Epic software is used by many hospitals that is HIPPA compliant. It is used to track all additions, modifications, and ensures the complete patient history is recorded. Check out this blog to learn more about EPIC software!
EPIC software is used by many hospitals to track patient care and manage the overall patient experience. When something goes wrong during a patient stay that leads to long-term injuries or death of the patient, it is highly common that medical malpractice litigation ensues.
Health Information Personal Privacy Act, HIPPA
The Health Information Personal Privacy Act, commonly referred to as HIPPA, places several important requirements on health care providers. HIPPA requires that all access to a patient’s electronic medical record commonly referred to as EMR, track all addition, modifications, and allow access while ensuring the complete revision history of the EMR is maintained.
EMR Audit Log
Audit logs or audit trails are required to ensure that reconstruction of the complete revision history can be established. EPIC printed reports of patient’s EMR can be produced using various filters that result in a less than complete production of the patient’s full electronic medical records. Some of the filters that are routinely used include:
Date filter to show only the time the patient was receiving care at the healthcare provider
Production of only non-confidential notations
Production of only the final version of the EMR without the detailed revision history
Filter notes exclusive to the named defendant health care providers
Filter by department
These filters described previously when used in producing a patient’s EMR result in an incomplete production of the EMR.
Sticky Notes
EPIC has a communication platform known as Sticky Notes. This serves as an instant messaging mode of communication between healthcare workers discussing a specific patient. EPIC lacks a report that can allow easy printing or export of these notes. This creates a common misperception among health providers that these notes are not part of the legal discoverable record. In fact, there are other ways to access these sticky notes, which are an important part of documenting the patient care provided. An in-person inspection of the EMR using a camera to record the user’s screen can allow for obtaining these important communications. These sticky notes are part of the EMR and are subject to preservation by HIPPA.
On-Site Inspection
During an onsite inspection to obtain the complete EMR, it is important to ensure that the user accessing EPIC has full administrative rights to the system. In some health care organizations, sticky notes may be accessible only to physicians. Regardless, obtaining these important communications can be a vital source of information to reveal important events leading up to a lifelong injury or death.
Enigma Forensics has assisted in numerous medical malpractice cases working with either the plaintiff or defendant’s side of litigation. Our experts dig through each record to analyze ultimately to find the “smoking gun!” We call ourselves the data detectives! If you are working on a medical malpractice case and would like to win, call Enigma Forensics at 312-668-0333.
To learn more about Electronic Medical Records check out these blogs.
Why is the Health Insurance Portability and Accountability Act of 1996 so important? It keeps our healthcare systems in check! Check out this video with transcripts to learn how it affects patient’s rights to request their own Electronic Medical Records (EMR’s).
Lee Neubecker: So HIPAA is the Health Insurance Portability and Accountability Act of 1996 and why this is important is all the hospital information system providers, have to certify that their software is HIPAA compliant. Otherwise, the hospitals receiving Medicare reimbursement wouldn’t be able to use the software. So, the presumption should be that any healthcare organization that is receiving Medicare funding is compliant with the rules of HIPAA and we’ll talk through what that requires here.
HIPAA Audit Trail Requirements: EMR / EHR
Application audit trail audit trails
EMR Opened / Accessed
EMR Closed
EMR Created
EMR Edited (Original and Replacement Value) with last update time
EMR Deleted
System level audit trails
Successful or unsuccessful logon event by username
Date and time of each logon or logoff attempt
Specific device used to logon
Application user successfully or unsuccessfully accessed
User audit trails
Monitor and log user activity in an ePHI application
Record events initiated by the user
Commands directly initiated by the user
Log access to ePHI files and resources
Healthcare organizations must retain records at least six years
States with stricter retention requirements must be honored
First, HIPAA requires that there be application audit trails that show when the EMR was open, accessed, closed, created, edited, the original value, replacement value, who updated it? When, from what computer, whether it was deleted? Your system-level audit trails, which has to do with the logons of the user to the system when they logged on, what computer was at the nurses’ station? Was it the computer that was actually bedside with the patient? So all of that can be relevant, especially in establishing whether or not a healthcare provider was with the patient at an important time.
User audit log trails monitor the user activity within a specific EPHI application. It records events, what commands were issued, and so on. Healthcare organizations must retain these records for at least six years and typically, if there’s an issue where litigation is involved at the point in time that they’re notified, their risk management committee will collect the records and make preservation of the available data. Some states have stricter retention requirements beyond six years and in those cases, the state rules should apply according to HIPAA.
HIPAA Audit Trail Requirements: Must Track
Each time a user logins
Whenever changes are made to databases
When new users are added
Access levels for each user
File access by users
Logins to operating systems
Firewall logs
Anti-malware logs
Other requirements of HIPAA include the following.
When a user logs on when changes are made to the databases, when users are added, access level for each user, what rights they have, the file access by the user. Logins to the operating system, firewall logs, anti-malware logs and more. So there’s a lot of requirements that hospitals are compliant and other health care organizations that are receiving Medicare funding follow these requirements.
