How to Obtain EMR Audit Trails for NY Malpractice Lawsuits

What Is an EMR Audit Trail?

An EMR audit trail (also called an audit log or metadata report) is a electronic record of all activity within a patient's electronic medical record. Unlike the printed medical record — which shows the final version of each note, order, and result — the audit trail shows:

- Who accessed the record (by username and role) - When they accessed it (date and time stamp) - What they viewed, created, modified, or deleted - From where they accessed it (workstation, device, or location) - Prior versions of notes that were later modified

Every major EMR system — including Epic, Cerner, Meditech, Allscripts, and others — automatically generates audit trails as a built-in feature. These audit trails are required by federal law (HIPAA) and are maintained by healthcare institutions for years.

The audit trail is separate from the medical record itself — and it is not included in standard medical record requests. If you don't specifically request the audit trail, you won't get it — and you'll miss critical evidence about what really happened.

Why EMR Audit Trails Matter in Malpractice Cases

EMR audit trails can reveal evidence that is not visible in the printed medical record — and this evidence can be critical in malpractice cases:

• Late entries: A physician or nurse may add a note after an adverse event — backdating it or creating it days later — to make it appear they assessed the patient or took appropriate action. The audit trail reveals when the note was actually created — which may be long after the date on the note.
• Modifications and deletions: The audit trail shows if a note, order, or result was modified or deleted after the fact — and shows the original version. This can reveal attempts to alter the record after an adverse event.
• Who accessed the record and when: The audit trail shows who looked at the record — which can reveal whether a physician actually reviewed the patient's chart, whether a nurse checked on the patient, or whether a specialist was consulted.
• Timing of orders and actions: The audit trail can reveal the exact time an order was placed, when a medication was administered, or when a result was reviewed — which can prove or disprove allegations of delay. [Link to: /medication-errors/statute-of-limitations]
• Failure to monitor: The audit trail can show whether a nurse or physician checked on the patient at the required intervals — or whether there were long gaps in monitoring. [Link to: /medical-malpractice/failure-to-monitor] [Link to: /medical-malpractice/icu-negligence]
• Failure to review results: The audit trail can show whether a physician reviewed lab results, imaging reports, or consultation notes — and when. This can prove failure to follow up on abnormal results. [Link to: /delayed-diagnosis-lawyer/failure-to-follow-up]
• Cover-ups and alterations: In cases where providers attempt to alter the record after an adverse event — the audit trail is the evidence that exposes the alteration.

What Information Is in an EMR Audit Trail?

EMR audit trails vary by system — but typically include the following information for each entry:

- Date and time stamp: Exactly when the action occurred — down to the second. - User identity: The username and role (physician, nurse, pharmacist, etc.) of the person who performed the action. - Action type: What was done — including: - Log in / log out: When a user accessed the system. - View: What records were viewed (and for how long). - Create: New notes, orders, or entries created. - Modify: Changes made to existing entries — including what was changed. - Delete: Entries that were deleted. - Print: What was printed (and when). - Copy/Forward: Notes that were copied or forwarded (common in charting — and a source of errors). - Source/location: The workstation, device, or location from which the action occurred. - Prior versions: For modified entries — the original version before the change.

In addition to the audit trail, there are related EMR reports that can be valuable:

• System-generated reports: Including user activity logs, access logs, and security logs.
• Metadata: Data about the data — including creation dates, modification dates, and authorship.
• Deleted item recovery: Even deleted entries may be recoverable from the audit trail or backup systems.

Step-by-Step: How to Request EMR Audit Trails

Obtaining EMR audit trails requires a specific request — they are not included in standard medical record requests. Here is how to request them:

Step 1: Request during pre-suit investigation

During the pre-suit investigation, send a written request for the complete medical record — including the EMR audit trail — to the hospital's Health Information Management (HIM) department or Medical Records department. The request should be on your attorney's letterhead and include: - The patient's name, date of birth, and medical record number - The dates of treatment - A HIPAA-compliant authorization signed by the patient (or legal representative) - A specific request for the EMR audit trail, audit log, metadata report, and any system-generated reports - A request for the records in electronic format (not paper)

Step 2: Follow up

Hospitals often initially provide only the printed medical record — without the audit trail. Follow up in writing, specifically requesting the audit trail again. Cite HIPAA's requirement to provide all designated record set materials.

