L-105

‌Provided affidavit related to EMR and audit trail logs.

RONI S. AND TIMOTHY C. MCKINNEY, v. THE CLEVELAND CLINIC FOUNDATION

IN THE COURT OF COMMON PLEAS CUYAHOGA COUNTY, OHIO

Case No.: CV-20-931660

Filed affidavit regarding electronic medical records.

AUSTIN ROBERTS v. IOWA HEALTH SYSTEM d/b/a UNITYPOINT HEALTH, TRINITY MEDICAL CENTER

IN THE CIRCUIT COURT OF THE FOURTEENTH JUDICIAL CIRCUIT ROCK ISLAND COUNTY, ILLINOIS, Case No. 2020 L 76

Filed affidavit regarding electronic medical records and audit trails.

‌SMART MORTGAGE CENTERS, INC. V BRIAN NOE, EILEEN PRUITT, AND NEXA MORTGAGE, LLC

IN THE CIRCUIT COURT OF WILL COUNTY, ILLINOIS TWELFTH JUDICIAL CIRCUIT Case No. 20 CH 292

Filed an affidavit regarding allegations of trade secret misappropriation.

PHILIPS NORTH AMERICA, LLC v. FITBIT, INC.

IN THE US DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS

Case No.: 1:2019cv11586

Filed affidavit relating to forensic inspection of electronic data relative to allegations of trade secret misappropriation.

ROBERT WATSON and MARK SAULKA, v. RYAN TODD WEIHOFEN and POOL TECHNOLOGIES, LTD.,

IN THE CIRCUIT COURT OF COOK COUNTY ILLINOIS COUNTY DEPARTMENT, CHANCERY DIVISION, Case No. 2019 CH 12252

Filed affidavit regarding the expected cost to comply with a subpoena for production of electronic medical records.

‌LOUIS ARGIRIS v. PAUL V. FAHRENBACH, M.D., GI SOLUTIONS OF ILLINOIS LLC, ATHANASIOS D. DINIOTIS, M.D., TIESENGA SURGICAL ASSOCIATES, S.C. d/b/a SUBURBAN SURGERY CENTER INCORPORATED, JOSEPH Z. PUDLO, M.D., and JOSEPH Z. PUDLO, M.D., S.C.

‌COOK COUNTY CIRCUIT COURT, ILLINOIS, Case No. 2019 L 012187.

Provided affidavit in support of a motion to compel for the revision history of the plaintiff’s medical records. Consulted with counsel in serving subpoena to EMR system provider.

Involved Greenway Health’s EHR platform.

‌CHRISTOPHER JOHANSEN v. NOW MARKETING SERVICES INC. AND INTERCOVE, INC.

‌CIRCUIT COURT OF WILL COUNTY, IL, Case No. 19-L-989.

Provided affidavit relating to departed employee apparent deletion activities including access of emails post employee departure in support of a motion to compel forensic preservation and analysis of the departed employee’s personal electronic devices.

‌ROBERT WATSON AND MARK SAULKA v. RYAN TODD WEIHOFEN AND POOL TECHNOLOGIES, LTD.

CIRCUIT COURT OF COOK COUNTY, IL, Case No. 19-CH-12252.

Provided affidavit discussing the expected costs of a third party producing electronically stored information.

‌BYRON FOXIE, as legal guardian and parent of TIGE W. FOXIE, v. ANN & ROBERT H. LURIE CHILDREN’S HOSPITAL OF CHICAGO, and ALMOST HOME KIDS, and OTHER UNKNOWN PARTIES, JOHN DOES 1-10 and ROE CORPORATIONS 1-10 CIRCUIT COURT OF COOK COUNTY, ILLINOIS, Case No. 19 L 7430

Provided testimony in the form of three affidavits supporting a motion to compel during discovery due to deficiencies in EMR production. Involved Epic EMR software.

‌PHOTOFAX, INC. v. MICHAEL CALDARAZZO

‌CIRCUIT COURT OF KANE COUNTY, ILLINOIS, Case No. 19-CH-000217.

Performed forensic imaging of departed employee devices. Assisted with the construction of an ESI protocol. Analyzed, signed an affidavit, and testified regarding alleged misappropriation of trade secrets.

‌BLACK ROCK TRUCK GROUP, INC. FKA NEW ENGLAND TRUCK SALES AND SERVICE, INC. v. HARRY TARASIEWICZ and JOSEPH TARASIEWICZ

‌UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK, Case No. 7:19-cv-2367

Performed preservation of evidence, search and production of ESI. Analysis regarding allegations of trade secret misappropriation. Provided testimony regarding fabrication of emails and destruction of evidence.

TERRI BROWN v. MOUNT SINAI MEDICAL CENTER OF FLORIDA, INC. ET. AL.

IN THE CIRCUIT COURT OF THE ELEVENTH JUDICIAL CIRCUIT IN AND FOR MIAMI-DADE COUNTY, FLORIDA

Case No. 2018-016560-CA-09

Filed affidavit regarding the inadequate production of Plaintiff’s electronic medical records.

JERAME ANDREWS, and THERESA ANDREWS v ANKLE AND FOOT CENTERS OF GEORGIA. ET. AL

IN THE STATE COURT OF GEORGIA FULTON COUNTY Case No. 18EV003536

Filed affidavit regarding the inadequate production of Plaintiff’s Electronic Medical Records.

UNITED STATES DEPARTMENT OF JUSTICE V. BUYANTOGTOKH DASHDELEG, PETITION FOR REMOVAL.

Executive Office for Immigration Review Chicago, Illinois, File No. A218-056-722

Filed affidavit regarding the authenticity of email transmitted.

‌PEOPLE OF THE STATE OF ILLINOIS v. CHRISTIAN DAIGRE‌

CIRCUIT COURT OF COOK COUNTY, ILLINOIS, Case No. 2018-cr-1626801

Provided affidavit regarding the lack of the original sources of data being preserved that would allow for authentication of SMS and MMS messages allegedly sent and received.

‌RILEY ANN BERGTHOLDT v. ADVOCATE HEALTH AND HOSPITAL CORP, ET. AL.

‌CIRCUIT COURT OF COOK COUNTY, ILLINOIS, Case No. 2018-L-8647

Provided affidavit detailing deficiencies with defendant’s production of Electronic Medical Records (hereafter “EMR”) produced from Allscripts and from EPIC.

‌ANDREA BROCK, MICHAEL BROCK, S.B. v. THE UNIVERSITY OF CHICAGO MEDICAL CENTER D/B/A COMER CHILDREN’S HOSPITAL

‌CIRCUIT COURT OF COOK COUNTY, IL, Case No. 18-L-1175.

Provided affidavit in support of a motion to compel production of the Patient’s complete EMR, including Defendant’s secure file storage system, “Sticky Notes”, “In Basket” messages, audit trail records and complete revision history of the EMR as stored in the EPIC Hospital Information System.

‌TERRI BROWN, an individual, and ALAN ROCK, her husband, v. MOUNT SINAI MEDICAL CENTER OF FLORIDA, INC. d/b/a MOUNT SINAI MEDICAL CENTER, a Florida Corporation; and WILLIAM F. BURKE III, M.D., an individual; and BRETT C. FUKUMA, M.D., an individual

‌CIRCUIT COURT OF MIAMI-DADE COUNTY, FLORIDA, Case No. 2018-016560-CA-09.

Filed two affidavits in support of a motion to compel for an on-site collection of plaintiff’s electronic medical records. Involved Epic EMR software and Synapse PACS.

‌THE FOREST PRESERVE DISTRICT OF COOK COUNTY V. ROYALTY PROPERTIES, LLC; CANNON SQUIRES PROPERTIES, LLC; MERIX PHARMACEUTICAL CORPORATION, RICHARD KIRK CANNON, MERYL SQUIRES-CANNON, MCGINLEY PARTNERS, LLC, AND ROYALTY FARMS, LLC CIRCUIT COURT OF COOK COUNTY, ILLINOIS, Case No. 18 L 315.‌

Provided in courtroom testimony on the significance of electronic file metadata as it relates to when documents were received and modified.

‌BROWARD ENERGY PARTNERS v. RAPPAPORT

‌CIRCUIT COURT OF COOK COUNTY LAW DIVISION, Case No. 18 L 1096.

Provided in court testimony and testimony via affidavit to assist with eDiscovery protocol process and address allegations of spoliation, withholding of information and authenticity of email.

‌JORIE LP, KOPLIN AND CONTENT CURATION & DATA ASSET MANAGEMENT v. ROBERTS MCGIVNEY ZAGOTTA ET AL.‌

‌CIRCUIT COURT OF DUPAGE COUNTY, ILLINOIS, Case No. 17 L 728.

Provided in court testimony and testimony via affidavit involving issues of email authenticity, cell phone fabrication of evidence, and eDiscovery.

‌MCMAHON v. DIGITAL FUEL SOLUTIONS

‌CIRCUIT COURT OF WILL COUNTY, ILLINOIS, Case No. 15 L 681.

Provided written affidavits regarding alleged software code misappropriation. Assisted counsel with seeking preservation of electronic data from third parties.

‌BORCHERS V. FRANCISCAN TERTIARY PROVINCE OF THE SACRED HEART, INC., ET. AL..

‌Case No. 2011 IL App (2d) 101257.

Testified in support of violation of the Electronic Communications Privacy Act by Plaintiff’s former employer.

http://www.illinoiscourts.gov/opinions/AppellateCourt/2011/2ndDistrict/December/2101257

.pdf

‌SABAN v. PHARMACARE MANAGEMENT, LLC ET. AL.

‌NORTHERN DISTRICT OF ILLINOIS (Chicago), Case No. 1:10-cv-02428.

Rebuttal witness regarding trade secret misappropriation.

‌TRANCO INDUSTRIAL SERVICES, INC. v. CAMPBELL

‌NORTHERN DISTRICT COURT OF INDIANA, HAMMOND DIVISION, Case No. 07-CV-206.

Won TRO – Violation of Computer Fraud & Abuse Act – Trade Secret Misappropriation Supervised and prepared our testifying expert for this case.

‌VALUEPART v. ITR NORTH AMERICA ET. AL.

‌NORTHERN DISTRICT COURT OF ILLINOIS, EASTERN DIVISION, Case No. 06-CV-02709.

http://www.forensicon.com/resources/case-summary/valuepart-v-itr

‌CHARLES A. KRUMWIEDE v. BRIGHTON ASSOCIATES, LLC AND ISMAEL C. REYES

‌NORTHERN DISTRICT COURT OF ILLINOIS, EASTERN DIVISION, Case No. 05-C-3003.

