Guidelines for EHR Documentation to Prevent Fraud. Appendix B: Case Studies

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.


Case Study 1

Issue: Electronic Tools That Enable Borrowing Data from Another Source

Electronic tools make it easy to copy and paste documentation from one record to another or pull information forward from a previous visit, someone else's records, or other sources. Failure to build in technical or policy and procedural safeguards creates an environment in which documentation manufacturing is encouraged and fraudulent entries are possible thereby compromising data integrity. There also are instances in which borrowed documentation cannot be tracked to the original source creating both legal and quality-of-care concerns.

The scenarios below illustrate how easy it is to use technology for good consequences (best case) but also undesirable outcomes (worst case). Health record documentation elements can be repetitive because some conditions and situations are frequently encountered and similar processes are followed. Health interventions also follow a standard course. However, each patient is unique, making each health service distinct from all others. Documentation created for one patient or a specific visit is most often not suitable for others, and copying text entries from one record to another should be carefully controlled.

Worst Case Examples

Professional Services

While John Doe was a patient at Memorial Medical Center, a number of medical tests and diagnostic evaluations were performed on him in an outpatient clinic over a two-week period. Concern arose about the health plan claim, so John requested a copy of his medical records along with the bill for services. The statement included evaluation and management codes consistently reported at the highest level of service (level 5).

Because Mr. Doe is a retired auditor for health plans, he examined the documentation and discovered that the medical history was pulled through within departments, between departments, and in subsequent visits with the same provider using the electronic health record (EHR) system, even when the visits did not include the clinician taking a history. The health plan was billed for a high level of service (of history) for each hospital outpatient clinic visit. John was also a systems analyst for a health system for many years and follows the evolution to EHRs with interest.

John is concerned that the EHR does not have the functionality (or it is not used) showing that the history (or any documentation component) obtained during a previous encounter was copied and reused as documentation for subsequent visits to support physician intensity of service. After many attempts to have services billed at the correct level (what John insists is really a level 2 or 3 evaluation and management when the pulled through data are not considered for service intensity), he contacts the fraud division of the health plan about his concerns.

Academic Medical Center and Physician Services

Shirley Sick was admitted to Memorial Medical Center for a workup to determine the cause of hypertensive episodes. She has undergone mitral valve replacement with a porcine graft and also requires a pacemaker to regulate and stabilize her heart rate.

The physician progress notes in a hospital-based EHR were copied and pasted multiple times by the attending physicians, consulting physicians, and residents by using a convenient macro feature available in the software. The teaching physicians regularly copy and paste the resident's notes as their own, which saves time in a very busy environment and covers the Medicare requirement of teaching physicians personally performing services for reimbursement.

A new resident misdiagnosed adrenal insufficiency and recorded the incorrect diagnosis in Shirley Sick's record. Because of the normal routine for borrowing documentation from other sources, the physicians copied and pasted this documentation and relied on the erroneous assessment several times, resulting in an increased level of evaluation and management services complexity for the Medicare claim and at the same time creating a patient safety and quality-of-care issue. Ultimately, the patient died from a medication error after administration of steroids to treat the adrenal insufficiency the patient didn't have, and the case is now in litigation.

Behavioral Health Services

Across the street at Community Mental Health Center, a state department of health surveyor identified nurse Norah Jones repeatedly documenting the same text on progress notes completed for several patients on her caseload. Nurse Jones explained that when completing notes for patients receiving medication management services, she always copied and pasted entries between patient records. She stated that medication dosage was an exception most of the time because they are more variable. Norah used this shortcut for documentation as one way to get her charting completed in the EHR before the end of her shift.

The state surveyor called this pattern of documentation “cookie cutting.” This practice involves copying and pasting the same text from one record to another, neglecting to document the variations accurately from one patient to another. For example, the patient's response to the medication may be different, regimen compliance may be different, and request for follow-up date and time may also be different. This practice by Norah Jones and other nurses from Community Mental Health resulted in a large focused review conducted by the Medicaid Fraud Division along with fines and penalties for payment for care that was not rendered at the level of service claimed.

