BEST PRACTICES FOR CASE EVALUATION
How to Analyze Electronic Medical Records
by Vickie L. Milazzo, RN, MSN, JD
Electronic medical records (EMR) were once the wave of the future, but no more. Now they are here and they are here to
stay. If you are an experienced CLNC® who has never worked with EMRs, you could find them intimidating at first. However, your role
as a CLNC® in reviewing the EMR is the same as your role in reviewing handwritten medical records. In either case your task is to
determine whether the record is complete, accurate and free of tampering and to address any concerns your attorney-client has about case issues.
The depth of your review will be influenced by the type of case and the attorney you're working with.
The good news is that EMRs are actually easy to work with because they are more legible than handwritten records. This article will quickly get you
up to speed and help you appreciate that you do have the competency to review any type of medical record, whether handwritten or
electronic.
First, you have to know what comprises an EMR. An EMR is any combination of text, graphics or other information in digital form created, maintained,
modified, retrieved or distributed via computer.
Second, you need to understand how EMR documentation is created and how it flows. You also need an overall grasp of common documentation practices,
something your nursing training and experience has provided. Because the contents of electronic and handwritten records are basically the
same, mastering the EMR is only a matter of learning how the various electronic formats are created and handled. In most cases you will be analyzing
paper printouts of electronic records, so some of the principles of analyzing handwritten records still apply.
As with any case you screen, you will often initially review an incomplete set of EMRs. If you work the case in depth, make sure you receive a
complete copy the EMR before you render conclusive opinions.
In order to understand how an electronically documented event or incident actually unfolded, here are some specific questions you should advise your
attorney-client to uncover the answers to through discovery:
What EMR software program does the facility or healthcare provider use? What are the program's capabilities and limitations? What are the components of the system? What are the points of entry?
How and where are entries made? Who can make entries?
Who has access to the EMR? How are dates and times entered on the EMR?
Does the EMR system have preset standard responses, such as automatic times for medication administration?
How do the electronic signatures work? Who uses such signatures? Do the medical and nursing staff share signature blocks indiscriminately? Does the facility have a policy on the use of signature blocks and passwords? (No healthcare provider should entrust his electronic signature to a third party, as this creates liability issues.)
Can healthcare professionals make changes or corrections to the EMR? Are handwritten corrections allowed? Is there a facility policy in place for making corrections to the EMR?
Is the EMR printed? If so, when it is printed, e.g., daily or at the end of the admission?
How is the EMR secured? What security monitoring system is used to track and report activity on the facility's computers? Does this system capture hidden passwords? Does it record all keystrokes, window titles and times, clipboard activity, menus, mouse clicks, etc.?
What systems does the facility use for password protection, data integrity, data backup and recovery, and accountability for documentation and other actions of healthcare providers? What precautions secure the EMR if the system goes down?
Where and how is the EMR stored? Who has access to stored EMRs? Is the EMR accessible off-site? If so, by whom and under what circumstances?
Understanding these nuances of EMR documentation is essential to the CLNC®'s role in alerting the attorney to possible security
loopholes and possible tampering.
How to Detect Tampering in the EMR
Detecting tampering is sometimes more challenging in the EMR than in a handwritten record. However, once you establish a suspicion of tampering, a
computer expert can easily prove or disprove the allegation.
With any EMR program, data integrity is difficult if not impossible to guarantee. The EMR can be manipulated years after the patient goes home. EMRs
can be altered even if they are password protected, access restricted, encrypted or secured by undisclosed internal data structures and file formats
or built-in "secret" audit trails on the hard drive. In short, every EMR program has security loopholes.
Here are some of the issues you should be aware of in assessing the possibility of tampering:
Are the time stamps from different portions the EMR consistent with the chain of events? Every EMR has several components, each with its own internal clock that time-stamps each entry.
Does the EMR program have a password or lock-out feature that automatically places a virtual electronic signature on every entry regardless of when the chart is printed?
Is the electronic signature protected by a private key? If so, proving that a healthcare provider did not digitally sign the medical document will be difficult unless his private key has been compromised.
Does the electronic signature require a countersignature? This makes it more difficult to alter.
Does the electronic signature contain an embedded time stamp that can be manipulated by manually adjusting it prior to electronically signing the medical record? This step is sometimes forgotten by an individual tampering with the medical record, and the resulting discrepancy in the time of the tampered entry would be obvious.
Does the EMR provide for the use of "canned" notes, templates set up to save time in entering information about patients who experience similar responses? An entire report can even be canned with only a few individualized entries.
Are digests of the EMR created and transmitted via email? If so, is the digest time-stamped and signed electronically by the person who created it?
Do medical record custodians keep copies of the original EMR in files stored separately from the original medical record?
Does the billing department keep copies of portions of the medical record attached to the financial statements?
