Medical Matter Data Gathering Package
Help a legal and technical team identify the clinical, administrative and audit records that matter in a medical matter and hand them to a specialist lawfully and precisely.
Edition 2026-11-03 | November 3, 2026
Who uses it: Attorneys, paralegals, health information management, privacy officers, project coordinators and client IT.
Scope: Medical treatment, documentation and privacy disputes. Clinical opinions stay with qualified clinicians and experts.
Package 07: Medical matters
Help a legal and technical team identify the clinical, administrative and audit records that matter in a medical matter and hand them to a specialist lawfully and precisely. Who uses it: Attorneys, paralegals, health information management, privacy officers, project coordinators and client IT. Scope: Medical treatment, documentation and privacy disputes. Clinical opinions stay with qualified clinicians and experts.
Before you gather
Start with the episode. Use the clinical episode, issues, patient identifiers and date range selected by counsel. The EHR may be one of several systems, so ask about separate imaging, laboratory, pharmacy, practice management, claims, portal, interface, legacy and backup sources.
Separate the layers of the record. A chart rendering, the underlying clinical record, version and amendment information, audit events and billing records answer different questions. Ask what the actual export includes before treating a printed chart as the full electronic record.
Ask how logging was configured. The HIPAA Security Rule requires audit controls that record and examine activity in systems containing electronic protected health information (45 CFR 164.312(b)); each product and site sets which events it logs and how long it keeps them. Request the vendor and version, the enabled event types, field definitions, clock settings and the earliest and latest available dates.
Confirm the authority for each disclosure. 45 CFR 164.512(e) sets different conditions for a court order and for a subpoena. Substance use disorder records under 42 CFR Part 2, psychotherapy notes and other state protected categories carry added protections; HHS gives February 16, 2026 as the compliance date for the 2024 Part 2 final rule. Keep real patient records in the restricted workspace.
Find the actual retention rule. The HIPAA Privacy Rule sets no general retention period for medical records, and the six year period in 45 CFR 164.316(b)(2) applies to required HIPAA documentation, not to charts. State law, licensure, payer contracts and preservation duties set the period for each record type.
Using the worksheets
Give each request to its suggested owner and record each response, including any gap, in Gathering-checklist.csv. Point to records held in the approved evidence location, where passwords, real patient data and controlled technical information stay.
Medical matters: records to find
Each request below matches a row in Gathering-checklist.csv. Record the response, status and record IDs there.
MED-R01 Matter scope and legal authority
Ask: Counsel and privacy officer.
Gather: Issues, relevant care episodes or periods, providers, jurisdiction, proper patient or representative authority and applicable authorization, order or other approved process.
Where to ask: Counsel and privacy or HIM files.
Why it matters: Defines the lawful, proportionate request and recipients.
If missing or uncertain: Collect and disclose through the route counsel approves.
Sources: HE02 164.512(e); HE03; LG01
MED-R02 Patient and encounter crosswalk
Ask: HIM and registration owner.
Gather: Approved patient identifiers, historical or merged IDs, encounter or account numbers, facilities, aliases as relevant and matching limitations.
Where to ask: Master patient index and registration.
Why it matters: Prevents wrong patient or missing encounter requests.
If missing or uncertain: Use masked IDs in general coordination; maintain the actual crosswalk in the restricted workspace.
Sources: HE01; NI04
MED-R03 System and vendor map
Ask: Clinical IT and department owners.
Gather: EHR vendor, version or modules, hosting, facilities, departmental systems, portal or HIE, practice management, billing, dictation, devices or interfaces, legacy and backup services.
Where to ask: Clinical architecture, application inventory and providers.
Why it matters: Identifies actual systems that may contain relevant records or logs.
If missing or uncertain: Confirm each candidate system with its owner.
Sources: HE01; HE06; NI04
MED-R04 Clinical record export description
Ask: HIM and application owner.
Gather: Available chart components, signed or unsigned status, notes, orders or results, attachments, flowsheets, medication or administration and export format or options for the selected episode.
Where to ask: Clinical record system and departmental records.
Why it matters: Allows the recipient to specify what is needed beyond a routine printout.
