FORENSIC FRIDAY: Where Did This Clinical Note Actually Come From?

You find a clinical note in the medical record.

It has a physician's name.

A date.

A timestamp.

It appears to document exactly what you need.

But before treating it as the source, there is another question worth asking:

Where did this clinical note actually come from?

In today's interconnected healthcare environment, the EHR in which you find a clinical document may not be the EHR in which that document originated.

And for forensic medical record review, that distinction can matter.

Consider a seemingly ordinary discharge summary.

It originates in Hospital A's EHR.

From there, it may take several paths.

It might cross an interface into another system within the enterprise.

It might become available through an interoperability network — for example, through Oracle Health/Cerner connectivity to CommonWell and Carequality.

It might be transmitted as part of a transition-of-care workflow.

It might be sent directly to the referring provider through Direct secure messaging.

It might become available through a state HIE, Department of Health infrastructure, or another clinical data repository.

Eventually, Hospital B's EHR may acquire the document.

But here's an important distinction:

Interoperable does not necessarily mean synchronized.

Some exchanges operate substantially through query-and-retrieve workflows. The outside information may not simply appear in Hospital B's chart in real time.

A clinician, health information management professional, or other authorized user may have to initiate a query or request outside records. The EHR may then discover available records and retrieve them from another organization, exchange, or repository.

That means another timestamp becomes important:

When was the information retrieved?

The source document might have been created Monday.

It might have been amended Tuesday.

Hospital B might not query for it until Thursday.

And depending on the exchange mechanism, document versioning, source-system behavior, receiving-system behavior, and what was actually requested and retrieved, the artifact displayed Thursday may require some investigation before assuming it represents the current state of the originating record.

The provenance problem

Suppose Hospital A's physician signs the discharge summary at 10:14 a.m.

At 11:02 a.m., a version of that document becomes available externally or is transmitted through a transition-of-care workflow.

At 3:47 p.m., the physician discovers an error and adds an addendum:

“Correction: patient denied anticoagulant use prior to admission.”

Hospital A now contains the amended record.

But what does Hospital B contain?

That depends.

Was the external document regenerated after the addendum?

Was a new version made available?

Was the previous document superseded?

If the exchange is query-based, when was Hospital B's query performed?

Had Hospital B already retrieved the earlier document?

Was another query performed after the amendment?

Would that subsequent retrieval return an updated document?

Would the receiving EHR recognize it as a newer version of an existing document — or display both?

Did Hospital B ever retrieve the amended version at all?

Those are not trivial questions when a disputed fact appears in one record production but not another.

Two legitimate medical records can contain different versions of what appears to be the same clinical note.

Neither difference necessarily means someone altered, concealed, or improperly documented anything.

The records may simply represent different points in the document's lifecycle.

And then there is the document itself.

Many clinical documents exchanged between EHRs are represented using CDA — Clinical Document Architecture — and its U.S. implementation, C-CDA.

A Continuity of Care Document, or CCD, is one type of C-CDA document.

Underneath the nicely formatted clinical summary a user sees may be a structured XML document containing the clinical content along with identifiers, codes, sections, authorship, timestamps, relationships, and other metadata.

And that introduces another layer of provenance.

CDA provides mechanisms for identifying document relationships and versions.

A replacement document can reference the document it replaces.

An addendum can reference the document it appends.

Documents may carry a setId identifying the document lineage and a versionNumber distinguishing successive versions.

In other words, what appears to the clinician as one “document” may actually have a history that can be represented in the underlying exchange artifact.

But here's the forensic wrinkle:

Successfully sending the correct document does not necessarily guarantee that another EHR will display it exactly as the originating system intended.

Hospital A may generate a perfectly valid C-CDA document from a carefully designed template.

Its XML may contain the expected sections, identifiers, relationships, codes, narrative text, and version information.

Then Hospital B has to consume it.

Its EHR must recognize the document and templates, parse the XML, interpret the structured elements, map what it understands into its own data model, and render the human-readable portions through its own viewer or workflow.

Different products — and different versions or configurations of the same product — may not handle every incoming artifact identically.

