EHRs are a critical consideration when discussing medicolegal liability. Medical malpractice has some historical considerations and principles. According to Black’s Law Dictionary, “common law” is defined as the body of law derived from judicial decisions, rather than from statutes or constitutions [23]. Another word for common law is case law and one third of the world’s population utilizes the common law as a legal system or incorporates the common law in a mixed system that combines the common law with civil law. Medical practice classically runs afoul of the common law in matters of medical negligence. Within the common law, negligence has four elements: 1) duty, 2) breach, 3) causation, and 4) damages. Practically, negligence occurs when physician practice departs from the standard of care and consequently a material harm ensues. This is known as a tort which is a civil wrong other than a breach of contract. The remedy of a tort wrong is restitution by converting damages to a dollar amount. The tortfeasor (the person that commits the tort) must pay the damages.

The legal structure of modern medical negligence draws from Donoghue v. Stevenson the landmark House of Lords court decision in Scots delict law and English tort law [24,25,26]. Donoghue set the standard for medical negligence worldwide in every legal jurisdiction that uses the common law. The case held that a manufacturer held a duty of care which was breached because it was reasonably foreseeable that a failure to ensure safety would lead to a harm to a consumer. Medical negligence requires that by action or inaction, a harm is reasonably foreseeable.

While EHR systems offer many benefits to clinical practice and research in anesthesiology, EHRs create new and different physician and hospital liability exposures. In fact, EHR-related lawsuits have increased in recent years as growth in use has occurred. Approximately two-thirds of EHR-related claims involved user-related factors and 40–60% involved system factors, with some cases involving more than one contributing factor according to analysis of claims in the CRICO Comparative Benchmark System (CBS) [27, 28]. Graber et al. investigated malpractice claims for a two-year period using the CRICO Comparative Benchmark System (CBS) and found 248 cases in which EHR-related events were cited as contributing factors in the legal action [28]. In those 248 cases, only 7 were identified in which anesthesiology was the primary medical service. Cases were also found in ambulatory (59%), inpatient (31%), and emergency (10%) settings, often involving substantial harm or death [28]. Thirty percent of the errors were medication related, 30% were errors related to diagnosis, and 30% were related to medical/surgical treatment [28].

This study differentiated EHR-related contributing factors between those related to systems and those caused by the user. System factors refer to the design, technology, and security of the system whereas user-related factors relate to the person using the system such as inaccurate patient information, entering the wrong medication, and copy and paste mistakes. Systems related issues included such components as software design, routing of data, systemic malfunction, incompatible systems and failures of alerts or decision support. User-related errors included incorrect information, pre-populated forms and poor training or education. The highest individual source of errors in malpractice cases in which EHR was listed as a contributing factor was attributed to medication discrepancies (31%), including ordering, dispensing or administration errors [23,24,25,26]. Other issues cited in litigation surrounding EHR use include alert fatigue, workarounds, and insufficient use of training and education. Some sources of errors include drop-down menus, which may omit less frequently encountered scenarios [29]. Suboptimal CDS design contributes to high override rates and alert fatigue, which may affect liability [30]. Excessive medication interaction alerts can appear despite negligible potential risk; legal implications remain ambiguous if CDS alerts are removed or if clinicians do not adhere to these alerts [30]. Auto-correction and auto-population in text entry and documentation can input incorrect or outdated information, which is the leading cause for EHR-related malpractice claims [29].

Clinicians often have access to huge amounts of patient data; however, there is no current statute or precedent to address the extent to which clinicians have a responsibility to review it all in an integrated EHR with many sources. Alternate venues for provider-patient correspondence, such as emails and EHR messages, create additional healthcare encounters, increased documentation burdens, and liability risks [31]. Anesthesiologists and other clinicians may be predisposed to information overload, leading physicians and other providers to overlook key findings despite reliable access to documentation [30]. The clinician who misses a critical detail that affects treatment decisions may be liable for negligence; this is true even when a detail is missed at a different institution [30]. Additionally, the institution in which the clinician works can also be considered liable under the respondeat superior doctrine, where an employer is held accountable for the actions of their employees [30].

EHRs may also increase clinicians’ responsibility and accountability [30, 32]. An audit log, also known as an audit trail or event log, is a chronological record of activities in an EHR system. An audit log tracks who accessed the system, when, from where, and what they did. This includes logging in, entering or modifying data, viewing parts of the chart, and printing [33]. This is metadata – data about the data – that is captured in a log in nearly all EHR systems. Metadata describes actions that are performed on EHR data. This includes who logged into an EHR, what records they requested to view when data were entered, and other information associated with entries in the record, including the edit history. There are multiple strategies used by EHRs to record data about events and the relationships between them [34]. This metadata is not visible to the casual users of these systems and creates an audit trail that can be seen and used in malpractice cases.

Thus, an EHR audit log creates the opportunity to answer certain questions: Has the information presented by the EHR been changed after it was captured? This includes physiologic data, mechanical data (e.g., fresh gas flow rates) and the content of written notes. An audit log will also include the time of day that a user logged on and when they were presented with a note. Did a clinician see an important note immediately, or hours after it was written? Did they write their progress note at the time stamped on it, or did they write it hours earlier or later, and change the timestamp? As this metadata is not typically described as part of the medical record, and is not, as yet, routinely printed when charts are sent from one institution to another (or as part of discovery in a lawsuit), logs that answer these questions may pose significant risk, or quality improvement opportunities, to an institution or group of clinicians. Sophisticated electronic auditing procedures can identify individuals who reviewed, or failed to review, key information.30 Documentation templates that automatically import information may introduce new liabilities; information copied and pasted from other clinicians’ notes may contain inaccurate or incomplete information.30.