If missing or uncertain: Ask for a component list, data dictionary and exclusions rather than a claim of complete EMR.
Sources: HE01; HE06
MED-R05 Documentation history and amendments
Ask: Clinical application owner.
Gather: Existing addenda, corrections, amendment records, signature or cosignature history and available earlier versions relevant to the issue.
Where to ask: EHR audit or version functions and provider.
Why it matters: Supports later professional interpretation of documentation chronology.
If missing or uncertain: Record the event definition and any workflow explanation for each timestamp difference.
Sources: HE06; NI04
MED-R06 Audit and access records
Ask: Clinical security and vendor.
Gather: Event types, actor, patient or encounter IDs, actions, source workstation, session or IP where available, emergency or proxy access, configuration changes, retention and report parameters.
Where to ask: Clinical audit system, vendor and security.
Why it matters: Helps the specialist understand what actions can actually be examined.
If missing or uncertain: Mark which fields are recorded, which periods each log covers and whether and when logging was enabled. Confirm actual log completeness with the vendor and site.
Sources: HE01 164.312(b); HE06
MED-R07 Timestamp and identity explanations
Ask: Clinical IT and HIM.
Gather: Meaning of entered, service, event, signed, imported or modified times; local, UTC, time zone or DST rules; clock sources; shared, delegated or service users and ID mappings.
Where to ask: Application data dictionary and administrators.
Why it matters: Prevents false sequences or attribution.
If missing or uncertain: Ask the vendor for a written explanation where needed and record any time conversion.
Sources: NI04; HE06
MED-R08 Imaging and diagnostic sources
Ask: Radiology laboratory and pathology owners.
Gather: Relevant source images or reports, diagnostic results, amendments, accession or order IDs and exchange or interface records from actual systems.
Where to ask: PACS or RIS, laboratory or pathology and interfaces if used.
Why it matters: Request the underlying diagnostic objects behind the chart report.
If missing or uncertain: The specialist defines the native objects and format needed, and the owner confirms whether and where each artifact is held.
Sources: HE01; NI04
MED-R09 Medication and treatment operations
Ask: Pharmacy and clinical operations.
Gather: Relevant prescription, dispense or administration records, order changes, medication reconciliation and connected device records where actually kept.
Where to ask: Pharmacy, eMAR and relevant devices or providers.
Why it matters: Identifies distinct clinical record sources.
If missing or uncertain: Separate scheduled, ordered, dispensed, charted and administered meanings for a qualified clinician or expert to interpret.
Sources: HE01; NI04
MED-R10 Portal referral and exchange
Ask: Portal, HIE or telehealth owners.
Gather: Relevant messages, uploads, referrals, exchanged documents, telehealth material if recorded, proxy permissions and interface error or status records.
Where to ask: D32 and communications providers.
Why it matters: Surfaces patient facing and interorganization information.
If missing or uncertain: Confirm recording and retention; patient proxy activity and imports require interpretation.
Sources: HE01; HE03; HE06
MED-R11 Practice administration and claims
Ask: Practice manager and billing.
Gather: Scheduling or check in, calls if recorded, referrals, eligibility or authorizations, coding, claims or remittances and corrections for relevant episodes.
Where to ask: Practice management, clearinghouse, payer and phone systems.
Why it matters: Links clinical and administrative events without treating them as equivalent.
If missing or uncertain: Ask for unique IDs and export omissions, and pair claims and charges with clinical records.
Sources: HE01; HE03; NI04
MED-R12 Relevant communications and external copies
Ask: Counsel and custodians.
Gather: Permitted relevant internal or provider messages, secure texting, mail, incident communications, outside care records and legal or practice management files.
Where to ask: Clinical communication tools, D04 to D12, D28 and D35.
Why it matters: Finds sources outside the clinical chart.
If missing or uncertain: Counsel separates privilege, patient protections and third party authority. Request only patient and personnel material related to the matter.
Sources: LG01; HE02; CL01
MED-R13 Preservation retention and historical data
Ask: Counsel, records and IT.
Gather: Actual retention schedules, holds, overwrite dates, former systems, migration reconciliation, backups or catalogs and access or restoration constraints.
Where to ask: HIM, records manager, migration and backup providers.
