Federal prosecutors built health care fraud cases on the printed chart for decades. In an EHR, the stronger evidence often sits one layer underneath it, in the audit trail: the system-generated record of every user who touched a patient's file, what they did, and when. A note that reads cleanly on screen can carry a different story in its metadata: whether the entry was created before or after the billed date of service, whether a template was copied across unrelated patients, or whether the clinician named on the encounter ever opened the record.
What a Certified EHR Audit Log Records
Since the 2015 Edition ONC Health IT Certification Criteria took effect, every certified EHR has had to satisfy 45 CFR 170.315(d)(2), the auditable-events and tamper-resistance rule. The system must record the user identification, the date and time of the action, the patient affected, the data category touched, and whether the action was an addition, deletion, change, query, print, or copy. The log must also be tamper resistant: no user can change, overwrite, or delete a recorded action, and the system must detect whether the log itself has been altered. A clinician can edit a note, but nobody inside the practice can quietly edit the system's record of that edit.
Template Reuse, Cloning and Over-Documentation
A 2014 HHS-OIG review of Medicare program-integrity contractors found EHR features can mask a record's true authorship and distort its content to inflate billed claims, naming two practices: copy-pasting, which it calls cloning, and over-documentation, where a template auto-populates a note with content the credentialed user never reviewed. Only 3 of 18 contractors surveyed were using audit log data at all. The log can expose cloning even when the note reads cleanly: identical language across unrelated patients, or a note generated in seconds for a billed lengthy encounter. A billing employee who recognizes the pattern and raises it can become a witness for the government; see Whistleblower Retaliation Claims by Former Employees.
Who Actually Created the Entry
Because every action ties to a specific user credential, not to a name typed into a note, the log can surface a mismatch between the clinician credited with an encounter and the account that created it. Shared logins compound this: the log attributes every entry to the credential used, not to whoever typed it. Documenting or billing under another person's credentials can draw a separate count on top of the underlying fraud; see Aggravated Identity Theft in Healthcare Prosecutions. The federal health care fraud statute, 18 U.S.C. 1347, punishes a knowing and willful scheme to defraud a health care benefit program, and a defendant need not know the statute's text, which is one reason investigators lean on what the log shows rather than on what the provider says the practice was.
How a Defense Reads the Same Log
An audit trail that looks damaging on its face does not resolve a case. The same entries can show a note was finished contemporaneously by an appropriately credentialed staff member, which answers an over-documentation theory directly rather than conceding it. A late addendum, properly dated and signed the day it was written, is not an alteration, even though it sits in the same log as entries the government calls untimely. Agents executing a search warrant can reach the EHR's native audit trail directly from the server, which is one reason the response in that first hour should come from counsel who already understands how these systems log activity, as part of a broader healthcare fraud defense strategy.
An EHR audit log cannot be edited by the person it describes, which is what turns it from another page in the chart into evidence.
Why Early Legal Counsel Is Critical
It is critical that healthcare providers promptly retain experienced healthcare defense counsel upon learning that an EHR audit log has become part of a government inquiry, whether the request arrives as a grand jury subpoena, a civil investigative demand, or a search warrant. Early legal intervention can protect the provider's rights, ensure appropriate responses to government requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with investigators on the provider's behalf. Delaying representation can significantly affect the outcome, particularly where documentation findings extend exposure toward the anti-kickback statute or Stark Law once a referral or billing pattern draws attention.
How Health Law Alliance Can Help
Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience. If a government inquiry has reached your practice's EHR audit log, whether through a subpoena, a civil investigative demand, or a search warrant, Health Law Alliance's criminal healthcare fraud defense attorneys read the same system data investigators do. Contact us today for a free, confidential consultation.
