Missing Medical Records: The Subpoena Checklist
A records production that looks complete and is not costs more than one that is obviously short. The expert forms an opinion, the opinion goes into a disclosure, and months later a nursing flowsheet or a pharmacy log appears that changes the timeline. Most incomplete productions are not bad faith. They come from a request that let the custodian decide what "the chart" meant. This guide covers how to detect a short production, what a complete hospital chart contains, how to word the request so categories cannot quietly drop out, and what to do when they do.
How to tell the production is incomplete
Do this before anyone reads the records for substance. It takes an afternoon with the production and the billing, and it is the foundation for every follow-up letter.
1. Encounter count against page count
List every dated encounter the production itself proves happened: each admission, clinic visit, ED visit, imaging study, procedure, and each date on the itemized bill. Then check that every encounter has the notes it must have generated. An inpatient day with no nursing note, a surgery with no anesthesia record, an imaging charge with no report: each is a specific, documented gap. Page count alone proves little; a 400-page production of a three-day admission can still lack the medication administration record entirely.
2. Pagination and Bates gaps
Your Bates range should be continuous; if not, the problem is on your side. The custodian's own pagination is the revealing one. Many EHR print jobs stamp "Page 14 of 212" or a per-section page number on each sheet. Look for skipped numbers, a section that ends mid-sentence, a "continued" that never continues, and a page total on the custodian's cover sheet or affidavit that does not match what arrived. A Bates-cited search across the production, flagging every page where a given date, drug or author appears, is the quickest way to prove a day or a category is thin. The free record search does this on an uploaded production without a login.
3. Category check
Most productions are short on whole categories rather than scattered pages. The usual absentees:
- Nursing notes and assessments: admission assessment, skin and fall-risk scores, shift narrative, often filed apart from physician notes.
- Medication administration record (MAR): what was actually given, by whom, when, and what was held or refused. Orders are not the MAR.
- Flowsheets: vitals, intake and output, neuro checks, pain scores, restraint checks, ventilator settings. In most EHRs a separate report nobody prints unless asked.
- Imaging reports versus images. The report is text in the chart; the images live in PACS and are produced only on specific request.
- The EHR audit trail, which no facility produces as part of "the chart."
- EMS run sheet, held by the ambulance service, though a copy is often scanned into the ED record.
- Pharmacy records: dispensing logs, pharmacist interventions, automated dispensing cabinet transactions.
- Outside records scanned in from the transferring facility or prior providers, filed under "media" and skipped by a standard print.
- Billing: the UB-04 (CMS-1450) claim form, itemized statement and coding summary. Billing proves what was charged for and therefore what should have a record behind it.
What a complete hospital chart contains
Use this as the checklist the production is scored against and as the definition section of the request itself. Not every chart contains every item; a category that is genuinely absent should be confirmed in writing by the custodian, not inferred from silence.
| Category | Contents | Where it hides |
|---|---|---|
| Registration and face sheet | Demographics, insurance, emergency contact, admission source, attending, consents to treat | Patient-access system; sometimes produced from a different department than clinical records |
| Emergency department | Triage note and acuity score, ED nursing notes, physician note, orders, results, disposition, EMS run sheet if transported | ED tracking board data and triage timestamps are often a separate report |
| History and physical, consults | Admission H&P, consultant notes, specialist opinions | Consult notes from a group practice may be in that group's own system |
| Progress notes | Physician, resident, APP, and interdisciplinary notes, by date and time, with signature and co-signature history | Unsigned and pended notes may be excluded from a standard print |
| Orders | Every order with ordering provider, time entered, time acknowledged, status (active, held, discontinued), verbal/telephone order read-back | Discontinued and cancelled orders are frequently filtered out |
| Medication administration record | Each scheduled and PRN dose: drug, dose, route, time due, time given, administering nurse, held/refused reasons, barcode scan result | Separate MAR report; infusion titration history may be a further report |
| Nursing documentation | Admission assessment, shift assessments, risk scores (fall, skin, sepsis screens), care plans, patient education, restraint and sitter documentation, narrative notes | Risk-score history and care-plan versions are usually separate reports |
| Flowsheets | Vitals, I&O, neuro checks, pain, lines and drains, ventilator and oxygen settings, glucose, early-warning scores | Default prints often summarize per shift; request the full-interval data |
| Laboratory | Every result with collection time, received time, result time, reference range, critical-value flag and who was notified | Critical-value notification logs are commonly kept by the lab, not in the chart |
| Imaging | Order, report (preliminary and final, with addenda), images (DICOM), wet-read or critical-finding communication | Images in PACS; preliminary reads overwritten by the final in some prints |
