Medical Records as Evidence in Malpractice Cases

Medical records function as the primary documentary foundation in medical malpractice litigation, providing the factual substrate against which the standard of care is measured and contested. This page covers the evidentiary role of medical records across the lifecycle of a malpractice claim — from pre-suit access through trial — including how records are authenticated, disclosed, and challenged. Understanding the evidentiary mechanics matters because records deficiencies, alterations, or gaps directly affect whether the elements of a malpractice claim can be established at all.

Definition and scope

Medical records as evidence encompasses all documented clinical information generated during a patient encounter that a party seeks to introduce in a legal proceeding to establish or rebut a fact in dispute. Under the Federal Rules of Evidence (FRE), medical records are most commonly introduced under FRE 803(4) (statements made for purposes of medical diagnosis or treatment) and FRE 803(6) (records of regularly conducted business activity — the business records exception). These two hearsay exceptions allow records created outside of litigation to be admitted for their truth in both federal courts and, in substantially parallel form, in state courts that have adopted versions of the Uniform Rules of Evidence.

The scope of "medical records" in litigation extends beyond the paper or electronic chart. It encompasses:

1. Contemporaneous clinical notes — physician progress notes, nursing notes, operative reports, and discharge summaries
2. Diagnostic data — laboratory results, imaging studies (radiographs, MRI, CT), pathology reports, and cardiology tracings
3. Medication administration records (MARs) — timestamped logs of drugs dispensed and doses administered
4. Orders and protocols — standing orders, physician orders, and institutional clinical protocols referenced in care delivery
5. Electronic health record (EHR) metadata — access logs, edit histories, and audit trails generated by certified EHR systems under 45 CFR Part 170 (ONC Health IT certification regulations)
6. Billing and coding records — Evaluation and Management (E&M) codes that document the claimed scope of clinical decision-making

The Health Insurance Portability and Accountability Act (HIPAA), codified at 45 CFR Parts 160 and 164, governs the conditions under which covered entities may disclose records in response to litigation. HIPAA's Privacy Rule permits disclosure pursuant to a court order or, absent one, pursuant to a subpoena accompanied by satisfactory assurance that the patient has been notified (45 CFR § 164.512(e)). This intersects directly with HIPAA's broader role in malpractice litigation.

How it works

The evidentiary journey of a medical record in malpractice litigation follows a defined procedural sequence.

Phase 1 — Pre-suit access. Before a lawsuit is filed, the patient (or authorized representative) exercises the HIPAA right of access under 45 CFR § 164.524, which requires covered entities to provide access within 30 days. Many states also impose independent patient access statutes with shorter windows. Pre-suit access is essential to satisfying certificate of merit and pre-suit notice requirements that condition filing in jurisdictions that have enacted them.

Phase 2 — Formal discovery. Once litigation commences, records are obtained through the discovery process via subpoenas, Rule 34 requests for production (federal cases), or state equivalents. Parties may subpoena records held by non-party providers, laboratories, pharmacies, and insurers. Protective orders under FRE and HIPAA are commonly sought to limit redisclosure.

Phase 3 — Authentication. Under FRE 901 and 902(11), a record must be authenticated before admission. A custodian of records typically executes a declaration or testifies that the record was made at or near the time of the events, by a person with knowledge, kept in the course of regular business activity, and that it was the regular practice to make such records. Failure to authenticate is a predicate objection that can exclude key documents.

Phase 4 — Expert review and opinion. Authenticated records are then provided to expert witnesses who analyze whether documented clinical conduct conformed to the applicable standard of care. Experts rely on the records as factual premises; their testimony bridges the documentary evidence to the legal standard.

Phase 5 — Trial presentation. At trial, records are admitted into evidence, published to the jury through witness examination, and may be displayed as demonstrative exhibits. Inconsistencies between records and testimony, or between records from different providers, are central cross-examination tools.

Common scenarios

Altered or incomplete records. Spoliation doctrine applies when records are destroyed, altered, or withheld after a duty to preserve attaches. Courts have imposed sanctions ranging from adverse inference jury instructions to default judgments. EHR audit trails — now mandated for certified systems under ONC rules — can reveal post-hoc edits with timestamp precision, making concealment of alterations significantly more detectable than in the paper-record era.

Late entries and addenda. Clinicians routinely add late entries to correct omissions. When a late entry appears days or weeks after an adverse event, its timing is scrutinized. Courts distinguish between addenda that are clearly labeled and dated (potentially legitimate) and backdated entries with no audit trail disclosure (potentially fraudulent).

Missing records. Gaps in the record — absent nursing assessments during a critical window, missing fetal monitoring strips in a birth injury case, or undocumented informed consent discussions — create evidentiary inference problems. Under the doctrine of omnia praesumuntur contra spoliatorem, courts may instruct juries to draw adverse inferences against the party who controlled the missing records.

Discrepancies between billing records and clinical notes. An E&M code claiming a comprehensive history and physical examination, when the corresponding note documents a limited assessment, creates a factual dispute about what care was actually rendered. This is particularly relevant in misdiagnosis and failure-to-diagnose claims.

Records from multiple providers. Longitudinal treatment spanning multiple institutions requires consolidating records from different systems. Discrepancies in medication lists, allergy documentation, or prior test results across facilities are a common evidentiary focus in medication error and continuity-of-care claims.

Decision boundaries

The admissibility, weight, and litigation impact of medical records depend on several classification boundaries that practitioners and courts must navigate.

Admissible vs. inadmissible records. A record satisfying FRE 803(6) or a state equivalent is presumptively admissible. A record that is unauthenticated, obtained in violation of a protective order, or derived from an inadmissible source (e.g., a privileged peer review file under most state statutes) is excludable. Peer review and quality improvement records enjoy statutory protection in 47 states under peer review privilege laws, which shield internal committee deliberations from discovery even when the underlying clinical records are fully accessible.

Original vs. copy. The Best Evidence Rule (FRE 1002) requires the original of a writing to prove its content. FRE 1003 permits duplicates unless authenticity is genuinely questioned. For EHR-generated records, a certified printout is treated as an original under FRE 1001(d).

Treating provider records vs. consulting expert records. Notes and reports generated by a provider retained solely as a litigation expert are not business records — they are prepared in anticipation of litigation and are subject to different disclosure rules under FRE 26(a)(2). Treating provider records, by contrast, qualify as business records even if the treating provider later serves as a fact witness.

HIPAA-covered records vs. non-covered sources. Records held by entities that are not HIPAA-covered (e.g., employer health files, non-covered wellness apps, fitness device data) are not subject to HIPAA access or disclosure rules, though they may be reachable through state law subpoena or discovery processes. The evidentiary rules governing admissibility apply regardless of HIPAA status.

Statutory vs. common law preservation duties. Federal regulations under 42 CFR Part 482 (Conditions of Participation for Medicare and Medicaid hospitals) require hospitals to retain medical records for at least 5 years from the date of discharge, or 3 years after a minor reaches the age of majority. State statutes vary — some mandate 10-year retention periods — and the applicable retention rule affects when a spoliation duty attaches and how far back records can be demanded.

References

• Federal Rules of Evidence, Article VIII (Hearsay) and Article IX (Authentication)
• HIPAA Privacy Rule — 45 CFR Parts 160 and 164, HHS Office for Civil Rights
• 45 CFR § 164.512(e) — Disclosures for judicial and administrative proceedings
• [