12.3 Evidence Preservation, Legal Holds, and Spoliation
Key Takeaways
- The duty to preserve evidence attaches when litigation is reasonably anticipated — a serious adverse event, a preservation letter, or a claim notice all start the clock, and waiting for a complaint is always wrong.
- A litigation hold must be written, issued by or through counsel to identified custodians, describe scope in operational terms, suspend routine destruction, require tracked acknowledgment, be reissued periodically, and be released only on counsel's written authorization.
- EHR audit trail metadata showing who accessed, viewed, edited, and signed — and when — is frequently the decisive evidence in a malpractice case and is one of the most commonly overlooked items.
- Preserve first what decays fastest: telemetry full disclosure, device event logs, security video, and physical artifacts disappear in hours to weeks, while the medical record is stable for years.
- Spoliation exposes the organization to curative measures, evidentiary and monetary sanctions, adverse inference instructions, default judgment in extreme cases, and an independent tort in a minority of states — and it converts a defensible care case into a cover-up case.
Why This Matters on the Exam
Preservation is the part of claims work that is judged entirely by what you did in the first hours and days. Everything else in Domain 5 — investigation, reserving, defense strategy, resolution — depends on the evidence still existing. The CPHRM tests this task heavily because the failure mode is so common and so avoidable: an organization with a defensible standard-of-care case loses it because telemetry rolled over, corridor video was overwritten, or an infusion pump was cleaned and returned to service.
The Trigger: Reasonable Anticipation of Litigation
This is the single most tested fact in the topic. The duty to preserve potentially relevant evidence attaches when litigation is reasonably anticipated — an objective standard measured by what the organization knew or should have known. It does not wait for a complaint, for service of process, for a lawyer to be retained, or for a claim number to be opened.
Events that start the clock include:
- A serious adverse event or sentinel event with significant harm — unexpected death, permanent injury, wrong-site surgery, neonatal encephalopathy, a retained foreign object.
- A preservation letter (also called a spoliation letter) or a letter of representation from plaintiff's counsel.
- A subpoena, records request from an attorney, or a notice of intent to sue under a state pre-suit statute.
- A verbal or written threat of legal action by the patient or family.
- An internal report identifying a Potentially Compensable Event (PCE).
- A licensing board complaint, government investigation, or search warrant.
Two corollaries follow. First, on the exam, waiting for the complaint is always wrong. Second, once the duty attaches, the organization must act affirmatively: routine, automatic, unattended destruction is still destruction, and "the system deleted it on schedule" is not a defense.
The Litigation Hold Notice
A litigation hold (legal hold, preservation notice) is the written instrument that converts the duty into behavior. Exam-ready elements:
- Written and prompt. An oral instruction to "hang on to everything" is not a hold; it cannot be proved, tracked, or enforced.
- Issued by or through counsel. In-house or defense counsel signs or authorizes it. This signals seriousness, supports privilege over the hold communication and counsel-directed collection, and puts the scope decision where it belongs.
- Directed to identified custodians. Not a global email. Identify the people and departments who actually hold data: treating clinicians, unit and department managers, Health Information Management (HIM), Information Technology, biomedical/clinical engineering, security, pharmacy, materials management, scheduling and staffing, laboratory, radiology, and leadership.
- Scope described in plain operational language. Custodians must be able to act on it: "the complete record for this patient including all versions and audit logs; all email and text messages referencing this patient; infusion pump serial number 44821 and its event log; corridor and unit video from 0600 on March 4 through 0600 on March 5."
- Suspends routine destruction — retention schedules, auto-purge, archiving, media reuse, and device servicing.
- Requires written acknowledgment from each custodian, tracked in a log so compliance is provable.
- Reissued and updated periodically, and whenever new custodians, systems, or evidence types are identified. Staff turn over; holds go stale.
- Released only when counsel says so, in writing. An indefinite forgotten hold creates its own problems, and an unauthorized release destroys evidence.
The risk manager typically coordinates the hold, IT and the data owners execute it, and counsel decides scope. A short interview of key custodians about where the data actually lives is worth more than any template.