Supervised and prepared our testifying expert for this case. http://www.forensicon.com/resources/case-summary/krumwiede-v-brighton-associates/

‌S.C. JOHNSON & SON, INC. v. MILTON E. MORRIS ET. AL.‌‌

‌CIRCUIT COURT OF RACINE COUNTY, WISCONSIN, Case No. 04-CV-1873.

Led the investigation and preservation effort that uncovered personal webmail, revealing a fraudulent kickback scheme, which resulted in a law enforcement sting and later a successful conviction of the accused. This ultimately resulted in an award of $203.8 million to compensate SC Johnson & Son, Inc. for its losses. https://www.forensicon.com/resources/case-summary/wisconsin-appeal-sc-johnson-vs-mor ris-schelle/

LIEBERT CORPORATION ET. AL. v. JOHN MAZUR ET. AL.

‌CIRCUIT COURT OF COOK COUNTY, CHANCERY DIVISION, Case No. 04 CH 02139.

‌Appellate Court, Second Division, Case No. No. 1-04-2794.

Provided testimony via affidavit and in court, identifying patterns of trade secret misappropriation.

‌KALISH v. LEAPFROG ONLINE ET. AL.

‌CIRCUIT COURT OF COOK COUNTY, ILLINOIS, Case No. 03-L-011695.

Performed analysis of the computer used by the recently departed employee and reported on the employee’s actions to the court.

http://www.forensicon.com/resources/case-summary/kalish-v-leapfrog-online/

‌LORILLARD TOBACCO COMPANY v. CANSTAR (U.S.A.), INC. ET. AL.

‌NORTHERN DISTRICT COURT OF ILLINOIS, EASTERN DIVISION, Case No. 03-C-4769.

Performed forensic preservation and forensic analysis that resulted in identifying a counterfeiting syndicate. Located personal email accounts and offshore wiring accounts used to perpetrate the counterfeiting scheme. More than $5 million was awarded from Neubecker’s discovery of a counterfeit scheme.

‌EDUCATION & PROFESSIONAL DEVELOPMENT‌

‌TECHNICAL SKILLS

Managed Engineering Development and data analysis activities across many disparate technologies, from legacy through more recent technologies and platforms including;

‌Database Technology:

Filemaker, MySql, Oracle, Sql, Sql Server, Law eDiscovery, & Medical ERP Patient Record Systems

‌Forensic Software:

Aircrack, Airmon, Access Data, Mobile Edit Pro, Cellebrite, Encase, Paladine, Recon Lab, Forensic Toolkit, Paraben, & WiFite

‌Online Reconnaissance:

Dark Web, IRC, GFI Languard, Maltego, & Usenet

‌Security Monitoring:

Nmap, Splunk, Snort, Wireshark, Sophos UTM, & Shodan

‌Operating Systems / Command Line Shells:

Mac OS X, Windows (Dos/3.1/NT/2000/XP/Vista/2008/2012/7/8/10), Windows Server NT, 2000, 2008, 2012 (Active Directory, Group Policy Management, Certificate Management), Bash, Busybox, Amiga, Commodore, CPM, TI 99/4a, Grub, Kali Linux, Linux, Raspbian OS, Solaris, VMware, Raspberry PI OS, & Unix

‌Programming:

C++, CVS, DOM, Pascal, Xcode, Xml, Kintone, Python, Fabric & Visual Basic

‌Software Applications:

MS Office, SDR, Webx, WebTrends, Camtasia, Adobe Photoshop, MS Office, MS Project, MS Access, MS Excel, MS Powerpoint, MS Word, MS Visio, Peachtree, Quickbooks & Quicken

‌Web:

Expert in Search Engine Optimization, ASP, Coldfusion, HTML, Java, Javascript, Python, PHP, Scripting Languages, Artificial Intelligence, & WordPress

‌EDUCATION & PROFESSIONAL DEVELOPMENT

  • M.B.A., Magna Cum Laude – Babson F.W. Olin Graduate School of Business – Wellesley, MA
  • B.B.A. Finance, Magna Cum Laude – Eastern Michigan University Ypsilanti, MI
  • Guidance Software – EnCase® Introduction to Computer Forensics 32 credits – Sterling, VA
  • Guidance Software – EnCase® Intermediate Analysis and Reporting 32 credits – Sterling, VA
  • Guidance Software – Information Risk and Policy Compliance 3 credits – Chicago, IL
  • Continuing Education – Computer Programming – Harry S. Truman College – Chicago, IL
  • Novell Computer Network Training – Walsh College – Troy, MI

PROFESSIONAL EXPERIENCE

EnigmaForensics.com — President & CEO
Chicago, IL (8/2018 – Present)‌

  • Provided direct consulting to clients involving complex issues relating to eDiscovery
  • Retained by Government Agency to assist with deposing technical deponent in litigation relating to patient health care records
  • Assisted with developing a court approved protocol for production of ESI
  • Conducted complex investigations involving the authenticity of emails

HaystackID — Chief Information Officer
Boston, MA (4/2018 – 7/2018)

  • Managed all IT resources for eDiscovery production environment and internal systems
  • ‌Oversaw data center migration
  • Created documentation and work ticketing system for tracking problems and improving service response
    ‌HaystackID — Boston, MA (1/2018 – 3/2018)‌Chief Information Security Officer
  • Performed initial security assessment of organization
  • Prepared for GDPR compliance initiatives of organization
  • Outreach to potential clients

FORENSICON, a QDiscovery Company — Founder and consultant, Chicago, IL (2016 – 2017)

  • Identified opportunities to provide existing client base with services available from combined companies
  • Presented on the Telephone Consumer Protection Act regarding strategies towards mitigating lawsuits

‌FORENSICON, INC. — Chicago, IL (2000 – 2016)‌President & CEO

  • Conducted fraud examinations involving misappropriation of funds, trade secrets, tax evasion, money laundering, and other white collar related investigations
  • Supervised a team of forensics experts in providing complex litigation plaintiff and defense consulting
  • Appointed by the U.S District Court of the Northern District of Illinois to assist defense counsel in the trial against accused terrorist trial of Tahawwur Rana – The single count where my firm presented testimony, the defendant was found not guilty
  • Performed online investigative work to identify and assist law enforcement with the apprehension of the Boston Bombing perpetrators, Dzhokhar and Tamerlan Tsarnaev
  • Uncovered and reported the third known data breach of the Chicago Board of Elections voter database and election worker personal information
  • Supervised testifying experts on many cases of record to prepare technical experts for cross examination and rebuttal of their findings
  • Preserved electronic evidence for a range of clients using legally sanctioned protocols
  • Selected as preferred vendor by the Illinois Attorney Registration Disciplinary Commission – assisted with investigating various claims filed against licensed Illinois Attorneys
  • Developed Custom ERP System for evidence management, project management, time tracking and billing
  • Provided expert testimony to resolve disputes for various commercial, nonprofit, and governmental agency clients
  • Appeared several times as a computer forensics expert on WCIU TV Chicago Channel 26, First Business, NPR Business News, NBC Chicago and more
  • Led data breach first responder efforts for; State Government Social Services Department, Non-Profit HealthCare Organization, Financial Services Company, Accounting Firm, Private Membership Club Organization and various Corporations
  • Oversaw the development and presentations made to attorneys and legal support staff at the Chicago Bar Association, Illinois Attorney & Discipline Regulatory Commission, DuPage County Bar Association, various associations and more
  • Provided expert witness testimony regarding willful deletion of evidence by a departing employee where the testimony was upheld on appeal proving spoliation of evidence
  • Compiled emails from numerous platforms into popular litigation support platforms
  • Speaker at various events on the topic of computer forensics (see list below)
  • Performed computer forensics examinations in FBI forensics labs
  • Led the successful forensic analysis defense efforts against a law firm client of our firm that was accused of willful spoliation of evidence – discovered and reported our findings to Judge Mikva that no spoliation had occurred as alleged, the drive was merely encrypted and contained all information
  • Led numerous anonymous online defamation investigations resulting in the identification of many anonymous persons responsible for the defaming activities
  • Expert in Search Engine Optimization

LYCOS, INC. — Senior Product Development Manager, Community Products Group,
Waltham, MA (1998 – 1999)

  • Managed and/or launched a large group of products including chat, message boards, and games
  • Responded to SEC/FBI Inquiries pertaining to illicit behavior in Lycos network online properties
  • Tracked hacker attacks on the Lycos network of sites to help identify and prosecute offenders
  • Implemented safeguards against denial-of-service attacks across product group
  • Instituted product development and service roadmap management system for teams
  • Created & managed multiple cross-functional product teams
  • Managed transition of products from external to internal hosting
  • Led engineering team on the development of scalable & secure online products

‌INNOVATIVE CONSULTING, INC. — President Brownstown, MI (1994 – 1997)

  • Led a company of five professionals providing IT support to various sized Companies
  • Provided Network support in a multi server environment (NT, Novell, Mac, Linux)
  • Implemented financial management software for tier 3 automotive suppliers
  • Designed & executed disaster recovery procedures for multiple businesses
  • Architected multi-office communication infrastructure for multiple companies

‌‌COMERICA BANK — Securities & Trust Fund Accountant, Detroit, MI (1994)

  • Audited security transactions for bank trust funds
  • Researched discrepancies in reporting
  • Published & verified daily yield rates of several portfolios of marketable securities
  • Initiated automation of trust fund daily reporting

FORD MOTOR COMPANY, INC. — Detroit, MI (1992 – 1994)‌Product Pricing Analyst

  • Estimated cost impact on production forecast for various product design changes
  • Benchmarked sourced products to ensure price competitiveness
  • Designed & implemented a profit forecasting system using Excel & EDI

