Audit Trail & Metadata Findings Report
| Matter | v. Medical Center |
|---|---|
| Case type | Medical malpractice — delayed response to a deteriorating post-operative patient |
| EHR system | Epic (hospital inpatient); audit trail produced from Epic Clarity access/audit log export |
| Prepared for | , Esq. (counsel for plaintiff) |
| Prepared by | Gagan Singh, EMR Check — Forensic EMR Audit-Trail Analysis · gagan@emrcheck.com |
| Report date | 2026 |
1. Engagement summary
Counsel engaged EMR Check to independently verify the electronic medical record produced in discovery and to analyze the Epic audit trail for evidence bearing on the timing, authorship, and integrity of the documentation surrounding a post-operative event on the night in question. The produced chart asserts that the patient was assessed at regular intervals and that the attending physician was notified promptly upon deterioration. The audit trail does not support that account in four material respects, detailed below.
2. Materials reviewed
(a) Certified copy of the inpatient chart as produced (Bates 000001–001482); (b) the Epic audit trail export covering the admission (Bates 001483–001917), produced in response to our supplemental discovery language; (c) hospital EHR policies on late entries and addenda; and (d) deposition transcript excerpts of the charge nurse and attending physician.
3. Methodology
We validated the audit trail export for completeness — a continuous event sequence, no truncated date ranges, and all expected event types present — then reconciled every clinical note in the produced chart against its corresponding audit-trail entries, comparing the service time shown on the face of each note with the filed/entry time recorded by the system. Where the audit trail showed post-event activity, we requested and analyzed the prior note versions. Every finding cites the produced record by Bates number and audit-trail line; nothing here relies on information outside the produced record.
4. Findings
Finding 1 — Late entry: the 03:15 nursing assessment was written 9.5 hours later
The nursing assessment that appears in the chart timestamped 03:15 was not created at 03:15. The audit trail shows it was first created at 12:47 that same afternoon — after the rapid-response event and after the patient had been transferred to the ICU — and entered using Epic's late-entry function with the service time back-dated to 03:15. The face of the chart gives no indication of this.
| Timestamp (UTC) | User | Action | Detail |
|---|---|---|---|
| Day 1 · 12:47:22 | RN-1 · Registered Nurse | CREATE | Flagged: Note created via Epic late-entry function — service time back-dated to Day 1 · 03:15 (WS-NURS-07) |
| Day 1 · 12:51:08 | RN-1 · Registered Nurse | SIGN | Note signed (WS-NURS-07) |
Finding 2 — Post-event editing: the attending's progress note was revised three times after the event
The attending physician's progress note was modified three times the day after the event. Version comparison shows the phrase “no acute distress, continue current plan” in the original was replaced with “patient closely monitored overnight; plan reviewed with nursing.” Epic retains each version; the produced chart displays only the final one.
| Timestamp (UTC) | User | Action | Detail |
|---|---|---|---|
| Day 2 · 14:02:51 | MD-1 · Attending | EDIT | Flagged: Progress note edited (v2) — assessment paragraph rewritten |
| Day 2 · 14:19:33 | MD-1 · Attending | EDIT | Flagged: Edited (v3) — “no acute distress, continue current plan” deleted |
| Day 2 · 19:36:14 | MD-1 · Attending | EDIT | Flagged: Edited (v4) — “patient closely monitored overnight; plan reviewed with nursing” added |
Finding 3 — Documentation gap: vitals flowsheet rows for the critical window were removed
The audit trail records flowsheet entries for 23:40 (Day 0) and 00:30 and 01:30 (Day 1) that do not appear in the produced chart. Each was deleted by the same user within a six-minute span at 13:02–13:08 on Day 2. Epic logs the deletion events, but the produced “complete chart” omits the deleted rows and any indication that deletions occurred.
Finding 4 — Access pattern: risk management reviewed the chart before the first clinical addendum
A user assigned to the hospital's risk-management department accessed the full chart at 09:12 on Day 2 — roughly five hours before the first of the edits described in Findings 2–3. Counsel may consider the sequence (adverse event, risk-management review, then revision of the clinical record) in evaluating spoliation remedies and witness-examination strategy.
5. Chronology excerpt (reconciled)
The full reconciled chronology is delivered as a separate exhibit, synced to Bates numbers and audit-trail lines. An excerpt:
| Time | Event per produced chart | Event per audit trail |
|---|---|---|
| Day 0 · 23:40 | No entry | Vitals recorded — later deleted (Finding 3) |
| Day 1 · 03:15 | Nursing assessment: “patient resting comfortably” | No activity. Note actually created Day 1 · 12:47 (Finding 1) |
| Day 1 · 05:52 | Rapid response called | Rapid-response documentation begins 05:54 (contemporaneous) |
| Day 2 · 09:12 | — | Risk management accesses full chart (Finding 4) |
| Day 1–2 · 12:47–19:36 | — | Late entry filed; attending note edited 3×; flowsheet rows deleted |
6. Basis, limitations, and next steps
Every finding traces to specific lines of the produced audit trail and Bates-stamped pages of the produced chart; no finding depends on speculation about the EHR's internal behavior. This report addresses record integrity and timing only — it expresses no opinion on the standard of care. On request, the findings are restated in a declaration or affidavit tailored to the jurisdiction, with exhibits keyed to each cited line.
This page is educational information, not legal advice. EMR Check provides consulting and analysis services, not legal representation.