WANTED:Definitive Standards For the Discovery of EHR Audit Logs

It is 5:30pm on a Tuesday afternoon, December 2012 and Mary Smith, a single mother of four children, is straightening her desk and preparing to leave the office. Her cell phone rings…her 16 year old son’s name, John, pops up on the screen. However, it is the ACME Urgent Care calling to inform her that her only son is in an ambulance, on his way to the ACME Emergency Department. She is informed by the doctor that he believes her son has had a cranial bleed. Dr. Mark Jones, a neurosurgeon, is on the emergency department call roster for that evening and is called into the hospital. Although it is the hospital’s policy to send all children under the age of 18 to the local children’s hospital, Dr. Jones knows that John will not survive the transfer and agrees to treat him at ACME. Dr. Jones speaks with Mary and informs her that there is very little hope of survival but he will do everything possible to save John’s life. Four months later, John has recovered well from what was a massive hemorrhagic stroke due to an arteriovenous malformation (AVM)…a birth defect his family never knew he had until the day it ruptured. Today Dr. Jones is going to embolize the (AVM) in preparation for the final repair to John’s brain. A catheter is threaded through John’s femoral artery up to his brain and into the AVM. As Dr. Jones pushes the embolizing compound through the catheter, he sees that something terrible has happened. The embolizing compound has shot off into a major artery, shutting off blood flow to part of John’s brain. Dr. Jones is already mourning for this kid who has worked so hard these past months to regain his strength and mobility. He loves this kid. John is paralyzed on the right side of his body. The prognosis is that he will never fully recover. His mother is grief stricken. How will she take care of him and work full time? She has 3 other children to support? Her insurance is tapped out as is her savings. She sues the hospital and Dr. Jones. She is angry and needs the money. Somebody has to pay. During discovery, Mary’s attorney requests audit logs of all activity pertaining to John’s medical record within ACME’s electronic health record application. A review of the audit logs appears to show that Dr. Jones had accessed the medical record but failed to appropriately document the calibration process that is required before the embolization could begin. Dr. Jones vehemently defended himself stating that he did everything “by the book.” Dr. Jones was found guilty of gross negligence and lost his license to practice medicine, based on findings in the audit logs. In a statement he made on the radio on December 6, 2008, President Obama stated “We will make sure that every doctor’s office and hospital in this country is using cutting edge technology and electronic medical records so that we can cut red tape, prevent medical mistakes, and help save billions of dollars each year.” [1] Although these are admirable goals, medical mistakes do still happen and litigation is still a common response. The increasing use of electronic health records means an increased ability to electronically track activities that occur within a specific medical record. An unintended consequence to healthcare providers is that medical malpractice attorneys are being encouraged to use audit logs to obtain evidence for use in medical malpractice litigation. [2] Additionally, the Office of the Inspector General (OIG) and Centers for Medicare and Medicaid Services (CMS) are encouraging the use of audit logs for identifying fraudulent coding and billing. [3] The inherent problem with this thought is that there is not enough consistency in the audit logs from one EHR to another, nor is there enough consistency in the interpretation of the audit log data to rely on these results to prosecute health care providers for malpractice or fraud. [4] The terms “metadata”, “audit log”, and “access report” appear to be used interchangeably, however, understanding the differences within the definitions is crucial to the appropriate use of the information. The integrity of the audit logs can be questionable and interpretation of the information can be difficult. [5] Another conundrum for healthcare providers appears to be confusion over how long metadata, audit logs and access reports must be retained. [6] With the current condition of the regulations, producing audit logs for discovery requests can be expensive, burdensome and present many challenges for healthcare providers; even potentially causing blame to be placed where it is not due. [7] As litigation increasingly relies on audit logs as evidence, the federal government must stretch beyond guidance and incentives to set a mandatory standard for electronic health record audit log content and set a defined audit log retention requirement. In addition to these measures, the federal government needs to limit the scope of electronic discovery to that mandatory standard to reduce the cost and burden to healthcare providers for the production of audit logs for use in malpractice and fraud litigation. [1] Lomurro, Jonathan. Electronic Medical Records: Changing Medical Malpractice Litigation. Digital Discovery Has Invaded the Medical Malpractice Field. Feb. 17, 2016. https://casetext.com/posts/electronic-medical-records-changing-medical-malpractice-litigation Ret. Sept. 17, 2016. [2] Jennifer Keel, Follow the Audit Trail , Trial 29–33 (May 2014); Mark R. Bower, Nursine S. Jackson & Jerry I. Meyers. Another Trip Down the Audit Trail , AAJ Prof’l Negligence Newsletter (Fall 2011). [3] Centers for Medicare and Medicaid. Documentation Integrity in Electronic Health Records. June 2016. https://www.cms.gov/Medicare-Medicaid-Coordination/Fraud-Prevention/Medicaid-Integrity-Education/Downloads/ehr-docintegrity-factsheet.pdf Ret. Sept. 17, 2016 [4] Centers for Medicare and Medicaid. Program Integrity Issues in Electronic Health Records: An Overview. Page 6. https://www.cms.gov/Medicare-Medicaid-Coordination/Fraud-Prevention/Medicaid-Integrity-Education/Downloads/ehr-provider-booklet-overview.pdf . Ret. Oct. 1, 2016. [5] Sedona Priniples: Second Edition: Best Practices Recommendations and Principles for Addressing Electronic Document Production, p.4. 2007. http://sos.mt.gov/Records/committees/erim_resources/A%20-20Sedona%20Principles%20Second%20Edition.pdf Ret. Nov.2016. [6] AHIMA Privacy and Security Audits of Electronic Health Information (2014 update). http://library.ahima.org/doc?oid=300276#.V-ai6vArK1s [7] Main, Chad. Court Addresses EMR Audit Trails and Peer Review Privilege. Percipient. May 22, 2015. https://percipient.co/court-addresses-emr-audit-trails-and-peer-review-privilege/ Ret. Oct. 15, 2016.