PRESENTATIONS

  • “Keys to Unlocking Electronic Medical Records EMR”, MCLE Tuesday May 25, 2021 delivered via Zoom co-sponsored by the Illinois Public Defender Association, the Illinois Innocence Project, the Center for Integrity in Forensic Sciences, and the Family Justice Resource Center.
  • Illinois Public Pension Advisory Committee: Friday, December 2nd’s IPPAC Winter Conference “The Imminent Threat of Cyber Attacks to your Pension Boards” panel
  • National Society of Insurance Investigators: “Cellphones, Pictures, Videos . . . What a Cyber Forensic Investigation Can Reveal”, December 4th, 2014
  • The Disaster Conferences : “Cyber Threats and Data Breaches”, September 18th, 2014
  • First Chair Awards : “Data Breach & Incident Response: How to Mitigate Your Risk Exposure”, August 2014
  • Cigar Society of Chicago : “How to Catch a Terrorist”, September 2013
  • ICPAS Fraud Conference 2012: “What a Responsible Professional (CPA or Attorney)
  • Should Know about eDiscovery and Document Management”, September 2012
  • Law Bulletin E-Discovery Seminar: “Managing Scope & Review”, June 28th, 2011
  • NetSecure ‘11: IT Security and Forensics Conference and Expo: “Protecting Digital Assets from Hackers and Thieves”, March 24th, 2011
  • Chicago Association of Litigation Support Managers, CALSMposium: “Seventh Circuit Electronic Discovery Pilot Program”, October 7th, 2009
  • National Business Institute – “E-Discovery Searching the Virtual File Cabinets”:(co-presented with Christopher S. Griesmeyer, partner at Levenfeld Pearlstein, LLC and David W. Porteous, partner at Faegre Baker Daniels LLP) “Obtaining Electronic Data & Best Practices in using Computer Forensics”, September 19th, 2008
  • Law Bulletin E-Discovery Seminar — “Electronic Discovery in Practice”: (co-presented with Jennifer Wojciechowski of Kroll Ontrack) “Avoiding the Pitfalls of the Electronic Era”, October 2005
  • Institute of Internal Auditors, Chicago West Chapter Meeting: (co-presented with Cameron Nelson, attorney at Greenberg Traurig) “Using Computer Forensics To Conduct Investigations”, May 9th, 2006
  • Association of Certified Fraud Examiners Workshop: (co-presented with Kathryn Hoying, attorney at Johnson & Bell, Ltd.) “Using Computer Forensics to Conduct Investigations”, February 10, 2006
  • Chicago Law & Technology Conference: “Computer Forensic Update”, co-presented with Greenberg Traurig LLP Attorney Cameron Nelson, February 23, 2006
  • FagelHaber, LLC’s E-Discovery Conference: (co-presented with Richard Chapman, Gary Green, David Rownd and Robert Kamensky, attorneys at FagelHaber, LLC) “Avoiding the Pitfalls of the Electronic Era”, October, 2005
  • Chicago Bar Association, CLE Seminar: (co-presented with Kathryn Hoying, attorney at Johnson & Bell, Ltd.) — “Deliverables to Request From Your Computer Forensics Examiner”,2005
  • Chicago Economic Development Council: “Internal Fraud Investigations”, 2005
  • Law Bulletin Publishing Company E-Discovery Conference 2005: “Show me the Smoking Gun!”, 2005
  • American Law Firm Association’s International Client Seminar 2005: (co-presented with Joe Marconi, attorney at Johnson & Bell, Ltd and Donald Kaufman, attorney at McNees, Wallace & Nurick LLC) — “Discovery, Document Retention & eDiscovery in aPost-Enron/Andersen World”, 2005
  • Chicago Bar Association, CLE Seminar: (co-presented with William J. Cook of Wildman Harrold, Jeffrey L. Hartman of Competitive Advantage Solutions and Mark S. Simon of Eclipsecurity, LLC) “Computer Forensics For Lawyers”, May 6th, 2004
  • Chicago/Milwaukee Joint Midwest Law & Technology Conference 2004: “Finding the Smoking Guns: Legal Computer Forensics Without the Geekspeak”, November 30th, 2004
  • Chicago Bar Association, CLE Seminar: “Resolving Intellectual Property Theft with Computer Forensics”, October 20th, 2004
  • Chicago Bar Association, CLE Seminar: “Computer Forensics for Lawyers”, May 6th, 2004
  • Law Bulletin Publishing Company E-Discovery Conference: “Electronic Document Collection and Processing”, April 27th, 2004
  • LegalTech 2003, Chicago : “True Electronic Discovery”, October 30th, 2003
  • Chicago Bar Association (Law Office Technology Committee): “Electronic Discovery 101”, 2003
  • Illinois Academy of Criminology: “Electronic Discovery 101”, Circa 2003
  • Greater Chicago Chapter of the Association of Legal Administrators: “Electronic Discovery 101”, Circa 2003
  • Chicagoland Chamber of Commerce: “Web Page Programming For Search Engine Effectiveness”, Circa 2001
  • NORBIC: “Web Page Programming For Search Engine Effectiveness”, Circa 2001
  • Law Practice Today — (July 2004) — Invited to be a contributing expert on a roundtable article by Dennis Kennedy on the online magazine: http://www.abanet.org/lpm/lpt/articles/ftr07041.html

ARTICLES

‌CURRENT & PAST MEMBERSHIPS / CERTIFICATIONS

  • Certified Information Systems Security Professional (CISSP) — Chicago Chapter
  • HTCIA (High Tech Crime Investigation Association) — Past President — Midwest Chapter
  • Illinois Academy of Criminology — Chicago Chapter
  • U.S. Secret Service Electronic Crimes Task Force Member — Chicago Midwest Region
  • Union League Club of Chicago — Technology Group Member
  • Association of Certified Fraud Examiners — Associate Member
  • State of Michigan — Private Investigator — License Number 3701205872

Preoperative Care and Informed Consent: An audit trail’s role in retrospective assessment

Informed consent prior to a procedure should be documented in the patients chart and visible on an audit trail.

by Dr. Aikaterina Assimacopoulos

Informed consent is a must prior to any elective procedure. After all risks, benefits and alternatives (r/b/a’s) are thoroughly explained consent can be given. An informed patient is one who understands the nature and purpose of the procedure as well as postoperative expectations of pain, recovery time, need for physical therapy, and any changes to physical appearance. Signed consent should be found in the patients EMR.

Informed Risk Assessment

Common surgical risks include the risk of infection, bleeding or damage to surrounding organs. If a minimally invasive approach is planned, the possibility to convert to an open procedure should be discussed. If the patient is to have an exploratory surgery, a risk is the possibility that nothing is found on exploration. In some cases, there is a potential the surgeon recognizes additional measures must be taken upon viewing the patient’s anatomy. In these cases, the surgeon is usually aware of this potential and should obtain consent and discuss r/b/a’s.

Doctor Washing Hands Before Operating. Hospital Concept.

The benefit or likelihood of a positive outcome should be clearly and realistically defined. The patient should be aware of any alternative options and their r/b/a’s. This includes both more conservative methods of treatment such as medications, physical therapy, or injections as well as any alternative surgical approaches that may vary in method or invasiveness. For example, a vaginal vs. abdominal approach to hysterectomy or LINX vs. Nissen fundoplication methods for gastroesophageal reflux.

A signed consent form and statement should be uploaded in the chart. For example, “r/b/a’s discussed, patient expressed understanding, all questions asked and answered” should be documented in the chart. However, this does not necessarily mean the patient was properly informed. Often this statement is included as part of a provider’s template, without being consciously documented. Therefore, this raises the question of whether or not the conversation actually took place.

Because this discussion is verbal, it is difficult to use an audit trail to prove whether appropriate informed consent was obtained. However, an audit trail can be used to analyze other aspects of preoperative care which, if deficient, or incomplete, could support the notion informed consent was deficient as well.  

What to look for in an audit trail

If surgical complications arose and the physician was concerned about the preoperative care provided, the physician could enter the patient chart after the fact and make additions to the patient’s chart. This is why it is necessary to get an audit trail that extends through the date the EMR is generated. Providers can alter a patients EMR at any time. These changes might not be visible on the EMR but will be on the audit trail.

In most cases, evidence of the following actions should exist in both the printed patient chart and the audit trail:

  • A clinic visit in which the patient’s need for surgery is assessed.
  • Any attempt to manage symptoms with more conservative first-line measures. For example, prescription orders or referrals to physical therapy or a pain specialist.
  • A diagnosis made prior to surgery and added to the patient’s problem list.
  • In some cases, evaluation of the patient’s personal risk due to any comorbid conditions is done using a ‘risk calculator’ and results should be documented.
  • A preoperative physical/assessment for higher risk patients.
  • A complete history and physical note (H&P) within the 30 days prior to surgery.
  • Procedure-specific labs and imaging which should be viewed by the surgeon prior to surgery.
Understanding EMR Audit Trails
Keys to Unlocking the EMR Audit Trails (Electronic Medical Records)

Withheld EMR Audit Trail Incites Default Judgement

Judge James O’Hara writes order in full support of the law to release all of patients audit trail information to them. This was in response to the case of Angela Prieto vs. Rush University Medical Center in Chicago.

Cook County Circuit Court Judge James N. O’Hara wrote a Memorandum Order for the case of Angela Prieto vs. Rush University Medical Center (“RUMC”) and other defendants. The 23-page order highlights some important federal statutes, such as HIPAA and the HITECH Act. This established a legal basis for a plaintiff to receive their complete electronic medical record. Judge O’Hara implements a severe sanction that effectively was a default judgement leaving only the dollar amount of financial award to be determined by the jury.

Case Background

Plaintiff, Angela Prieto, on behalf of her son alleged that RUMC “negligently caused [her son] to suffer from hypoxic ischemic encephalopathy and respiratory distress syndrome during birth.” The case was originally filed in 2018. The request for production of electronic health records was originally filed in January of 2019. Plaintiff requested RUMC to produce the complete and unaltered EMR and audit trail. As of January 2022, there were three repeated requests from Prieto for RUMC to produce the complete EMR audit trail. 

Audit Trails in EMR

The use of Electronic Medical Records (“EMR”) also known as Electronic Health Records (“EHR”) is mandatory to comply with requirements that health care providers maintain electronic medical records for patients. Every hospital, doctors office, or any medical practice in the United States must be compliant. The transition to using EMR began in 1992. Electronic medical records became mandatory since the start of 2014 through the American Recovery and Reinvestment Act.

All EMR systems are required by federal law to have an audit trail system built in. Audit trails show any deletions or edits that may not be part of the finalized medical record. A complete EMR audit trail shows all entry, access or modifications made to a patient’s chart. EMR audit trail productions should include all available records from the initial patient encounter until the date of production.

Audit Trail Manipulation

Health care providers often limit their production of audit trail records to the date the patient left the health care facility. However, this practice is problematic. When a patient’s EMR is modified after a Plaintiff files litigation and requests their complete EMR with audit trail records, manipulation of the Plaintiff’s medical records after that date can’t be detected. It is a common practice for healthcare providers to only produce the finalized patient EMR chart. This omits the revision history, a clear indicator of when the patient’s EMR was modified, by whom, from where, what time, and the specific redline changes that were made, as is required by any HIPAA compliant EMR system.

