Potential pitfalls: risk management for the EMR: Part 2

by Laura Brockway, ELS

Establish a system to appropriately capture paper and other external clinical documents. Optimally, all paper documents should be scanned into the electronic record for easy accessibility. These documents could include paper records used before implementing an EMR, diagnostic test results, consultant reports, hospital reports, or records from other physician offices. Additionally, a process should be implemented to ensure that, once scanned, the paper documents are properly stored or destroyed.

Alternatives exist for practices working with systems that have limited memory or scanning capability. Since some patients’ previous medical records can be lengthy (hundreds of pages), physicians can review the records, summarize them, and include that information in the patient’s history within the EMR. The original paper records will still be available from the previous physician, if copies are ever required. While scanning a patient’s entire paper record into the system is preferred, we recognize that this is not always possible. The important step is to develop a policy for capturing patients’ previous medical records and follow it consistently.

Prescriptions are not always captured in the EMR. E-prescribing can be very helpful if it saves the information as part of the patient’s medical record. If physicians who use EMRs are not e-prescribing, prescriptions should be captured by scanning the paper prescription into the EMR or fully documenting the name, dose, quantity, instructions, and refill amount. Documenting only the name of the medication does not meet the documentation guidelines set by the Texas Medical Board. The same is true when dispensing sample medications to a patient.

Ensure records are backed up reliably. The HIPAA security rule requires that patient data be backed up to ensure it can be retrieved if a hardware failure or other event occurs. The risk management department has received several calls from physicians whose back-ups failed. One physician lost 600 patient records due to a hardware failure. He had been diligently backing up the data on a regular basis and storing copies off-site. However, when the back-up was set to restore, the data was unavailable. The back-up process that he had been following since the set up of the EMR was not adequately capturing the patient data.

Creating a back-up data set is only the first step. The back-up record must be tested regularly to ensure that all appropriate data are being copied, and that data restoration is possible. Testing should occur for all back-up types, including in-house creation on a removable hard drive or for processes that send the information over the Internet for offsite storage. Even if an EMR vendor is providing offsite back up, physicians are advised to confirm that the data is created appropriately.

Make sure the records are complete when providing printed copies. Many physicians using an EMR do not regularly print a patient record, and they may be unaware that clicking the print button on an EMR does not always provide a complete record. A patient or subsequent treating physician could receive an incomplete record as the result of the EMR printing protocols. If the records request came from an attorney, and that attorney received an incomplete record, this could cause the attorney to accept and file a malpractice claim based on incomplete information.

After printing what one assumes to be a complete record, ask these questions:

  • Does the record show the electronic signature and date the physician signed the progress notes?
  • Does the record indicate when entries were made by staff, showing their initials or unique identifier?
  • Does the record show all lab and consult reports with the physician signature and date indicating timely review?
  • Does the record show all medications prescribed, refills authorized, and samples given (if relevant)?
  • Are patient consent forms included in the printed record?
  • Are patient telephone calls included in the printed record?

In some EMRs, all this information is available on the screen but does not show up on the printed record when the general print button is clicked. It may be necessary to go to phone notes, prescription refills, etc. and print them individually to ensure that they are included in the complete record that was requested. Confirming that a complete record is sent is a prudent risk management practice.

When implementing systems to have a patient’s paper records scanned, test the print function to make sure it captures everything from the scanned documents. Items often overlooked include documentation of phone calls or requests for medication refills.


“EMR systems are quickly becoming the new technology tool used by hospitals and practices replacing manual documentation systems. The promise of EMR is a more accurate, legible and comprehensive medical record, available to physicians at the touch of a button.” (1) Whether you are purchasing your first EMR system, have just begun to implement one, or have used one for years, following the recommendations in this article may help you reduce risk and enhance the practice of safe medicine.

What are you thoughts on risk management for the EMR? Any tips or tricks? Please share your comments!