Recent Appellate Decisions and Discovery Strategy for Health Care Counsel
Originally published in AHLA Health Law Weekly, October 2, 2026.
By Michelle Carroll
Electronic health record (EHR) audit data can show who entered, viewed, or changed information and when. It does not, by itself, explain what the event meant clinically. Recent New York appellate decisions show that courts look at whether requested data relate to a disputed fact, whether the record already produced appears complete, and whether a qualified witness can explain the system. This article reviews those cases and explains how counsel can preserve, request, produce, and use EHR audit data.
Introduction
A printed medical record may appear complete while the EHR retains a separate chronology. Audit data may show when a note was created, edited, signed, or viewed, which user performed an action, and whether information was imported or amended. Those details can be important when the timing of treatment, the availability of a result, the authorship of an entry, or the completeness of the produced record is disputed.
The term "audit trail" does not describe one standardized report. An EHR may maintain access logs, amendment histories, note versions, authentication records, and interface data. Each serves a different function, and the terminology varies by system. A login does not establish that a particular result was reviewed. An entry timestamp may differ from the time care occurred. An amendment may document a proper correction rather than an effort to conceal information.
Counsel should identify the disputed fact before requesting or interpreting audit data. The scope of the request, the relevant EHR module, and the witness needed to explain the data all follow from that question.
What the Audit Trail Records
At a basic level, audit log records activity within an information system. Depending on the platform and configuration, it may identify the user, date and time, workstation or location, action performed, affected record, and prior or revised value. Other reports may document access, authentication, order entry, result acknowledgment, note amendments, data imports, or interface activity.
Those categories matter because different disputes call for different data. If the issue is whether a laboratory result was available, the relevant evidence may include result-interface and acknowledgment data. If authorship or chronology is disputed, note-version history and signature events may be more probative. If improper access is alleged, an access report may be central. A generic request for "the complete audit trail" can be both overbroad and incomplete: overbroad because it captures immaterial activity, and incomplete because it may omit the specific subsystem that recorded the event at issue.
The Regulatory Baseline
The Health Insurance Portability and Accountability Act Security Rule requires covered entities and business associates to implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing or using electronic protected health information. It also requires policies and procedures that protect such information from improper alteration or destruction.[1]
Separate federal certification criteria for health information technology require certified systems to record specified auditable events; protect those events from being changed, overwritten, or deleted by the technology; detect alterations; generate sortable audit reports; and document accepted or denied patient amendment requests.[2] These requirements help explain why relevant data may exist, but they do not define the scope of civil discovery or establish that every system produces the same report.
Federal guidance also treats the integrity of EHR documentation as a compliance concern. The Centers for Medicare & Medicaid Services (CMS) has cautioned that improper use of copy-and-paste functions, templates, macros, and auto-filled text can create errors and undermine documentation integrity.[3] CMS instructions addressing amendments, corrections, and delayed entries require the date and author to be identifiable and the change or addendum to be clearly and permanently denoted.[4] These authorities provide useful context, but a litigation inference still depends on the facts of the encounter and the function of the particular system.
Recent Decisions Address Discovery and Trial Use
In federal litigation, the Federal Rules of Civil Procedure permit discovery of electronically stored information (ESI) that is relevant to a claim or defense and proportional to the needs of the case. A request may specify the form in which ESI should be produced.[5] State discovery standards vary, but recent New York decisions illustrate the factual showing courts may expect when audit data is requested or offered at trial.
The foundation remains Vargas v. Lee.[6] The Second Department permitted discovery after the plaintiffs produced evidence that the hospital had not provided the complete patient file and limited the request to the period following surgery. The court recognized that an audit trail can show who accessed the record, when and where access occurred, and what changes were made. In Punter v. New York City Health & Hospitals Corp.,[7] however, the First Department affirmed the denial of renewed discovery. The trial court had distinguished Vargas because the plaintiff had not alleged that portions of the record were lost or altered. These decisions make the requested data's connection to a disputed fact central to the analysis.
In Heinrich v. State,[8] the New York Court of Claims applied that distinction to a narrowed request. The claimant identified 12 chart entries bearing on which providers had information, when they had it, and what modifications were made. The court permitted the limited production after balancing materiality against the burden of retrieval.