Example Audit Trail: Meditech
Example Audit Trail
Lee Neubecker:
Here’s an example of what an audit trail log looks like. I know it’s probably a little bit difficult to see all of this but what we see, this one’s Meditech. What you’ll see here is there’s a run date, the date and time the report was run, the runtime, the username, the specific database being accessed, and who the patient was. Then across the top, you have different data columns such as date, time, the user. What action, were they modifying, exporting, viewing? The description of the action? Then you have the device being used to access it. It also shows here that there’s a confidential flag and certain records which may or may not be produced. And then there’s the ability for someone to, you know, Dr. Smith could enter something and emulate another user and you don’t often see the notion that someone else emulated another user when you’re viewing the progress note or printed chart. So the audit trail is important. Now, unfortunately, this audit trail doesn’t show you the specific changes being made and oftentimes, what’s necessary is you actually have to get a direct in-camera inspection of the Meditech or other HIS system to be able to record and document what the care provider sees.
Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.
Where does one start when requesting Electronic Medical Records or EMR’s? Enigma Forensics has created a process for you to follow to help navigate to trial or settlement.
Process of Navigating to Trial or Settlement
Lee Neubecker: So now I’m going to a little bit about the overview and process of working one of these cases with electronic medical records, such as myself. And typically, the cases start off with the need to make the request for the complete electronic medical record. Oftentimes, attorneys contact us when this has already been done but they suspect that the data is deficient in some way or fabricated.
So, we often will review the records produced, identify examples or problems with filters, anything that looks suspect, and then assist with drafting a supplemental request to produce.
If the supplemental materials are produced, we review that. We look for deficiencies in the records, and oftentimes there will still remain deficiencies. So in that case, we have to spend time analyzing the EMR and working on a report of sorts that shows examples of what’s missing. And at that point in time, we’re trying to compel the judge to order an inspection. On the converse side, if we’re working for the hospital, we’ll be looking through the EMR and often reporting to them whether or not there was a fabrication by hospital staff and that’s important for insurance carriers because they want to understand what the risk is if they litigate a case to trial. And it may be more advantageous to simply settle the case if there are some problems in the EMR.
So after we’ve drafted the motion to compel, well, typically, we write an affidavit in support of the motion to compel an onsite direct inspection. That motion gets filed by the attorney with our affidavit attached and then there’s a hearing. These days, the hearings tend to be on Zoom telephonically, and oftentimes the judge will ask questions. Essentially when we’re doing an onsite, what we want is we want to be able to see the entire record of the patient as the physician can see it, the communications between providers, and the complete revision history. This often requires videoing or taking photos of the data to capture data that are not easily printed from current reports with the HIS system.
So when the onsite inspection happens, it’s not uncommon that there will be multiple experts there. I’ve been hired to observe an inspection by a plaintiff counsel that is seeking to look at the EMR. In that role, I’m looking to just document and understand how they’re requesting the data, whether data is being withheld despite the onsite, and to advise my client in terms of what the data is that was produced and whether there are any issues with it. The onsite inspection isn’t where the analysis happens. It’s usually an effort to try to dump all the data out, run reports, make sure the settings are documented appropriately, and really that the only filter being used is the filter for the patient. There should be no other need to filter anything. Those records are the patient’s records. They have a right to that content and this process is one that is going to become much more common as we continue with the understanding of medical records and audit trails becoming more prevalent. After the onsite inspection, there’s a need to review that data. Oftentimes normalize it again, compare it against earlier produced EMR. That analysis might document that early on, that the health care organization was willfully holding back information that was key and important. And so, in instances where that happens, there’s a need to write a report to document those changes or deficiencies. And long before the trial happens and the reports issued, the expert witness that you use is your EMR expert will have to be deposed most likely. And what I usually find, at least in cases I’ve been involved with is that the cases typically settle after the deposition. Because at that point in time, you’re really looking at what does the factual record reflects? There are not so many opinions so much as there are facts. In some cases, there are opinions about why does the chart shows lots of entries that all were created days after discharge and they’re all unrounded hours with no minutes. In a situation like that, my opinion would be that’s likely fabrication because usually if you’re entering notes and other procedures contemporaneous to events, you’re going to have randomization of the minutes and everything is not going to be stacked up at zero, zero minutes on the hour.
So if a case is going to trial, there’s a need to prep your EMR expert, to let them review the timeline, the earlier affidavits in the data that was collected so that they’re prepared for trial. In most cases, so cases tend to settle and they usually settle after the onsite inspection and collection of data. Sometimes they’ll settle much earlier. I’ve seen cases settled as soon as I get involved and help with writing a request for supplemental production but sometimes the cases go on further. In my experience, the further along through this process the plaintiff gets, if we’re able to identify willful withholding of records, the settlement offer tends to be much higher.
1. Request Patient’s Complete EMR
Provide the complete EMR audit trail for [Patient Name] detailing any health care provider’s access, review, modification, printing, faxing, or deletion activities in a comma delimited format with any and all corresponding native files or records that may relate to the patient as required by the HIPAA § 164.312(a)(1).
Audit trail should include the complete revision history of the EMR
Provide the name of all medical software applications utilized to store EMR
Provide the data dictionary for each software application containing EMR
Provide all User and Administrator Manuals for each EMR software application
So, I gave an overview of this. There are slides here that I’ll walkthrough. I want to have plenty of time for questions. So, I’m not going to read each of these but in summary, you want to make sure that you’re getting all the data and there’s an outline here, if you email [email protected], she can send you a complimentary sample request for EMR that helps you form that request. Obviously, you may want to retain us to help you tweak that for your specific circumstances. It’s a good idea though to ask for the user manuals when you’re doing this process and you want to make sure that you’re clear about asking for the complete revision history.
