Medical Records in Malpractice Cases

Medical records serve as the documentary foundation of nearly every medical malpractice claim filed in the United States. This page covers how records are defined under federal and state law, how they function as evidence throughout litigation, the scenarios in which they become dispositive, and the boundaries that govern their admissibility and interpretation. Understanding the role records play is essential context for grasping the elements of a medical malpractice claim and the discovery phases that follow.

Definition and scope

Medical records, in the litigation context, encompass any document, electronic entry, image, or data set created by a healthcare provider in the course of diagnosing or treating a patient. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), codified at 45 C.F.R. Parts 160 and 164, defines protected health information (PHI) and establishes the framework under which records are maintained, disclosed, and accessed. The HIPAA Privacy Rule (45 C.F.R. § 164.524) grants patients the right to access their own designated record sets within 30 days of a request, with a single 30-day extension permitted in certain circumstances.

The scope of records relevant to malpractice litigation extends beyond simple clinical notes. Covered categories include:

• Physician orders and progress notes — narrative documentation of clinical decision-making
• Nursing notes and flow sheets — timestamped observations of patient status
• Operative and procedure reports — detailed accounts of surgical or interventional acts relevant to surgical malpractice claims
• Diagnostic imaging and pathology reports — radiographs, MRI studies, biopsy results
• Medication administration records (MARs) — logs governing medication error malpractice claims
• Informed consent forms — documents central to informed consent and malpractice disputes
• Electronic health record (EHR) metadata — audit trails showing when entries were created, modified, or accessed

The Centers for Medicare & Medicaid Services (CMS) Conditions of Participation (42 C.F.R. § 482.24) require hospitals to retain complete and accurate medical records for every patient. State retention mandates vary: most states require retention of adult patient records for a minimum of 7 to 10 years from the date of the last entry, while records for minors must typically be retained until the patient reaches the age of majority plus the applicable limitations period.

How it works

In a malpractice action, medical records perform three distinct evidentiary functions: establishing the timeline of care, demonstrating the standard of care applied or breached, and corroborating or undermining expert witness testimony.

The process by which records move from a provider's system into litigation follows a structured sequence:

1. Preservation demand — Counsel sends a litigation hold letter to the provider or facility immediately upon anticipation of a claim, triggering the duty to preserve all relevant records and metadata. Spoliation of records after a preservation demand can result in adverse inference jury instructions under Federal Rule of Civil Procedure 37(e) (28 U.S.C. Appx., Fed. R. Civ. P. 37).
2. Authorization and release — The patient or authorized representative executes a HIPAA-compliant authorization permitting disclosure to counsel. In litigation, court orders and subpoenas provide an independent pathway under 45 C.F.R. § 164.512(e).
3. Formal discovery request — Records are obtained through interrogatories, requests for production, and non-party subpoenas during the medical malpractice discovery process.
4. Authentication — Under Federal Rule of Evidence 902(11), domestic business records are self-authenticating when accompanied by a written declaration from a custodian of records certifying compliance with Federal Rule of Evidence 803(6). State courts follow analogous rules.
5. Expert review — A qualified medical expert reviews the records to form opinions on the standard of care. The expert witness requirements in medical malpractice govern the qualifications and disclosure obligations attached to that review.
6. Admission at trial — Records admitted as business record exceptions to the hearsay rule under Fed. R. Evid. 803(6) become substantive evidence the jury may consider.

EHR audit logs deserve particular attention. Modern EHR systems such as those compliant with ONC Health IT Certification Program standards (45 C.F.R. Part 170) generate immutable metadata logging every user access, edit timestamp, and deletion event. This metadata has become a primary tool for detecting post-incident alterations.

Common scenarios

Four fact patterns account for the majority of record-centered disputes in malpractice litigation.

Altered or incomplete records. When a provider adds late entries, modifies existing notes, or omits adverse findings after an adverse event, plaintiffs argue spoliation. Courts have imposed sanctions including default judgment in cases where alteration was demonstrated through metadata comparison. The National Practitioner Data Bank (NPDB), maintained by the Health Resources and Services Administration (HRSA), separately tracks disciplinary actions that may flow from record falsification.

Missing records. Complete absence of records for a critical care episode — common in misdiagnosis disputes covered under misdiagnosis and delayed diagnosis malpractice — can give rise to a presumption of negligence in jurisdictions that recognize the spoliation inference doctrine.

Conflicting entries. Nursing notes that document a deteriorating patient condition while contemporaneous physician notes reflect stability create internal contradictions that expert witnesses exploit at deposition and trial. The contrast between a nursing note timestamped at 02:14 and a physician note timestamped at 07:30 covering the same six-hour window is a recurring pattern in birth injury malpractice claims, particularly in fetal monitoring strip disputes.

Record access disputes. Providers occasionally assert psychotherapy notes protections under 45 C.F.R. § 164.524(a)(1)(i) or assert that certain quality-assurance documents are privileged under state peer-review statutes, creating threshold admissibility questions that courts resolve before discovery can proceed.

Decision boundaries

Not all medical documentation carries equal evidentiary weight, and several classification distinctions govern how courts treat specific record types.

Business records vs. opinion records. Routine clinical documentation — vital signs, lab values, medication times — qualifies as a business record exception under Fed. R. Evid. 803(6) and is admissible for its truth. Narrative physician assessments containing diagnostic opinions occupy a different position: they may still be admitted under 803(6), but opposing counsel can argue the opinion embedded in the entry is inadmissible hearsay within hearsay unless a separate exception applies.

Peer-review privilege vs. discoverable records. Most states enact peer-review privilege statutes protecting the deliberations of hospital quality committees. In contrast, the underlying incident reports and root-cause analysis documents that fed those deliberations may not be privileged if they were created in the ordinary course of business rather than exclusively for the committee. The boundary between privileged and discoverable varies materially by state — a distinction directly relevant to hospital malpractice and institutional liability claims.

Original records vs. amended records. Providers have a legitimate right to correct errors through addenda under 45 C.F.R. § 164.526. An addendum is distinguishable from an alteration: a proper addendum is dated, identified as a late entry, and does not overwrite original content. EHR audit logs make this distinction verifiable. An addendum added 72 hours after an adverse outcome without clinical justification occupies fundamentally different evidentiary ground than a routine correction made within 24 hours under established coding protocols.

Retained vs. destroyed records. The applicable statute of limitations and state retention laws determine whether a destroyed record represents a routine purge or actionable spoliation. A record destroyed 3 years after creation under a 7-year retention policy and before any litigation hold presents a different legal profile than one destroyed 6 days after a patient complaint.

References

• HIPAA Privacy Rule — 45 C.F.R. Parts 160 and 164, U.S. Department of Health and Human Services
• [45 C.F.R. § 164.524 — Access of Individuals to Protected Health Information, Electronic Code of Federal Regulations](https://www.ecfr.