The term'discovery'refers to the activity conducted before a trial to find facts and evidence [35]. The procedural rules of discovery have been broadened in the pretrial period to prevent surprise evidence at trial. Every keystroke leaves a footprint, and although the audit trail information may not be included in the patient’s legal medical record, it is nonetheless discoverable. This discoverability underscores the potential impact of audit logs on legal proceedings. For example, consider note completion's timeliness after a critical incident. In a case of medical negligence, the defense might argue that the delay in charting was due to the need for a physician to care for the patient. From a plaintiff’s perspective, that same delay might signal the desire to craft the note to mitigate liability risks more carefully.

When a medical malpractice case arises, the EHR and audit logs help determine which individuals and health organizations were involved in a patient’s care. Such knowledge can be used to guide risk management, attorneys, and expert witnesses with issues around prosecution and defense [36]. [ii]While audit logs may assist in medico-legal activities, limitations also exist. An audit log does not fully account for the entire clinical activity in question. Though EHR audit logs are a legal requirement, not all EHR vendors track and store the same information with the same degree of detail. Some healthcare workflows are complex, and an audit log may lack enough detail to characterize an activity fully. Audit logs have also been shown to have varying degrees of inaccuracy [37]. In a medico-legal dispute, the hierarchy of evidence considers the “chart” supreme. The court considers the narrative account of involved parties and will listen to court-recognized experts when necessary. However, the modern chart, or EHR, will be viewed as the most compelling datapoint. The fidelity of the EHR is critical, and the legal requirement to protect patient confidentiality by an audit log may still generate insufficient legal coverage in accusations of negligence.

In addition to subpoenaing the medical record, underlying metadata may also be subpoenaed for use in a malpractice lawsuit. Metadata may be used to suggest physician misconduct, misdiagnosis, and lack of credibility and vigilance. In large and complex systems with documents collected from several institutions and health information exchanges, the likelihood that relevant information may be overlooked is much greater than when the chart contains limited data. Additionally, scanned documents may be burdensome and difficult to read, which may cause delayed review of large charts [38]. Overrides of CDS alerts or reminders and clinician departure from guidelines and recommendations leave an electronic footprint that can lead to liability in the case of an adverse event [27]. This data can bolster the case for the plaintiff [38]. Federal regulations include notable provisions regarding the management of EHR, which include recommendations and rules that encourage improved functionality (Fig. 2) [39]. It is thus important for an institution to be aware of what logging is available on their systems.

Recommendations for EHR use provided by federal regulation and medical informatics associations

Legal liabilities associated with EHR systems are unclear. Many EHR contracts include a “hold harmless” clause which restricts the ability of clinicians to report EHR-related problems. The U.S. Office of the National Coordinator for Health Information Technology in 2013 released a guide to EHR contracts that may be used to guide purchasers of this software [40]. The report details commonly used instances of indemnification against EHR developers for claims brought regarding personal injury, death, privacy or security violations or intellectual property infringement. This language often shifts responsibility to the purchaser/user regardless of the cause, if the claim arises from the use of EHR. The U.S. FDA has requested healthcare organizations to report EHR-related safety hazards, enabling processes to do so [30]. Genomic data and predictive analytics will likely lead to heightened privacy and insurability concerns along with new ethical and legal dilemmas [39].

The standards for the use of electronic information in litigation are rapidly changing and the rules of electronic discovery (e-discovery) are emerging and evolving. Physician workarounds may result in inconsistent data documentation practices which pose potential medicolegal risk by increasing the chances that key patient information could be outdated and overlooked by other users [41]. Ethical concerns may also be present with EHR use, such as determining who has ownership of protected health information and who informs patients of privacy breaches.

Before the widespread adoption of the automated anesthesia record, individual anesthesiologists exercised discretion on the nature of recorded information. These actions were predicated on a belief about what was an expected physiologic response to various stimuli. As a result, hemodynamic records were, at best, a much more qualitative record and at worst, a work of fiction. In anesthesia jargon, “train tracks” described a record with very little moment to moment hemodynamic variation [42]. In the paper record era, such a document was created and advanced as evidence for a well conducted anesthetic. In truth, hemodynamic parameters are stochastic, and a lack of variability is generally indicative of physiologic distress. A loss of heart rate variability has, for example, long been recognized as correlated with increased mortality after myocardial infarction [43].

In the lead up to the anesthesia record keeping transition from paper to electronic, the Anesthesia Patient Safety Foundation (APSF) raised a concern that the new record keeping system would increase the negligence litigation risk. This was based on the belief that when the automated anesthesia record displayed the expected much wider variability, any negative outcome would now be attributed to this new more variable hemodynamic finding [44]. Around that same time, the APSF also stated that an automated record would provide contemporaneous and unbiased information about intraoperative events and therefore may help refute any claims of negligence. The statement reasoned that an automated record would support a claim that intraoperative responses were appropriate and logical [45].

It is well established that in claims of negligence, poor record keeping is associated with a poor defense [46]. From the court’s perspective, post hoc charting or a spoken recall of the narrative events will be the least compelling evidence. The medical record is considered the gold standard of evidence, and more information is generally better than less. The risk is that an unvarnished and unbiased account might indeed point to negligent actions; nonetheless, medical practice is not benefitted by a culture designed to obfuscate objective data. The best automated anesthesia record not only captures all relevant information but can be designed to prompt and further document the standard of practice.