| Procedures and surgery | Consent, pre-op checklist, anesthesia record, intra-op nursing record, counts, implant log, operative note (brief and dictated), PACU record, pathology | Anesthesia record often lives in a separate anesthesia information system |
| Monitoring data | Telemetry strips, fetal monitoring tracings, device interrogations, alarm logs | Retained by biomedical or monitoring vendors on short retention schedules |
| Discharge | Discharge summary, discharge instructions, medication reconciliation, follow-up appointments, transfer form | Instructions given to the patient may be in the patient-portal system |
| Communication | Secure chat and paging logs between clinicians, patient-portal messages, telephone encounter notes, family communication | Secure-messaging platforms are rarely considered part of the legal record |
| Scanned and outside records | Transfer packets, prior records, advance directives, patient-supplied documents, outside imaging | "Media" tab; skipped by many print profiles |
| Billing | UB-04, itemized statement, CPT/ICD coding summary, claim history | Patient financial services; separate request |
| Audit trail | Every access to the chart: user, role, date, time, action, device, and the before-and-after values of edited entries | Produced only on specific request; see the next section |
Wording the request so categories cannot be omitted
Designated record set, not "the medical record"
HIPAA gives the patient a right of access to protected health information in a designated record set, defined at 45 CFR 164.501 to include the medical and billing records a covered entity maintains and any other records it uses to make decisions about the individual. Facilities, by contrast, keep an internal policy defining their legal medical record, the subset they treat as the official business record, and that is what a request for "the complete medical record" gets you. The gap between the two is where flowsheets, device data, communications and scanned material live. Request the designated record set and define it with the category list above.
"Complete and entire," with a definition attached
The phrase does nothing by itself. Make it work by attaching a definition clause: the request includes all records in every category listed, held in any system or by any department, in any format including electronic, scanned, imaged, audio and video, for the period stated; and if a listed category does not exist for this patient, the custodian is asked to state so in writing, by category. That last sentence converts silence into either a production or a written admission that the category is empty. Either is useful.
The audit trail and metadata
Certified EHR technology must record audit-log events, including the user, date, time and action for additions, deletions and changes to patient data (the ONC certification criterion at 45 CFR 170.315(d)(2), which references the ASTM E2147 audit-log standard). So the data exists. Request it specifically: the complete audit log, access log and revision history for the patient's record for the stated period, showing for each event the user, role, date, time, device, action taken, and, for edited or deleted entries, the prior content. Ask for native export (spreadsheet or delimited text), not a printed screen. Expect the facility to say the audit trail is not part of the designated record set; in litigation that is beside the point, because it is ordinary electronically stored information requested under the discovery rules, not under HIPAA's access provision. The companion guide on EMR audit trails in malpractice cases covers how to read what comes back.
Native format and form of production
A PDF print of an EHR loses sortable timestamps, the distinction between time of event and time of entry, and the flowsheet intervals collapsed to fit a page. Where the rules let you specify the form of production (in federal court, Fed. R. Civ. P. 34(b)(1)(C), and 45(a)(1)(C) for subpoenas), ask for flowsheets, MAR, orders, labs and the audit trail in native or delimited export, and imaging in DICOM, with the PDF print as the paginated reference copy.
Scope by date and identifier
State the date range generously, name the patient by every name, date of birth and medical record number you have, and include records held under any merged or duplicate record number. Duplicate chart numbers are a routine cause of a half-produced record.
HIPAA authorization pitfalls
When the route is a patient authorization rather than a subpoena, the authorization controls what the facility will release, and a defective one is rejected weeks after you sent it. The core elements are at 45 CFR 164.508(c):
- Specific description of the information. "All medical records" is accepted by some custodians and rejected by others. Attach the category definition as a schedule and reference it.
- Sensitive categories need their own language. Psychotherapy notes require a separate authorization under 164.508(b)(3)(ii). Substance-use disorder treatment records from Part 2 programs are governed by 42 CFR Part 2. HIV, genetic and reproductive-health records carry extra protection in many states. If the form does not expressly cover them, they are withheld without comment.
- Expiration date or event. Required by 164.508(c)(1)(v). Use an event ("conclusion of the litigation") rather than a date where your state permits.
- Who is receiving it. Name the firm, not the attorney, so a staff change does not invalidate the request.
- Signature and authority. A personal representative signing for a deceased or incapacitated patient should attach proof of authority (letters of administration, power of attorney). Most estate rejections are for a missing attachment.
- The access route is different. A request made by the patient or personal representative under 45 CFR 164.524 triggers the 30-day clock and the cost-based fee limits of 164.524(c)(4). A third-party authorization does not. Where the patient is your client, consider having the patient make the access request and direct the records to you.
