EHR AUDIT TRAIL & MEDICAL RECORDS FORENSICS
The chart tells one story. The audit trail tells another.
Every EHR system logs more than the visible chart shows — who accessed the record, when entries were made or changed, and what the system did automatically versus what a person typed. Most consultants read the printed record. I read the system underneath it, as a Healthcare IT Analyst who has built and administered the platforms that generate this data.
Serving plaintiff and defense counsel in Florida and nationwide. NDA executed on all engagements.
WHAT IS EHR AUDIT TRAIL FORENSICS?
An EHR audit trail is the system-generated log sitting behind every electronic medical record — a record of who opened the chart, what was viewed, what was added or changed, when it happened, and from which device or terminal. It exists separately from the printed or PDF chart attorneys typically receive in discovery, and most legal teams never see it unless they know specifically to request it.
Audit trail analysis can establish whether documentation was entered in real time or reconstructed after the fact, whether a record was altered after an adverse event, whether entries were backdated, and whether the system-of-record actually matches what was produced in discovery.
A technical vantage point most consultants don't have.
Most legal nurse consultants and even most computer forensics experts approach audit trails from one side only — clinical or technical, not both. My background is different: eleven-plus years administering EHR systems including Cerner, combined with active clinical nursing practice and dual master's-level training in information security and IT management.
That means I don't just read an audit log — I understand what the system was doing when it generated each entry, which fields populate automatically versus manually, and what a normal versus anomalous access pattern looks like from the inside. That distinction is frequently the difference between an audit trail that looks suspicious and one that actually is.
Access Log Analysis
Review of who accessed a patient record, when, from what device, and whether access aligns with the clinician's documented involvement in care.
Edit History & Metadata Review
Examination of modification timestamps, version history, and system-generated metadata to identify changes made after the fact.
Backdating & Late Entry Detection
Identifying discrepancies between the stated time of documentation and the system's actual entry timestamp — a frequent point of dispute in malpractice and wrongful death cases.
System-Specific Review
Direct working knowledge of major EHR platforms' audit structures, including Cerner systems administered firsthand, to interpret logs accurately by system.
Discovery Request Support
Guidance for counsel on what to request, in what format, and from which system modules — audit trails are frequently produced incomplete unless the request is specific.
Expert Testimony & Report
Findings delivered as a clear, defensible written opinion with full methodology disclosed, built to withstand cross-examination on technical grounds.
EHR audit trail forensics is most valuable where documentation integrity, timing, or record alteration is in dispute.
Record & System Identification
Confirm which EHR platform generated the record and what audit trail data that system captures and retains
Technical & Clinical Analysis
Cross-reference audit log data against the visible chart, timeline of care, and documented clinical events
Findings & Expert Opinion
Written report translating technical findings into a clear, litigation-ready opinion for counsel
Clinical foundation
Registered Nurse, multistate — acute, behavioral, and forensic clinical settings
Technical depth
MS Information Security · MBA IT Management · 11+ years healthcare IT, including Cerner system administration
Investigative training
Credentialed private detective training · Forensic & Investigative Sciences Level I Certificate, TEEX · Applied forensic linguistics · Founder, Florida Unsolved
Professional memberships
Member, Academy of Forensic Nursing (AFN) · Member, American Association of Legal Nurse Consultants (AALNC) · Associate Member, Florida Association of Professional Investigators (FAPI)
Ready to discuss your case?
Consultations are confidential. NDA available on request. Plaintiff and defense.
Shane Huey, MS, MBA, RN
Based in St. Augustine, Florida. Nationwide remote.