At 2:00 a.m. a patient in a telemetry bed is found unresponsive and resuscitation fails. The family is distraught and tells the charge nurse they will 'see this hospital in court.' No claim has been filed and no attorney has written. Which action best reflects the risk manager's duty?
Scope: What Must Actually Be Preserved
Modern healthcare evidence is scattered across clinical systems, building systems, personal devices, and paper that housekeeping throws away. Preserve by category, not by memory.
| Evidence type | Preservation action | Automatic-destruction risk |
|---|---|---|
| Medical record, all versions | Capture the legal record set plus every addendum, amendment, and prior version; freeze edit access to the encounter | Low for the record itself, but late entries and amendments obscure which version existed at the time |
| EHR audit trail and metadata | Request a full audit log export — user ID, timestamp, action (view/create/modify/delete/print/sign), and module — in exportable native form | High. Many systems retain granular audit detail on a shorter cycle than the record itself |
| Physician orders, MAR, downtime forms | Preserve the electronic medication administration record and every paper or downtime form used during the encounter | Moderate — downtime paper is routinely discarded after scanning or not scanned at all |
| Fetal monitoring strips | Preserve the electronic archive and any paper tracings; note the proprietary archive format and confirm it can still be read | High — paper strips are misplaced and archives are lost across system migrations |
| Imaging studies | Preserve original DICOM (Digital Imaging and Communications in Medicine) studies, not screenshots, printed films, or compressed exports | Moderate — PACS migration, lossy compression, and purge of prior studies |
| Telemetry and physiologic monitor data | Export full-disclosure waveform and alarm data to fixed media | Very high — full disclosure is frequently retained only 24 to 72 hours |
| Device and pump event logs | Export the device's internal event, error, and programming log before the device leaves the unit | High — logs are overwritten on power cycle, reset, or servicing |
| The device itself | Sequester out of service with settings, tubing, and memory undisturbed; tag it; log chain of custody | High — cleaned, reset, reprogrammed, repaired, or returned to the manufacturer |
| Security, unit, and OR video | Identify every camera with a view; export the specific segment to fixed media immediately | Very high — many systems overwrite on a cycle measured in days to a few weeks |
| Email, secure messaging, and text — including personal devices | Suspend auto-purge; collect from the messaging platform and, where counsel directs, from personal devices used for clinical communication | High — auto-delete settings and ephemeral messaging apps |
| Staffing, scheduling, and assignment records | Preserve schedules, assignment sheets, float and agency records, acuity tools, and time records | Moderate — treated as transient operational paper and discarded |
| Physical artifacts | Preserve armbands, packaging, labels with lot and serial numbers, discarded tubing and bags, restraint logs, explanted hardware | Very high — thrown away during routine room cleanup |
| Policies, procedures, and protocols | Capture the exact version in effect on the event date, with effective dates and approval history | High — policy systems display only the current version by default |
The Automatic-Deletion Problem
Most healthcare evidence is not destroyed by a person; it is destroyed by a schedule. Video management systems overwrite the oldest footage when storage fills. Email systems auto-purge deleted items and mailboxes of departed employees. Telemetry full disclosure rolls continuously. Device memory is finite and overwrites the oldest events. Archiving and system migrations silently drop metadata. None of this is exculpatory: courts assess whether the party took reasonable steps to preserve once the duty attached, and an unsuspended automatic process is a failure of reasonable steps.
The practical implication is a triage rule: preserve first what disappears fastest. Video, telemetry, device logs, and physical artifacts come before the medical record, which is stable and retained for years.
An infusion pump is implicated in a fatal overdose. The biomedical engineering manager proposes to run the pump's self-test, clear the fault codes so it can be returned to service, and ship it to the manufacturer for evaluation. What should the risk manager direct?
Spoliation and Its Consequences
Spoliation is the destruction, alteration, concealment, loss, or failure to preserve evidence relevant to pending or reasonably anticipated litigation. It does not require an intent to harm; negligent failure to suspend a retention schedule is the most common form in healthcare.
| Remedy | Typical trigger | Practical effect |
|---|---|---|
| Curative measures and cost shifting | Prejudice from lost information that cannot be restored or replaced | Additional discovery at the offender's expense, fees and costs |
| Evidentiary sanctions | Demonstrated prejudice | Defense evidence excluded; plaintiff permitted to testify about the missing item's contents |
| Adverse inference instruction | For electronically stored information in federal court, a finding that the party acted with intent to deprive the other side of the evidence (Federal Rule of Civil Procedure 37(e)(2)); many state standards are lower | The jury may presume the lost evidence was unfavorable to the hospital |
| Default judgment or striking of defenses | Egregious, intentional destruction | Liability decided without a trial on the merits |
| Independent spoliation tort | Recognized in a minority of states | A separate cause of action with separate damages |
| Individual professional exposure | Altering or back-dating a medical record | Licensure discipline, credentialing action, and in some circumstances criminal exposure |
Learn the sanction ladder, but internalize the practical point the exam is really testing: apparent destruction converts a defensible care case into a cover-up case. Jurors forgive clinical error far more readily than concealment. A hospital that can defend the standard of care but must explain why the corridor video is gone will be tried on the missing video, and defense counsel's leverage in settlement negotiations evaporates. This is also why the risk manager's answer to "should we fix this chart entry" is always no — preserve the record as it exists and add a properly dated, properly identified late entry only through the organization's documented amendment process.
Chain of Custody for Physical Evidence
Physical evidence needs a chain of custody — a continuous, signed record of who has had the item since it was collected. The log records the item description with serial and lot numbers, who collected it and when, where it is stored, and every transfer with date, time, and signatures. Store items in a secured, access-controlled location under risk management or security control, not in a supply room or the manager's desk.
Absolute rules for implicated equipment:
- Do not clean, disinfect beyond what infection control minimally requires, repair, recalibrate, reprogram, update firmware, or run diagnostics that alter memory.
- Do not return the device, tubing, or disposables to the vendor or manufacturer without counsel's approval, a written custody agreement, and observation of any testing.
- Do not allow a vendor representative to inspect or "check" the device unaccompanied.
- Do photograph the device in place, including the display, settings, connections, and any attached tubing or bags, before anything is moved.
Scenario
A patient in restraints on a behavioral health unit is found injured. The unit reports it four days later. The risk manager confirms the fall was captured by a hallway camera, but the video system overwrites on a 14-day cycle and the security director is on vacation; the restraint log is a paper form the unit discards monthly; the patient's bed alarm data lives in a vendor-hosted system with a 30-day retention window.
The correct actions run in order of decay speed: contact security operations that day to export the video segment to fixed media and confirm export succeeded; collect the paper restraint and rounding logs immediately; open a ticket with the bed-alarm vendor to preserve and export the data before the retention window closes; then issue the written hold through counsel to security, the unit manager, IT, HIM, and the vendor liaison, with acknowledgments tracked. Notifying counsel and the carrier proceeds in parallel; nothing waits on the claim being opened.
Exam Traps
- Waiting for a complaint, a claim number, or a lawyer's letter before preserving.
- Issuing an oral hold, or issuing a written hold with no acknowledgment tracking and no reissuance.
- Forgetting the EHR audit trail, which is frequently the decisive evidence on who saw a critical result and when.
- Sending the hold only to clinicians, omitting security, IT, biomedical engineering, staffing, and vendors who actually hold the fastest-decaying data.
- Assuming personal-device texts are out of scope when clinicians used them to communicate about the patient.
- "Correcting" the record instead of preserving it.
- Letting the vendor take the device for evaluation as a courtesy.
- Never releasing the hold, or releasing it without counsel's written authorization.
Three months into litigation, a hospital discovers that operating room corridor video from the event date was overwritten 21 days after the event because no one notified the security department to export it, although a litigation hold had been sent to the clinical custodians. Which statement best describes the hospital's exposure?