Why it matters: Supports a time sensitive, realistic collection plan.
If missing or uncertain: No generic HIPAA six year chart rule; identify actual state, provider, record or patient circumstances for specialist review.
Sources: HE04; HE01 164.316; LG01 37(e)
MED-R14 Sensitive record segmentation
Ask: Privacy officer and counsel.
Gather: Whether Part 2, psychotherapy or other specially protected records are involved; relevant consents or orders and release restrictions.
Where to ask: Privacy or HIM and counsel restricted file.
Why it matters: Allows lawful limited disclosure and separate handling.
If missing or uncertain: Pending authority stays visible. Counsel confirms the authority for any use in litigation against the patient.
Sources: HE05; HE07; HE02
MED-R15 Export quality and transfer
Ask: Collector and receiving specialist.
Gather: Export method, account or role, dates or time zone, parameters, counts by component, metadata or attachments, errors, field legend, hashes where used and transfer receipt.
Where to ask: Collection reports and approved evidence repository.
Why it matters: Makes completeness and limitations reviewable.
If missing or uncertain: The specialist chooses any additional export; keep originals and record every change.
Sources: NI04; HE06
Medical matters: questions for IT and system owners
A useful answer names the actual system, period, supporting record and limits. Where someone else holds the answer, record who can give it. The same questions are in IT-and-owner-questions.csv.
| No. | Question | Suggested responder | Supporting record |
|---|---|---|---|
| 1 | Which systems contain the selected patient episodes and which system owns each component? | HIM, privacy officer and clinical IT as appropriate | System, module or owner and identifier map. |
| 2 | What does your routine chart export include and omit? | HIM, privacy officer and clinical IT as appropriate | Written component or format description and a permitted masked sample. |
| 3 | Can earlier note versions, addenda, signatures and corrections be separately retrieved? | HIM, privacy officer and clinical IT as appropriate | Vendor or site specific capability and actual availability statement. |
| 4 | Which events does the audit export include? | HIM, privacy officer and clinical IT as appropriate | Event dictionary, enabled settings, query scope and retention dates. |
| 5 | What do the different timestamps and user identifiers mean? | HIM, privacy officer and clinical IT as appropriate | Data dictionary, time zone or DST rules and identity or proxy mappings. |
| 6 | What records remain in old systems, departmental platforms, exchanges or backups? | HIM, privacy officer and clinical IT as appropriate | Historical system and retention inventory with owners. |
| 7 | Which requested records require separate authority or segregation? | HIM, privacy officer and clinical IT as appropriate | Privacy or counsel approved release route and restrictions. |
| 8 | What errors, patient matching limits, missing intervals or excluded components affect the response? | HIM, privacy officer and clinical IT as appropriate | Exception report linked to the record request IDs. |
Medical matters: sample questions for counsel
These are drafting prompts for counsel to tailor: define the event, source, period and parties, and check relevance, proportionality, privilege, privacy, possession, custody or control, local rules and case orders. A document request, interview or deposition topic may be the better device. The prompts are also in Discovery-drafting-questions.csv.
| No. | Prompt |
|---|---|
| 1 | Identify the systems and responsible custodians maintaining records of [defined patient episode] during [period], subject to the authorized disclosure scope. |
| 2 | Identify the patient, encounter, accession and account identifiers used to link the responsive components, under the agreed privacy protections. |
| 3 | Describe the components included in and excluded from [identified chart export] and the export parameters used. |
| 4 | Identify available records of amendments, addenda and signature events for [defined documentation], without assuming those records establish improper alteration. |
| 5 | Identify the recorded audit event types, retained periods and person able to explain the fields for [specified system and period]. |
| 6 | Describe the meanings and time zone conventions of the date or time fields in [identified export]. |
| 7 | Identify relevant predecessor or departmental systems or migration limitations affecting [defined record category]. |
| 8 | Identify the factual preservation or collection steps and known omissions for [defined source], excluding privileged legal advice and respecting protected record restrictions. |
Medical matters: decisions and handoff
These decisions belong to counsel or the receiving specialist. Each stays open until its owner records a decision. Add questions specific to the client and a responsible person in Open-questions.csv.
