Page 4 of 9

FM12.3 | Cyber Forensics & Privacy of Medical Documents — SDL Guide

Learning Objectives

• Define cyber forensics and describe its application in the context of medical records and electronic health information (FM12.3)
• Explain the legal framework governing electronic records in India, including the Information Technology Act 2000 (amended 2008) and the Section 65B certificate requirement for admissibility
• Describe how electronic medical records are examined for authenticity, alteration, and chain of custody
• Apply the legal principles governing privacy of medical documents — ownership, retention, disclosure, and the consequences of unauthorised disclosure
• Identify the circumstances under which medical records may and must be disclosed

INSTRUCTIONS

The digital transformation of medical records has created a new frontier in forensic medicine: cases involving disputed clinical records, tampered laboratory reports, forged prescriptions, and unauthorised disclosure of patient data are now reaching courts. As a future clinician, you will maintain electronic health records throughout your career. Understanding the legal status of those records — how they can be authenticated, what protects them from tampering, when their disclosure is mandated vs prohibited, and how forensic analysis is applied to electronic documents — is essential both for practising lawfully and for participating in the legal processes that depend on medical documentation.

References

• KSN Reddy — Essentials of Forensic Medicine & Toxicology (textbook)
• BV Subrahmanyam — Modi's Medical Jurisprudence and Toxicology (textbook)

---

Version 2.0 | NMC CBUC 2024

The Medicolegal Significance of Electronic Medical Records

Electronic medical records (EMRs) have become central to medicolegal proceedings across a wide range of case types — medical negligence, criminal investigations, insurance disputes, employment cases, and professional conduct hearings. Their significance as forensic evidence derives from three properties that they share with physical exhibits: they contain information relevant to legal questions, they can be authenticated (or their authenticity challenged), and they can be subjected to forensic analysis to detect alteration, tampering, or unauthorised access.

Provided image

The categories of medicolegal scenario in which EMR forensics becomes critical include:
• Medical negligence litigation: One of the most common uses — was the clinical record created contemporaneously with the events it documents, or was it backdated after the adverse outcome? Were entries modified, added, or deleted after the date shown? In clinical negligence, the timing and completeness of documentation can be outcome-determinative.
• Criminal investigations involving healthcare workers: Cases of deliberate patient harm (poisoning by a healthcare worker, fraudulent certification), criminal abortion, insurance fraud using falsified clinical records, and registration fraud using altered qualifications all involve electronic records that may have been created or modified for criminal purposes.
• Drug prescription fraud: Electronic prescriptions, e-stamps, and prescription database systems can be forensically examined to detect forgery, duplication, and unauthorised prescription generation.
• Telemedicine and digital consultation disputes: As telemedicine expands, disputes about what advice was given, when, and to whom will increasingly rely on electronic communication records — emails, chat logs, video consultation recordings, and audio files.
• Wearable and IoT medical data: Data from implanted cardiac devices, glucometers, wearable pulse oximeters, and activity monitors can be relevant in personal injury claims, insurance disputes, and criminal investigations. This data constitutes electronic medical records under the broad IT Act definition.

In each of these scenarios, the forensic medical officer must understand not only the clinical content of the record but also its technical provenance — where it was created, by whom, at what time, and whether it has been modified since creation. These questions are answered by cyber forensics, the branch of forensic science that analyses digital evidence.

Scientific and Legal Basis of Cyber Forensics in Medicine

Cyber forensics (also called digital forensics) is the application of scientific methods to identify, preserve, examine, and present digital evidence in a form that is legally admissible. In the medical context, the digital evidence of interest includes: EMR entries and their modification history, DICOM imaging files, laboratory information system (LIS) records, pharmacy dispensing records, electronic prescriptions, hospital management system (HMS) access logs, and communications (email, messaging) between healthcare workers.

The scientific basis of cyber forensics rests on two foundational concepts:

1. Metadata — the 'data about the data':
Every digital file contains metadata — information recorded automatically by the creating system about the file's properties. For a document or EMR entry, this includes: creation date and time (with timestamp precision to the second or millisecond), last-modified date and time, the user account under which the entry was made, the computer's IP address, and sometimes the geographic location of the creating device. Critically, metadata is not easily falsified without specialised tools, and forensic examination can often detect metadata manipulation because the file's internal metadata and the filesystem's metadata may not be consistent after tampering. In the medical negligence scenario from the hook, metadata examination might reveal that an EMR entry dated on the day of the adverse event was actually last modified two days later — consistent with backdating.