Federal Law Requires production of EMR Audit Trails to Patients involved in Litigation
Healthcare electronic charting

Electronic Health Records and EMR revision history must be retained by any HIPAA compliant EMR software system.

As Judge O’Hara put it in his order, “The term ‘Audit Trail’ refers to the part of the patient’s EHR that displays any person logging in to the record to modify the record, correct the record, add to the record, alter the record, revise the record, complete the record, put finishing touches on the record, and any other entry or access into the medical record, or any other name synonymous with the reflection of who, when and what a person did in relation to the Electronic Health Record.”

Request for ‘a complete, unaltered EHR Audit Trail’

He went on to discuss the EMR audit trail request in this specific case stating, “…requests asked for ‘a complete, unaltered EHR’…Prieto also requested ‘a complete, unaltered Audit Trail… in native format.’” This is a typical wording of requests for EHR or EMR Audit Trails that many healthcare providers fail to produce the first time. Instead, healthcare providers often send incomplete audit trails filtering out certain information.

…inspection revealed many aspects of the audit trail and EHR discovery that were either withheld, misrepresented or otherwise not produced…

Judge James O’Hara

When the Defendant in this case failed to produce the Plaintiff’s complete electronic medical records, including a complete audit trail and EMR revision history as requested, Judge O’Hara granted “a motion for in camera, on-site inspection of the auditing systems at RUMC…” Judge O’Hara actually attended the onsite inspection himself. The date for the on-site inspection with the judge was set and O’Hara wrote of it, “…inspection revealed many aspects of the audit trail and EHR discovery that were either withheld, misrepresented, or otherwise not produced…”

Federal Laws Pertaining to EHR Audit Trail Production

HIPPA

Judge O’Hara listed the federal law governing audit trails. “Congress enacted the Health Insurance Portability and Accountability Act (“HIPAA”) to ‘improve the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information,’” O’Hara quoted from HIPAA. He then continued, “In response to HIPAA, the Department of Health and Human Services (“HHS”) published HIPAA’s right of access rule: ‘Except as otherwise provided… an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set.’”

HITECH & THE Cures Acts

O’Hara went on to quote, “the HITCH Act in 2009, Congress ‘expanded HIPAA to include individuals’ rights to obtain electronic health records and added a stronger privacy and security requirements to protect health information.’” He continued on, “The Cures Act would later respond to a growing concern that healthcare software developers and provided sought to restrict the amount and types of information accessible to individuals by adding ‘information blocking’ provisions – to further encourage the broad access to patients’ own health information.” Healthcare providers often cite the “Designated Record Set” as not including the EMR audit trail or revision history.

U.S. Department of Health and human services (“HHS”)

Judge O’Hara continued to quote the rules of HHS in regards to a patient’s EHR audit trail production, “‘Individually identifiable health information’ is further defined as information created by a health care provider that relates to the provision of health care to an individual, among other things, that can be used to identify the patient. Id. In sum, audit trail information is included in the patient’s right of access if it is created or used by the healthcare provider, can be used to help treat or identify the patient, relates to the provision of health care to the patient, and is maintained in electronic media.” 

Electronic medical records with patient data and health care information stored electronically in tablet. Doctor using digital smart device to read the patient’s EMR chart.

The Alleged Burden of Producing the Complete Medical Record

The supposed time burden for the medical facility to produce the EHR Audit Trail and revision history is a major objection provided to the court as a defense to the request for a Plaintiff’s complete electronic medical record. Judge O’Hara addresses that point in stating, “HHS has acknowledged that this imposes a heavy burden on healthcare providers… However, the national policy is that this burden cannot overcome the patient’s right of access… HHS went even further to impose a scheme of penalties for entities that disobey this national policy.” 

Federal law says that audit trail data… is included in the patients right of access

Judge James O’Hara

Judge O’Hara finalized his section on the law by stating, “In sum, federal law says that audit trail data, including metadata associated with a patient’s EHR, is included in the patient’s right of access and that it constitutes information blocking to refuse to produce such data.”

Read the full order here: https://www.famjustice.org/_files/ugd/06ff46_3a6bcab463544b8b97bb10e7249405d8.pdf

In-Person Direct Access Provides Additional Information

An in-person on-site discovery will allow you to view what the EMR notes look like at different points in time, and gain access to inactive or deleted records. Check out this blog to learn more!

In-person direct access is what is often required to be able to get a complete view of what happened, because some of the data doesn’t show when you’re just looking at the produced printed charts. Such missing items may include: routing history, what the notes look like at different points in time, access to inactive or deleted records, and communications. Below is a screenshot from a popular Health Information System, Epic.

EPIC

Epic Notes View

So this is Epic and here you see the notes view and when you’re entering into the system, there’s routing which can give you additional detail about what happened in terms of the routing of the notes. You have a note time, a filed time, and a note time. In this case, all these records with exception of this one down here, the 10:04 AM note time was filed 15 minutes later. So it’s important to have both date and timestamps because sometimes, the file times are many days after discharge or nowhere contemporaneously to the events and that’s important if notes are being entered into this EMR days after something awful happened, you really want to know when those notes were filed. If they’re filed long after things went wrong, oftentimes, that suggests that fabrication of the EMR took place. You can see here, here’s some of the routing, it allows for you to specify different recipients and so knowing that routing of information, that’s important because it’s not always evident when you’re looking at the chart. Here’s an example of adding a note and you can see here, there’s the ability to copy and paste different notations. The date and time on these notes when you first go to create a note, default to the current computer’s clock time but it’s totally possible to change the date and time to put it back in time by dates or hours and that information is relevant. Here’s an example of the Cerner notes. Again, Cerner allows the user to change the date to something other than the current date and time. And it still stores, again, the creation time of that note, even if the note purports to be days earlier. And there are also different filters here, when you’re looking at the EMR with power notes on Cerner, there are different filters, such as my notes only, there’s inactive, active, and so on.

Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.

Part 1 of 4: “The Keys to Unlocking Electronic Medical Records”
https://enigmaforensics.com/blog/keys-to-unlocking-the-emr-audit-trails-electronic-medical-records/
Part 2 of 4: “HIPAA”
https://enigmaforensics.com/blog/health-insurance-portability-and-accountability-act-of-1996-hipaa/
Part 3 of 4: “Navigating to Trial or Settlement”
https://enigmaforensics.com/blog/navigating-to-trial-or-settlement/
Part 4 of 4: “In-Person Direct Access”
https://enigmaforensics.com/blog/in-person-direct-access-provides-additional-information/

Navigating to Trial or Settlement

Where does one start when requesting Electronic Medical Records or EMR’s? Enigma Forensics has created a process for you to follow to help navigate to trial or settlement.

Process of Navigating to Trial or Settlement

Lee Neubecker: So now I’m going to a little bit about the overview and process of working one of these cases with electronic medical records, such as myself. And typically, the cases start off with the need to make the request for the complete electronic medical record. Oftentimes, attorneys contact us when this has already been done but they suspect that the data is deficient in some way or fabricated.

So, we often will review the records produced, identify examples or problems with filters, anything that looks suspect, and then assist with drafting a supplemental request to produce.

If the supplemental materials are produced, we review that. We look for deficiencies in the records, and oftentimes there will still remain deficiencies. So in that case, we have to spend time analyzing the EMR and working on a report of sorts that shows examples of what’s missing. And at that point in time, we’re trying to compel the judge to order an inspection. On the converse side, if we’re working for the hospital, we’ll be looking through the EMR and often reporting to them whether or not there was a fabrication by hospital staff and that’s important for insurance carriers because they want to understand what the risk is if they litigate a case to trial. And it may be more advantageous to simply settle the case if there are some problems in the EMR.

So after we’ve drafted the motion to compel, well, typically, we write an affidavit in support of the motion to compel an onsite direct inspection. That motion gets filed by the attorney with our affidavit attached and then there’s a hearing. These days, the hearings tend to be on Zoom telephonically, and oftentimes the judge will ask questions. Essentially when we’re doing an onsite, what we want is we want to be able to see the entire record of the patient as the physician can see it, the communications between providers, and the complete revision history. This often requires videoing or taking photos of the data to capture data that are not easily printed from current reports with the HIS system.

So when the onsite inspection happens, it’s not uncommon that there will be multiple experts there. I’ve been hired to observe an inspection by a plaintiff counsel that is seeking to look at the EMR. In that role, I’m looking to just document and understand how they’re requesting the data, whether data is being withheld despite the onsite, and to advise my client in terms of what the data is that was produced and whether there are any issues with it. The onsite inspection isn’t where the analysis happens. It’s usually an effort to try to dump all the data out, run reports, make sure the settings are documented appropriately, and really that the only filter being used is the filter for the patient. There should be no other need to filter anything. Those records are the patient’s records. They have a right to that content and this process is one that is going to become much more common as we continue with the understanding of medical records and audit trails becoming more prevalent. After the onsite inspection, there’s a need to review that data. Oftentimes normalize it again, compare it against earlier produced EMR. That analysis might document that early on, that the health care organization was willfully holding back information that was key and important. And so, in instances where that happens, there’s a need to write a report to document those changes or deficiencies. And long before the trial happens and the reports issued, the expert witness that you use is your EMR expert will have to be deposed most likely. And what I usually find, at least in cases I’ve been involved with is that the cases typically settle after the deposition. Because at that point in time, you’re really looking at what does the factual record reflects? There are not so many opinions so much as there are facts. In some cases, there are opinions about why does the chart shows lots of entries that all were created days after discharge and they’re all unrounded hours with no minutes. In a situation like that, my opinion would be that’s likely fabrication because usually if you’re entering notes and other procedures contemporaneous to events, you’re going to have randomization of the minutes and everything is not going to be stacked up at zero, zero minutes on the hour.

So if a case is going to trial, there’s a need to prep your EMR expert, to let them review the timeline, the earlier affidavits in the data that was collected so that they’re prepared for trial. In most cases, so cases tend to settle and they usually settle after the onsite inspection and collection of data. Sometimes they’ll settle much earlier. I’ve seen cases settled as soon as I get involved and help with writing a request for supplemental production but sometimes the cases go on further. In my experience, the further along through this process the plaintiff gets, if we’re able to identify willful withholding of records, the settlement offer tends to be much higher.

