13.3 EHR Lockout & Documenting Medical Errors

Lock the Session, Tell the Truth in the Chart

The last two Medical Record Management tasks protect the integrity of electronic systems and the honesty of the legal record. On the CMAC blueprint, 4.02.8 is sign-out/lock-out discipline; 4.02.9 is documenting medical errors. Together they prevent impersonation in the EHR and fraudulent or incomplete documentation after mistakes—both classic exam and real-world failure modes.

4.02.8 — Properly Sign Out and Lock Out of the EHR

An open EHR session under your credentials is a loaded prescription pad, chart pen, and privacy key sitting unattended. Anyone who types under your login creates entries that audit logs will attribute to you.

Sign-Out vs Lock-Out

Exam rule: If you leave a computer, lock or log off. Do not rely on “I’ll only be gone 30 seconds” or on a coworker “watching the desk.”

Session Security Habits (Memorize)

1. Log in only with your unique credentials.
2. Never share passwords, leave passwords on sticky notes, or use another staff member’s open session “just to print.”
3. Open only the patient charts you need (minimum necessary).
4. Position screens away from public view; use privacy filters in open clinics.
5. Lock/log off before walking away—even to the printer around the corner.
6. On shared workstations, fully sign out so the next user authenticates as themselves.
7. Report suspected credential theft or shoulder-surfing immediately.
8. Follow remote/VPN rules if accessing EHR from outside the clinic.

Wrong-user documentation is not a minor IT issue. If a coworker enters vitals under your session, the legal record says you measured them. If they view a neighbor’s chart under your login, your audit trail shows the access. Task 4.02.8 exists to stop both problems at the source.

End-of-Shift EHR Checklist

1. Complete and sign/authenticate your open notes per policy.
2. Clear temporary print jobs containing PHI from personal trays.
3. Sign out of EHR, email, and other PHI systems.
4. Secure paper charts and ROI queues.
5. Lock your physical workstation or office as required.

4.02.9 — Document Medical Errors

A medical error is a preventable failure in the process of care (wrong patient, wrong dose, missed allergy check, misfiled critical result, procedure on incorrect site, etc.). Documentation after an error has two audiences: clinical safety (what happened so the team can respond) and legal/quality (truthful record and learning system).

Immediate Clinical Sequence (Before Chart Wording)

1. Protect the patient—stop ongoing wrong treatment, assess ABCs/vitals, call for help if unstable.
2. Notify the supervising provider immediately for clinical decision-making.
3. Follow emergency protocols (rapid response, EMS) when indicated.
4. Then document facts and complete incident/occurrence reporting per policy.

Documentation never replaces rescue. Rescue never replaces honest documentation.

Golden Rules of Error Documentation

Paper Chart Corrections (Classic Method Still Tested)

When paper is still used:

1. Draw a single line through the error so it remains readable.
2. Write error or mistaken entry (facility wording), the correction, date, time, and your initials/signature.
3. Do not use correction fluid, scribble densely, or remove pages.
4. If a late note is needed, label late entry with the current date/time and the date/time the event occurred.

EHR Corrections: Late Entry, Addendum, Amendment

Never ask IT to “just delete” a signed note that reveals an error. Never copy-forward false information into today’s note to make the chart look clean.

What to Include in the Clinical Note After an Error

Document factually, for example structure:

• Date/time of entry and of the event (if different).
• What was ordered vs what occurred (drug, dose, patient identifiers used or missed).
• Patient assessment after the event (symptoms, vitals, response).
• Notifications (provider name/time; family if provider directed disclosure conversation).
• Interventions ordered and completed.
• Patient status at time of note.
• Your identity/role.

Avoid: “I was careless,” “Nurse X always distracts me,” “Patient overreacted,” or joking language. Avoid documenting legal conclusions (“This was malpractice”). Stick to observable facts.

Incident / Occurrence Reports

Most facilities require a separate incident report for quality and risk management:

• Complete it promptly and honestly.
• Do not photocopy it into the chart unless policy says to (many sites keep it administrative).
• Do not refuse to complete it to “protect a coworker.”
• Participate in root-cause analysis without altering prior chart entries.

Linking Errors to Other CMAC Domains

Exam Traps for 4.02.8–4.02.9

1. “Just use my login—I’m busy.” → Refuse; each person uses own credentials.
2. “Delete the wrong dose so the chart looks fine.” → Never erase; correct with addendum/late entry and notify provider.
3. “Don’t write the error; only fill the incident form.” → Clinical record still needs factual care documentation; follow policy for both.
4. “Auto logoff will handle it.” → You still lock/log off when leaving.
5. “Backdate the note to the time of the injection.” → Enter as late entry with true entry time; do not falsify timestamps.

Integrated Closing Scenario

You realize you documented today’s blood pressure in the wrong patient’s EHR because a previous user left the chart open and you did not verify identity. Immediate actions: assess whether any clinical orders went to the wrong chart; notify the provider/supervisor; correct both charts using proper amendment/late-entry tools (no silent delete); complete an incident report; and reinforce personal practice—always verify two identifiers and never chart in a session you did not open under your own secure login. That single scenario unites lockout discipline (4.02.8) with error documentation (4.02.9).

Domain 4.02 Map (All of Medical Record Management)

For CMAC day, remember three records mantras: complete and organize the chart correctly, file and release only under HIPAA rules, and lock your session and never erase the truth. That mindset covers Medical Record Management’s ~10 items and protects patients long after the exam.