2. Review EMR Records Produced
Identify Examples of Withheld Records or Apparent Manipulation
Filters beyond the patient used such as user id or department
Lack of production of records from the beginning of the notable time period until the date the EMR report was generated
Audit trail lacks details of the revision history
Production of the data in a non-usable format
So I talked about the review of the records produced and typically, we’re trying to identify examples of withheld records or other things that we can find or prove that are deficient from the production. Audit trails that lack the definition of what was being changed are an example, the production of data in a non-usable format, going onsite to have it exported. So it’s not produced in a crazy, out-of-order duplicative format is often helpful.
3. Request Supplemental Production of Deficient Records
Ask for what you want specifically before filing a motion.
Request the complete revision history showing the life cycle of the patient’s EMR.
The supplemental request for the production of deficient records is likely to not bear fruit but is necessary to show you tried to work things out before seeking judicial intervention.
So when we’re asking for the records that we’re missing, we want to be specific on that and ideally pose that directly to opposing counsel in an email. So that it’s documented and that way, if you’re hearing a motion, you can show the judge that you’ve already tried to be specific about what you were asking for. It should always include the revision history. That phrase is so important. Usually, that’s missing from productions. And it’s often, the case that even though you ask for things correctly, they still aren’t produced as requested. So, having that clear documentation of asking for it in email is important.
4. Review Supplement Production of Records Received
Immediately review the supplemental production upon receipt.
Check to see if the request that was made was answered correctly.
To the extent that production remains unresponsive, communicate that to opposing counsel before filing your motion.
So when the supplemental production comes in, we want to typically look at that quickly, try to see if they’ve complied or failed to address certain sections. If they failed to disclose their filters or they filtered things differently than requested, you want to create a paper trail and send a follow-up email asking for that, and then if they don’t comply, that’s going to help you with your motion to compel when appearing in front of the judge.
5. Affidavit in Support of Motion to Compel Onsite Direct Inspection
Detailed foundation for the request
Reference prior requests and data produced
Communicate the deficiencies in the produced EMR
Establish examples where the revision history showing changes is important
Establish that the reported dates are not necessarily the original entry time and that modification history can be obtained by directly examining the EMR system
So the affidavit that we’re generating is typically outlining these deficiencies. It might be sharing exhibits that include the emails that you sent asking for the data. We want to make sure that we’ve detailed the foundation for the request, pointing out examples of what was asked for what was produced, how that was deficient? Giving examples where the revision history showing changes is important. Specifically, the lack of when the records were actually created or last updated, who updated them, when? That information is very important and it’s often not in the initial round of production of EMR.
6. File Motion To Compel Onsite Inspection Of EMR
A federal U.S. District Court ordered a hospital to provide such direct access to a patient plaintiff in a medical malpractice case. (Borum v. Smith, W.D. Ky. No. 4:17-cv-17, 2017 U.S. Dist. LEXIS 109249 (July 14, 2017)
The court’s decision lays out the arguments made by the hospital opposing the onsite inspection.
So, finally the motion to compel the onsite inspection of EMR, there’s a useful case out of Kentucky, Western District of Kentucky, the Borum versus Smith case. I think on our website, if you search at enigmaforensics.com for Borum, B-O-R-U-M, there’s a hyperlink to this case and it’s a federal case that lays out the arguments establishing and overcoming objections made by a hospital resisting an onsite inspection. So this can be very useful to lay the groundwork for arguing your motion to compel.
7. Court Testimony in Support of Motion to Compel Onsite Inspection
Having your EMR expert at this hearing is important
Overcome objections
Establish protocol for examination
Allow recording of the HIS software as it relates to the patient
Allow for the reproduction of previously produced EMR to verify filter settings and obtain the data in a delimited format
Ensure that all versions of notes including inactive and historical versions are included in the production of EMR
When that motion to compel hearing is held having someone like myself there to be able to answer questions of the judge, overcome objections, help to establish protocols for the exam to ensure that it’s effective and not a waste of everyone’s time is important. Recording of the HIS software should be allowable. An agreement to redact or call out anything that might’ve been captured that doesn’t relate to the patient is something that I see there’s no issue to but the ability to document and the record is critical. Ideally, during this onsite, you want to be able to reproduce what they produced previously so that you can confirm whether or not they had filters applied to it. If their earlier production of EMR only includes active records and no historical records, producing it in a more complete manner will help you to demonstrate to the court that the hospital was holding back important records that were your patient’s or your client’s records, that they have a right to. So again, making sure that inactive historical versions are included in the production of EMR is very important.