Worked example
The chart printout shows a note signed two days after the visit. The coordinator asks health information management for the definitions of service, entry and signature times and for any amendment or audit records. The specialist reviews the workflow and then interprets the sequence.
Preparing the handoff
The handoff is ready when counsel and the privacy officer have recorded the authority and any sensitive record restrictions; clinical, audit, diagnostic, portal and administrative records are requested as separate components; timestamps, identities, versions, formats and missing intervals have explanations or named questions; and restricted evidence moves only through the agreed route while the ordinary index uses masked identifiers.
Use Record-index.csv for one row per file or defined record set, and follow the walkthrough in the library for custody, restricted records and receipt.
| ID | Decision | Decision owner | Information needed | Closed by |
|---|---|---|---|---|
| MED-Q01 | What legal authority permits each disclosure and recipient, including specially protected material? | Counsel and privacy officer | Actual process, consent or order, case purpose and record categories | Written release instructions before any disclosure. |
| MED-Q02 | Which record components, event types and versions exist in this deployment? | HIM, vendor and clinical forensic specialist | Vendor or version, configuration, dictionary, masked sample and actual retention | A scoped export plan with its coverage limits. |
| MED-Q03 | Which retention and preservation requirements apply to these records? | Counsel and records specialist | Jurisdiction, provider or license, patient or record facts, schedules and case holds | Record specific schedule and preservation instructions; no blanket six year chart period. |
Sources for this package
Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave. The full list is in Source-register.csv.
HE02 HIPAA judicial proceedings provision. Federal regulatory compilation. 164.512(e) disclosures for judicial and administrative proceedings. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512
HE03 HHS court orders and subpoenas. Agency interpretation. Court orders compared with other subpoenas. https://www.hhs.gov/hipaa/for-individuals/court-orders-subpoenas/index.html
LG01 Federal Rules of Civil Procedure (December 1, 2025). Court procedural rules. Rules 26, 33, 34, 37(e) and 45. https://www.uscourts.gov/sites/default/files/document/federal-rules-of-civil-procedure.pdf
HE01 HIPAA Security Rule. Federal regulatory compilation. 164.308(a)(1), 164.312(b) and 164.316. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
NI04 NIST SP 800-86. Technical forensic guidance. Sections 3 to 6; collection, data files, operating systems, network or application sources. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf
HE06 ONC auditable events certification guidance. Agency certification guidance. 170.315(d)(2) auditable events and tamper resistance. https://healthit.gov/test-method/auditable-events-and-tamper-resistance/
CL01 Clio matter export scope. Vendor documentation. What a matter export contains and the separate subtabs. https://help.clio.com/hc/en-150/articles/9286116462747-Filter-Export-and-Convert-Matters
HE04 HHS medical record retention FAQ. Agency interpretation. The Privacy Rule sets no general medical record retention period. https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html
HE05 HHS Part 2 confidentiality. Agency interpretation. 2024 final rule; compliance date February 16, 2026; proceedings against a patient. https://www.hhs.gov/hipaa/part-2/index.html
HE07 Substance use disorder record regulation. Federal regulatory compilation. 42 CFR Part 2; consent and use in proceedings. https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
NY05 New York Commercial Division rules. Court rules. 11-a, 11-b, 11-c, 11-g and ESI Appendix A. https://www.nycourts.gov/rules/rule/section-20270-rules-commercial-division-supreme-court
NY06 New York Uniform Civil Rules Part 202. Court rules. 202.20 interrogatories; 202.20-j and Appendix A. https://www.nycourts.gov/rules/part-202-uniform-civil-rules-supreme-court-and-county-court
NY07 New York CPLR 3130. State procedural text. Use of interrogatories and restrictions. https://www.nysenate.gov/legislation/laws/CVP/3130
NY08 New York CPLR 3133. State procedural text. Answers and objections to interrogatories. https://www.nysenate.gov/legislation/laws/CVP/3133
Talk to a senior examiner
Get a free consultation. The initial consultation is free, and requests are handled in confidence.
Call (800) 868-8189 at any hour, or write to info@evestigate.com.
Request a consultation online at evestigate.com/contact.
© 2026 Global Digital Forensics, Inc. All rights reserved.