Step 3: Request during discovery

Once the lawsuit is filed, request the audit trail through formal discovery — including: - A discovery demand for the EMR audit trail, metadata, and all system-generated reports - A subpoena duces tecum to the hospital's HIM department - A notice to produce specifying the exact format and date range

Step 4: Retain an EMR expert

EMR audit trails can be complex and difficult to interpret. Retain a qualified EMR expert — typically a health information technology specialist — who can: - Interpret the audit trail - Identify suspicious entries (late entries, modifications, deletions) - Prepare exhibits for trial - Testify about the significance of the audit trail findings

[Link to: /medical-malpractice/discovery-process] [Link to: /resources/how-to-get-medical-records-for-a-lawsuit]

Common Hospital Systems in New York

New York hospitals use various EMR systems — and knowing which system a hospital uses helps in requesting the right audit trail format:

• Epic: Used by many major New York hospitals — including NewYork-Presbyterian, Weill Cornell, and others. Epic audit trails are comprehensive and can be exported in various formats.
• Cerner: Used by several New York hospitals and health systems. Cerner audit trails are also comprehensive.
• Meditech: Used by some New York hospitals — particularly smaller and community hospitals. Meditech audit trails may be less user-friendly but are still available.
• Allscripts: Used by some physician practices and smaller facilities.
• Other systems: Including Soarian, McKesson, and others — each with their own audit trail capabilities.

What to Do If the Hospital Refuses or Provides Incomplete Records

Hospitals may resist providing audit trails — claiming they are not part of the medical record, are too burdensome to produce, or contain protected information. If you encounter resistance:

1. Escalate the request: Speak with the HIM director or hospital compliance officer — who may be more knowledgeable about audit trail requirements.

2. Cite HIPAA: Under HIPAA, patients have a right to access their "designated record set" — which includes the EMR audit trail. The hospital must provide it within 30 days (with one 30-day extension for good cause).

3. File a motion to compel: If the hospital refuses during discovery, your attorney can file a motion to compel with the court — asking the judge to order production.

4. Request a forensic examination: In cases of suspected record alteration — your attorney can request a forensic examination of the hospital's EMR system — including backup tapes and deleted item recovery.

5. Spoliation claim: If the hospital destroyed or failed to preserve the audit trail — your attorney can bring a spoliation claim — asking the court for adverse inferences or sanctions.

6. Report to regulatory authorities: If the hospital is violating HIPAA or refusing to produce records — a complaint can be filed with the Office for Civil Rights (OCR) or the New York State Department of Health. [Link to: /resources/how-to-get-medical-records-for-a-lawsuit]

Using EMR Audit Trails in Your Case

Once you obtain the EMR audit trail, your attorney and EMR expert will analyze it for evidence:

- Late entries: Notes created after an adverse event — but dated earlier — can prove that the provider tried to create a record of care that didn't actually occur. - Modifications: Changes to notes, orders, or results after the fact can prove attempts to alter the record. - Deletions: Deleted entries may be recoverable — and can reveal what the provider tried to hide. - Access patterns: Who accessed the record — and when — can prove or disprove whether a physician actually reviewed the patient's chart, whether a nurse checked on the patient, or whether a specialist was consulted. - Timing: The exact timing of orders, medication administration, and result review can prove or disprove allegations of delay.

This evidence can be devastating to the defense — and can turn a "he said, she said" case into one with clear, objective proof of what happened. [Link to: /medical-malpractice/discovery-process] [Link to: /hospital-negligence/emr-audit-trails]

Frequently Asked Questions

The value of a medical malpractice case in New York depends on several factors, including the severity of the injury, the strength of liability evidence, and the economic and non-economic damages involved. New York is one of the few states with no caps on medical malpractice damages, meaning there is no artificial limit on what you can recover. Below are typical settlement ranges based on injury severity.