8. Onsite Inspection – Capture of Patient’s EMR
Inspection can occur using Zoom or other remote desktop tools
An in-person inspection can be advantageous
Your EMR expert should be able to direct the health care provider’s IT admin to perform any query or other activity that relates to the patient
Data can be saved to external media for later examination
Your EMR expert should be allowed to capture photos or video from the live system
So inspection onsite during the pandemic, a lot of things have shifted to Zoom or WebEx, that can certainly happen. An onsite inspection does have advantages and I usually recommend the onsite where possible. Now that vaccines are widely available, the concerns over going onsite should be much less. During this inspection, I always recommend that the healthcare providers, IT person with admin rights actually be the person that’s typing at the keyboard and moving the mouse but at the direction of the requesting party. That helps protect from any potential harm to the hospital information system and really shuttle out for full observation of the EMR as it exists within the system.
Typically, data is exported to external media and at the conclusion of that, the data is shared with a producing party, in requesting party subject to the right for either party to deem data confidential or redact, which typically, the confidentiality requirements, hospitals are already following that for the most part. So really, as long as the data is restricted to the patient, there really shouldn’t be much reason to hold back data that belongs to a patient as long as it’s just that patient’s data. That data will be examined after the onsite when there’s time to analyze it.
9. Review Records Captured Onsite
Limited time for onsite inspection and collection of data
Consider delaying review if a settlement offer is likely
EMR expert compares initial productions vs. onsite data collected
Identify examples of manipulated records or previously withheld records
Consider disclosing some of these smoking guns before proceeding with a written report by an EMR expert
So after the onsite, that’s when there’s more time to look at the data to analyze it, to compare it. If there’s an expectation that smoking guns were captured during the onsite, sometimes a plaintiff expert might want to just hold off for a week or two if they think that a settlement’s likely so that the costs aren’t incurred. To discuss the comparison of initial productions versus what was collected on-site, trying to identify examples of manipulated records or previously withheld records can be important in understanding what happened with the case.
So whether or not you write a formalized report or just disclose some of the smoking guns, that’s a decision that plaintiff counsel often considers. Defense counsel often needs to consult with their insurance carrier and have someone like me help tell them what the situation is so that they can decide, does the case have merit or should you proceed to trial and not make a settlement?
10. Write Final Report
Detail examples of previously withheld information
Detail examples of fabrication or manipulation of information
Clarify what happened with the EMR
So the final report that gets written up again, details, examples of previously withheld information. Examples of fabrication or manipulation of information and trying to clarify, in human words, a storyline of what took place.
11. Expert Witness Deposed
Survive Daubert challenge
Avoid mistakes
Establish a foundation for the admissibility of electronic evidence
Clarify any opinions expressed in the affidavit(s) or report(s)
So, when the deposition phase occurs, it’s important that your expert be able to survive a Daubert challenge. You don’t want to have all the work tossed out because the collection of data was not done properly or not performed by someone that has appropriate experience. It’s important to try to avoid mistakes, which sometimes typos happen and whatnot but trying to minimize mistakes typically requires giving your expert time to review and proof their report. Having other peer review processes performed and engaging with your expert to make sure that everything is clear and understandable. And ultimately, you’re trying to establish a foundation to admit important information that relates to EMR so that you can clarify what events took place and having your expert be able to explain that to a judge is really important.
12. Trial Testimony with Prep
Select an expert that is skilled at presenting technically complex information to non-technical audiences.
Verify that your expert has court testimony experience.
Ensure your expert has time to review materials before trial.
Most cases never make it to trial and settle earlier where the EMR speaks for itself.
So one of the things you want to look for when you’re picking an expert, you want to look for identifying an experienced expert that has testified on cases before and is capable of taking technically complex information and presenting it in an easy-to-understand manner. And that isn’t always easy for many geniuses out there that understand a lot of complex information. You want to make sure again, that your expert has time to refresh and review the materials before trial. Experts that are busy are going to be in many different cases and shifting between one med mail case matter in another involving EMR takes some time to shift.
So, I like to try to work on a case solidly for a period of time, get it up to a report, finish that and then come back to a case at the next checkpoint so that I can focus and not be split between two similar but different cases. As I said before, most cases never make it to trial because ultimately, the electronic medical records, if obtained and produced in their entirety with the date and time that they were entered, modified, and whatnot, that data will typically speak for itself. So, whether you’re defending a case or pursuing one, getting an understanding of events that took place, it’s highly critical.
13. Case Settles or Case Dropped
In our experience, in cases where EMR has been withheld or manipulated, settlement agreements are usually reached.
Establishing that the medical record doesn’t support allegations of abuse can result in a case being dropped.
Settlement offers increase when you are able to prove that the health care provider purposely withheld information.
Proving willful fabrication or manipulation of the EMR can help win the highest settlement.
So when we find examples of manipulation of information, settlement agreements are usually reached because if a hospital took a case to trial and it was proven that they manipulated the records, they would face far more litigation from other plaintiffs as a result of that. In some cases, some of the outcomes might not be to have a cash settlement, it might be for a parent to regain custody of their child because there were inappropriate allegations of harm that aren’t substantiated by the electronic medical record. If you can prove that a healthcare provider purposely withheld information, it’s really helpful to get a settlement or a favorable outcome if you’re on the plaintiff’s side. And again, as I said, what I’ve seen is the highest settlement offers usually come if you prove the willful fabrication or manipulation of EMR.
