The scan is clear, signed, and attached to the wrong Maria Hernandez.
That one synthetic error is a better healthcare document management system demo than 20 minutes of drag-and-drop. The buyer needs to see how the software detects uncertainty, holds the document, lets a qualified person correct the link, preserves the original action, and prevents the wrong file from reaching a patient-access response.
Document capture is easy. Record ownership is not.
Draw the boundary before scanning anything
A healthcare document management system, or DMS, can manage files that do not fit neatly inside an EHR. It may receive paper scans, external clinical documents, faxes, consent forms, contracts, invoices, policies, correspondence, and workforce records. Those files do not all belong to the same record or retention rule.
Start with six columns:
| Document class | Business purpose | System of record | Patient-linked? | Release path | Retention authority |
|---|---|---|---|---|---|
| outside clinical record | continuity of care | approved clinical record system | yes | designated-record-set review | clinical and legal policy |
| patient authorization | disclosure decision | release-of-information record | yes | included when applicable | privacy and legal policy |
| vendor contract | commercial and compliance proof | contract repository | usually no | business-record request | contract and legal policy |
| current policy | staff instruction | policy-management repository | no | controlled distribution | governance policy |
| invoice | payment and accounting | finance system | sometimes | defined accounting route | finance and legal policy |
The table forces a decision that software cannot make for you. A scan is not automatically part of the legal medical record, and keeping it outside the EHR does not automatically exclude it from a HIPAA designated record set.
The HHS explanation of the right of access describes designated record sets broadly. They can include medical, billing, payment, claims, case-management, and other records used to make decisions about individuals. Storage location and file type do not decide the question.
Test intake with messy documents
Create a trial packet without real patient data:
- two patients with the same last name and similar dates of birth;
- one patient with a former name;
- a referral that contains only a partial identifier;
- a double-sided form with a blank back page;
- a fax retransmission of a document already received;
- one file deliberately assigned to the wrong chart.
Watch the exception route. Does the system guess, reject, or hold? Can staff see why the match is uncertain? Does a correction preserve who changed the relationship, when, and why? Can the system prevent duplicate documents from appearing as two separate clinical facts?
Optical character recognition may help staff search a file. It should not quietly turn uncertain text into verified clinical data. Keep the original image, extracted text, confidence information where available, and human decision separate.
Follow identity into retrieval
Indexing fields look harmless until the practice has 800,000 pages. Ask which values are authoritative, which may be edited, and how an edit changes search results.
Use the ASTP/ONC SAFER Guides as a safety lens. The Patient Identification guide treats correct association between information and the person as planned safety work, not a cosmetic data-cleaning step. The System Management and Contingency Planning guides add two more questions: how interfaces and configuration are validated, and what happens when the main record system is unavailable.
Run a timed retrieval test:
DOCUMENT RETRIEVAL TEST
Request: all records in the approved scope for synthetic patient PS-1042
Identity resolution used: ______________________________
Repositories searched: _________________________________
Duplicates detected: ___________________________________
Held or disputed items: ________________________________
Version selected and why: ______________________________
Reviewer: __________________ completed: _______________The result should show what was searched and what remained unresolved. “No documents found” is unsafe when it really means one interface was down.
Preserve corrections without rewriting history
A user will eventually index a file incorrectly, scan only odd pages, or attach a newer version without noticing the old one. The correction workflow needs more than an edit button.
Test four actions separately:
- correct metadata while preserving the earlier value;
- move a document linked to the wrong synthetic patient;
- supersede a document without deleting it;
- mark a file for restricted review without making it disappear from authorised oversight.
Capture reason, actor, time, approval where required, and the effect on downstream copies. If the DMS sent the file to an EHR, portal, or billing system, changing the source alone may leave the wrong copy in use.
Rehearse an access request
Do not wait for a real request to discover that the DMS cannot search its own archive. Use a synthetic request with a defined scope and date range.
The workflow should identify repositories, find responsive documents, preserve approved exclusions and reviews, produce the selected form and format, and record delivery. A broad patient-access right does not mean every internal business record is released, and it does not permit staff to ignore responsive PHI because it sits in an invoice system or scanned correspondence folder.
Keep the release decision with the privacy and health-information-management team. The DMS can assemble candidates. It should not make legal judgments from a folder name.
Apply holds and disposition by class
A delete date is not a retention programme. The system needs a documented rule source, record class, event that starts the period, jurisdiction or contract context, approved exceptions, legal or investigation holds, and proof of disposition.
Test a hold against one synthetic patient and one business record. Confirm that routine disposition stops, authorised users can find the hold, and removal requires the approved role. Then export the hold history.
The HHS Security Rule summary explains that regulated entities need administrative, physical, and technical safeguards for electronic PHI. A DMS security review should therefore include access authorisation, activity review, integrity controls, contingency access, and vendor responsibilities for the proposed data.
Make the demo end with departure
Ask for 50 synthetic documents with original files, metadata, relationships, version history, holds, disposition status, and audit events. Export them. Give the package to a reviewer who did not configure the trial.
The reviewer should answer:
- Which file is current?
- Which patient or business record owns it?
- What changed?
- Who viewed or moved it?
- Is it on hold?
- Can it be released or destroyed under the approved policy?
If those answers exist only inside the vendor interface, the practice has rented its memory.
Patient Square does not claim that its clinical documentation products replace a healthcare DMS. Use this boundary test to decide where generated drafts, signed notes, imported documents, policies, contracts, and audit evidence belong before connecting systems.