Published
- Attorneys
- Physician reviewers
- Health information managers
- Clinical informaticists
Prepared · sources accessed (UTC) · physician review still to be recorded
A printed chart is a representation of selected stored information. It may not reproduce the screen, sequence, permissions, alerts, or available information at an earlier clinical decision. Conversely, a technical log can record an event without explaining its medical meaning. A sound review keeps those two problems connected while assigning each to the appropriate discipline.
This guide helps attorneys, health information staff, physician reviewers, and technical specialists frame questions about a disputed electronic record. It provides a question-to-source matrix and a two-part reporting method. It does not offer forensic extraction instructions or presume that historical screen states can always be recovered.
Start with the discrepancy, not a demand for every log
Write the disputed proposition precisely. “The physician saw the result” is different from “the result was routed to the physician’s account,” and both differ from “the result was clinically available in a way requiring action.” Identify which proposition matters before requesting technical material.
Ask what the existing production contains and excludes: signed notes, amendments, messages, orders, result versions, medication lists, scanned documents, and relevant metadata. Record the export date and production method. An export generated today can display a current label beside an older event; that does not necessarily establish the label used at the earlier time.
HHS’s individual-access guidance explains that designated record sets extend beyond the conventional clinical note. It does not establish that every technical log is within an individual’s access right. Counsel and records staff should determine the appropriate request and preservation process for each category.
Decide which questions require technical expertise
A physician can explain why a missing allergy, altered instruction, or delayed result would matter clinically. A technical reviewer may be needed to determine which data were stored, which event a log label represents, how a template populated a field, or whether an extraction is complete.
The organization or vendor may be the best source of configuration and event definitions. Obtain relevant documentation with its version and effective period. Current behavior can help form a hypothesis, but a present-day demonstration does not by itself reproduce a historical deployment.
NIST SP 800-86 describes forensic analysis from an information-technology perspective and expressly does not present itself as an exhaustive investigation manual or legal advice. Its 2006 publication date also matters: contemporary system-specific interpretation requires current technical knowledge.
Reconcile clocks without inventing an event sequence
List the clocks before sorting records into a single chronology. Possibilities include local display time, server time, an external laboratory timestamp, an interface receipt time, note entry time, signature time, and a manually stated time of care. Document time zone, daylight-saving treatment, and known synchronization limits where material.
The ONC audit certification companion guide addresses synchronized timestamps and auditable actions. It also explains that audit granularity can identify a category such as medication-list access without recording the particular medicine. A log therefore needs interpretation; it is not a recording of human attention or comprehension.
Where clocks cannot be reliably aligned, report a range or separate sequences. Avoid false precision. “The interface event occurred before the signed note, but the exact interval is unresolved” can be more accurate than an unsupported minute-by-minute narrative.
Trace a disputed assertion through its versions
Choose one assertion and follow it from the earliest identifiable source to later destinations. A phrase may move from a patient account into a draft, a signed note, a problem list, and a discharge summary. Identify where the meaning changed and where a correction did or did not reach another record.
Keep the source, transformation, responsible action if established, and clinical use in separate columns. Do not infer intentional falsification from a discrepancy alone. Equally, do not dismiss a clinically important discrepancy merely because a template or automated function contributed. The task is to establish what happened and its significance before assigning a legal characterization.
Fictional worked case: routed, opened, and acknowledged
Fictional case. An imaging result appears in a chart production dated June 12. An audit extract contains “route” at 08:05, “open” at 08:12, and “acknowledge” at 16:40. The complaint alleges that a physician knowingly ignored a recommendation throughout that day.
The technical reviewer first obtains the system’s definitions. In this invented configuration, “route” means delivery to a shared pool, “open” means that a user displayed the patient chart, and “acknowledge” is an action available to several authorized staff roles. The extract does not identify which part of the chart was visible during the open event.
The physician reviewer can explain the potential importance of the recommendation. The current evidence does not establish that the physician read it at 08:12. Additional task assignments, screen behavior, user identification, and clinical communications may clarify availability and response. If that information is unavailable, the report should preserve the limit.
In a second branch, a separate contemporaneous message quotes the recommendation and records the physician’s clinical plan. That evidence supports knowledge and response more directly, although the adequacy of the plan remains a medical question. The lesson is to combine sources without making the technical log prove more than it records.
Question-to-source worksheet
Complete the first column before choosing a request. Use the actual custodian and system names in a protected working file.
| Question | Likely source to investigate | Custodian | Technical interpretation needed | Clinical significance |
|---|---|---|---|---|
| Which result version existed? | Result history; source laboratory record | ______ | Version and amendment meaning | ______ |
| Where was it delivered? | Interface and routing records | ______ | Destination and failure semantics | ______ |
| What could this role display? | Historical permissions; configuration | ______ | Role and screen behavior | ______ |
| Where did the assertion originate? | Draft, signed note, import history | ______ | Lineage and transformations | ______ |
| Did a correction reach another field? | Amendment and downstream records | ______ | Propagation behavior | ______ |
For each request, add the relevant date range, preservation question, lawful access mechanism, and consequence if the source is unavailable. A targeted request should remain broad enough to capture competing explanations rather than only evidence favorable to one account.
Write a two-part report
The technical section should describe materials received, methods, relevant event definitions, findings, and limits. It should distinguish direct observation from inference and identify whether the historical environment was reproduced or merely approximated.
The clinical section should state which technical findings it accepts as assumptions, how the information affects medical interpretation, and what other evidence matters. If the technical conclusion changes, identify which clinical conclusion must be revisited. Each author should approve their own contribution; a joint cover page should not imply expertise in every discipline.
Preserve disagreement. A technical reviewer may establish that a message was delivered while the clinical reviewer concludes that delivery alone does not establish an adequate handoff. Those positions can coexist. Counsel determines how the evidence relates to the legal issues, applicable expert rules, and fact-finder’s role.
Questions readers ask
Does a chart-open event prove that a clinician read a particular result?
Not without evidence establishing what that event records and what was displayed. Even a specific viewing event does not directly measure comprehension. Corroborating clinical communications may be important.
Can a current product demonstration establish what happened years earlier?
Only to the extent the relevant versions, configuration, permissions, data, and conditions are shown to match. Otherwise it is a present-day demonstration with a limited relationship to the historical question.
What if a historical configuration cannot be recovered?
Document the effort and the resulting uncertainty. Other evidence may still answer part of the question. Do not fill an unrecoverable gap with an assumed configuration or imply that missing evidence necessarily favors either side.
Related resources and sources
Existing foundations: clinical documentation review, reading an EHR record, and qualifications and limits. Continue with medical-record review methods, multidisciplinary reviewer selection, and clinical AI change review.
Source and scope note. Primary sources are HHS access guidance, ONC audit certification guidance, and NIST SP 800-86, linked above. The example is fictional. Clinical interpretation, technical extraction, discovery, and admissibility are separate responsibilities. Prepared November 5, 2026 Pacific.