I had a case back in, I think it was around 2004 involving a heart catheterization operation that went wrong, and days after the operation, the patient was discharged and then passed away. It’s an unfortunate circumstance that left a family with one less parent. In that case, so years after the accident, the surgeon produced a CD disk that contained the video clips documenting the surgery. But what happened when I examined the CD, I was able to establish that the CD had been created a month previously. The CDs have headers that show the date and time that they’re created by a specific computer.
Furthermore, I looked at the video clips, there were DICOM video files. DICOM is digital imaging and communication of medicine and these video files had embedded metadata that showed the sequence number and the date and time and length of the clip. Well, what had happened is I think it was clip six, seven, and eight were deleted nine, 10, and 11 were renumbered to be six, seven, and eight. So there were three video clips that were removed and then the renaming of the files effectively made it look like the deleted clips never existed. Well, in doing forensics on that, I was able to establish what had happened and then during my deposition, I testified to that. At the end of it, the attorney for the hospital asked me, do you have any proof that the hospital had anything to do with this? Keep in mind, the surgeon was the one who produced the CD years after the operation.
Oh, my reply to the attorney for the hospital was if, given the opportunity to examine the hospital’s equipment, I could determine whether or not the CD that was produced was generated by their equipment and my deposition ended. Quickly after that, they asked for my business cards and then the maximum settlement of the insurance coverage from both the surgeon and the hospital, that offer was made in the case of, so it was a favorable outcome.
One other thing too, in many cases that have caps on liability, if the plaintiff is able to prove willful manipulation, in some states, those caps go away. So, if you’re defending a hospital in one of these cases, having someone like myself help you determine if the EMR shows willful manipulation or fabrication. That can be very important because exposure to the hospital could be much greater than in the case where things simply, you know, mistakes happen and unfortunately, mistakes happen and good people suffer harm as a result of disease, surgeries, and whatnot. But in situations where bad things happen and then individuals in a healthcare organization take efforts to fabricate the record, to make it look other than what events really took place, that can be very risky for a healthcare provider. And knowing that early on in a case is really important that hospitals know that and other health care providers. So in those situations, I’ve had a lot of experience digging in and answering those questions quickly before the plaintiff gets their answers. I’ve also helped the plaintiff get the answers to those questions and reached satisfactory settlements.
Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.
Have you ever requested Electronic Medical Records (EMR’s) and its beyond difficult to read? The printed pages are not searchable, mixed in with junk, lacking versions that you know should be recorded? Check out this video blog with transcripts. Lee Neubecker, CEO and President of Enigma Forensics offers keys to unlocking the mystery of EMR’s.
Click to view Video on Keys to Unlocking the EMR Audit Trails (Electronic Medical Records)
Video Transcripts follows: EMR Audit Trails, as produced by Healthcare Providers during medical malpractice discovery, frequently filter out the important history of the patient’s medical record. Learn how to compel discovery of the patient’s complete EMR history.
Lee Neubecker: So today, we’re going to be talking about the keys to unlocking Electronic Medical Record Audit Trails. We have a mixture of people on the webinar today. I know some people represent healthcare providers. Other people represent litigants involved with medical malpractice. I’m going to be talking a little bit today about how the process works.
Scenarios where Electronic Medical Records (EMR) are important
Eldercare neglect or abuse
Failure to provide appropriate & timely care leading to patient injury
Failure for staff to provide to correct type of care
Credentials of staff that performed procedures
Discussions between staff are relevant
Establishing the supervising physician neglected appropriate care
Allegations involving child welfare accusing parents of harming a child
Lee Neubecker: We’ll begin with discussing some of the scenarios where Electronic Medical Records are relevant and important. If you’re suspecting that the elderly has been abused in a nursing home, that could be important to know. Records of care when medications were provided, whether or not patients were neglected. All of that information can be discerned from reviewing the electronic medical record history. In some cases, there’s allegations about not providing appropriate care over time or the staff providing the wrong type of care. So, many of these cases become litigated in various medical record experts or clinical experts get involved. We’ll be talking about later today about how you really want to start with getting command of the EMR or Electronic Medical Records so that it can be efficiently reviewed not only by you and your team but also by any experts that might be retained to assist with the case. It’s important to understand that there might be discussions between staff, physicians and nurses and whatnot that aren’t in the progress notes or printed medical record. So we’ll be covering that in a little bit. Allegations about harm to children by parents or healthcare providers. That’s also relevant as well. In some cases, we’ve seen situations where the chart reflects a certain color of bruising many days after a child was admitted into a facility for care but the coloration of bruises often can suggest that the bruising happened before entry into a facility. On a case like that, knowing whether or not the child was bathed and whether it was reported early on can help determine was the child injured in the health care provider’s place of care or did it happen prior to admission?
What typically happens when you request the EMR
Printed pages (not searchable)
Mixed in with junk
Sorted most recent to oldest
Lacking version historical revisions
Limited reports that have unnecessary filters
Hold back on communications (Sticky Notes / Routing)
Records entered not contemporaneously to events
Lee Neubecker: So what typically happens when you ask for the electronic medical record for your patient or your chart, the healthcare providers will often produce it in the most unhelpful way. They might print it if it’s printed or dumped to a PDF that’s flattened, it’s not searchable.