2. Hash verification — the digital fingerprint:
A cryptographic hash function (such as MD5, SHA-1, or SHA-256) generates a fixed-length string ('hash value' or 'checksum') from an input file. The critical property is that even a single-bit change in the file produces a completely different hash value — this is called the avalanche effect. By computing and recording the hash value of a digital file at the time of lawful acquisition (e.g. when the hospital is ordered to produce records for court), and verifying that the hash remains unchanged when the file is later examined or presented in evidence, forensic examiners can prove — or disprove — that the file has been modified in transit.

Provided image

The legal framework — Information Technology Act 2000 (IT Act) and Section 65B:
The Information Technology Act 2000 (amended significantly in 2008) is India's primary legislation governing electronic records, electronic contracts, digital signatures, and cybercrimes. For the forensic medical context, the most important provisions are:
• Section 43: penalties for unauthorised access to, damage to, or downloading of computer system data — directly applicable to unauthorised access to EMR systems
• Section 66: computer-related offences (criminal forms of Section 43 acts) — applicable to deliberate data theft or destruction of medical records
• Section 66E: violation of privacy by capturing or publishing private images without consent — relevant to unauthorised sharing of patient images or case photographs
• Section 72A: disclosure of information in breach of lawful contract — applicable to healthcare data breaches

However, the most practically significant legal provision for medical record admissibility is Section 65B of the Indian Evidence Act, 1872 (not the IT Act itself, but cross-referenced through IT Act provisions). Section 65B governs the admissibility of computer-generated electronic records in court. A printout or other output from a computer (including an EMR) is admissible as evidence only if:
1. The computer was used regularly to store or process information of the kind in the printout
2. The computer was functioning properly at the relevant time
3. The information was supplied in the ordinary course of activities
4. A Section 65B certificate is provided — a formal declaration from the person responsible for the computer confirming the above conditions and attesting to the authenticity of the output

Without a valid Section 65B certificate, a printout of an EMR is not admissible as primary electronic evidence — it may only be admitted as secondary evidence with additional corroboration. The Supreme Court reaffirmed this requirement in Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020), holding that the Section 65B certificate is mandatory, not optional, for electronic evidence admissibility.

Examining and Documenting Digital Evidence

The forensic examination of digital medical evidence follows a process analogous to physical evidence collection: identification → acquisition → preservation → analysis → reporting. Each stage has specific technical and legal requirements that must be met for the evidence to remain admissible.

Provided image

Identification of relevant digital evidence requires the forensic examiner to determine which digital assets are relevant to the investigation. In a medical context, this may include: the EMR system's entry log for a specific patient, the access log showing which user accounts viewed or modified the record, the imaging system (PACS — Picture Archiving and Communication System) for radiology files, the pharmacy system's dispensing records, and email communications between clinical staff about the case.

Acquisition and preservation — bit-stream imaging:
The gold standard for digital evidence preservation is the creation of a bit-stream forensic image — an exact, bit-for-bit copy of the original storage medium (hard drive, server partition, or database dump). This is distinct from a file copy, which does not preserve deleted files, unallocated space, or metadata associated with the filesystem. The forensic image is taken using specialised write-blocker hardware that prevents any data from being written to the original medium during copying, thereby preserving its original state. Hash values are computed for the original medium and the forensic image immediately after imaging; if the hashes match, the image is verified as an exact copy.

Chain of custody for digital exhibits follows the same documentation principle as physical evidence — a continuous signed record of who had possession of the storage medium or forensic image, when, and in what condition. Unlike physical exhibits, digital evidence can be transmitted electronically, and the chain of custody must account for every transmission, storage, and access event. The hash value serves as the electronic equivalent of the wax seal — if the hash of the file on receipt matches the hash at acquisition, the file has not been altered in transit.

Common indicators of EMR tampering that a forensic examination may reveal:
• Timestamp inconsistency: The claimed entry date in the medical record is earlier than the software installation date or earlier than the patient's first registration in the system.
• Metadata-record mismatch: The file's modification timestamp shows a later date than the date stated in the entry — consistent with post-event modification.
• Audit log deletion: Hospital EMR systems maintain automatic audit logs of every access and modification. A record that shows no audit trail for a claimed modification period is suspicious.
• Formatting anachronism: The record uses formatting conventions or software version features that did not exist at the claimed date of creation.
• Authorship attribution error: The logged user account making a specific entry is shown by audit logs to have been simultaneously active on a different ward or in a different session.

