The platform landscape
eClinicalWorks (eCW) is a widely deployed ambulatory EHR. Its audit log captures documentation activity, and the platform's handling of note locking and addenda is central to integrity questions: once a progress note is locked, later changes should appear as addenda or logged edits rather than silent alterations. The audit log is the record that tests whether that actually held.
Audit trail & access-log reporting
- Audit log
- The administrative audit of user actions and documentation activity, including timing of note creation and changes.
- Note lock / addendum history
- Whether and when a note was locked, and whether subsequent changes were recorded as addenda — the dividing line between a legitimate correction and an undisclosed alteration.
- Encounter activity detail
- Per-encounter timing of documentation entry relative to the visit and to authentication.
Report names and behavior vary by version, module, and how the organization configured its system — capability should be assessed against the specific deployment, not assumed.
| Timestamp (UTC) | User | Action | Detail |
|---|---|---|---|
| 2024-03-11 22:47:03 | RN J. Doe | CREATE | Progress note created — status: draft |
| 2024-03-11 23:02:10 | RN J. Doe | VIEW | Vitals flowsheet opened |
| 2024-03-12 08:55:41 | Dr. A. Roe | VIEW | Progress note opened |
| 2024-03-12 09:14:55 | RN J. Doe | EDIT | Flagged: Progress note edited — entered late, back-dated to 03-11 |
| 2024-03-12 09:15:10 | RN J. Doe | SIGN | Progress note signed |
| Disclosed addendum | Silent edit | |
|---|---|---|
| What it is | A disclosed, timestamped addition made after the note is finalized | An undisclosed change to the note's original content |
| On the printed note | Disclosed on the face of the record | Not visible — the note shows only its final state |
| In the audit log | Recorded with its own timestamp | Should surface as a logged edit after finalization |
What to demand in discovery
- Request the eCW audit log per encounter, with timestamps for note creation, locking, and any subsequent edits or addenda.
- Ask specifically whether notes at issue were locked and when, and whether later content appears as an addendum versus an edit to the original.
- Seek the timing of documentation entry relative to the visit date, which surfaces entries authored well after the encounter.
- Request identification of the eCW version and audit configuration so capability is assessed against the actual install.
For adaptable request-for-production language — and the full set of audit-trail, metadata, and ancillary-system categories these requests should cover — see the EMR discovery guide. For the export itself, How to read an eClinicalWorks audit trail — a plaintiff attorney's guide walks through reading it line by line.
Common production gaps
- Producing the visible progress note without the audit log, so an edit made after locking is indistinguishable from contemporaneous documentation.
- Conflating an addendum (disclosed, timestamped) with a silent edit to the original note — the audit log is what separates them.
- Omitting note-creation timing so that entries authored days after the visit read as same-day documentation.
- Treating the clinician's printed view as the audit record when it reflects the final state, not the history.
Frequently asked questions
Does eClinicalWorks record when a note was changed after it was locked?
eCW's audit log is designed to capture documentation activity, including changes after a note is locked, which should surface as logged edits or addenda. Whether that held in a specific record is answered by producing the audit log alongside the note, not the note alone.
What is the difference between an addendum and an edit in eCW?
An addendum is a disclosed, timestamped addition made after a note is finalized; an undisclosed edit changes the original content. The audit log is the record that distinguishes a legitimate correction from a silent alteration, which is why it must be requested explicitly.
What should attorneys demand for eCW records?
Request the per-encounter audit log with note creation, lock, edit, and addendum timestamps, plus identification of the eCW version — not just the printed progress note, which shows only the final state.
What should a complete eClinicalWorks audit log production include?
At minimum: per-encounter audit entries with the user, role, action, and system timestamp for each event; note creation, lock, edit, and addendum times; and identification of the eCW version and audit configuration. Field names and export formats vary by version and setup, so requests framed by function — creation, locking, modification, addenda — travel better than requests tied to a particular report label.
Can the eCW audit log show when a progress note was actually written?
The audit log records the system time documentation activity occurred, which can be compared against the visit date and the clinical time the note claims to describe. A note entered days after the encounter generally surfaces in that comparison. How precisely entry timing can be reconstructed depends on the version and configuration of the specific installation, which is why the request should also make the provider identify the deployment.
What are the most common gaps in eClinicalWorks audit productions?
The recurring ones: the printed progress note produced without any audit log; an export that shows the note's final state but not its lock and edit history; addenda produced without the timestamps that distinguish them from silent edits; and productions that omit note-creation timing so late documentation reads as contemporaneous. Each gap is answerable with a targeted follow-up request rather than acceptance of the production as complete.
Does printing the chart from eClinicalWorks preserve the audit metadata?
No — a printed or PDF chart reflects the record's final state, not its history. The audit metadata that shows when notes were created, locked, edited, or supplemented lives in the system's audit log and must be requested separately. Treating the printout as the audit record is one of the most common ways a post-lock change goes unexamined.
Guides for other EMR systems
Facing a different platform? Each guide covers that system's audit-trail reporting, what to demand in discovery, and its characteristic production gaps:
This page is technical and regulatory information, not legal advice.