It might be included with lots of redundant information, out of order, sorted not intuitively from oldest to newest, but backwards. Oftentimes, the version revision history of the progress notes are completely missing. So, for instance, if you have an Epic EMR production. With Epic, they have the ability to enable the specific version number so that you can determine the revision history over time and that isn’t always what’s included in the printed report that gets produced.
Some reports will have unnecessary filters. For instance, if only named providers are shown and you don’t see a mixture of healthcare staff providing care to a patient, that might suggest that the report was produced with only the name key healthcare providers included. And so, when you’re requesting electronic medical records, you really want to be very specific to say, use no other filter other than the patient identifier or the patient medical record number, date filters and whatnot, narrowly defining the date and time when the patient was in the hospital or healthcare facility might result in filtering out of important records that show that the chart might’ve been modified or manipulated well after the patient’s departure from the facility and after the patient experienced some type of harm.
Another thing I see, sorry about that. Another thing I see that happens sometimes is in addition to different filters, such as like filtering by date or filtering by healthcare provider or department, sometimes the filters aren’t displayed on the reports and you really want to be able to understand what filters are used. One other filter that might be used without your knowledge is whether or not the record is considered confidential.
Confidential would suppress the record oftentimes from appearing on the printed medical record report. So you want active, inactive, all version history, confidential, you want the entirety.
Another important thing that is relevant in many cases involves the communications between healthcare providers. With Epic, you have the ability and with Cerner, you have the ability for routing of communications, either almost like an email system within the healthcare system or something known as sticky notes, which is basically like an instant messaging platform between healthcare staff about a patient.
And there’s documentation out there where hospitals say that sticky notes are not part of the medical-legal record. Well, HIPAA requires that all that data be retained. So the data is in there, it’s in the backend database or you have to inspect the hospital information system to be able to document it on the photo or on video.
Another thing that we see a lot of our records that are entered in, after the fact, when you enter a record into a hospital information system, you can list the reported date and time of the event but that is oftentimes different than when the record was actually saved and created in the system. So we’ll talk about that more as we go through.
Important Concepts & Terms
(EMR) Electronic Medical Records
(EHR) Electronic Health Record
(HIS) Health Information System
(PACS) Picture Archiving and Communication System
(ePHI) / (PHI) Electronic Protected Health Information
Data Dictionary
Delimited Format
Native Files
Audit Trail
Audit Logs
Pivot Tables
OCR (Optical Character Text Recognition)
Lee Neubecker: First, I’d like to cover some important concepts and terms that are relevant to Electronic Medical Records in medical malpractice litigation.
EMR, Electronic Medical Records is synonymous with EHR, the Electronic Health Record. A hospital Information System is sometimes referred to as HIS and that’s like Cerner or Epic or Meditech or whatever software system is being used to manage the patient care and store their electronic medical record. PACS is specific to video, phototypes involved with the documentation of electronic medical records, as it pertains to things like MRIs, x-rays, videos of surgeries, and so on. And each of these systems often has its own audit logs separate from the HIS system. ePHI is Electronic Protected Health Information. That’s what all the stuff is about.
Data dictionaries are abstract or key to help you to cross-reference the initials of the health care provider or the department or procedures or lab test results to the friendly name. And if you’re working on one of these cases, you want to include in your request for production, a production of the data dictionary, so that you can make sense of the charts and records that are produced to you.
Another thing that I like to ask for when I’m getting electronic medical records is to request that that data be produced in what’s known as a delimited format, which is like a spreadsheet format, sometimes known as comma-delimited. That allows you to manipulate the data much more easily and filter and aggregate and do things that can help you see into what’s happening quickly without having to review oftentimes tens of thousands of pages.
Native files refer to the file as it exists. Like if there’s a transcription that’s saved as a WAV file that has the original doctor’s notes, asking for the native file of the transcriptions would give you the actual file that was recorded, as opposed to some transcription of the file.
Audit trail or audit logs, HIPAA requires that data be stored about the creation, modification and access of electronic health records. And these audit logs will show when things are added, updated, modified. The logs and audit trails that are produced often don’t answer the key question about what changes are happening. And usually, I get involved with helping the parties understand well, what really happened? What was a real revision history? When did it occur? Who did it, from what computer? At what date and time was data deleted? Was it added? And that’s very relevant to many medical malpractice cases. When we’re analyzing data, some of the things we can do, we can take the electronic medical records if they’re produced in a delimited format, we can quickly prepare aggregate summary charts that might show how many minutes did, or how many interactions with the EMR did the supervising physician have? What dates and time where the records looked at? When did modifications occur? If modifications occurred after a patient’s discharge, which I see quite a lot of times, that can be suggestive of efforts to fabricate the medical record history.
When we get the data, in addition to trying to get it into a delimited or a spreadsheet format, we’d like to make sure that the data is OCRed, which is optical character text recognition, that allows for searching and key concepts, names of providers, dates and times and so on. And all of that can be very important as you work a case.
Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.
Join us on Friday, June 25 from noon – 1:00 pm. Please register on Eventbrite at:
https://electronicmedicalrecords.eventbrite.com
Electronic Medical Records Unraveled!
EMR Audit Trails as produced by Healthcare Providers during medical malpractice discovery frequently filter out the important history of the patient’s medical record. Learn how to compel discovery of the patient’s complete EMR revision history and the complete audit trail.
