EHR and Medical Records
Electronic Health Records (EHRs) have replaced paper charts in most medical practices. As a medical assistant, you will spend a significant portion of your day working inside an EHR — entering vitals, documenting chief complaints, updating medication lists, and tracking orders. Understanding how these systems are structured, and the security rules that govern them, is part of your daily professional responsibility.
What an EHR Is and Why It Replaced Paper
An EHR is a digital record of a patient's health information that can be shared across providers, facilities, and systems. It replaced paper charts because it reduces errors from illegible handwriting, enables instant access to records across locations, supports clinical decision-making tools (drug interaction alerts, preventive care reminders), and allows data reporting for quality improvement programs.
The terms EHR and EMR are often used interchangeably, but technically an EMR (Electronic Medical Record) stays within one practice, while an EHR is designed to share information across organizations. In exam questions, EHR is the preferred term.
The SOAP Note Format
Provider documentation in the EHR follows the SOAP format, a structured way to record each patient encounter. MAs contribute to the S and part of the O sections:
- S - Subjective: What the patient tells you. The chief complaint, history of present illness, current symptoms, and any relevant history the patient reports. Example: "Patient reports 3 days of sore throat and fever."
- O - Objective: What you measure and observe. Vital signs, physical exam findings, lab results, medication reconciliation. This is where MA-documented vitals live.
- A - Assessment: The provider's diagnosis or differential diagnoses. MAs do not document this section.
- P - Plan: The provider's treatment plan — prescriptions, referrals, orders, follow-up instructions. MAs may enter ordered tests but do not create the plan independently.
The MA Role in EHR Documentation
Common EHR tasks for medical assistants include:
- Rooming the patient: Entering vital signs (blood pressure, heart rate, temperature, respiratory rate, oxygen saturation, height, weight, BMI), pain scale, and reason for visit
- Chief complaint: Documenting the patient's stated reason for the visit in their own words
- Medication reconciliation: Reviewing and updating the current medication list, including OTC drugs and supplements
- Allergy updates: Confirming and documenting medication and environmental allergies
- Order entry: Entering lab, imaging, or referral orders after the provider directs you to do so
- Results routing: Sending lab and imaging results to the provider for review and then to the patient through the portal
- Prescription processing: Electronically sending prescriptions to the pharmacy after provider authorization
You document what you personally did and observed. Never document on behalf of someone else or fabricate entries. Inaccurate documentation is a legal and ethical violation.
Meaningful Use and MIPS
The federal government incentivized EHR adoption through the Meaningful Use program, which required providers to use certified EHRs in specific ways to receive Medicare and Medicaid incentive payments. This program evolved into MIPS (Merit-based Incentive Payment System) under MACRA, which now ties Medicare reimbursement rates to quality measures, including EHR data reporting. MAs support MIPS by ensuring EHR data is entered completely and accurately.
The Patient Portal
Most EHR systems include a patient portal, a secure online interface where patients can view their health records, lab results, appointment summaries, and send messages to the care team. MAs often help patients set up portal access and answer questions about how to use it. Encouraging portal use supports patient engagement and reduces phone call volume for the practice.
EHR Security
EHRs contain protected health information (PHI) and are governed by HIPAA security rules. As an MA, your security responsibilities include:
- Unique login credentials: Never share your username or password. Never log in under someone else's credentials, even if asked by a supervisor.
- Auto-logout: Always log out of the EHR when leaving a workstation. Most systems auto-logout after a period of inactivity, but do not rely on this.
- Audit trails: Every action in an EHR is logged — who accessed which record and when. These logs are reviewed for HIPAA compliance and can be subpoenaed in legal proceedings.
- Minimum necessary access: Only access records for patients in your care. Accessing a celebrity's chart, a family member's record, or a coworker's file out of curiosity violates HIPAA even if you do not share the information.
- Screen positioning: Position computer screens so they cannot be seen by patients in waiting areas or hallways.
Correcting EHR Entries
Mistakes in the EHR must be corrected properly. The correct method is to add an addendum or correction note — never delete the original entry. In paper records, errors were crossed out with a single line, dated, and initialed. The EHR equivalent is a corrective entry that preserves the original and explains the change. Deleting or altering records to cover a mistake can constitute fraud or obstruction.
Know the four parts of a SOAP note and which portions MAs document (S and O). Know that MAs never share login credentials, never access records without clinical need, and correct errors with addenda rather than deletion. The audit trail is a key HIPAA concept — every EHR action is logged.
Practice Questions
Question 1: During patient rooming, an MA documents vital signs, the chief complaint, and updates the medication list. Which section(s) of the SOAP note does this information belong in?
Answer: S (Subjective) and O (Objective). The chief complaint is subjective — it is what the patient reports. Vital signs and medication reconciliation are objective data. The MA does not contribute to the Assessment or Plan sections, which are the provider's responsibility.
Question 2: A medical assistant realizes they entered the wrong blood pressure reading in the EHR. What is the correct way to fix this?
Answer: Add a correction entry or addendum that documents the correct value, notes that the original entry was an error, and includes the date and time of the correction. Never delete the original entry. EHR systems maintain audit trails and deletion of clinical entries can be considered falsification of records.
Question 3: A coworker asks you to log into the EHR using your credentials so they can access a record while their password is being reset. What should you do?
Answer: Refuse. Sharing login credentials violates HIPAA security rules and your organization's policies. Every user must have their own unique credentials. If your coworker cannot log in, the appropriate step is to contact IT or the practice manager to resolve the password issue through proper channels.