Timing and the follow-up log
Under 45 CFR 164.524(b)(2), a covered entity must act on an access request within 30 days, extendable once by 30 days on written notice. State law often sets a shorter deadline. Subpoena return dates are governed by the court's rules and the face of the subpoena. Whichever applies, the practical control is a log kept from the day the request goes out:
| Field | Why it matters |
|---|---|
| Date sent, method, tracking number | Starts the clock; proves service |
| Custodian contact, name and direct line | Release-of-information departments turn over; a named contact gets answers |
| Deadline under the governing rule | Calendar it with a reminder a week before |
| Each contact: date, person, what was said | The record for the motion if one is needed |
| What arrived, when, page count, format, Bates range | Feeds the completeness check above |
| Deficiency notice: date, categories named, cure date | Shows the specific request and the opportunity to cure |
| Custodian's written response per category | Produced, does not exist, withheld on objection, or silent |
Send the deficiency notice as soon as the category check is done, and make it specific: the category, why the record must exist (the billing line, the order, the reference in another note), and the date by which it is expected. A generic "please send the rest of the records" letter is easy to ignore and weak in a motion.
Score the production before the expert reads it
Upload the records and get a Bates-cited chronology that lists every encounter date and every record category found, so the gaps are visible on the first day rather than after the expert report.
Start with the production you have →When to move to compel
Move when three things are in the file: a request that defined the categories, a written deficiency notice naming the missing ones with the evidence that they exist, and the meet-and-confer the court's rules require (Fed. R. Civ. P. 37(a)(1) in federal court; most state rules have an equivalent). The motion then writes itself as a table: category requested, evidence it exists, custodian's response, date of each contact. Attach the log.
Two categories deserve particular attention. First, the audit trail, where the "not part of the medical record" objection will be raised; frame it as electronically stored information under the discovery rules and point to the certification requirement that guarantees the data exists. Second, items held by third parties the facility contracts with: monitoring vendors, PACS hosts, the ambulance company, the anesthesia group. If the facility says it does not possess them, ask for an order identifying the holder so a targeted subpoena can issue before retention periods run.
Once a complete production is in hand, rebuild the timeline rather than patching the old one; new categories change the sequence of events more often than they add to it. A structured case timeline template that records the Bates source of every entry shows which conclusions rested on the incomplete set.
Frequently asked questions
What is the difference between the designated record set and the legal medical record?
The designated record set is the HIPAA term (45 CFR 164.501) for the records a covered entity maintains and uses to make decisions about the patient, including medical and billing records. The legal medical record is a narrower set each facility defines in its own policy as its official business record. Facilities answer a generic request with the legal medical record, which routinely leaves out audit trails, device data, some flowsheets, and incident-related material. Ask for the designated record set and name the categories you want.
How do I know a medical records production is incomplete?
Compare what was produced against what must exist. Count encounters against pages, check that every dated encounter in the billing or the discharge summary has a corresponding note, look for Bates gaps and skipped page numbers in the source pagination, and check each record category against a checklist: nursing notes, medication administration record, flowsheets, orders, imaging reports and images, pharmacy, EMS run sheet, outside records, billing. A category that is entirely absent is almost always an omission by the custodian, not a record that never existed.
Can I get the EHR audit trail with a HIPAA authorization?
Often not without a fight. Facilities take the position that the audit trail is not part of the designated record set and so is not covered by the patient's right of access under 45 CFR 164.524. It is, however, ordinary discoverable electronically stored information in litigation. Request it by subpoena or formal discovery, describe it specifically (user, date, time, action, for every access to the patient's chart during the stated period), and ask for native export rather than a screenshot.
What does "complete and entire" mean in a records request, and does it help?
Standing alone, it does little; custodians read it as the legal medical record. It helps when paired with a definition that lists categories and formats and states that the request includes records held in any system, by any department, in any format, including scanned outside records, and that no category is to be excluded without a written statement that the category does not exist.
How long does a provider have to respond to a records request?
For a patient access request under HIPAA, 45 CFR 164.524(b)(2) requires action within 30 days, with one 30-day extension on written notice. Many states set shorter deadlines or specific copy fees. Subpoena response time is set by the issuing court's rules and the subpoena itself. Calendar the deadline the day the request is sent and log every contact.
When should I move to compel missing records?
After you have made a specific, written deficiency notice naming each missing category, given a reasonable cure period, and conferred as the court's rules require. A motion built on a category-by-category comparison of what was requested, what exists according to the facility's own documents, and what was produced is much stronger than a general complaint that the production seems thin.
Related: EMR audit trails in medical malpractice cases and the medical malpractice case timeline template.