EHR Audit Logs in Fraud Review: What the Note Does Not Reveal

EHR audit logs in fraud review trace access and changes to the medical record supporting a claim. The note shows what the chart says. The log records when someone entered, viewed or changed it. If you work with clinical records, billing or the software itself, you may recognize the gap between the finished note and what happened inside the system. That gap is where an audit trail can earn its keep.

What Is an EHR Audit Log?

An EHR audit log records activity within the electronic record, including access and changes, in time order. Dates, times, user identifiers and action types help connect a recorded event to the person using the system and the patient record involved.

In its December 2013 report on hospital fraud safeguards, the HHS Office of Inspector General described logs that recorded creating, editing and viewing data. It also examined whether logs captured signature events, release of an encounter for billing, and document imports and exports. Hospitals reported different levels of coverage for those events.

Why Is It Important for EHR Systems to Keep Audit Logs?

Audit logs give reviewers a way to check the authenticity of the medical record behind a claim, including whether someone changed it after the date of care. They give a reviewer a history to compare with the finished documentation.

The OIG contractor report published in January 2014 found that only three of 18 Medicare contractors reported using audit-log data in reviews or investigations. One used the log to check for changes after the date of care. Another used it to validate the authenticity of medical-record entries.

The hospital report exposed a different gap. Hospitals OIG visited described using their logs to detect unauthorized viewing of patient records. None described analyzing them to detect duplicate claims or inflated billing. The same technology could serve privacy review while its potential for examining payment fraud went unused.

Why the Note and Audit Trail Can Tell Different Stories

Copy-forward and automated templates can put substantial text into a note without a clinician writing each sentence during that encounter. For fraud review, the question is how that text came to describe services the provider billed.

OIG described copy-pasting, also called cloning, as moving information from one source into another. When clinicians fail to update or check the information, inaccuracies can enter the chart and support inappropriate charges. The report also described templates that populate fields automatically and checkboxes that generate extensive documentation. Its concern was overdocumentation: false or irrelevant material creating the appearance of support for higher-level services.

The billing connection is concrete. A template can describe a more comprehensive service than the practitioner performed. The reader of the finished note sees the resulting account of care. Understanding its creation requires attention to the software’s behavior and the user’s actions.

The workplace behind those clicks matters too. A 2022 Vassar College senior thesis on EHR stakeholders, drawing on interviews with physicians and nurses, describes documentation demands coming from regulators, software systems and hospital administrators. Its analysis connects those competing demands to heavier workloads and records crowded with information. That gives us a useful question for the insider: what purpose did this field serve in your workflow, and who expected you to complete it?

An employee who knows the template can explain how its wording appeared. A billing specialist can explain how the documentation reached the claim. We examine those accounts alongside the recorded events.

The Government’s Audit-Log Allegations

The eClinicalWorks case shows why the accuracy of the log itself belongs in a fraud review. In May 2017, eClinicalWorks and certain employees agreed to pay a total of $155 million to resolve allegations involving misrepresented software capabilities and customer kickbacks. The government’s software allegations included inaccurate recording of user actions in an audit log.

The government’s complaint described the problem more precisely:

Created and modified tell different stories about the same order. The government also alleged that deleted imaging orders could continue to appear as current in progress notes, and that problems fixed in one software version could reappear in another. The note, the order and the software version each mattered to understanding the alleged failure.

The money at issue came from federal EHR incentive payments. The government alleged that eClinicalWorks concealed failures to meet certification requirements and caused false claims based on use of its software. A software technician brought the whistleblower case, and the government joined it.

Does an Audit Trail Show Copy and Paste?

An audit trail can identify copy-and-paste activity when it records that information. The entry method and the original source of copied text are specific details to establish for the system and period under review.

In the hospital survey reported in December 2013, 44% of hospitals said their logs recorded the method of data entry, such as direct typing, speech recognition or copy-paste. OIG separately examined whether logs retained the original date, time and user identification when data were copied. Recording an edit and recording where its text came from were distinct capabilities in that review.

The same report compared recommended safeguards with the certification rules and meaningful-use requirements of the time. It found that those requirements did not specifically address tracking whether an update came from copy-paste, direct entry or import.

OIG’s contractor report also explained why comparing encounters matters. Copied language may become apparent only when a reviewer examines multiple claims from the same patient or provider. The matching passages, the underlying encounters and any available entry-method data belong together. A single finished note can leave the source of its wording out of view.

What Are the Requirements for an EHR Audit Trail?

What an EHR audit trail must record depends on the software’s certification and the years in question. The federal certification framework now incorporates an ASTM standard for audit-log content. In a case review, we connect the applicable requirements to the product’s actual recording behavior.

In its December 2013 safeguards report, OIG found that 44 percent of hospitals reported they could delete their audit logs, and 33 percent reported they could disable them. Hospitals said they restricted those abilities to particular users, such as system administrators. Who could switch the log off matters alongside what it says.

The product version, logging settings and meaning of its event labels are practical questions for the people who operate the system. So is whether the available history covers the relevant period. We work through those questions with technical expertise before relying on a log to explain an entry or a change.

How Documentation Reaches a Medicare Claim

EHR billing fraud review connects the clinical account, the service billed and the payment rules for that encounter. The date matters because Medicare changed how most evaluation and management visit levels are selected.

The older documentation guidelines tied examination levels to documented elements across body areas and organ systems. That created an incentive for software that could produce those elements quickly. Templates, macros and copied text could increase the volume of documentation presented in support of a higher-level visit.

For office and outpatient visits, Medicare changed the framework effective January 1, 2021. Medical decision making or the practitioner’s total time on the day of the visit became the basis for selecting the applicable code level. Since January 1, 2023, the change has extended to most other visit families. CMS’s May 2026 evaluation and management guidance says documentation volume does not determine the level billed.

That changes what we look for in an alleged upcoding scheme. The useful comparison is the service claimed against the care, decision making or time supporting it under the applicable rule. The audit trail helps explain the documentation’s history. The claim supplies the payment question.

CMS also describes a billing specialist or another reviewer examining documentation before claim submission. The path from note to payment can therefore include decisions beyond the person who signed the note. We look at how the code was selected, what the reviewer saw and who understood the discrepancy.

What Evidence Is Needed to Report Fraud?

We work with you to connect the clinical record, its audit history and the payment the alleged conduct affected. Your knowledge of how the system worked helps us explain what the records show and who understood the discrepancy.

CMS told OIG that audit-log review required special training, and OIG called for logs to form part of a comprehensive review. Someone familiar with the installation can explain an event label, a template or a change between versions. That is where your experience matters: the event history has to be read in the context of the system that produced it.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Patient privacy and the records you hold are questions we work through with you and the healthcare fraud whistleblower lawyers we bring in.

You Know How the Record Was Made

If the chart tells a story that the workflow does not support, speak with our whistleblower experts about what you are seeing. We work beside you to connect the software’s behavior, the clinical record and the payment into your strongest whistleblower case. We stay with you through the process and bring in health care fraud whistleblower lawyers who understand electronic evidence.