A board investigation can turn a busy practice upside down fast. One day it is a letter, subpoena, or record request. The next day it is a scramble through the EHR, billing systems, email, text messages, and shared drives trying to figure out what exists, where it lives, and how it fits together.
That scramble is often where small documentation issues become bigger professional-license problems.
In general terms, licensing boards have broad authority to investigate complaints and compel production of records, and inadequate recordkeeping can become part of the underlying case rather than just a side issue. The Federation of State Medical Boards notes that boards investigate complaints, can issue discipline, and commonly treat inadequate recordkeeping as unprofessional conduct in some jurisdictions (FSMB overview, FSMB board structure guidelines).
In this post you’ll learn how to organize four categories that often matter most in a license case: patient files, audit trails, financial records, and internal communications. The goal is not to “clean up” a file after the fact. It is to create a defensible, accurate production set that shows what happened, when it happened, and who touched what. If you are earlier in the process and want a broader overview of requests and privilege issues, it may help to start with our guide on what happens when records are demanded in a license case.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
Boards generally do not review records the way a treating clinician reviews records. They review them like investigators. They look for chronology, completeness, consistency, missing metadata, altered entries, unexplained gaps, and whether the documents match the billing trail and internal communications.
That matters because healthcare records often sit across multiple systems. HHS guidance explains that a provider’s designated record set can include medical records and billing records used to make decisions about individuals, and OCR guidance also emphasizes role-based access and reasonable limits on who can see entire records (HHS guide, HHS Privacy Rule guidance). At the same time, OCR’s current audit program is focused on security controls relevant to hacking and ransomware, which keeps attention on access controls, audit mechanisms, and operational documentation (OCR HIPAA Audit Program, OCR January 2026 cybersecurity newsletter).
When an office responds with a stack of PDFs but no structure, no index, and no explanation of source systems, that can invite more questions than it answers.
Before sorting anything, many attorneys begin with a preservation plan. The reason is simple: once a board inquiry is reasonably anticipated, routine deletion can become dangerous. General records-management guidance from HHS states that no disposition should occur when an investigation, audit, or other matter is pending and requires the records to be held longer as evidence (HHS records policy). Discovery guidance from the American Bar Association also highlights that potentially relevant electronically stored information can include email, messaging platforms, cloud files, spreadsheets, accounting data, calendars, and database records (ABA on spoliation and ESI).
A practical preservation list may include: