3.7 Medical Record Documentation Review and Risk Mitigation

Why the Record Decides the Case

Domain 1 task M assigns the risk manager to review documentation and assist providers and staff with appropriate documentation to mitigate risk. The reason is blunt. The medical record is the primary evidentiary artifact in nearly every professional liability claim, regulatory survey, and payer audit. It is written contemporaneously by the people who will become defendants, it is admitted as a business record, and it is read aloud years later to jurors who were not there. Two maxims frame the whole subject:

• "If it wasn't documented, it wasn't done." Care that was delivered but never charted is extraordinarily difficult to prove at trial.
• The inverse, which risk managers underweight: excellent care can lose in court because of poor documentation. A single editorializing entry can convert a defensible chart into a settlement.

Your role here is advisory and educational, consistent with the rest of the exam's framing. You audit, you feed findings back through the correct channel, you build the education and the policy. You do not write in the chart on a provider's behalf, and you never direct anyone to change what a record already says.

Elements of Defensible Documentation

What Must Never Appear in the Record

• Blame or criticism of another provider. "The night team should have caught this" is a written admission handed to a plaintiff's attorney, and it can turn a colleague into an adverse witness and force separate defense counsel.
• Any reference to the incident report. Charting "incident report completed" or "occurrence form sent to risk management" identifies the existence of a document the organization is trying to protect under state peer review or quality privilege, and it is one of the most reliable ways to make that report discoverable. Document the clinical facts, meaning the event, the assessment, the treatment, and the notifications, and say nothing about the internal reporting system.
• Subjective characterizations of patients or families. They read to a jury as bias and undermine the credibility of every other entry in the chart.
• Conclusory liability language such as "medication error," "wrong-site," "inadvertently," or "apparently negligent." Chart what was ordered, what was administered, what was observed, and what was done next.
• Statements about what risk management or counsel advised, which drag privileged discussions into a discoverable document.

Corrections, Late Entries, and Alterations

There is a bright line between correcting a record and altering one. Correcting is transparent; altering hides. Keep the vocabulary straight:

• Late entry documents an event or observation that was omitted, entered after the fact and labeled as such.
• Addendum adds new information to a completed entry to clarify or complete it.
• Correction, sometimes called an amendment, changes content that was inaccurate when written.

The Medicare Program Integrity Manual states the operative standard for all three. The documentation must (1) clearly and permanently identify the amendment, correction, or delayed entry as such; (2) clearly indicate the date and author of the change; and (3) clearly identify all original content without deletion. On paper this means a single line through the error so the original remains readable, with the date, time, and initials of the person making the change and a brief notation such as "error" or "late entry." Never obliterate, never white out, never write over an entry, never squeeze text into a margin or between lines, and never backdate. In an electronic record the system must retain the prior version and expose both the original and the change in the audit trail.

Spoliation is the destruction, alteration, or concealment of evidence. Consequences include an adverse inference instruction, in which the jury is told it may assume the altered or missing material was unfavorable to the party that changed it, along with monetary sanctions, exclusion of defense evidence, referral for licensure action, and in some jurisdictions punitive exposure or an independent tort. The practical teaching point is harsher than the legal one: an obvious alteration almost always does more damage than the underlying care. Jurors forgive a complication; they do not forgive a chart that looks cleaned up. Because electronic metadata records every version, alteration is trivially provable, and the case stops being about the medicine and becomes about the cover-up.

Distinguish the patient's right of amendment, which is a lawful and fully documented process rather than an alteration. Under the HIPAA Privacy Rule at 45 CFR 164.526, an individual may request amendment of protected health information in the designated record set. The covered entity must act within 60 days, with a single 30-day extension on written notice explaining the delay. It may deny the request when the entity did not create the information, the information is not part of the designated record set, it is not available for inspection, or the record is accurate and complete. A denial must be in writing, and the individual may submit a statement of disagreement that accompanies the disputed information on future disclosures. In every case the original entry stays in the record.

Documentation Risk Specific to the Electronic Health Record

The security, cyber-incident, and telehealth dimensions of health information technology belong elsewhere. What concerns you here is the quality and defensibility of what the system records.

• Copy-forward and cloning. Carrying a prior note forward propagates stale or simply wrong findings: a documented normal examination on the day the patient deteriorated, a resolved problem still listed as active, a family history for the wrong patient. In litigation, cloned notes damage the credibility of the entire chart, because the defense cannot establish which observations were actually made on which day, and payers treat cloned documentation as unsupported. ECRI's Partnership for Health IT Patient Safety published four safe practice recommendations: make copied material easily identifiable, make its provenance readily available, ensure adequate staff training and education, and regularly monitor, measure, and assess copy-and-paste practices.
• Templates and default values. Pre-populated normals that no one unchecked produce documentation of examinations that never happened. That is simultaneously a liability exposure and a billing-integrity exposure.
• Alert fatigue and overrides. Override rates for interruptive alerts are high enough that clinicians dismiss most of them reflexively, and the system permanently records that the clinician was warned and proceeded anyway. An overridden high-severity alert with no documented rationale is a powerful plaintiff exhibit, which is why policy should require a reason code on the alerts that matter and should prune low-value alerts.
• Audit trails and metadata are discoverable. The system logs who opened the chart, who edited what, when, from where, and how long a note was open. Plaintiffs routinely request the audit log, and it exposes late amendments after notice of a claim, unauthorized access, and notes signed in implausibly short intervals.
• Unsigned and incomplete notes, unauthenticated verbal orders, and open encounters are the defects that are easiest to quantify and easiest to fix, which makes them a natural first target.

Documentation Defect, Litigation Consequence, Mitigation

The Risk Manager's Proactive Role

Documentation review is not a random chart pull. Drive it from data: claim themes, event report clusters, survey findings, and near-misses.

• Run targeted audits in the areas your loss experience implicates, such as obstetric monitoring interpretation, informed consent notes, emergency department discharge instructions, restraint monitoring, anticoagulation, and post-fall reassessment.
• Deliver provider-specific feedback through the established channel, meaning medical staff leadership, the peer review structure, or clinical documentation integrity, rather than directly and punitively.
• Convert every near-miss into education: what the record needed to show and did not.
• Partner with health information management (HIM) and coding on the amendment policy, delinquency management, and template design, and review new templates before go-live.
• Track a metric, such as delinquency rate or the percentage of falls with documented post-fall reassessment, and report the trend to the safety or quality committee.

Exam Traps

• Choosing "have the provider correct the note" when the defensible answer is a properly labeled late entry or addendum that preserves the original.
• Confusing the patient's HIPAA amendment right with permission to alter a record.
• Believing that documenting the incident report demonstrates diligence.
• Treating the audit trail as an internal artifact rather than discoverable evidence.
• Having the risk manager write in or edit the medical record, or discipline a provider directly, when the exam expects you to audit, educate, and escalate through the medical staff structure.