A nurse can assess whether the vitals in a chart make clinical sense. An EMR technical specialist can investigate a different question: does the entry labeled 02:14 represent documentation recorded at that time, a later entry at 09:40, or information imported from another source? Those are different questions.
Treat that as a hypothetical. The distinction matters whenever the sequence of documentation is disputed. The time displayed beside a clinical observation and the time a system records an action can represent different events, and the chart alone usually cannot show which.
EMRCheck helps attorneys identify the technical records needed to investigate those questions and interpret what the available evidence supports. Obtaining an audit report is the beginning of that work, not the end.
Clinical review and technical analysis answer different questions
Clinical experts evaluate the care described in the record. They assess the significance of vital signs, medications, diagnoses, and treatment decisions against the standard of care.
Technical EMR analysis examines the documentation process. Which account created an entry? What does each timestamp mean? Was the note edited before or after signature? Did the produced record include the relevant history? The same record element raises both kinds of question.
| Record element | Clinical question | Technical question |
|---|---|---|
| Vital signs | Are the values consistent with the patient's condition, and was the response to them appropriate? | When were the values recorded, under which account, and did they arrive by manual entry, a device interface, or another workflow? |
| Progress note | Do the assessment and plan reflect the standard of care? | When was the note created, edited, and signed, and does the produced version match the retained history? |
| Medication order | Were the drug, dose, and timing appropriate? | Who initiated, modified, released, and cosigned the order, and in what sequence? |
| Result review | Should the result have prompted action? | Does any access event show the result itself was opened, or only that a broader section of the chart was viewed? |
| Produced chart | Is the record complete enough to evaluate the care? | Does the production include retained versions, audit events, and order history, or only the current view? |
Some clinicians and legal nurse consultants also have technical expertise, and not every IT professional has the forensic EMR experience this work requires. The question is whether your case team includes someone qualified to obtain and interpret the relevant EMR evidence.
What the chart view may leave out
A flowsheet, note, medication administration record, or printed PDF is a presentation of stored information. Depending on the system and the export, it may not include all retained versions, audit events, or order history. The examples below are hypothetical and illustrate the gap between what a chart displays and what a system may have retained.
- Hypothetical: entry time and event time
- Vitals are attributed to 02:14. The audit trail may show when they were recorded, which could be 02:14, 09:40, or the time an interface posted them. None of those alone says anything about the care. Set beside the clinical record, they show the sequence in which the documentation was made.
- Hypothetical: note creation and signature
- A note displays 14:00. The system may have retained a creation time, one or more edit events, and a signature time, each different from the displayed time. Which event the displayed time represents depends on the platform and how it was configured.
- Hypothetical: order initiation and release
- An order appears signed. The retained order history may separate who initiated it, who modified it, when it was released to pharmacy or nursing, and whether a cosignature followed, in a sequence the signature line alone does not show.
- Hypothetical: export and retained source data
- A chart was migrated or exported. The original timestamps and history may or may not have survived. Comparing the export against the source system's retained data, where it still exists, is how that question gets answered.
These are questions for the evidence. A discrepancy alone does not establish improper care or altered documentation. Late documentation, access events, template use, and missing fields all have routine explanations in many systems. The analysis reports what the records support, whether that helps or hurts the theory of the case. For the patterns that do warrant a closer look, see altered records and back-charting analysis.
Templates and order signing
A signature is an event. The origin of the signed content is a separate question.
When the relevant metadata, history, configuration, and workflow records are preserved and produced, technical analysis can investigate whether a note or order originated from a template, an order set, copied or carried-forward content, or an automated process. Who signed it, and when, is answered from different records than where the content came from.
The inquiry may require more than an access log. Order history, document versions, provenance metadata, and the configuration of the signing workflow can all matter. Provenance means the information a system keeps about how a record was created or revised, and which systems and accounts were involved.
Not every system records every copy-and-paste action, and this analysis does not promise otherwise. Template use alone does not establish whether the clinician independently reviewed the patient or the underlying information. Neither does a signature. Technical findings describe the documented workflow so the legal and clinical teams can assess its significance.
Finding the relevant audit evidence
Receiving an audit report does not finish the analysis. Its event codes, timestamp definitions, account mappings, and coverage must be understood before anyone draws conclusions from it. The records below are what make that possible, and most are obtainable in discovery when requested by name.
- Patient-specific audit records
- The log of actions taken in this patient's chart during the relevant period: views, entries, edits, signatures, prints, and exports. The chart-level report, not a system-wide extract.
- Event-code definitions
- The vendor's key to what each logged action name means. Without it, an event labeled as access cannot be told apart from an edit, a print, or an automated refresh with any confidence.
- Order histories
- Each state an order passed through, with the account and time recorded for every transition: entered, modified, released, verified, cosigned, discontinued.
- User and account mappings
- The table connecting account identifiers to named people and roles. An account is not a verified human actor. Shared logins, proxy access, and automated service accounts all exist, and the mapping is where that gets sorted out.
- Timestamp explanations
- Which field holds the time an action occurred in the system, which holds the time a clinician entered as the event time, and what time zone and clock source each one uses.
- Export and migration documentation
- How the production was generated, from which system, and whether audit history and original timestamps were carried across any system conversion.
The analysis considers how the system was configured, what history was retained, and what was actually produced. It separates observations the data supports from open questions that need additional records or an explanation from the producing party. Conclusions depend on the system, its configuration, the retained data, and the records produced. The EMR discovery guide covers the request language, and the EMR system guides cover what each major platform retains.
Experience behind the analysis
I bring 15+ years of experience building and running the infrastructure that clinical systems depend on: databases, audit tables, access logs, backups, retention processes, and migrations.
That experience informs the questions I ask about the record behind the screen and the technical evidence needed to answer them. Where the answer is that the produced records cannot support a conclusion, that is what the report says.
Common questions
Do I need technical EMR analysis if I already have a nurse consultant?
It depends on what is disputed. If the question is whether the care was appropriate, clinical review may be all the case needs. If the question is when an entry was made, who made it, whether it was changed, or where its content came from, the answer lives in audit records and metadata that call for technical interpretation. The two reviews complement each other.
Isn't the audit trail self-explanatory once it is produced?
Rarely. Event codes, timestamp fields, and account identifiers are platform-specific, and the same report can support different readings until the definitions, configuration, and coverage are established. What the evidence supports depends on the system, its configuration, the data retained, and the records actually produced.
Can technical analysis prove a record was falsified?
It can show what the system retained about when and how entries were made, viewed, and changed. Whether that amounts to falsification is a legal and factual conclusion for counsel and the finder of fact. Late documentation, template use, access events, and missing fields each have routine explanations in many systems, and the analysis reports supported observations and open questions, not conclusions about intent.
This page is educational information, not legal advice. EMR Check provides consulting and analysis services, not legal representation, and using this site does not create an attorney–client relationship.