Two more recent appellate decisions move the issue beyond production alone. In Wright v. Stephens, [9] the Fourth Department held that the trial court abused its discretion by precluding an electronic medical records expert from explaining audit data. The proposed testimony was relevant to when the patient arrived in the emergency department and whether treatment was delayed in violation of hospital protocols. The ruling demonstrates that audit data may require expert explanation when system events bear directly on a disputed chronology.
The Fourth Department revisited discovery in Harms v. Lewis,[10] decided in April 2026. An earlier motion had failed because the plaintiff offered only conjecture that the audit trails contained relevant information unavailable elsewhere, and the defendants had explained why some data was unavailable. Later depositions contradicted material assertions in the defendants' affidavits, indicated that additional audit data might still exist, and showed that the representatives were not fully knowledgeable about retention practices. On that new record, the court affirmed an order compelling further production and testimony.
Wright and Harms make a practical point: counsel should connect the audit data to a disputed issue and have a knowledgeable witness explain how the system recorded and retained it.
Why Audit Data Is Easy to Misread
Audit data can establish a system event with precision, but the event does not explain itself. Its legal significance depends on what the system recorded and what the user actually saw or did.
An access entry establishes that a user opened some part of the record. It does not necessarily establish which screen appeared, what information was visible, how long it remained displayed, or whether the user understood a particular result. Counsel should therefore avoid treating access as proof of clinical awareness without evidence connecting the audit event to the relevant information.
System time and clinical time may also differ. Entry, signature, filing, interface, service, and event timestamps can describe different points in the documentation process. A late signature, standing alone, does not establish that care occurred late or that documentation was fabricated.
Automated processes add another layer. Interfaces, background processes, shared work queues, and system-generated updates may appear under a user, service account, or generic label. Terms such as "modify," "accept," "view," or "result" may have a system-specific meaning. Reliable interpretation may require the data dictionary, the system configuration in effect during the encounter, and testimony from a knowledgeable witness.
An audit log can show that a system event occurred. A knowledgeable witness must explain what the event means and what information it made available to the user.
Preservation and Production
EHR audit data may be retained differently from the patient-facing chart. Some data remain in the production system; some move to archives; some are held by a vendor; and some reports can be generated only through a defined administrative process. Preservation should begin with an inventory, not an assumption that saving the PDF chart captures the underlying ESI.
A defensible hold should identify the patient, encounter, users or roles, relevant time window, EHR modules, connected systems, amendment histories, access logs, and any reports already generated. Counsel should determine retention periods, whether routine overwriting is possible, who controls vendor-held data, and what export formats preserve the relevant fields. If ESI that should have been preserved is lost, Rule 37(e) may govern the available measures or sanctions, depending on prejudice and intent.[11]
Production planning should bring legal, health information management, information technology, compliance, and, when necessary, the EHR vendor into the same conversation. Native or structured production may be appropriate when sorting and field-level analysis matter. A flat PDF may be adequate for a narrow report but inadequate if it removes field names, filters, time-zone information, or prior values. Whatever form is used, counsel should preserve the extraction parameters and be able to explain what the production includes and excludes.
Practice Guidance for Requesting Counsel
A focused request is more likely to produce usable evidence and withstand a proportionality objection. Counsel should identify the fact in dispute, then define the patient, encounter, date range, event types, users or roles, and EHR modules tied to that issue. The inquiry should also account for related laboratory, pharmacy, radiology, messaging, and patient-portal systems, which may maintain separate logs.
Counsel should specify a reasonably usable production form and request the field definitions, report parameters, time-zone conventions, and legends required for interpretation. The request should explain why the rendered chart does not resolve the issue. Any custodian or technical deposition is generally more useful after counsel has reviewed the production and identified the fields or events that require explanation.
Practice Guidance for Responding Counsel
Responding counsel should avoid both reflexive resistance and unexamined production. Counsel should determine which systems and reports contain the requested events, whether the organization controls vendor-held data, and how the legal health record or designated record set differs from other potentially discoverable ESI. The categories may overlap, but they are not synonymous.