Best Case Example

Memorial Medical Center uses an EHR for both the hospital and the clinic. The EHR has specific patient safety and documentation integrity tools built into its design. Memorial provides orientation to all medical students and residents providing patient care services on how to use the tools for accurate and complete documentation. Because it is very important that only those services personally provided or supervised by teaching physicians generate a bill for services, the computer-generated templates guide all of the participants in patient care to the correct place and format for recording observations within the record. These entries always include a date/time stamp and the author of the note. Teaching physicians must sign on to the system so the appropriate authentication is attached to their chart entries, and any templates must be modified to reflect specific conditions and observations unique to the service. Teaching physicians must be physically present to report services for health plan claims. Medical necessity and intensity of service documentation are unique to each visit, so when EHR templates and macros are not modified, they are clearly identified both by a different screen color and by a watermark across the text saying “Unmodified Documentation Template.” Info buttons provide the documentation guidelines and reporting requirements for teaching physicians and are available at the click of a mouse. Alerts are generated when a copy or paste function is used warning the EHR user about plagiarism and the risk of copying documentation out of context in a legal document.

Memorial also created a full slate of documentation guidelines, policies, and procedures surrounding use of the EHRs and related tools for capturing information. Special emphasis was placed on the prohibition of pulling forward information from previous visits as a basis for increasing the level of evaluation and management for billing. There are now clear protocols about the completion of an entry or record-when information displays (or not) to users and when the record gets locked down for either pulling forward or copying text content to another location. Situations and examples are provided that describe the appropriate use of pulled forward and copied entries taken from other sources. Policies about the use of scribes or surrogates making entries in an EHR are created and monitored for compliance. All designated scribes or surrogates have the ability to create entries but require countersignature authorization from the supervising clinician before they display to other users of the EHR system.

Community Mental Health Center also started a clinical documentation improvement program that included appropriate use of nursing documentation templates suitable for recording medication management. These templates create the framework for required documentation unique to each patient. They include built-in edits to ensure correct recording of dosages by comparing nurse entries with the issuing pharmacy instructions and the original scripts.

Discussion Questions:

  1. Which of the guidelines included in appendix C of the January 2007 AHIMA e-HIM ® practice brief “Guidelines for EHR Documentation to Prevent Fraud” could be used to discourage evaluation and management upcoding because of the pull-forward or copy-and-paste habits of the physicians on staff at Memorial Medical Center?
  2. What other adverse effects may result from the cookie-cutter approach used at the Community Mental Health Center?
  3. There are times when pulling forward of entries from previous visits into current records is appropriate. What are some examples of this practice in electronic environments that is a fully legitimate and desirable method for documentation?

Case Study 2

Issue: Data Integrity

A wide spectrum of data is collected in healthcare and must be collected accurately, completely, and consistently. Data integrity is of extreme importance because it is used to identify and track patients as they move from one level of care to another. Data are used to verify the identity of an individual to ensure that the correct patient is receiving the appropriate care and to support billing activity. According to Johns in Health Information Management Technology: An Applied Approach , (2nd edition, page 851) “Data integrity means that data should be complete, accurate, consistent and up-to-date. Ensuring the integrity of healthcare data is important because provider use them in making decisions about patient care”

The scenarios below are examples of worst case and best case examples associated with data integrity. Because of the voluminous amount of data collected in healthcare, data integrity can be compromised repeatedly. On occasion, information is entered incorrectly or in incorrect formats in various healthcare settings, so procedures must be defined to ensure that data are collected consistently no matter what medium is being used.

Worst Case Examples

Clinical Notes with Difficulty in Date Association

A patient was seen by a clinician on September 1, 2006, just before lunch. Once the patient is examined, the clinician gets sidetracked and is not able to enter his note on the date the patient was seen. During the visit, the patient discussed a possible reaction to a prescribed medication. On September 5, 2006, the clinician is back on duty after a long weekend; upon review of the record, he realized that he did not make an entry on September 1, 2006.

As the clinician began documenting, he decided that he wanted the date to reflect the actual date the patient was seen. He changed the date to September 1, 2006, at 11:30 a.m. He proceeded to enter the documentation as best he could. He remembered and documented the symptoms the patient described surrounding the potential medication reaction.

