Electronic health records were supposed to make care safer and records clearer, and in many ways they have. They have also created new kinds of liability. Copied notes contradict the exam that actually happened, default text documents things that were never done, alerts are overridden by habit, and every click leaves a timestamp that a plaintiff's attorney can request. This article covers the main EHR-related exposures for medical practices and facilities, what federal guidance says about them, and the controls and coverage that help.
The record is now evidence, including its metadata
In a paper chart, a note was a note. In an EHR, each entry carries a history: who created it, from which workstation, when it was opened, changed, signed or amended. CMS guidance describes the audit log as recording the user, workstation, document, type of event (such as an amendment, correction or deletion) and date and time, and notes that it can reveal altered records.
In litigation, that history is often requested alongside the printed chart. It can help a defense, for example by showing that a clinician reviewed a result promptly. It can also hurt, for example by showing that a note was written days after a bad outcome, or that a template populated a complete review of systems in two seconds.
Never change a record after a claim or bad outcome. Once you know of a potential claim, do not edit, add to or "clean up" the chart except through a properly labeled, dated late entry or amendment for a legitimate clinical reason. Altered records found in the audit trail can turn a defensible case into an indefensible one. Notify your insurer and follow counsel's instructions, including any litigation hold.
Copy-paste, templates and auto-population
CMS published a decision table on the proper use of EHR features as part of its program integrity education. It describes several risky features:
| Feature | Risk CMS describes | Recommended controls |
|---|---|---|
| Copy and paste / copy forward | Redundant or inaccurate records, unclear authorship, notes that do not reflect care actually given, improper payment such as upcoding | Written policy limiting use, tailoring copied text to the visit, attribution of copied material, auditing |
| Templates | Over-documentation and possible false-claims exposure when the template does not fit the patient | Open-ended templates, required visit-specific detail, removing irrelevant pulled-in data |
| Auto-population and macros | Large amounts of default text generated with little or no provider action | Provider action required before a note is generated, verifying and editing defaults, restricting users |
| Dictation, scribes, voice-to-text | Entries made on the provider's behalf without review | Timely review, editing and sign-off by the provider; retaining all signatures when several people contribute |
The liability problem is the same as the billing problem: a note that says the lungs were examined and clear, copied from last month, is hard to defend when the patient had pneumonia. Each encounter should document what actually happened at that encounter. Our guide to medical documentation covers documentation habits in more detail.
Alerts, defaults and wrong-patient errors
Clinical decision support is meant to catch errors, but poorly tuned systems create their own exposure.
- Alert fatigue. When most alerts are irrelevant, clinicians override them by habit, including the important ones. An override is recorded, and a plaintiff will ask why the warning was ignored. Review override rates and retire low-value alerts through a governance committee.
- Default doses and order sets. A wrong default in an order set can repeat the same error across many patients. Pharmacy and clinical leaders should review order sets on a schedule and after any reported event. See preventing medication errors.
- Wrong-patient entries. Multiple open charts and similar names lead to orders and notes on the wrong patient. Limit the number of open records, display clear patient identifiers, and require confirmation for high-risk orders.
- Results and messages. Inboxes that route results to departed or absent clinicians are a frequent source of missed follow-up. See closing the loop on test results.
Security, integrity and access rules
Federal rules set baseline expectations for how electronic records are protected and shared.
- Audit controls. The HIPAA Security Rule's audit controls standard (45 CFR 164.312(b)) requires mechanisms that record and examine activity in systems containing electronic protected health information. CMS guidance recommends keeping the EHR audit log running at all times, with only narrow maintenance exceptions.
- Integrity. Covered entities must have policies and procedures to protect electronic health information from improper alteration or destruction.
- Authentication. Systems must verify that the person seeking access is who they claim to be. Shared logins defeat both security and the evidentiary value of the record.
- Information blocking. Under the 21st Century Cures Act, unreasonable practices that interfere with access to, exchange or use of electronic health information can be information blocking, and HHS has adopted Medicare disincentives for providers found to have engaged in it.
For the privacy side of these rules, see HIPAA compliance essentials.
Downtime, migrations and new tools
Some of the largest EHR exposures occur during change:
- Downtime. Keep downtime procedures, paper forms and read-only backups ready, and reconcile paper documentation into the record afterward.
- EHR conversions. Data that does not migrate cleanly, such as allergies, problem lists or historical results, can be lost. Validate a sample of migrated charts and keep access to the legacy system for as long as your record retention obligations require.
- AI documentation and ambient scribes. Tools that draft notes from conversations are subject to the same principle CMS applies to scribes and dictation: the clinician must review, edit and sign. Confirm how the vendor stores recordings and drafts, and what your contract says about errors.
- Vendor contracts. EHR and software contracts often limit the vendor's liability. Know who bears the cost if a software defect contributes to patient harm or a data breach.
A short annual EHR risk review keeps these issues visible. Pull a sample of notes from each clinician and check for copied text that does not match the visit, confirm that departed users have been deactivated and their open tasks reassigned, review the alert override report, test the downtime procedure, and confirm that the audit log is running and retained. Record the review and the fixes; underwriters and surveyors both respond well to evidence of an ongoing process.
How insurance typically responds
Medical professional liability
Responds to patient injury claims, including those involving documentation, alert or order-set errors. See medical malpractice insurance.
Cyber liability
Responds to breaches, ransomware and system outages, including notification costs and, on many forms, business interruption. See cyber liability for healthcare.
Regulatory and billing coverage
Some policies offer limited coverage, often sublimited, for defense of billing audits or regulatory proceedings. Fines and repayments are often excluded.
Technology E&O (vendors)
Health IT vendors carry their own errors and omissions coverage; your contract determines whether you can benefit from it.
Policy forms, sublimits and exclusions vary by carrier, and a single EHR event, such as a ransomware outage that delays care, can involve more than one policy. It pays to know in advance how they fit together.
When to call a broker
Call your broker before an EHR conversion, when you adopt AI documentation tools, if you receive a records request connected to a potential claim, or after any outage or security incident. As a broker, we compare options across the market and line up professional, cyber and regulatory coverage around how your practice uses technology. Contact us to talk it through.