1. Request Patient’s Complete EMR

  • Provide the complete EMR audit trail for [Patient Name] detailing any health care provider’s access, review, modification, printing, faxing, or deletion activities in a comma delimited format with any and all corresponding native files or records that may relate to the patient as required by the HIPAA § 164.312(a)(1).
  • Audit trail should include the complete revision history of the EMR 
  • Provide the name of all medical software applications utilized to store EMR
  • Provide the data dictionary for each software application containing EMR 
  • Provide all User and Administrator Manuals for each EMR software application

Email [email protected] for a complimentary sample request for EMR

So, I gave an overview of this. There are slides here that I’ll walkthrough. I want to have plenty of time for questions. So, I’m not going to read each of these but in summary, you want to make sure that you’re getting all the data and there’s an outline here, if you email [email protected], she can send you a complimentary sample request for EMR that helps you form that request. Obviously, you may want to retain us to help you tweak that for your specific circumstances. It’s a good idea though to ask for the user manuals when you’re doing this process and you want to make sure that you’re clear about asking for the complete revision history.

2. Review EMR Records Produced 

Identify Examples of Withheld Records or Apparent Manipulation

  1. Filters beyond the patient used such as user id or department
  2. Lack of production of records from the beginning of the notable time period until the date the EMR report was generated
  3. Audit trail lacks details of the revision history
  4. Production of the data in a non-usable format

So I talked about the review of the records produced and typically, we’re trying to identify examples of withheld records or other things that we can find or prove that are deficient from the production. Audit trails that lack the definition of what was being changed are an example, the production of data in a non-usable format, going onsite to have it exported. So it’s not produced in a crazy, out-of-order duplicative format is often helpful.

3. Request Supplemental Production of Deficient Records

  • Ask for what you want specifically before filing a motion.
  • Request the complete revision history showing the life cycle of the patient’s EMR.
  • The supplemental request for the production of deficient records is likely to not bear fruit but is necessary to show you tried to work things out before seeking judicial intervention.

So when we’re asking for the records that we’re missing, we want to be specific on that and ideally pose that directly to opposing counsel in an email. So that it’s documented and that way, if you’re hearing a motion, you can show the judge that you’ve already tried to be specific about what you were asking for. It should always include the revision history. That phrase is so important. Usually, that’s missing from productions. And it’s often, the case that even though you ask for things correctly, they still aren’t produced as requested. So, having that clear documentation of asking for it in email is important.

4. Review Supplement Production of Records Received

  1. Immediately review the supplemental production upon receipt.
  2. Check to see if the request that was made was answered correctly.
  3. To the extent that production remains unresponsive, communicate that to opposing counsel before filing your motion.

So when the supplemental production comes in, we want to typically look at that quickly, try to see if they’ve complied or failed to address certain sections. If they failed to disclose their filters or they filtered things differently than requested, you want to create a paper trail and send a follow-up email asking for that, and then if they don’t comply, that’s going to help you with your motion to compel when appearing in front of the judge.

5. Affidavit in Support of Motion to Compel Onsite Direct Inspection

  1. Detailed foundation for the request
  2. Reference prior requests and data produced
  3. Communicate the deficiencies in the produced EMR
  4. Establish examples where the revision history showing changes is important
  5. Establish that the reported dates are not necessarily the original entry time and that modification history can be obtained by directly examining the EMR system

So the affidavit that we’re generating is typically outlining these deficiencies. It might be sharing exhibits that include the emails that you sent asking for the data. We want to make sure that we’ve detailed the foundation for the request, pointing out examples of what was asked for what was produced, how that was deficient? Giving examples where the revision history showing changes is important. Specifically, the lack of when the records were actually created or last updated, who updated them, when? That information is very important and it’s often not in the initial round of production of EMR.

6. File Motion To Compel Onsite Inspection Of EMR  

So, finally the motion to compel the onsite inspection of EMR, there’s a useful case out of Kentucky, Western District of Kentucky, the Borum versus Smith case. I think on our website, if you search at enigmaforensics.com for Borum, B-O-R-U-M, there’s a hyperlink to this case and it’s a federal case that lays out the arguments establishing and overcoming objections made by a hospital resisting an onsite inspection. So this can be very useful to lay the groundwork for arguing your motion to compel.

7. Court Testimony in Support of Motion to Compel Onsite Inspection

  • Having your EMR expert at this hearing is important
  • Overcome objections
  • Establish protocol for examination
  • Allow recording of the HIS software as it relates to the patient
  • Allow for the reproduction of previously produced EMR to verify filter settings and obtain the data in a delimited format
  • Ensure that all versions of notes including inactive and historical versions are included in the production of EMR

When that motion to compel hearing is held having someone like myself there to be able to answer questions of the judge, overcome objections, help to establish protocols for the exam to ensure that it’s effective and not a waste of everyone’s time is important. Recording of the HIS software should be allowable. An agreement to redact or call out anything that might’ve been captured that doesn’t relate to the patient is something that I see there’s no issue to but the ability to document and the record is critical. Ideally, during this onsite, you want to be able to reproduce what they produced previously so that you can confirm whether or not they had filters applied to it. If their earlier production of EMR only includes active records and no historical records, producing it in a more complete manner will help you to demonstrate to the court that the hospital was holding back important records that were your patient’s or your client’s records, that they have a right to. So again, making sure that inactive historical versions are included in the production of EMR is very important.

8. Onsite Inspection – Capture of Patient’s EMR 

  • Inspection can occur using Zoom or other remote desktop tools
  • An in-person inspection can be advantageous
  • Your EMR expert should be able to direct the health care provider’s IT admin to perform any query or other activity that relates to the patient
  • Data can be saved to external media for later examination
  • Your EMR expert should be allowed to capture photos or video from the live system

So inspection onsite during the pandemic, a lot of things have shifted to Zoom or WebEx, that can certainly happen. An onsite inspection does have advantages and I usually recommend the onsite where possible. Now that vaccines are widely available, the concerns over going onsite should be much less. During this inspection, I always recommend that the healthcare providers, IT person with admin rights actually be the person that’s typing at the keyboard and moving the mouse but at the direction of the requesting party. That helps protect from any potential harm to the hospital information system and really shuttle out for full observation of the EMR as it exists within the system.

Typically, data is exported to external media and at the conclusion of that, the data is shared with a producing party, in requesting party subject to the right for either party to deem data confidential or redact, which typically, the confidentiality requirements, hospitals are already following that for the most part. So really, as long as the data is restricted to the patient, there really shouldn’t be much reason to hold back data that belongs to a patient as long as it’s just that patient’s data. That data will be examined after the onsite when there’s time to analyze it.

9. Review Records Captured Onsite

  • Limited time for onsite inspection and collection of data
  • Consider delaying review if a settlement offer is likely
  • EMR expert compares initial productions vs. onsite data collected
  • Identify examples of manipulated records or previously withheld records
  • Consider disclosing some of these smoking guns before proceeding with a written report by an EMR expert 

So after the onsite, that’s when there’s more time to look at the data to analyze it, to compare it. If there’s an expectation that smoking guns were captured during the onsite, sometimes a plaintiff expert might want to just hold off for a week or two if they think that a settlement’s likely so that the costs aren’t incurred. To discuss the comparison of initial productions versus what was collected on-site, trying to identify examples of manipulated records or previously withheld records can be important in understanding what happened with the case.

So whether or not you write a formalized report or just disclose some of the smoking guns, that’s a decision that plaintiff counsel often considers. Defense counsel often needs to consult with their insurance carrier and have someone like me help tell them what the situation is so that they can decide, does the case have merit or should you proceed to trial and not make a settlement?

10.  Write Final Report

  • Detail examples of previously withheld information
  • Detail examples of fabrication or manipulation of information
  • Clarify what happened with the EMR

So the final report that gets written up again, details, examples of previously withheld information. Examples of fabrication or manipulation of information and trying to clarify, in human words, a storyline of what took place.

11. Expert Witness Deposed

  • Survive Daubert challenge
  • Avoid mistakes
  • Establish a foundation for the admissibility of electronic evidence
  • Clarify any opinions expressed in the affidavit(s) or report(s)

So, when the deposition phase occurs, it’s important that your expert be able to survive a Daubert challenge. You don’t want to have all the work tossed out because the collection of data was not done properly or not performed by someone that has appropriate experience. It’s important to try to avoid mistakes, which sometimes typos happen and whatnot but trying to minimize mistakes typically requires giving your expert time to review and proof their report. Having other peer review processes performed and engaging with your expert to make sure that everything is clear and understandable. And ultimately, you’re trying to establish a foundation to admit important information that relates to EMR so that you can clarify what events took place and having your expert be able to explain that to a judge is really important.

12. Trial Testimony with Prep

  • Select an expert that is skilled at presenting technically complex information to non-technical audiences.
  • Verify that your expert has court testimony experience.
  • Ensure your expert has time to review materials before trial.
  • Most cases never make it to trial and settle earlier where the EMR speaks for itself.

So one of the things you want to look for when you’re picking an expert, you want to look for identifying an experienced expert that has testified on cases before and is capable of taking technically complex information and presenting it in an easy-to-understand manner. And that isn’t always easy for many geniuses out there that understand a lot of complex information. You want to make sure again, that your expert has time to refresh and review the materials before trial. Experts that are busy are going to be in many different cases and shifting between one med mail case matter in another involving EMR takes some time to shift.

So, I like to try to work on a case solidly for a period of time, get it up to a report, finish that and then come back to a case at the next checkpoint so that I can focus and not be split between two similar but different cases. As I said before, most cases never make it to trial because ultimately, the electronic medical records, if obtained and produced in their entirety with the date and time that they were entered, modified, and whatnot, that data will typically speak for itself. So, whether you’re defending a case or pursuing one, getting an understanding of events that took place, it’s highly critical.

13. Case Settles or Case Dropped

  • In our experience, in cases where EMR has been withheld or manipulated, settlement agreements are usually reached.
  • Establishing that the medical record doesn’t support allegations of abuse can result in a case being dropped.
  • Settlement offers increase when you are able to prove that the health care provider purposely withheld information.
  • Proving willful fabrication or manipulation of the EMR can help win the highest settlement.

So when we find examples of manipulation of information, settlement agreements are usually reached because if a hospital took a case to trial and it was proven that they manipulated the records, they would face far more litigation from other plaintiffs as a result of that. In some cases, some of the outcomes might not be to have a cash settlement, it might be for a parent to regain custody of their child because there were inappropriate allegations of harm that aren’t substantiated by the electronic medical record. If you can prove that a healthcare provider purposely withheld information, it’s really helpful to get a settlement or a favorable outcome if you’re on the plaintiff’s side. And again, as I said, what I’ve seen is the highest settlement offers usually come if you prove the willful fabrication or manipulation of EMR.

