The Defensible Medical Record

Richard F. Cahill, JD, Vice President and Associate General Counsel

Medical records play a pivotal role in the delivery of healthcare and serve a critical function in routine clinical operations. Essential details of the record include a patient’s medical and social history, comorbidities, drug allergies, presenting complaints, signs and symptoms derived from a careful physical examination, differential diagnoses, and treatment plan. Accurate documentation in the medical record optimizes patient well-being and helps promote continuity of care and patient satisfaction.

Federal and state regulations—notably HIPAA and the Affordable Care Act—address virtually every facet of health record content, security, storage, access, and disposal. Advancements in technology, including electronic health records (EHRs), have expanded the concept of the medical record and its requirements. Physicians are well advised to keep current on the rules governing health records—potentially a challenge because the rules change frequently and vary by state.


The variations in state requirements are especially evident in the rules about retaining records for healthcare treatment and billing. Some states have enacted specific statutes that establish applicable retention requirements. Other states rely on administrative code provisions or on opinions generated by medical boards or professional societies. Unfortunately, many jurisdictions have no official guidance on retention for physicians to follow.

The Centers for Medicare and Medicaid Services (CMS) and other governmental entities also have policies on storing and retaining records. Federal legislation, such as the HITECH Act, has added another dimension to retention requirements.

For record retention recommendations, see our article “Medical and Dental Record Retention.”

Administrative Actions

Beyond patient care, health records serve other vital functions that are integral to the practice of medicine. For example, billing audits—especially by CMS—require clear documentation demonstrating medical necessity, the nature and scope of the services rendered, and sufficient justification for the billing code utilized. Accurate progress notes will facilitate prompt payment and avoid unnecessary disputes over the level of care rendered and the amount of reimbursement owed to the provider.

Medical records also establish the quality of care rendered in the event of a medical board complaint, a peer review inquiry, or an investigation by the Office of Civil Rights of the U.S. Department of Justice.

Patient grievances may be filed based on an individual’s faulty recollection of events, or a failure to understand the course of treatment or the underlying reason that an adverse consequence occurred. When a medical record is well documented, many allegations are often readily resolved—frequently before a formal administrative process is even initiated. Should the action move forward, physicians with appropriate documentation are better able to support their decisions and treatment plans with greater confidence of achieving a favorable outcome.

Professional Liability Actions

The medical record—including specialty referrals, progress notes, and laboratory results—is usually the key evidence in a professional liability action. The record is critical in helping the provider recall events that might have occurred years earlier. It is an independent document that establishes facts at a time when there was no pending conflict or other motivation to shade or otherwise embellish the circumstances at issue.

In the event of civil litigation, the medical record is considered reliable and credible because it was created during the normal course of business by the physician, hospital, advanced practice provider, or clinic personnel at or near the time of the event in question. Judges and juries generally regard medical records as the most trustworthy and probative piece of evidence. When introduced as independent documentary evidence, a well-documented medical record is a powerful defense to offset patient allegations that a physician was negligent in making medical decisions and providing treatment.

In cases involving medical malpractice allegations in which the record is silent or incomplete, plaintiff’s counsel will always remind practitioners of the adage, “If it’s not recorded, it wasn’t done.” Careful documentation is especially important during conversations with patients about informed consent and informed refusal. For more on these topics, see our articles “Informed Consent: Substance and Signature” and “Informed Refusal.”

As a defendant under oath, a physician may be subjected to skillful cross-examination by opposing counsel and asked to recall and testify about intricate details of an individual’s care. Usually, the details relate to incidents that occurred many years earlier. Suddenly, a few seemingly unimportant details can become the focal point of allegations and, ultimately, the focus of jury deliberations.

The argument will be made that if the patient’s medical record had contained additional important items of history or findings, the unfortunate outcome could have been averted. A detailed medical record is invaluable for refreshing a physician’s recollection of the patient’s history and physical findings. It also prompts a physician’s memory about interactions with the patient and earlier thought processes.

For further documentation guidance, see our article “The Faintest Ink: Documentation to Defend Quality Patient Care.”


Upon receiving notice that a malpractice suit is about to commence or has already been filed, physicians must ensure the safety and integrity of the patient’s medical record. Any changes made to the medical record after learning of a lawsuit raise questions about the provider’s truthfulness, motives, and the quality of the medical care.

Forensic document experts are frequently called to testify that a paper record has been augmented or altered. In situations in which a practitioner has an EHR, counsel will retain information technology experts to conduct a metadata audit. The audit provides a complete analysis of every keystroke (including additions, deletions, and changes) and when the entries were made, by whom, and how long a document was open for review and revision.

Changes to either a paper record or an EHR—including corrections, deletions, late entries, and addenda—are readily discoverable, patently obvious, and usually deleterious to a successful defense. If experts discover that the medical record has been altered, it can also expose the physician to punitive damages and result in a medical board investigation.


An important safeguard in the office is a procedure that requires the personal approval of the patient’s treating physician or the office manager before medical information from the patient’s record can be copied or released. Protected health information (PHI) requires a written request for release and, except for specific exemptions, must be accompanied by a valid HIPAA-compliant authorization signed by the patient or a court order. This process should also include documenting when and where the copied record was sent. Federal and state privacy regulations must be strictly followed regarding keeping and releasing PHI.

In the event of litigation, it is helpful to your legal representative to have some means by which to reconstruct the dates of when the record was previously copied and by whom. In professional liability litigation, one of the first steps an attorney who is considering accepting a case takes is to obtain a complete copy of the medical record. Many physicians and defense counsel have been embarrassed during discovery proceedings or at trial to learn that some other party, in advance of litigation, obtained an earlier copy of the medical record that materially differs from the original record.

Most communications with your insurance carrier or attorney are legally privileged and, as such, are not subject to discovery by the opposing party. These communications should be kept separate from the patient’s medical record, thereby eliminating the possibility of their being inadvertently copied or provided to opposing counsel without a court order specifically compelling their production.

For further assistance, contact the Department of Patient Safety and Risk Management at (800) 421-2368 or by email.

The guidelines suggested here are not rules, do not constitute legal advice, and do not ensure a successful outcome. The ultimate decision regarding the appropriateness of any treatment must be made by each healthcare provider considering the circumstances of the individual situation and in accordance with the laws of the jurisdiction in which the care is rendered.

J12439 06/20