Medicare Compliance & Reimbursement

EHRs:

Lacking Audit Trails Could Render EHRs Moot In Court

Most EHR systems fail to track revisions' sources, study shows.

Electronic health records need more work--the most common EHR systems still fail to provide a good audit trail that indicates who changed what.

Many EHR systems allow "canned" documentation that a provider cuts and pastes from a previous visit or a template, according to a study of roughly 30 products by consultants Patti Trites and Reed Geltzer with Advocates for Documentation Integrity and Compliance in Augusta, MI. And with many systems, finding a record that shows that the provider used "canned" documentation is impossible.

Many systems don't show which provider made a change to a record, and when. On paper, seeing if someone scribbled on a chart or used liquid paper to erase something is easy. But there's no liquid paper on a computer screen, explains Trites.

Other systems will allow physicians to send a record to billing even though it may be missing vital documentation, says Trites. "That happens in the paper world every day, but this is supposed to be a better way," she laments. If you automate a bad system, it just allows you to go wrong faster, she notes.

Bad Practices Could Spell Legal Trouble Down The Road

Since Trites and Geltzer started studying EHR products three years ago, many vendors have started making improvements. They're re-testing the major systems, and so far they've found some improvements. One major system just removed the ability to plug in "default" documentation, Trites reports.

Trites and Geltzer are working with some Quality Improvement Organizations and vendors to compare the vendors' products to their standards.

The real problem with many EHR products is that they wouldn't stand up to the civil rules of evidence in court, warns Trites. "These records aren't going to hold up in a civil proceeding," because you can't tell who altered them and on what date, she explains.

In one doctor's office, a nurse routinely filled out documentation before the doctor arrived for the day--and before the patients had actually come in. Afterwards, the doctor would sign off on the documentation, which was all "cloned" from previous records, says Trites.

Some systems will allow a good "audit trail," but still allow "cloned" documentation, cautions Trites.

For instance, the IT system at Central Utah Multi-Specialty Clinic draws a line through the old wording in its record revisions and adds the date and time of the change, according to IT Director Jamie Steck. "If you're talking about a clinician, you're going to want to know why they changed it," he explains.

Since CUMSC installed its EHR system, carriers have audited its files several times, and the EHR's audit trail has made the process much easier, says Steck. When carrier reps come in, CUMSC can give them access to a computer terminal and explain how to search for the information they need. That way, they don't waste CUMSC employees' time, he explains.

Providers should have someone who's familiar with health information management principles help them select a system, advises Trites. They should have policies and procedures that spell out how their practice deals with information, and have everyone sign off on them, advises consultant Norman Brooks with Lee-Brooks Consulting in Chicago.

Providers should also make sure that their system has an audit trail and that staff can access it without being a programming whiz, advises Trites. Providers need to make sure the system doesn't delete audit information at the end of each day; they also need to ask whether the system will meet Health Insurance Portability & Accountability Act standards, Trites stresses.

In addition, providers ought to ensure that employees don't use each others' computers and accounts, so that they can tell which employees made which changes, says Brooks.

So far, vendors aren't willing to build security and accountability into their products until customers demand them or the vendors get sued, says Trites. "It's the vendor's responsibility," she notes, "but the physician's going to sit in the courtroom."

Other Articles in this issue of

Medicare Compliance & Reimbursement

View All