I had a case back in, I think it was around 2004 involving a heart catheterization operation that went wrong, and days after the operation, the patient was discharged and then passed away. It’s an unfortunate circumstance that left a family with one less parent. In that case, so years after the accident, the surgeon produced a CD disk that contained the video clips documenting the surgery. But what happened when I examined the CD, I was able to establish that the CD had been created a month previously. The CDs have headers that show the date and time that they’re created by a specific computer.

Furthermore, I looked at the video clips, there were DICOM video files. DICOM is digital imaging and communication of medicine and these video files had embedded metadata that showed the sequence number and the date and time and length of the clip. Well, what had happened is I think it was clip six, seven, and eight were deleted nine, 10, and 11 were renumbered to be six, seven, and eight. So there were three video clips that were removed and then the renaming of the files effectively made it look like the deleted clips never existed. Well, in doing forensics on that, I was able to establish what had happened and then during my deposition, I testified to that. At the end of it, the attorney for the hospital asked me, do you have any proof that the hospital had anything to do with this? Keep in mind, the surgeon was the one who produced the CD years after the operation.

Oh, my reply to the attorney for the hospital was if, given the opportunity to examine the hospital’s equipment, I could determine whether or not the CD that was produced was generated by their equipment and my deposition ended. Quickly after that, they asked for my business cards and then the maximum settlement of the insurance coverage from both the surgeon and the hospital, that offer was made in the case of, so it was a favorable outcome.

One other thing too, in many cases that have caps on liability, if the plaintiff is able to prove willful manipulation, in some states, those caps go away. So, if you’re defending a hospital in one of these cases, having someone like myself help you determine if the EMR shows willful manipulation or fabrication. That can be very important because exposure to the hospital could be much greater than in the case where things simply, you know, mistakes happen and unfortunately, mistakes happen and good people suffer harm as a result of disease, surgeries, and whatnot. But in situations where bad things happen and then individuals in a healthcare organization take efforts to fabricate the record, to make it look other than what events really took place, that can be very risky for a healthcare provider. And knowing that early on in a case is really important that hospitals know that and other health care providers. So in those situations, I’ve had a lot of experience digging in and answering those questions quickly before the plaintiff gets their answers. I’ve also helped the plaintiff get the answers to those questions and reached satisfactory settlements.

Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.

Part 1 of 4: “The Keys to Unlocking Electronic Medical Records”
https://enigmaforensics.com/blog/keys-to-unlocking-the-emr-audit-trails-electronic-medical-records/
Part 2 of 4: “HIPPA”
https://enigmaforensics.com/blog/health-insurance-portability-and-accountability-act-of-1996-hipaa/
Part 3 of 4: “Navigating to Trial or Settlement”
https://enigmaforensics.com/blog/navigating-to-trial-or-settlement/
Part 4 of 4: “In-Person Direct Access”
https://enigmaforensics.com/blog/in-person-direct-access-provides-additional-information/

Keys to Unlocking the EMR Audit Trails (Electronic Medical Records)

Have you ever requested Electronic Medical Records (EMR’s) and its beyond difficult to read? The printed pages are not searchable, mixed in with junk, lacking versions that you know should be recorded? Check out this video blog with transcripts. Lee Neubecker, CEO and President of Enigma Forensics offers keys to unlocking the mystery of EMR’s.

Click to view Video on Keys to Unlocking the EMR Audit Trails
(Electronic Medical Records) 

Video Transcripts follows:
EMR Audit Trails, as produced by Healthcare Providers during medical malpractice discovery, frequently filter out the important history of the patient’s medical record. Learn how to compel discovery of the patient’s complete EMR history.

Lee Neubecker: So today, we’re going to be talking about the keys to unlocking Electronic Medical Record Audit Trails. We have a mixture of people on the webinar today. I know some people represent healthcare providers. Other people represent litigants involved with medical malpractice. I’m going to be talking a little bit today about how the process works.


Scenarios where Electronic Medical Records (EMR) are important

  • Eldercare neglect or abuse
  • Failure to provide appropriate & timely care leading to patient injury
  • Failure for staff to provide to correct type of care
  • Credentials of staff that performed procedures
  • Discussions between staff are relevant
  • Establishing the supervising physician neglected appropriate care
  • Allegations involving child welfare accusing parents of harming a child

Lee Neubecker: We’ll begin with discussing some of the scenarios where Electronic Medical Records are relevant and important. If you’re suspecting that the elderly has been abused in a nursing home, that could be important to know. Records of care when medications were provided, whether or not patients were neglected. All of that information can be discerned from reviewing the electronic medical record history. In some cases, there’s allegations about not providing appropriate care over time or the staff providing the wrong type of care. So, many of these cases become litigated in various medical record experts or clinical experts get involved. We’ll be talking about later today about how you really want to start with getting command of the EMR or Electronic Medical Records so that it can be efficiently reviewed not only by you and your team but also by any experts that might be retained to assist with the case. It’s important to understand that there might be discussions between staff, physicians and nurses and whatnot that aren’t in the progress notes or printed medical record. So we’ll be covering that in a little bit. Allegations about harm to children by parents or healthcare providers. That’s also relevant as well. In some cases, we’ve seen situations where the chart reflects a certain color of bruising many days after a child was admitted into a facility for care but the coloration of bruises often can suggest that the bruising happened before entry into a facility. On a case like that, knowing whether or not the child was bathed and whether it was reported early on can help determine was the child injured in the health care provider’s place of care or did it happen prior to admission?

What typically happens when you request the EMR

  1. Printed pages (not searchable)
  2. Mixed in with junk
  3. Sorted most recent to oldest
  4. Lacking version historical revisions
  5. Limited reports that have unnecessary filters
  6. Hold back on communications (Sticky Notes / Routing)
  7. Records entered not contemporaneously to events 

Lee Neubecker: So what typically happens when you ask for the electronic medical record for your patient or your chart, the healthcare providers will often produce it in the most unhelpful way. They might print it if it’s printed or dumped to a PDF that’s flattened, it’s not searchable.

It might be included with lots of redundant information, out of order, sorted not intuitively from oldest to newest, but backwards. Oftentimes, the version revision history of the progress notes are completely missing. So, for instance, if you have an Epic EMR production. With Epic, they have the ability to enable the specific version number so that you can determine the revision history over time and that isn’t always what’s included in the printed report that gets produced.

Some reports will have unnecessary filters. For instance, if only named providers are shown and you don’t see a mixture of healthcare staff providing care to a patient, that might suggest that the report was produced with only the name key healthcare providers included. And so, when you’re requesting electronic medical records, you really want to be very specific to say, use no other filter other than the patient identifier or the patient medical record number, date filters and whatnot, narrowly defining the date and time when the patient was in the hospital or healthcare facility might result in filtering out of important records that show that the chart might’ve been modified or manipulated well after the patient’s departure from the facility and after the patient experienced some type of harm.

Another thing I see, sorry about that. Another thing I see that happens sometimes is in addition to different filters, such as like filtering by date or filtering by healthcare provider or department, sometimes the filters aren’t displayed on the reports and you really want to be able to understand what filters are used. One other filter that might be used without your knowledge is whether or not the record is considered confidential.

Confidential would suppress the record oftentimes from appearing on the printed medical record report. So you want active, inactive, all version history, confidential, you want the entirety.

Another important thing that is relevant in many cases involves the communications between healthcare providers. With Epic, you have the ability and with Cerner, you have the ability for routing of communications, either almost like an email system within the healthcare system or something known as sticky notes, which is basically like an instant messaging platform between healthcare staff about a patient.

And there’s documentation out there where hospitals say that sticky notes are not part of the medical-legal record. Well, HIPAA requires that all that data be retained. So the data is in there, it’s in the backend database or you have to inspect the hospital information system to be able to document it on the photo or on video.

Another thing that we see a lot of our records that are entered in, after the fact, when you enter a record into a hospital information system, you can list the reported date and time of the event but that is oftentimes different than when the record was actually saved and created in the system. So we’ll talk about that more as we go through.

Important Concepts & Terms

  • (EMR) Electronic Medical Records
  • (EHR) Electronic Health Record
  • (HIS) Health Information System
  • (PACS) Picture Archiving and Communication System
  • (ePHI) / (PHI) Electronic Protected Health Information
  • Data Dictionary
  • Delimited Format
  • Native Files
  • Audit Trail
  • Audit Logs
  • Pivot Tables
  • OCR (Optical Character Text Recognition)

Lee Neubecker: First, I’d like to cover some important concepts and terms that are relevant to Electronic Medical Records in medical malpractice litigation.

EMR, Electronic Medical Records is synonymous with EHR, the Electronic Health Record. A hospital Information System is sometimes referred to as HIS and that’s like Cerner or Epic or Meditech or whatever software system is being used to manage the patient care and store their electronic medical record. PACS is specific to video, phototypes involved with the documentation of electronic medical records, as it pertains to things like MRIs, x-rays, videos of surgeries, and so on. And each of these systems often has its own audit logs separate from the HIS system. ePHI is Electronic Protected Health Information. That’s what all the stuff is about.

Data dictionaries are abstract or key to help you to cross-reference the initials of the health care provider or the department or procedures or lab test results to the friendly name. And if you’re working on one of these cases, you want to include in your request for production, a production of the data dictionary, so that you can make sense of the charts and records that are produced to you.

Another thing that I like to ask for when I’m getting electronic medical records is to request that that data be produced in what’s known as a delimited format, which is like a spreadsheet format, sometimes known as comma-delimited. That allows you to manipulate the data much more easily and filter and aggregate and do things that can help you see into what’s happening quickly without having to review oftentimes tens of thousands of pages.

Native files refer to the file as it exists. Like if there’s a transcription that’s saved as a WAV file that has the original doctor’s notes, asking for the native file of the transcriptions would give you the actual file that was recorded, as opposed to some transcription of the file.

Audit trail or audit logs, HIPAA requires that data be stored about the creation, modification and access of electronic health records. And these audit logs will show when things are added, updated, modified. The logs and audit trails that are produced often don’t answer the key question about what changes are happening. And usually, I get involved with helping the parties understand well, what really happened? What was a real revision history? When did it occur? Who did it, from what computer? At what date and time was data deleted? Was it added? And that’s very relevant to many medical malpractice cases. When we’re analyzing data, some of the things we can do, we can take the electronic medical records if they’re produced in a delimited format, we can quickly prepare aggregate summary charts that might show how many minutes did, or how many interactions with the EMR did the supervising physician have? What dates and time where the records looked at? When did modifications occur? If modifications occurred after a patient’s discharge, which I see quite a lot of times, that can be suggestive of efforts to fabricate the medical record history.