When another clinician reviewed the record, he saw the new note. This second clinician worked over the weekend and did not recall seeing this information but sees now that the date displayed is September 1, 2006, at 11:30 a.m.

Note and Event Entries-Date/Time Stamp

A facility has multiple biomedical peripherals connected to the EHR such as portable ECGs and intravenous infusion pumps. The main system has a synchronized clock for display with date and time stamping on notes, laboratory results, etc. Performance measures established by the Joint Commission on Accreditation of Healthcare Organizations, ORYX, and Centers for Medicare and Medicaid Services (CMS) are monitored, tracked, and reported, and now some payment is made for not just the service but also the quality of the service. Indicators for chest pain include the ECG be performed within 10 minutes of arrival in the emergency room.

A patient is brought to the emergency room at 23:55 on September 1, 2006. An ECG is started and completed according to orders entered at 23:57. The ECG is uploaded, read, and interpreted. At 00:30 on September 2, 2006, the clinician completes her documentation of the assessment and orders admission for acute myocardial infarction.

After a retrospective review of the case, the ECG is reported as being ordered at 23:57 but not completed until September 2, 2006, at 00:45. This is 15 minutes after the note entered by the clinician stating the ECG was done and showed ST-elevation myocardial infarction. Not only has this case fallen out for performance measures but it will also have difficulty standing up in court. It could possibly fail a third-party review if the outpatient was treated and released because the chest pain was thought to be gastrointestinal in nature. An audit might determine the ECG was not a covered service if done after the time of discharge.

In addition, the facility might not receive proper credit (or in the reverse if the clock times show it was done on time, but it really wasn't) and either receive wrongful payment or no payment when reimbursement is based on quality indicators. The linkage of peripherals needs to have the clocks on each system synchronized to support the integrity of the data collected for the care provided.

Touch Pads in Long-Term Care

Sunset Village nursing care facility implemented an EHR to streamline documentation so that the resident assessment instrument (RAI) is integrated with the assessment process/protocol (RAP) and the Minimum Data Set (MDS). A special feature of the software ensures optimal reimbursement for skilled beds through a point-of-care system that prompts nursing personnel to enter data elements.

The nurses and nursing assistants enjoy the convenience of the touch pad technology and the time the new system saves them for charting. However, the director of nursing has discovered that the system is creating documentation inconsistent with actual patient conditions. The MDS being transmitted to CMS is overstating the type of care for therapy units and suppressing one of the reportable quality indicators (residents with pain). The documentation in the records supports the optimized payment from Medicare for the skilled-care patients, but the director of nursing is very concerned about the consequences of using it.

Best Case Examples and Solutions

Clinical Notes with Difficulty in Date Association

Text entries into the EHR have a hard-coded date/time stamp that cannot be altered by the author. However, the clinician making a late entry can associate the date of the visit/service by using a second date/time field option, which allows for dates of reference for both a late entry and the date the care was provided. The ability to make amendments to the EHR is defined by business rules and policy. Entry errors are defined and reported accordingly.

Documentation Tools in a Teaching Hospital

University Hospital uses an EHR for both the hospital and the clinic. The EHR has specific patient safety and documentation integrity tools built into the design. University provides an orientation to all medical students and residents on how to use the documentation tools so the information collected is always accurate and complete.

It is very important that only those services personally provided or supervised by teaching physicians generate a bill for services. The computer-generated templates guide all users to the correct place and format to record observations, including a date/time stamp and the author of the note. Teaching physicians must sign on to the system so the appropriate authentication is attached to their chart entries, and any templates must be modified to reflect specific conditions and observations unique to the service. Teaching physicians must be physically present to report services for health plan claims. Medical necessity and intensity of service documentation are unique to each visit.

The templates and macros in the EHR not modified are clearly identified both by a different screen color and by a watermark across the text that says “Unmodified Documentation Template.” Info buttons providing documentation guidelines and reporting requirements for teaching physicians are available to the physicians at the click of a mouse. Alerts are generated when a copy or paste function is used to warn the end user about plagiarism and the risk of copying documentation out of context in a legal document.