Despite these issues, an EMR expert can analyze computer-generated audit trails to detect tampering once specific suspicions are established. The EMR
expert can also assess whether each electronic signature is linked to its documentation entry and not to a falsified copy.
Additionally, you should apply the basic rules for detecting tampering in the handwritten medical record:
Briefly check each page for consistent format, print style and font.
Identify any missing records and inform your attorney-client.
Compare different copies of the EMR from different sources for consistency.
Identify inconsistencies in time stamps among different EMR components or between electronic and handwritten records.
Assess for any of the following:
Fax numbers or printed headings that are inconsistent with the rest of the EMR.
Evidence that pages are copied, reduced or offset compared to original printouts of the EMR.
Updated or inconsistent documentation forms that were not in use at the time of the incident.
Notes that appear more like answers to interrogatories instead of clinical observations about the patient.
Notes that appear to be canned, either in part or as a whole, because of these clues:
The patient's name is missing or different in different areas of the note because the healthcare provider didn't update the patient's name in all instances.
The report inconsistently identifies the orientation of an injury, such as substituting right for left throughout the report or randomly mixing right and left.
The wording is exactly the same from one record to the next.
Changes in documentation pattern, length or content within the EMR or between the EMR and handwritten entries.
Altered, substituted or falsified entries.
Gaps in the time or content of the documentation.
Missing entire EMR or sections of the EMR.
Missing documentation of an incident or event.
Inconsistencies between the EMR and electronic or paper billings.
Inconsistencies among the notes by different healthcare providers.
Focus your comments on significant tampering issues relevant to the issues in the case.
How to Assist Your Attorney-Client with EMR Discovery
As the CLNC®, you can assist your attorney-client with discovery of electronic medical records. Use the following lists of
essential interrogatories and requests for production as your starting points. Expand each list as needed to meet your client's requirements
and the specifics of your case.
Recommended Interrogatories
Please state the exact name of the EMR system, and the names, addresses and telephone numbers of the vendor, vendor representatives and tech support personnel.
Please identify each individual component part, section and subsection of the EMR system.
Please state when the EMR system was initially implemented and when any upgrades were installed.
Please state whether the facility uses EMR exclusively or whether portions of the medical record are handwritten.
Please state what kind of security monitoring system the healthcare provider has in place.
Please state whether the EMR software allows a grace period during which a note can be changed, edited or deleted before being permanently saved and dated.
Please state whether the EMR program has a lock-out deadline, and if so, when and how often this deadline takes effect.
Please state how many templates were created or used to create the document and produce a copy of any and all such templates.
Please state whether the EMR is ever printed in hard copy, and if so, how often and under what circumstances.
Please identify the form in which an EMR can be retrieved – as paper copy or on CD.
Please identify the names, addresses and phone numbers of the hospital employees responsible for teaching new staff and updating staff on EMR documentation policies.
Please identify the names, addresses and phone numbers of the persons responsible for maintaining and backing-up the EMR system.
Recommended Requests for Production
In your opening paragraph you should clarify that if the respective department or nursing unit does not have the particular document you are
requesting, then make it clear that any department or unit that has a similar document should produce it in response to your letter.
A copy of the EMR software version, service pack and all manufacturer warnings or alerts.
A copy of the EMR operations, instruction and maintenance manuals.
A copy of all policies and procedures for any EMR system safeguards designed to guarantee reporting of attempts to breach security.
A copy of all facility policies and procedures regarding the EMR, including but not limited to printing and storage procedures.
A copy of all facility policies and procedures for employees, nurses, ancillary personnel and physicians regarding EMR documentation standards.
A copy of all facility policies and procedures related to security and confidentiality of the EMR, including but not limited to password protection, data integrity and accountability for documentation and other actions by healthcare providers.
A copy of the facility's policy and procedure for late entries and corrections to the EMR.
A copy of all facility policies and procedures concerning synchronization of the computer system's internal clocks, time stamps and audit trails, and evidence that such synchronization was in place at the time of the incident or event.
A copy of all message digests of the EMR document in question.
A copy of any orientation manual or educational manual that teaches new employees how to use the EMR system and evidence of continuing education for all relevant healthcare providers.
A copy of all facility policies and procedures for back-up and restoration of the EMR.
You should also obtain the JCAHO standards for electronic medical records and information management; for maintaining the confidentiality, security and integrity of the EMR; and for protecting the EMR against loss, destruction, tampering, unauthorized use or access.
Add EMR Analysis to Your List of CLNC® Services
While you're developing confidence in your own EMR analysis skills, you might consider hiring a CLNC® subcontractor who is an EMR expert. Then you can offer this service to your attorney-clients immediately. You will also want to expand your pool
of testifying experts by adding EMR experts, such as forensic document examiners and computer specialists. The ability to supply this expertise
to your attorney-client makes you indispensable.