When we get the data, in addition to trying to get it into a delimited or a spreadsheet format, we’d like to make sure that the data is OCRed, which is optical character text recognition, that allows for searching and key concepts, names of providers, dates and times and so on. And all of that can be very important as you work a case.

Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.

 

Part 1 of 4: “The Keys to Unlocking Electronic Medical Records”
https://enigmaforensics.com/blog/keys-to-unlocking-the-emr-audit-trails-electronic-medical-records/
Part 2 of 4: “HIPPA”
https://enigmaforensics.com/blog/health-insurance-portability-and-accountability-act-of-1996-hipaa/
Part 3 of 4: “Navigating to Trial or Settlement”
https://enigmaforensics.com/blog/navigating-to-trial-or-settlement/
Part 4 of 4: “In-Person Direct Access”
https://enigmaforensics.com/blog/in-person-direct-access-provides-additional-information/

How to Unlock Electronic Medical Records

Electronic Medical Records can make or break a case! Do you want to learn how to unlock an Electronic Medical Record Audit Trail? Check out this complimentary MCLE (1 hour) credit seminar via Zoom, as Enigma Forensics CEO, Lee Neubecker offers keys to unlock the mysteries of the EMR audit trail. Read through this blog to register for this complimentary event.

Please join Enigma Forensics as our CEO, Lee Neubecker, as he presents:

“Keys to Unlocking Electronic Medical Records EMR”

Tuesday, May 25,

noon-1:00 p.m. Via Zoom

This complimentary program is offered for 1 hour of MCLE Credit in Illinois.

Register here: https://osadil.eventsair.com/2021-the-keys-to-unlocking-electronic-medical-records/2021-thekeystounlockingelectronicmedrecords/Site/Register

Enigma Forensics is partnering with the following sponsors:
The Family Justice Resource Center

If you are facing a wrongful allegation, The Family Justice Resource Center can help. The process of overcoming a medically-based wrongful allegation is exceedingly difficult. They offer a place to turn for families facing allegations of abuse and neglect. By learning the keys to unlocking the Electronic Medical Records it will become easier to uncover the root cause of every allegation. #https://www.famjustice.org/

Center for Integrity in Forensic Sciences

The Center for Integrity in Forensic Sciences (CIFS) is the first non-profit organization in the United States to bring exclusive focus to improvement of the reliability and safety of criminal prosecutions through strengthening the forensic sciences. Its educational and service goals span legislation, all facets of the judicial system, and experiential education of tomorrow’s lawyers and scientists. Its innovative approach allows law students and both undergraduate and graduate students in the sciences to work collaboratively, expanding the knowledge and competency of students across that broad spectrum. #https://cifsjustice.org/about-cifs/

Illinois Innocence Project

The Illinois Innocence Project (IIP) is dedicated to freeing innocent men and women imprisoned in Illinois for crimes they did not commit. They advocate on behalf of this silenced population by researching and investigating claims of innocence and providing legal representation and other assistance to prove credible claims of actual innocence. #https://www.uis.edu/illinoisinnocenceproject/about/

Illinois Public Defender Association

The Illinois Public Defender Association was incorporated in 1969 as a non-profit 501 [c][6] an educational organization for Public Defenders. The goals of education, interchange of ideas, and camaraderie are reflected by semi-annual seminars serving Public Defenders and court-appointed counsel in all 102 counties. #https://www2.illinois.gov/osad/PublicDefenderInformation/Pages/PDAssociation.aspx

Enigma Forensics

Lee Neubecker is CEO and Founder of Enigma Forensics. We are a computer forensic company that focuses on Electronic Medical Records and Data Recovery. We are pleased to offer this complimentary MCLE credited event.

To learn more about the keys to unlocking Electronic Medical Records EMR

How to Compel Discovery of Electronic Medical Records

How to Compel Discovery of Electronic Medical Records

EMR Audit Trails as produced by Healthcare Providers during medical malpractice discovery frequently filter out important history of the patient’s medical record. Learn how to compel discovery of the patient’s complete EMR history.

Are you attempting to compel the production of a patient’s electronic medical chart and the complete electronic medical record audit trail?

Medical malpractice litigation today routinely requires obtaining the complete electronic medical record audit trail. Compelling the entire patient’s EMR Audit Trail Discovery is vital to the case. Hospitals, clinics, dentists, and other health providers are required to document patient interactions in electronic HIPAA compliant Healthcare Information Systems (HIS). Electronic Medical Records (EMR) also referred to as Electronic Health Records (EHR) are used almost interchangeably. Requesting and receiving the complete EMR for a harmed party can be a daunting process, especially when health care providers produce voluminous audit trail reports in paper form that lack any clear documentation of exactly what changes were made to the EMR.

HIPAA compliant HIS software providers are required to log all access, review, editing, and deletion of records. Such logs must include a record of the user making the change, the source computer that made the change, the date and time of the records actual creation (this can be different than the date and time stamp that appears on the printed patient chart or progress notes), and all versions of the chart as it existed at various points in time. While the HIS software providers maintain HIPAA compliance, ensuring that deleted or revised patient records remain in the HIS record, those earlier revision instances or deleted (marked inactive) records are routinely left off the patient’s printed EMR. By design, the EMR audit trail reports lack the specific modifications being made and by whom. It is often necessary to formulate your discovery request in a specific way to ensure that all audit trail logs from all of the various HIS-connected systems are produced in such a way that provides a clear understanding of health care events that took place.

The following graphic depicts the typical process involved with retaining a computer forensics expert skilled in deciphering EMR to assist with compelling discovery of the complete patient electronic medical records, including the revision history.

1. Request Patient’s Complete Electronic Medical Records (EMR)

It is important that your discovery request includes important relevant details and enough specificity to ensure you receive a comprehensive production of available information without having unnecessary filters applied. We have seen routine usage of filters such as named users, narrow start and ending dates, departments and other available filters that result in receiving an incomplete production of the patient’s EMR. If you would like a sample electronic medical record discovery request list of items, please call us and we would be happy to share our sample request with you. Engaging our firm early on in the process can help speed things along.

2. Review Produced EMR Records

Reviewing the timeline of events and the complaint to develop an understanding of the critical moments when decisions were made or not made leading to harm to the patient is usually the starting point for engaging a computer forensics expert to assist you. Following the review of the case documents, converting the EMR produced to a more usable format is important before analysis begins. Ensuring that the EMR has been OCR’s, adding page labels to the document if missing saves time downstream and allows for surgical review of voluminous EMR to isolate records of care by date, time, health care provider name, medication, or other activity. Summarizing data and performing focused reviews around key dates and times can provide important insights.

3. Identify examples of withheld records or apparent manipulation

During the review process, it is helpful to identify examples of abnormalities or notations that indicate other data referenced is not contained in the production of the patient’s EMR. Reviewing the complete EMR records produced, not just the critical dates and times, can often help establish normal patterns of EMR and can be used in contrast to critical dates and times where EMR appears to be missing from the record. Skilled and experienced EMR data forensics experts often find indicators of manipulation that may not be readily apparent to someone who is not an EMR data forensics expert. Plaintiff’s medical malpractice counsel should send a written or emailed request to the health care provider to produce apparently missing records. This documentation of asking for the missing data will be helpful later when a motion to compel is filed with the court. Judges always like it when litigants attempt to work things out first amongst themselves before seeking judicial intervention. It is not uncommon that our firm is retained at this stage when the non-expert has reviewed the EMR produced and suspects something is hinky. Having your EMR data forensic expert assist with drafting the follow-on request for missing EMR can help lay the foundation for a later affidavit in support of a motion to compel.

4. Review Supplemental Production of Records if Received

In many cases, healthcare providers will partially respond to a supplemental request for EMR. The production oftentimes still lacks the clear ability to correlate the revision history of the patient’s chart and medical record. The review of all of the EMR produced to date is important in beginning to build the argument to be included in the future EMR expert witness affidavit in support of an onsite inspection of the HIS to obtain the patient’s complete EMR including the revision history.

5. Affidavit in Support of Motion to Compel Onsite Direct Inspection

The EMR data forensics expert must lay the foundation documenting their credentials, what they reviewed, significant findings, notes of any deficiencies in the production, and establishing that additional information not produced by the health care provider may be available from performing an onsite inspection. Direct engagement with the HIS can often reveal additional details such as the actual time or original entry of a notation as well as the life cycle of modification over time showing which device was used to access or modify the notation, what user accessed/modified the record, and the current status of records entered into the EMR. Inactive or deleted notations may be revealed on some HIS systems by toggling the view settings to show inactive records. The sworn statement by the EMR data forensics expert is an important tool in winning your motion to compel and often is filed with the motion, or submitted shortly after and before the hearing on the motion. In some cases, sharing the EMR data forensics expert’s curriculum vitae with the health care provider and the signed affidavit in support of the motion to compel onsite recorded inspection of the patient’s EMR may result in an agreement to allow inspection without the court’s order or an acceptable settlement offer. It never hurts to try.

6. File Motion to Compel Onsite Direct Inspection of the EMR System

Usually, to obtain direct onsite inspection of the healthcare provider’s HIS is a request likely to encounter objections and resistance. Filing a motion to compel and providing a supporting EMR expert witness affidavit can help overcome objections. A federal U.S. District Court ordered a hospital to provide such direct access to a patient plaintiff in a medical malpractice case. (Borum v. Smith, W.D. Ky. No. 4:17-cv-17, 2017 U.S. Dist. LEXIS 109249 (July 14, 2017)). The court’s decision and arguments can be viewed at this link. Onsite inspections can also be performed using remote control/viewing software such as WebEx, Zoom, TeamViewer, and others if the court allows and so orders. Typically, healthcare provider staff or HIS software consultants with administrative access to the HIS will perform the actions directed by the plaintiff’s EMR consultant and allow for recording screenshots of the patient’s EMR as viewed within the software.

7. Court Testimony in Support of Motion to Compel Onsite Direct Inspection

Having your EMR expert present in the hearing on your motion to compel usually takes place in person or via a remote video conferencing tool such as Zoom. Since the outbreak of Covid-19 began to escalate in 2020, courts have become more comfortable with allowing remote experts to appear via electronic video conferencing, making it easier to retain the most knowledgeable EMR computer forensics expert witness without concerns over the geographic location of your expert witness. Allowing the judge to ask questions of your EMR expert witness directly and assist you with responding to any raised objections has been proven to be highly effective in winning the motion to compel onsite inspection of the plaintiff’s EMR.