The authority for developing templates and implementing documentation content and formats is spelled out in policy (bylaws) and is done through collaboration of EHR and HIM/medical record committees at the facility.

Clinical Notes with Difficulty in Date Association

The date that a note is entered into the EHR is hard coded. However, clinicians have the ability to associate the note with a date of service to reflect a reference date of when they saw patients as well as an indication of a late entry. Both of these dates are important to best practices in HIM.

Note and Event Entries-Date/Time Stamp

The facility made a conscious effort to ensure a standard for date and time stamps. To accomplish this goal, the facility inventoried all interfaced applications and biomedical equipment. Each equipment vendor was contacted to determine the best method of synchronizing peripherals to the main system, which minimized or eliminated users having to keep track of the time themselves. However, some equipment may need to be checked at the beginning of shifts or at 00:01 as the staff do with crash carts, etc.

Touch Pads in Long-Term Care (Best Case)

Sunrise Estate nursing care implemented an EHR to streamline documentation so that the RAI is integrated with the RAP and the MDS. A special feature of the software ensures optimal reimbursement for skilled beds through a point-of-care system that prompts all personnel to enter data elements. Each section of the MDS requires various personnel to provide coded data supported by their patient-specific documentation in the EHR.

Clinical, nonclinical, and medical staff have all found the convenience of the touch pad technology to be a time savings for both charting and completing their portion of the MDS. The software for collecting the MDS data has built-in hierarchy for the user (physician or nurse assistant) and for most data elements. For example, any activities of daily living (ADLs) or sleep patterns checked off by a nurse assistant would be accepted, but if a physician or nurse documented items relative to ADLs during the same MDS reporting period, a pop-up window would ask, "Section X has information already entered for ADLs; do you want to proceed?" This prompt allows the nurse or physician to proceed or to double-check what the nurse assistant previously recorded.

Orders in EHR

The orders section in an EHR can be a large database. Prescriptions must have specific fields associated with them to identify the details of the individual order-which physician placed the order; the date, time, reason, or diagnosis associated with the medication; status, etc.

Diagnosis on Note Different Than Final Diagnosis Coded and Billed

The provider may document a diagnosis that attaches itself to a template note. The coder may decide from the physician's documentation that the diagnosis should be coded more specifically. Thus, the diagnosis in the EHR template note might be different than what was coded and billed.

Discussion Questions:

  1. What procedures can be established to ensure that medication reactions described by a patient are documented in an accurate and timely manner to prevent medication errors and negative medication reactions?
  2. When dealing with disparate systems, what time-safe rules can be established to prevent staff from being able to enter data after a subsequent visit has been documented without systematic alerts to notify specific end users of a late entry or a change in documentation?
  3. What steps can an agency take to develop an electronic process to perform thorough data quality audits at specified time intervals?
  4. In a teaching facility, what documentation guidelines can be established to ensure that documentation completed by residents and interns is countersigned by tenured medical staff to prevent inconsistent documentation and billing discrepancies that can lead to fraudulent billing activities?

Application of Guidelines:

These case studies have been prepared along with guidelines to provide further references. See guidelines 1-3.


Case Study 3

Issue: Patient Identification and Demographic Data: Automated Patient Registration Data Elements/Patient Safety Risks

Failure of an EHR system to provide appropriate safeguards against medication errors, including the wrong patient, the wrong drug, or failure to consider all available data, can contribute to poor quality care. Examples of automated patient registration data elements and patient safety issues illustrate the need for identity management safeguards.

Worst Case Example

Dr. Rogers is ordering a prescription by using electronic order entry for a nursing home resident in the geriatric outpatient clinic at City Hospital on October 15. The patient with dementia presents to the clinic with a nursing assistant from Sunset Village, she is registered as Ethel Mertz, and her health records are placed in queue for Dr. Rogers.