The findings from digital forensic examination are documented in a formal digital forensic report, which must meet the same professional standards as any medicolegal report: structured format, factual findings clearly separated from opinion, and an opinion section with probability language and stated limitations.

Privacy of Medical Documents — Legal Framework, Obligations & Violations

The privacy of medical records is governed in India by an intersecting framework of statutes, judicial pronouncements, and professional regulations. No single comprehensive medical privacy statute equivalent to the US HIPAA exists, but the combined effect of the Information Technology Act 2000 (IT Act, amended 2008), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, the common law doctrine of medical confidentiality, and theConsumer Protection Act 2019 creates substantial legal protection for electronic health information.

Decision Flowchart for Disclosure of Patient Medical Records

Ownership, custody, and access:
In Indian law, medical records are generally held to be the property of the institution that creates them (hospital or clinic), but the patient has a fundamental right to access and obtain copies of their own records. This right was affirmed by the Supreme Court in multiple rulings and is enshrined in the Medical Records Rules under the Clinical Establishments Act. A hospital cannot refuse to provide a patient (or, after death, their legal heirs) copies of their medical records without a lawful justification. Unjustified refusal may constitute:
• Deficiency of service under the Consumer Protection Act 2019 (note: the 1986 Act was repealed; always cite the 2019 Act)
• Obstruction of justice if records are suppressed in contemplation of legal proceedings
• Potential contempt of court if records are withheld after a court order for production

Retention requirements:
Medical records must be retained for a defined minimum period. Under CGHS (Central Government Health Scheme) guidelines, outpatient records must be retained for 3 years; inpatient records for 3-5 years. The Medical Council of India (now superseded by NMC under the NMC Act 2020) had advised 3 years as a minimum, but hospitals handling complex or high-risk cases routinely retain records for longer periods. Electronic records have no physical storage constraint, so retention periods are typically set by institutional policy in compliance with the minimum legal requirements.

Permitted disclosure (lawful exceptions to confidentiality):
The general obligation of medical confidentiality yields to disclosure in the following circumstances:
• Court order or summons — production of records in compliance with a court order is mandatory; refusal constitutes contempt.
• Police requisition under BNSS — a registered medical practitioner must produce records relevant to a criminal investigation under lawful requisition. However, a mere verbal request is insufficient; a formal written requisition from a competent officer is required.
• Notifiable disease reporting — certain communicable diseases require statutory notification to public health authorities.
• Public safety — a serious and specific threat to an identifiable third party may justify disclosure to prevent imminent harm (this is a narrow common law exception; not a broad licence for disclosure).
• Patient's own consent — explicit informed consent from the patient for disclosure to specified parties.

Prohibited disclosures and their consequences:
Unauthorised disclosure of a patient's medical records — whether by sharing with family members without consent, providing information to employers, or posting clinical images on social media — may constitute:
• Breach of contract (doctor-patient confidentiality as an implied contractual term)
• Violation of Section 72A of the IT Act 2000 (disclosure of information in breach of lawful contract)
• Violation of Section 66E (capturing or publishing private images without consent) if clinical images are involved
• Professional misconduct under the NMC Act 2020, potentially leading to suspension or erasure from the medical register
• Deficiency of service under the Consumer Protection Act 2019

Disclosure Scenario	Permitted?	Legal Basis	Consequence of Improper Action
Court order/summons	Mandatory	CrPC/BNSS; Indian Evidence Act	Contempt of court if refused
Police written requisition	Permitted (with formal requisition)	BNSS Section 176	Obstruction of justice if withheld
Patient's own request	Mandatory	Consumer Protection Act 2019; right to access	Deficiency of service if refused
Employer's request (without patient consent)	Prohibited	IT Act 2000, NMC Act 2020	Professional misconduct
Social media sharing of patient images	Prohibited	IT Act 2000 Section 66E	Criminal liability + professional sanction
Research (without ethical approval and consent)	Prohibited	NMC ethics guidelines; ICMR guidelines	Institutional and professional sanction