Enigma Forensics, Inc. was founded by Lee Neubecker, CISSP, an established Computer Forensics Expert for over 20 years and the President / CEO of Enigma Forensics. Mr. Neubecker has been ranked as one of the top global experts in cybersecurity and computer forensics by Who’s Who Legal for many years running.
Please join us this week, on Friday, June 25th at Noon to 1 PM CST for a complimentary Zoom webinar learn more about:
Neubecker demystifies Electronic Medical Records (EMR) by revealing how EMR can be fabricated, filtered, incomplete or misleading.
Neubecker will walk through the typical stages involved with litigating medical malpractice cases as they relate to EMR.
Neubecker will discuss some of the typical problems and concerns with tendered EMR audit trails and patient charts as produced during discovery.
You will learn how to request and compel discovery to obtain the complete patient EMR audit trails and EMR revision history.
Most of all, you will learn how to detect records that may have been electronically manipulated.
Have you or someone you know been involved in medical injury or accident? Do you want to win your case? Or…If you’re an attorney and have questions about a case involving medical malpractice, read this blog and contact Enigma Forensics for the “W”.
Were you or a loved one involved in a medical accident or injury? Are you an attorney who is representing an injured client?
If the answer is yes, take immediate action and file a Discovery request or subpoena to access all of your Electronic Medical Records (EMR). Why is this important? In order to prove injury or malpractice and win your case it’s imperative to discover what took place and the actions that caused an event. Your electronic medical records or EMR audit trail will document what transpired. EMR audit trails will include prescriptions, tests, treatments, transfers, operation notes, nurse practitioners and doctors notes and a ton more. Electronic Health Records (EHR) are rich with data information describing the care that was provided and decisions that were made good or bad. Some medical record systems such as Epic have sticky notes that are traditionally not part of the formal patient permanent electronic record. Those sticky notes are required to be stored by the Health Insurance Portability and Accountability Act (HIPPA), but are not part of the discharge report showing the patient electronic medical record history. The data does exist and working with a qualified medical record forensic expert can help you to gain a more complete record of the patient encounter with the health care provider.
What else does Electronic Medical Records (EMR) include?
Electronic Medical Records and the patient medical record audit trail include the original record and will note any modifications. It will also preserve dates, times, who accessed the record and whether the record was printed, viewed, deleted or otherwise modified. Many of the systems today, such as; Epic, Cerner, Meditech, All Scripts and others have reports that can be downloaded to reveal vital information about who has authorization to access and audit electronic health records.
Medical dictations are another vital piece to the puzzle. Dictation files are sometimes sent to third party transcription service providers as raw audio files called WAV files. After the WAV files are received they are typically transcribed to text files and fed back into the electronic health record software system. When modification of the patient medical record occurs after an injury or malpractice took place, comparing the transcription WAV files to the produced chart may help reveal alteration to the patient medical records.
Patient Electronic Medical Charts are often Incomplete. You could lose your case!
When electronic medical record discovery requests are made by plaintiffs to healthcare providers, it is common that the production lacks the complete patient medical record history. Healthcare providers facing litigation commonly provide a minimal amount of data in an often useless format. The form of production is often scanned copies of previously printed our documents or charts. Codewords for health care providers, departments and procedures often make interpretation even more challenging. Having an experience EMR computer forensics expert can help provide a more accurate interpretation of the complete Electronic Health Record (EHR) for the harmed patient.
The Health Insurance Portability and Accountability Act of 1996, or HIPAA is a federal law which requires your medical records to be retained for six years at a federal level. However, most states also have their own medical retention laws which can be more stringent than HIPAA stipulates. Check out this government website to learn about how different states interpret this governance. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
How important are faxes? This could win your case!
In some cases, Electronic Medical Records (EMR) are faxed to outside providers either to or from your primary physician. Software vendors such as Forward Advantage provide automated faxing capabilities integrating with the existing health care information management systems and patient medical records. It’s vital you request all communication between facilities to help prove or disprove what and when medical knowledge was presented to the provider to make an informative decision relatable to an event.
Let’s say you have already requested an EMR audit trail for a patient. Did you know that the Electronic Medical Records (EMR) audit trail you received contains cryptic codes that you will not be able to comprehend. It’s extremely helpful to request all of the underlying data dictionaries that will provide the definition of the codes used referring to the friendly name, including, the healthcare provider’s name, department, computer used to access the EMR, procedures, treatments, tests ordered, drugs prescribed and lab results.
Did you know that medical data is required to be retained for six years?
Do you want to to win your case! You need Enigma Forensics experts on your team! Hire a professional forensic expert to assist in writing a Discovery request to obtain, preserve and analyze ALL of the electronic medical records and to help you obtain the complete EMR audit trail. We can help uncover the truth of what took place and help tell the court the story about what happened to you or your client.
Call Enigma Forensics at 312-668-0333 to schedule a complimentary phone call to discovery how we can assist.
EMR or EHR are synonymous. Both are medical records. The electronic medical records or EMR reveal an audit trail of what transpired during a medical or health visit. Each record is unique and tells a story about the patient. We are experts that can assist you to win your case!