Counsel should then evaluate the requested scope against retention, retrieval, validation, privacy, and production burdens, proposing a targeted alternative when the demand is broader than the disputed issue. Amendments and delayed entries should be reviewed in clinical context rather than presumed suspicious. The witness designated to explain the production should understand the report's terminology, automated events, clock settings, retention limits, and extraction method, while avoiding speculation about clinical intent.
A Practical Framework for Early Case Assessment
Before sending a discovery request, counsel should answer four questions: What disputed fact should the audit data clarify? Which system and time window matter? What production format will preserve the needed fields? Who can explain how the system was configured and used during the relevant period? The answers help narrow the request and identify the right witness.
Counsel should also check for retention deadlines, routine overwriting, or vendor-held data that could put relevant audit records at risk.
Conclusion
Audit logs can add chronology, authorship, access, and amendment details that are missing from a rendered chart. To establish what an event means, counsel must connect it to the information available to the user and a witness who understands the system.
Counsel should begin with the fact in dispute, identify the system that recorded it, preserve the relevant data, and obtain testimony from someone who can explain how the system operated during the period at issue. That foundation determines whether an audit event can support the inference presented to a court or jury.
About the Author
Michelle Carroll is the Founder & CEO of Lexcura Summit. She draws on more than four decades of experience across pediatric oncology and hematology, intensive and emergency care, medical-surgical care, hospice, home health, long-term care, skilled nursing, assisted living, and geriatric behavioral health. Her work focuses on examining complex clinical documentation and translating medical records into clear, litigation-focused analysis. She also hosts the Lexcura Clinical Insights podcast.
Endnotes
[1] 45 C.F.R. § 164.312(b), (c)(1), https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312.
[2] 45 C.F.R. § 170.315(d)(2)–(4), https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/subpart-C/section-170.315.
[3] Centers for Medicare & Medicaid Services, Documentation Integrity in Electronic Health Records (June 2016), https://www.cms.gov/files/document/ehrdocumentationfs062816pdf.
[4] Centers for Medicare & Medicaid Services, Medicare Program Integrity Manual, Pub. 100-08, ch. 3, § 3.3.2.5 (Rev. 12633, May 9, 2024), https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf.
[5] Fed. R. Civ. P. 26(b)(1), 34(a)(1)(A), 34(b)(1)(C), https://www.uscourts.gov/sites/default/files/2025-02/federal-rules-of-civil-procedure-dec-1-2024_0.pdf.
[6] Vargas v. Lee, 170 A.D.3d 1073, 1076–77 (N.Y. App. Div. 2019), https://www.nycourts.gov/reporter/3dseries/2019/2019_02142.htm.
[7] Punter v. N.Y.C. Health & Hosps. Corp., 2019 N.Y. Slip Op. 34239(U), at *2–3 (Sup. Ct. N.Y. Cnty. Nov. 4, 2019), aff'd, 191 A.D.3d 563 (N.Y. App. Div. 2021), https://www.nycourts.gov/reporter/3dseries/2021/2021_01132.htm.
[8] Heinrich v. State, 73 Misc. 3d 650, 657–58 (N.Y. Ct. Cl. 2021), https://www.nycourts.gov/reporter/3dseries/2021/2021_21263.htm.
[9] Wright v. Stephens, 239 A.D.3d 1271, 1274–75 (N.Y. App. Div. 2025), https://www.nycourts.gov/reporter/3dseries/2025/2025_03416.htm.
[10] Harms v. Lewis, 2026 N.Y. Slip Op. 02550, at *2–3 (App. Div. Apr. 24, 2026), https://www.nycourts.gov/reporter/current/3dseries/2026/2026_02550.shtml.
[11] Fed. R. Civ. P. 37(e), https://www.uscourts.gov/sites/default/files/2025-02/federal-rules-of-civil-procedure-dec-1-2024_0.pdf.
Copyright 2026, American Health Law Association, Washington, DC. Reprint permission granted.
Michelle Carroll is the Founder and Chief Clinical Strategist of Lexcura Summit, where she leads clinical intelligence reviews of medical records for attorneys and healthcare organizations.
Talk to Us
If you need the audit trail behind a chart, we can help you identify the right data, the right request, and the witness who can explain it. Visit lexcurasummit.com or book a brief conversation at calendly.com/michelle-lexcurasummit.