EHR Audit Trails, Corrections, and Addenda

Why Audit Trails Matter

Every action taken inside an electronic health record (EHR) system is automatically recorded in a log called an audit trail. This log captures who opened a record, when they opened it, what they viewed or changed, and from which workstation or login the action came. Audit trails exist because the medical record is a legal document. Courts, accrediting bodies, insurers, and regulators all rely on the record being trustworthy and complete. If a record could be silently changed or deleted, no one could trust the information it contains.

As a medical assistant, you will work in EHR systems daily — scheduling patients, entering vital signs, documenting chief complaints, and scanning documents. Every keystroke you make leaves a trace. Understanding audit trails protects you legally and helps you practice with integrity.

What an Audit Log Contains

A typical audit trail entry includes:

• User ID — the login name of the person who took the action
• Date and time — down to the minute or second, using the system clock
• Action type — for example: view, create, edit, print, or delete (where deletion is permitted at all)
• Record affected — the patient name or ID and the specific note or field changed
• Before and after values — in many systems, the log shows what the field said before the change and what it says after

No authorized user can erase the audit log. Even system administrators who have broad technical access are not permitted to alter it in ways that would conceal activity. This permanence is the foundation of record integrity.

Corrections Versus Addenda

Mistakes happen. A medical assistant may document the wrong medication route, transcribe an incorrect blood pressure reading, or enter data in the wrong patient's chart. When you discover an error in a finalized (signed or locked) note, you must correct it the right way.

You may never:

• Delete the original entry
• Type over or overwrite the original text so it disappears
• Use correction fluid or any method that hides what was originally written or entered

You must:

• Use the EHR's built-in correction or addendum function
• Leave the original entry fully visible and timestamped
• Add the corrected information in a new, clearly labeled entry
• Date, time, and sign the addendum with your own credentials
• State what was incorrect and what the correct information is

An addendum is a separate note attached to the original entry. It does not replace the original; it supplements it. The reader can see both the original documentation and the correction side by side. This transparency is what makes the record legally defensible.

Step-by-Step: Adding an Addendum

1. Locate the finalized note that contains the error.

2. Select the addendum or late-entry function (the exact button label varies by EHR vendor).

3. The system will open a new text field linked to the original note — do not attempt to edit the locked original text.

4. Begin with a clear statement such as: "Addendum to note dated [date] at [time]: The medication route was documented as 'IV.' The correct route is 'IM.' Error noted and corrected by [your name, credential]."

5. Enter the correct information in full.

6. Sign or authenticate the addendum. The system will automatically capture your user ID, date, and time.

7. Confirm that the original note remains intact and that the addendum appears linked to it.

Never ask a supervisor to sign an addendum for you if you made the original error. The correction should be authenticated by the person making it, with their own login.

Legal and Ethical Significance

Altering or destroying a medical record to hide an error is considered falsification of medical records. This is not simply a workplace policy violation — it can constitute fraud, expose the facility to civil liability, and in serious cases result in criminal charges. For a medical assistant, it can mean permanent loss of certification through AAMA or AMT and loss of employment.

Patient safety is the most important reason to document accurately. If a patient is seen by another provider, transferred to a hospital, or treated in an emergency, that provider relies on the record. A corrected, honest record — even one that shows an earlier error — gives the next provider accurate information. A falsified record can lead to repeated errors or patient harm.

Privacy and Audit Trail Investigations

Facilities routinely run audit reports to check for unusual access patterns — for example, a staff member who looks up records of patients they did not treat, or access at an unusual hour. Under HIPAA, accessing a patient record without a treatment, payment, or operations reason is impermissible, even if you do not share the information. Audit trails make these investigations possible. As a medical assistant, only access records for patients you are actively helping to care for during your shift.

Summary

• Audit trails automatically record every action in the EHR and cannot be altered.
• Errors in finalized notes must be corrected using the addendum function, never by deleting or overwriting original content.
• An addendum must be dated, timed, signed by the person making the correction, and must clearly state what was wrong and what is correct.
• Falsifying records is illegal, unethical, and can end a medical assisting career.
• Only access patient records when there is a legitimate care-related reason.