THE OKLAHOMA BAR JOURNAL 42 | SEPTEMBER 2025 Statements or opinions expressed in the Oklahoma Bar Journal are those of the authors and do not necessarily reflect those of the Oklahoma Bar Association, its officers, Board of Governors, Board of Editors or staff. medical malpractice lawsuit is to obtain a complete set of electronic medical records. In today’s health care, medical records are electronic, and because the medical records are electronic, there are numerous types and versions of medical records.4 In fact, it is not uncommon for a patient, a patient’s attorney or a representative of a hospital to all obtain a different version of the electronic medical record when a copy is requested. It gets even more complicated; beyond the legal medical record a health care facility produces in response to a medical authorization, there are numerous versions of medical records that contain metadata and all kinds of information not contained in the “legal medical record.” One such example, and an important part of the medical record, is the audit log or audit trail.5 Audit logs are like a trail of breadcrumbs left by a medical provider in the electronic medical record system. Audit logs maintain a host of information related to medical record access events, including timestamps, user identities and the specific actions taken within a patient’s chart – whether that involves viewing, editing or deleting information. When a health care provider performs an action related to a medical record, that action is maintained in the audit log. For example, if a health care provider orders a radiology exam, the audit log tracks when that health care provider orders the exam and when the health care provider reviews the radiology report from that exam. Because the audit log tracks specific actions of a medical provider, it can confirm key sequences or establish a timeline related to the care and treatment at issue. Further, audit logs are useful in establishing whether documentation was contemporaneous with patient care or altered after adverse events. These audit logs can show patterns of unusual access in a patient’s medical chart or, on the flipside, can confirm a health care provider’s memory of the events that occurred. Either way, the audit log helps confirm the treatment timeline. Unfortunately, there are no Oklahoma Supreme Court or Oklahoma Court of Civil Appeals opinions regarding the discoverability of medical record audit logs. Additionally, there are no specific Oklahoma statutes governing the discovery of audit logs. Even though Oklahoma appellate courts have not directly addressed production of audit logs, many Oklahoma state district courts have heard this issue and may have orders from other medical malpractice cases to assist with how a court may handle production of audit logs. There are opinions from other state courts6 discussing the discovery and production of audit logs in medical malpractice cases. While orders from other district courts are not binding, these orders can be helpful to support arguments for the discovery and production of audit logs. Because there is no binding Oklahoma authority on production of audit logs, the general discovery rules7 of relevant evidence govern the discovery of audit logs. A strong argument regarding relevance and discovery of audit logs is the federal HIPAA statute.8 Under HIPAA, patients have a “right of access” to obtain personal health care information, and health care providers are required to maintain a patient’s health care information.9 Part of the records health care facilities are required to maintain are audit controls or a way to record and examine activity in a medical record system.10 Notably, HIPAA does not require a specific type of audit log that a health care facility must maintain, only that the health care facility monitors the activity within a patient’s health care information.11 Therefore, it can be argued that because hospitals are required to maintain audit logs and audit logs are protected health information of a patient/plaintiff, a patient/plaintiff should be entitled to the audit log. Typically, an audit log is not produced in response to a request for medical records with a HIPAA authorization. Therefore, the audit log must be requested and produced during discovery in a medical malpractice case. The request for the audit log can be made through In Oklahoma medical malpractice cases, audit logs serve as silent witnesses to the creation and modification of the medical record.
RkJQdWJsaXNoZXIy OTk3MQ==