All 27 chapters in this guide
Published
- Institutions
- Physicians
- Attorneys
Reviewed by Kanwar Partap Singh Gill, MD · sources checked
When a hospital or outpatient employer controls the technology, a malpractice investigation must examine both the clinical decisions and the system in which those decisions occurred. Responsibility cannot be allocated reliably from job titles alone. The relevant questions include who selected the system, who could change it, who knew about the problem, what safeguards were feasible, what a clinician could actually see or do, and how the alleged failure contributed to the injury.
The federal SAFER Guides offer a structured way to evaluate electronic health record safety, including organizational responsibilities, system management, patient identification, order entry, results follow-up, communication, and downtime planning. They are safety resources, not a rule automatically establishing negligence or allocating liability. Their relevance to a particular claim depends on the facts, applicable duties, expert analysis, and any separately applicable regulatory requirements. Source: 2025 SAFER Guides.
Map actual control before assigning fault
| Participant | Questions about responsibility and control | Evidence that can resolve the question |
|---|---|---|
| Treating physician or other clinician | What information was available or reasonably should have been obtained? Was the output clinically plausible? What follow-up, verification, escalation, or alternative action was feasible? | Encounter records, displayed results, communications, training, access permissions, and contemporaneous escalation. |
| Hospital or outpatient employer | Who selected, configured, staffed, and monitored the workflow? Who assigned coverage and controlled inboxes, alerts, downtime procedures, and retention? | Governance records, contracts, configuration history, staffing and coverage schedules, incident trends, and corrective actions. |
| Medical group or practice leadership | Who owned the handoffs among clinicians, sites, specialists, and covering teams? | Assignment rules, supervision arrangements, referral tracking, onboarding, and departure procedures. |
| IT, informatics, and operational teams | Who could change routing, permissions, alert thresholds, interfaces, and release settings? What monitoring identified failures? | Tickets, release notes, access logs, testing records, validation results, and change approvals. |
| Technology vendor or integrator | What did the product promise and actually do? Were limitations, defects, or known risks communicated? What did the customer change? | Product documentation, implementation specifications, defect reports, version history, and support correspondence. |
| Laboratory, imaging provider, or external interface operator | Was the result generated, transmitted, matched, acknowledged, and delivered to an accountable recipient? | Source reports, interface messages, failure queues, correction notices, and critical-result communication records. |
| Health plan or utilization-review contractor | Did a coverage or medical-necessity decision introduce delay? Who made and reviewed it? | Submission and decision timelines, criteria, reviewer qualifications, requests for information, and appeal records. |
This table identifies investigative questions. It does not establish that every participant owes the same duty, that every vendor is liable in tort, or that fault should be divided into predetermined percentages. Employment, agency, direct institutional negligence, contractual duties, causation, and applicable defenses require their own analysis.
An institution's control of a system can be significant evidence. It does not automatically erase a clinician's independent obligations. A clinician's signature likewise does not establish that the clinician controlled routing rules, staffing levels, interface defects, or hidden software behavior. A contract allocating indemnity or defense costs between organizations does not itself determine all rights of an injured patient.
Clinical control and the corporate practice of medicine
The Medical Board's corporate-practice guidance distinguishes clinical decisions from ordinary business management. Decisions about diagnostic testing, referrals, treatment, and control of medical records can implicate professional authority. Business and Professions Code sections 2052 and 2400 and the applicable statutory structures and exceptions require a separate analysis of the organization and activity. Owning software alone does not establish an unlawful corporate practice, and the guidance should not be summarized as a prohibition on every hospital employment arrangement. Source: Medical Board practice information and corporate-practice guidance.
An institutional policy that prevents a clinician from correcting a dangerous output, making an indicated referral, or escalating an unsafe workflow deserves examination on its actual facts. Preserve the policy, the clinician's available authority, objections, responses, and the consequences for care. A corporate-practice theory and a malpractice theory remain separate: each needs its own legal basis, responsible actors, supporting evidence, and appropriate remedy.
Reconstruct the clinical experience, not just the printed chart
A chart export is one representation of a changing information system. It may not show the exact screen, alert, queue, or version available when a decision was made. Useful technical evidence can include authorship and signature history, amendments, access and action logs, order status, result routing, interface acknowledgments, and relevant role permissions. Counsel should ask what each field means before drawing conclusions from it.
A “delivered” message may describe a technical destination rather than a human review. A “read” status may reflect an application event without establishing comprehension, evaluation, or action. Conversely, a missing event in a particular export does not necessarily establish that no action occurred; the relevant function may be logged elsewhere or may not have been retained. These are evidentiary questions for the system custodian and, when appropriate, a qualified technical expert.
Time also requires care. Server time, workstation time, local time, daylight-saving changes, interface delays, and imported records can produce apparent inconsistencies. A reliable chronology identifies the event, source, time zone, clock assumptions, and whether a timestamp represents creation, receipt, modification, or later display. An expert should distinguish what the logs establish from what remains an inference.
Preserve the information needed to explain the event
After a significant incident or anticipated claim, relevant custodians should receive a coordinated preservation instruction. Depending on the facts, it may cover native records, audit trails, interface messages, portal communications, inbox ownership, local configuration, relevant product versions, and support tickets. Short retention periods for operational logs make prompt identification important. Preservation should be proportionate to the dispute and should protect patient information through appropriate access controls and secure handling.
The clinical record should continue to support patient care. A legitimate later entry should be truthful, dated, attributable, and identifiable as a later entry. Do not overwrite the historical record, backdate an explanation, or use copied text to create a false appearance of contemporaneous review. The records page addresses California retention and forthcoming note-authorship requirements in greater detail.
A results-inbox example
An abnormal imaging result reaches a former physician's inbox after the physician leaves a practice. The employer controls the account, forwarding rules, and coverage assignment. A covering clinician sees an unrelated encounter but has no access to that inbox. The patient is diagnosed months later.
The investigation should determine whether the ordering clinician arranged appropriate follow-up, whether the practice had a functioning departure procedure, whether the result was routed to an active recipient, whether the imaging provider completed required communication, and when a reasonable intervention could have changed the outcome. It should also examine whether the patient received instructions and whether relevant warning signs led to other opportunities to act. A single screenshot of an unopened result cannot answer all of those questions.
For the physician, the preventive response is a named results owner, clear coverage, a route for unresolved items, and documented escalation when access fails. For the institution, it is tested routing and reconciliation when staff join, leave, change roles, or take leave. For counsel, it is a chronology connecting the alleged system defect and clinical omissions to the patient's injury. Source: SAFER Guide, Test Results Reporting and Follow-Up.
Build a system that can detect its own failures
A useful safety process assigns an accountable owner to each high-risk handoff, tests the workflow before deployment, monitors unresolved work, and provides a workable escalation route. Downtime plans should specify how clinicians obtain essential information, place and reconcile orders, communicate urgent findings, and return to the electronic system. Staff need a practical route to report unsafe behavior and a responsible person empowered to correct it. Sources: SAFER organizational resources and Contingency Planning Guide.
These measures reduce avoidable risk; no workflow guarantees that malpractice will never occur. Their legal value comes from what they actually accomplish: making hazards visible, assigning achievable responsibilities, documenting action, and enabling a fact-based explanation when an injury occurs.