8. Onsite Inspection

Once the court has granted the motion to compel an onsite inspection, it is important to ensure that any in-person meeting isn’t a waste of everyone’s time. Problems that can arise include the health care provider producing someone to operate the computer terminal who is not knowledgeable about how to use the HIS or that lacks full administrative access to the complete backend databases containing detailed historical information including revision history of the EMR. In some cases, such as Cerner and Epic, some screens can be viewed in the software that will show progress notes and the revision histories including the user name modifying or entering the record and the times the record was updated by the user. In other systems, it may be necessary to access the back-end database system with administrative credentials to perform Structured Query Language (SQL) queries to identify the relevant record history. Having an EMR expert that has experience writing SQL database queries is important when the HIS doesn’t offer a built-in report or display view that can show the complete historical record of events.

9. Review Records Captured Onsite

Following the onsite inspection, it is often necessary to review in more detail the screenshots and video footage documenting the EMR in the HIS. Reports generated during the onsite may need to be compared against earlier productions of EMR to help document any records that were withheld. Where it is provable that the healthcare provider withheld patient EMR, it may be possible to petition the court to order reimbursement of expert witness fees associated with the consulting engagement.

10. Write Final Report

Many times, a final report is not necessary. Typically, once it is established that records were withheld, or it is believed to be known that this may be the case, it is more often than not that a settlement offer is made to the plaintiff when obfuscation or manipulation of the patient’s EMR took place. If no acceptable settlement is reached, writing a final report in the form of a sworn affidavit to detail the delays and extra costs associated with discovery is important for petitioning the court to award expert fees. Other times, the data obtained from the onsite inspection can be presented without a report or sworn affidavit. Photos and videos can sometimes avoid the need to generate a final report.

11. Expert Witness Deposed

Should an acceptable settlement offer not have been reached, the EMR expert witness will be deposed. This typically is preceded by a request for the disclosed expert witness’s communications with counsel and any work product or notes. Working with an EMR expert witness that has been deposed numerous times and has achieved successful outcomes following the given deposition can make or break your case. If the defense counsel can undermine the credibility of your expert, the admissibility of any of the opinions sworn to by your expert may be excluded. If your EMR expert witness is successful at establishing that records were held back or manipulated and provides a reliable deposition in support of those opinions, your case matter is likely to receive a reasonable settlement offer proportionate to the offenses and harm caused to your client.

12. Trial Testimony

It is rare that you will need your EMR Expert Witness to testify at trial regarding manipulation or withholding of evidence. If the facts exist and have been produced, they often speak for themselves. Many healthcare organizations face frequent malpractice litigation. If it is established in the public record that a healthcare organization permanently deleted a patient’s EMR, that organization could lose Medicare/Medicaid funding for not maintaining HIPAA compliance, a problem that could far exceed paying out a settlement to a single aggrieved party.

13. Case Settles

Medical malpractice cases often settle when it has been established that the records have been altered to distort the true record of patient care. Having news reports published detailing how a healthcare organization manipulated historical patient EMR to mask a mistake resulting in the harm of the patient would only invite more litigation by other harmed patients. In the interest of protecting their organization from further litigation and more intrusive discovery, healthcare organizations need to maintain their profitability and minimize costs paid out for ongoing litigation.

Summary

When you are getting stonewalled by a healthcare organization and feel that you are receiving cryptic EMR audit trails, or a production that is missing data that should exist, having an experience EMR computer forensics expert witness and consultant on your side can help you achieve a better outcome for your client. If you would like to discuss a case matter with us, we are happy to provide a complimentary consultation. Call us today at 312-668-0333.

Related Content

Filters Used to Withhold the Complete Electronic Medical Records

The universal implementation of electronic medical records (EMRs) has become the single most important piece of evidence used in medical malpractice litigation. In response to an EMR Discovery request, healthcare providers use various filters to create useless or hard to read data. Hire an expert to help you weed through the audit trail and to present Discovery requests relevant to the case.

Healthcare providers use filters to withhold electronic medical data when complying with a court order and producing EMR audit trails. During the discovery period, EMR audit trails are commonly used as the single most important piece of evidence in medical malpractice litigation. Knowing evidence is in the details, has led to a chess game of filters proving “Not all electronic medical records (EMRs) productions are created equal!” Figuring out how electronic medical records (EMRs) are filtered is a game changer!

Follow the filters!

When counsel requests a patient’s electronic medical records (EMRs) to review for evidence, the production is often delivered in non-electronic limited formats, such as; scan documents, PDF, or image files. Filters provide limited format productions of (EMRs) therefore it becomes extremely difficult to read and find evidence. Are hospitals and healthcare facilities doing this on purpose? Are they filtering their production to include irrelevant information with very little details about the event in question? They are not making it easy that’s for sure. In truth, they are complying with the court order and producing files that include the electronic health records of the plaintiff. They’re just not providing data information in its completeness. Using filters to produce audit trails is fairly common, but for the injured party and representing counsel these tactics are extremely excruciating. Requesting electronic medical records (EMR’s) is now a challenging game of filtering chess!

Forensic Experts know how to request data essential to your case.

It is quite common that hospitals and healthcare facilities use a variety of filters that will result in an incomplete production. When forensic experts study the production headers they uncover filters that were used to produce an incomplete EMR audit trail. Experts know how to ask for relevant data and dig deeper to find evidence.

Filters, Filters, and More Filters!

  1. Date filters that are applied could exclude alteration of records after the event took place. We suggest the best practice is to use the earliest known date prior to the medical event as a starting point and place the end date the same as the current date of the request. Pushing the end date to reflect the current date will show who looked at the record post-event.
  2. Department filters will only return records that are from one particular department, such as radiology or another department.
  3. Employee filters include specific employees of the healthcare facility. If an EMR record only shows entries related to a physician’s user IDs this can be problematic. It’s important to know all of the names and user IDs of all healthcare providers that visited the patient.
  4. Workstation filters are specific to desktops and/or workstations and could be the cause of incomplete production.
  5. Location filters are used by healthcare providers to limit the full scope of production. It is not uncommon for physicians to access important medical records remotely. This could cause manipulation of data by remote access and filter out data after the event in question.

Enigma Forensics has years of experience developing requests for electronic medical records (EMRs). Our experts know how to ask the right question to retrieve the necessary data to be used as evidence. Save yourself time and expense and hire an expert! Our experts are CISSP certified (Certified Information Systems Security Professional) that provide testimony as a professional witness in a court of law.

Please call Enigma Forensics at 312-669-0333 for a complimentary consultation.

How important are Electronic Medical Records (EMR)?

Have you or someone you know been involved in medical injury or accident? Do you want to win your case? Or…If you’re an attorney and have questions about a case involving medical malpractice, read this blog and contact Enigma Forensics for the “W”.

Were you or a loved one involved in a medical accident or injury? Are you an attorney who is representing an injured client?

If the answer is yes, take immediate action and file a Discovery request or subpoena to access all of your Electronic Medical Records (EMR). Why is this important? In order to prove injury or malpractice and win your case it’s imperative to discover what took place and the actions that caused an event. Your electronic medical records or EMR audit trail will document what transpired. EMR audit trails will include prescriptions, tests, treatments, transfers, operation notes, nurse practitioners and doctors notes and a ton more. Electronic Health Records (EHR) are rich with data information describing the care that was provided and decisions that were made good or bad. Some medical record systems such as Epic have sticky notes that are traditionally not part of the formal patient permanent electronic record. Those sticky notes are required to be stored by the Health Insurance Portability and Accountability Act (HIPPA), but are not part of the discharge report showing the patient electronic medical record history. The data does exist and working with a qualified medical record forensic expert can help you to gain a more complete record of the patient encounter with the health care provider.

What else does Electronic Medical Records (EMR) include?

Electronic Medical Records and the patient medical record audit trail include the original record and will note any modifications. It will also preserve dates, times, who accessed the record and whether the record was printed, viewed, deleted or otherwise modified. Many of the systems today, such as; Epic, Cerner, Meditech, All Scripts and others have reports that can be downloaded to reveal vital information about who has authorization to access and audit electronic health records.

Medical dictations are another vital piece to the puzzle. Dictation files are sometimes sent to third party transcription service providers as raw audio files called WAV files. After the WAV files are received they are typically transcribed to text files and fed back into the electronic health record software system. When modification of the patient medical record occurs after an injury or malpractice took place, comparing the transcription WAV files to the produced chart may help reveal alteration to the patient medical records.

Patient Electronic Medical Charts are often Incomplete. You could lose your case!

When electronic medical record discovery requests are made by plaintiffs to healthcare providers, it is common that the production lacks the complete patient medical record history. Healthcare providers facing litigation commonly provide a minimal amount of data in an often useless format. The form of production is often scanned copies of previously printed our documents or charts. Codewords for health care providers, departments and procedures often make interpretation even more challenging. Having an experience EMR computer forensics expert can help provide a more accurate interpretation of the complete Electronic Health Record (EHR) for the harmed patient.

The Health Insurance Portability and Accountability Act of 1996, or HIPAA is a federal law which requires your medical records to be retained for six years at a federal level. However, most states also have their own medical retention laws which can be more stringent than HIPAA stipulates. Check out this government website to learn about how different states interpret this governance. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html

How important are faxes? This could win your case!

In some cases, Electronic Medical Records (EMR) are faxed to outside providers either to or from your primary physician. Software vendors such as Forward Advantage provide automated faxing capabilities integrating with the existing health care information management systems and patient medical records. It’s vital you request all communication between facilities to help prove or disprove what and when medical knowledge was presented to the provider to make an informative decision relatable to an event.

Let’s say you have already requested an EMR audit trail for a patient. Did you know that the Electronic Medical Records (EMR) audit trail you received contains cryptic codes that you will not be able to comprehend. It’s extremely helpful to request all of the underlying data dictionaries that will provide the definition of the codes used referring to the friendly name, including, the healthcare provider’s name, department, computer used to access the EMR, procedures, treatments, tests ordered, drugs prescribed and lab results.

Did you know that medical data is required to be retained for six years?

Do you want to to win your case! You need Enigma Forensics experts on your team! Hire a professional forensic expert to assist in writing a Discovery request to obtain, preserve and analyze ALL of the electronic medical records and to help you obtain the complete EMR audit trail. We can help uncover the truth of what took place and help tell the court the story about what happened to you or your client.

Call Enigma Forensics at 312-668-0333 to schedule a complimentary phone call to discovery how we can assist.

More about Electronic Medical Records

EMR or EHR what is the difference?