Electronic data records are taking the place of the old school hard copy files and completely revolutionizing the way data is gathered and stored. Electronic Health Records (EHR) or Electronic Medical Records (EMR) are synonymous with each other. (EHR) is data that includes the patient’s vital information such as an address, medical history, allergies, immunizations, lab tests results, radiology images, and vital signs, also, personal statistics like age, weight, sexual orientation, and insurance information. (EMR) is an individual’s private health data that is stored in a protected database only accessible to medical personnel in compliance with The Health Insurance Portability and Accountability Act (HIPAA) regulations. EHR’s or EMR’s make patient charting easier and results in fewer errors and keeps this delicate personal information private and secure.
Medical data can be manipulated!
Medical data can be altered and inserted into EMR systems and made to look like it was there all the time or not there at all. Medical malpractice lawyers rely on EMR audit trails to tell the story of either side of a case; the plaintiff or the defendant. Medical records are marked by metadata or raw data. This data is developed separately from the EMR system making manipulation detection visible by reviewing the raw data and the database logs. Metadata can also be described as underlying data, like a digital footprint that creates an audit trail. In order to analyze raw data, you will need to hire Enigma Forensics; we are experts in the field of electronic medical records (EMR) or (EHR).
During a forensic review of EHR’s or EMR’s, we can authenticate or reveal backdating, back charting, data editing, or falsification of records. We have been on both sides of medical malpractice cases and almost always save our client a considerable sum of money. We work closely with the attorneys involved to help with eDiscovery verbiage and assist with what to look for.
Enigma Forensics are experts in collecting and understanding electronic medical records or the EMR audit trail. Check out this blog to view our list of EMR Discovery Questions.
Electronic Medical Records (EMR) can be tricky! In most cases, during eDiscovery, you get what you ask for and only what you ask for! Every Discovery request involving a healthcare provider has unique aspects that need to be considered.
Enigma Forensics is an established Computer Forensic Expert Witness firm that has been involved in many medical malpractice cases and specializes in interpreting electronic medical records (EMR) audit trail or audit logs. Our staff has extensive experience with numerous EMR applications and can assist you with navigating through the challenges of EMR Audit Trails and/or Audit Logs. Electronic Medical Record a.k.a., EMR audit trail or log is the answer to who knew what when, in essence, it tells the story about what took place during the treatment of that patient.
The following is a list of important questions to file for the demand for eDiscovery for Electronic Medical Records, in a medical malpractice case.
Provide the name of all medical software applications utilized to store [Patient Name]’s Electronic Medical Records (EMR).
For each medical software application that contains [Patient Name]’s EMR, please provide the specific version of the software as well as the name of the company that produces the software during the relevant time period beginning on [beginning date] through the present date.
For each medical software application that contains [Patient Name]’s EMR, please indicate if any of the specified software applications were migrated off to a new platform and what the current status is of [Patient Name]’s EMR on the original system.
For each medical software application that contains [Patient Name]’s EMR, please provide the application administrators that have full access to the stored data and audit trails.
For each medical software application that contains [Patient Name]’s EMR, please provide all user and administrator manuals for each of the medical software applications.
For each application that contains [Health Care Provider Name]’s EMR, please provide the current retention settings for the audit trail for all patient’s EMR. Are the privacy log retention settings sent to a secondary audit log (e.g., Fair Warning)? Is the secondary audit log retention configurable within the systems and/or applications?
For each application that contains [Health Care Provider Name]’s EMR, please provide the earliest date that [Patient Name]’s EMR appears in the application’s audit trail.
Please provide the complete EMR audit trail for [Patient Name] detailing any health care provider’s access, review, modification, printing, faxing, or deletion activities in a comma-delimited format with any and all corresponding native files that may relate to the Electronic Medical Record for [Patient Name] as required by the Health Insurance Portability and Accountability Act § 164.312(a)(1). Such an audit trail should include the original values and new values for any alteration of the EMR and shall indicate the user making the change and the date and time of the change.
Please provide the data dictionary for each software application containing [Patient Name]’s EMR. Such dictionary shall include the username key that maps the real names of individuals to their unique user login account IDs for each medical software application containing any EMR for [Patient Name] as required by the Health Insurance Portability and Accountability Act § 164.312(a)(2)(i). Additionally, any lab test, codes, or other short-form identifiers included in [Patient Name]’s EMR Chart or EMR audit trail should be provided as part of the data dictionary production.
Please provide any and all original voice transcription recordings that were made by [Health Care Provider Name], or any other staff that related to [Patient Name].
Please provide any other native electronic files or emails that relate to [Patient Name] in the native format with an index containing the original unmodified metadata for each of the native files or emails produced.
Please provide any DICOM files that were captured as part of [Patient Name]’s treatment by [Health Care Provider].
Please provide electronic records of any outbound faxes and/or other methods of communication that were utilized by [Health Care Provider Name] to [EMR Recipient], in its native form with a corresponding comma file listing containing all available metadata in a delimited format with the corresponding file path to the native file produced for each record.
Please provide the name and title of the person most knowledgeable for the [Health Care Provider Name]’s software/auditing and compliance system.
What customizations and settings were active at the time when the plaintiff was admitted into the hospital? What privacy-related logging is in place for each such system and/or application? Are privacy log retention settings in place for each such system and/or audit log?