Sunset Village had been contacted the previous day to gather information for the appointment. The registration clerk from the hospital asked only for the patient's name, then used the lookup feature in the EHR system to locate existing health records and place them in Dr. Roger's authorized access list for the upcoming appointment. The City Hospital system automatically populates registration data and places patient records in an authorized access queue for scheduled patients in the clinics on the day of the visit.

The nurse has downloaded a printout from the EHR system for Dr. Rogers to use in the examination room while caring for the patient, but he doesn't see that the Ethel Mertz in the record is 27 years old and has an address in another city. It's easy to locate Ethel's record in the system by typing in the first three numbers of her Social Security number (also stamped on the fee ticket) used to bill Medicaid for services. The clinic staff has already verified that Ethel is eligible for Medicaid.

The physician order entry software provides the capability for default self-selection upon entering the first three letters of the drug. The physician wanted to order Norfloxacin for an eye infection. As soon as “Nor” was entered, the software prompted for Norflex, which was accepted. The prescription/medication order was received in the pharmacy and was filled for Norflex, which is a muscle relaxant rather than an antibiotic. Both are oral medications, although m uscle tightening or spasms could result from Norflex. The order was signed electronically, the medication was made available for the nursing assistant to pick up, and the patient was returned to the nursing home.

The patient with an infection requiring treatment with Norfloxacin began taking Norflex and returned to the emergency room later the same week with septic shock due to a very serious bacterial infection of the left eye. When the emergency room staff accessed her health record, there was no entry for a geriatric clinic visit on October 15, so the findings from her care were not available.

City Hospital filed a Medicaid claim for Ethel Mertz and was paid for a clinic visit on October 15 with pharmacy charges for a Norflex prescription. Unfortunately, the Sunset Village patient's name is Ethel Merts, age 93. She has a number of chronic health problems, takes a number of medications, and has an allergy to drugs containing quinolone.

Best Case Examples

City Hospital uses a certified EHR system with built-in safeguards in the computerized physician order entry (CPOE) software suite to prevent medication errors.

  • This system does not allow software to self-select (or default) the first alphabetical choice in the order process and requires a second validation to make sure the drug indicated is the intended substance and dose.
  • This system provides the user the opportunity to finish typing before any suggestions are made by the software.
  • The software provides a list of options (or drop-down menus) to the user to select from and then provides alerts or reminders from a knowledge base.
  • City Hospital does not allow use of abbreviations in ordering; the full name of the drug is always displayed to avoid any errors between similar medications.
  • The system also provides a warning message at the time of signature for contraindications and potential adverse effects.

During the ordering process used at City Hospital's outpatient clinic, Mrs. Mertz's physician is asked by the EHR system to verify selection of Norfloxacin because the current medication history indicates that the patient had an anaphylactic reaction to another antibacterial agent that includes quinolone. The physician selects another type of antibiotic that is equally effective and avoids the risk of an adverse reaction.

Patient Identity Management

A nursing home resident presents to the City Hospital geriatric clinic with Staphylococcus aureus conjunctivitis. The nursing home had arranged the appointment with Dr. Rogers by using an online registration portal that requires verification of five critical demographic data elements to establish patient identity. Because there are two patients with similar names at Sunset Village, the home is careful to make sure that this patient, Mrs. Ethel Merts, is registered with her physician Dr. Rogers. Her current medication list, problem list, and allergies are uploaded to the system from the nursing home EHR. The EHR at City Hospital sends a verification message of receipt, and Dr. Rogers has a printout of the nursing home records at the time of the examination. At any time when verification is required, Dr. Rogers is able to access the full EHR including the uploaded information provided by the nursing home.

Discussion Questions:

  1. What safeguards should be built into procedures to make sure of patient identity?
  2. What process would be used to correct the entries made incorrectly on the record of Ethel Mertz (age 27)?
  3. What steps are needed to resolve the Medicaid claims issue generated on the basis of false information for Ethel Mertz?
  4. What business process steps should be taken to prevent erroneous entries in a CPOE system?

Article citation:
AHIMA e-HIM Work Group: Guidelines for EHR Documentation Practice. "Guidelines for EHR Documentation to Prevent Fraud. Appendix B: Case Studies." Journal of AHIMA 78, no.1 (January 2007): [web extra].