Audit Trails in Medical Records

Defendants and their attorneys often claim ignorance of the CFR requirements and provide a partial list of documents that avoid revealing the information you need. Look at 45 CFR 164.312, 164.316, 164.528, and 170.210(b) (stating that “[t]he date, time, patient identification, and user identification must be recorded when electronic health information is created, modified, accessed, or deleted; and an indication of which action(s) occurred and by whom must also be recorded.”).   You can get into a situation where the hospital either has the records or is not HIPPA compliant which is often a lot more expensive than the lawsuit.