A receiving system may support a particular template differently.

A parser may handle an element differently than expected.

A document viewer may render the narrative differently.

Structured information may be imported into discrete fields while other information remains available only inside the external document.

Some content may be technically present in the XML yet not appear where the clinician expects to find it in the receiving EHR.

And older or differently constrained document templates can introduce additional compatibility considerations.

So when something appears to be “missing” from Hospital B's representation, there may be another question before concluding that Hospital A failed to send it:

Was it absent from the source document — or did something happen when the receiving system consumed or rendered it?

That distinction can be critical.

The originating EHR.

The generated exchange document.

The XML itself.

The exchange mechanism.

The receiving EHR.

The receiving system's parser and document viewer.

These are related — but they are not the same thing.

Now make it harder.

A clinician at Hospital B retrieves Hospital A's outside documentation.

She then writes:

"Per outside hospital documentation, patient denied anticoagulant use."

Or she copies information from the external note into her own progress note.

Now something interesting has happened.

The information has acquired a new author, new timestamp, new organization, and new EHR context — but its semantic origin remains upstream.

Then another clinician copy-forwards that documentation.

Another organization subsequently retrieves it.

Another provider incorporates it into another note.

What began as one statement from one source can eventually appear throughout a longitudinal medical record as multiple instances of apparently corroborating documentation.

But repetition is not necessarily corroboration.

Those entries may all be descendants of the same ancestor.

And the farther the information travels from that ancestor, the harder its provenance may become to reconstruct.

This is where ordinary chart review begins to resemble digital forensics.

The question is no longer simply:

“Where does the chart say this?”

The better questions become:

Where did this statement originate?

Which organization created the source document?

Which EHR held the native record?

Am I looking at the native note, an exchanged clinical document, a transition-of-care artifact, a retrieved outside record, or information subsequently incorporated into another provider's documentation?

Was this information pushed, queried, retrieved, or manually requested?

When was it retrieved relative to when the original was created?

Was the originating note amended afterward?

Did that amendment ever propagate — or was an updated document ever retrieved?

If the information appears different in the receiving EHR, was it different in the source document — or in how the receiving system parsed, mapped, or rendered it?

Does the underlying exchange artifact reveal a document ID, set ID, version number, replacement, or addendum relationship that isn't obvious from the rendered chart?

Are three clinicians independently documenting the same fact, or are three notes descendants of one imported statement?

And perhaps most importantly:

Have I actually seen the originating record?

Why I prefer to start at the source

When a clinically significant statement matters to a case, finding it somewhere in a 10,000-page record production isn't necessarily the end of the inquiry.

Sometimes it is the beginning.

Whenever possible, I want to work backward toward the originating EHR and native source documentation.

That is where you are more likely to establish the actual chronology, authorship, amendments, addenda, surrounding documentation, and context in which the information was originally recorded.

When necessary, the next layer may be the exchange artifact itself.

Because there can be a meaningful difference between:

what existed in the originating EHR,

what the originating EHR generated for exchange,

what traveled across the exchange,

and

what the receiving EHR ultimately displayed or incorporated.

It can also help distinguish clinical chronology from information chronology.

Those are not always the same thing.

A clinical event may occur Monday.

The original note may be written Monday.

An exchange document may be generated Monday.

An addendum may be entered Tuesday.

A revised document may — or may not — subsequently become available.

An outside organization may retrieve documentation Thursday.

Its EHR may render or incorporate that information according to its own capabilities.

A clinician may copy information from it into a new note Friday.

Years later, all of those artifacts may appear together in a single medical record production — ordered in a way that makes their lineage anything but obvious.

Interoperability has given clinicians access to information that once remained trapped in isolated systems.

For patient care, that represents enormous progress.

For forensic record review, it creates a fascinating problem:

The same information can exist in many places without having originated in many places — and the version you find may reflect when, where, and how it was exchanged, retrieved, interpreted, and displayed.

A medical record reviewer should know the difference.

Because sometimes the most important question about a clinical note isn't what it says.

It's where it came from, which version you're looking at, how it got there, and what happened to the original after it left.