Kim Johnson was nervous as she sat down at her dining room table in January 2015, clutching an unopened letter from the radiology department at Fleming County Hospital in Flemingsburg, Kentucky.
Breast cancer had killed Johnson’s mother years earlier, a painfully slow death that took a toll on her entire family. The prospect of that happening to her was all Johnson had been able to think about since she’d discovered a tender lump in her right breast weeks before, prompting her doctor to send her for a mammogram.
If she got sick, who would keep up with feeding the horses and chickens at the 101-acre family farm that she and her husband ran in northeastern Kentucky? Who would care for the three young children they’d recently adopted after raising five kids of their own?
Johnson, 53 at the time, says she ripped open the envelope, unfolded the letter and began to read. She says her eyes fixated on four words in the first sentence: “no evidence of cancer.”
“Oh my gosh,” Johnson remembers thinking. “I dodged a bullet.”
Her husband, Delbert, choked up when she called him with the news. That night, they loaded the kids into the car and headed to Tumbleweed Tex Mex Grill to celebrate.
Only, as medical experts who reviewed her records later told her, there’d been a terrible mistake.
As Johnson dined with her family, a cancerous tumor was silently growing inside of her. The warning signs were there in the initial X-rays of her breast — enough to warrant additional tests at the very least, according to doctors who later reviewed the images. But someone at the hospital had sent the wrong letter, Johnson’s lawyers allege, giving Johnson the all-clear instead of directing her to return for a follow-up exam.
By the time Johnson discovered the discrepancy 10 months later — thanks only to her own insistence on seeking a second opinion after the pain in her breast worsened — her new doctors feared it might be too late to save her.
Johnson didn’t know it then, but this was the start of a yearslong battle not only with a deadly disease, but with a health system and medical workers who, Johnson’s lawyers say, went to extraordinary lengths to cover up their error.
Johnson — who describes herself as “not a suing person” — ultimately filed a lawsuit because she wanted to know why her cancer wasn’t caught earlier. It took three years of litigation before Johnson, her lawyers and a digital forensics expert who reviewed her electronic patient records were able to piece together what they believe happened: In the days and weeks after Johnson filed a medical malpractice lawsuit in 2016, two hospital employees opened her electronic records and edited them, deleting evidence of the erroneous letter claiming that she was cancer-free, Johnson’s lawyers say.
The hospital then created fake letters and produced them as part of the court case purporting to have directed Johnson to seek additional tests, Johnson alleges in court filings. When questioned under oath, the doctor who’d been overseeing Johnson’s medical care pointed to the newly generated letters as evidence that Johnson was to blame for her own delay in treatment, court records show.
Andrew Garrett, the forensics expert who reviewed Johnson’s medical records on her behalf, has worked on hundreds of malpractice cases, for both patients and hospitals, to find evidence buried deep in electronic records. He described cases like Johnson’s as having a “smoking gun" hidden in the records.
Do you have a story to share about medical records? Contact us
A spokeswoman for LifePoint Health, the hospital chain that purchased Fleming County Hospital seven months after Johnson’s mammogram in 2015, declined to comment, noting that Johnson’s lawsuit is still pending before the Kentucky Supreme Court.
Lawyers for the hospital chain have dismissed Johnson’s allegations in legal filings and during court hearings as “a conspiracy theory” that cannot be substantiated because the electronic record system the hospital was using for mammograms at the time is now defunct and was prone to glitches. The hospital has acknowledged one discrepancy in Johnson’s medical records but said it was the result of “a clerical error” by an employee who’d gotten Johnson confused with another patient with the same last name.
The hospital hired a separate digital forensics expert to review Johnson’s medical record, as Garrett did, but the hospital didn’t submit findings in court, according to court records.
Johnson’s lawyers said they don’t believe the hospital’s explanations. Neither does her family.
“I tend to put my trust in doctors and professionals, the system even,” Delbert Johnson said. “But they failed Kim and tried to hide it.”
The cover-up alleged in Johnson’s lawsuit highlights a growing threat facing patients in the age of electronic medical records: the potential manipulation of their records by health care providers to hide mistakes and minimize liability.
NBC News talked to more than 20 patient advocates, expert witnesses and malpractice attorneys who described dozens of cases from the last decade that hinged on the discovery of edits made to a patient's record. In some instances, nurses’ notes had been deleted. In others, procedures the patient should have had, but didn’t, were logged after they died, painting a false picture of the care they received. Collectively, the patients in those cases or their surviving families were awarded tens of millions of dollars in damages.
As in Johnson’s case, these edits are often only uncovered through dogged and expensive efforts by medical malpractice lawyers and digital forensic experts to gain access to what is known as the “audit trail” of the patient record, which shows who accessed the record and how they modified it.
It’s impossible to know the full scale of the issue: Health care providers almost always require patients or their families to sign a nondisclosure agreement as a condition of any legal settlement. And hospitals routinely fight to suppress audit trails from being introduced in court, arguing that the records are so complex that it’s too expensive and burdensome for health care providers to release the files.
“The cases are literally doubling in complexity because of these issues,” said Matthew Keris, a Pennsylvania attorney who specializes in defending health care providers in malpractice lawsuits. He argues that audit trails rarely reveal evidence that’s significant to a case. Yet hospitals like the ones he represents often end up spending tens of thousands of dollars to analyze the records once they’re introduced as evidence, needlessly driving up the cost of litigation and benefitting no one.
But some experts say cases like Johnson’s are more common than people may think.
Garrett, the forensics expert, is one of the few specialists in the United States with expertise in this emerging technical field. He said his firm has worked on approximately 500 medical malpractice cases over seven years and has found significant alterations to the patient’s record that favored the hospital in 85 percent of them.
In about a quarter of those, the revision history reveals what Garrett describes as a “complete cover-up.”
A grim prognosis
Although the January 2015 letter initially alleviated Johnson’s fears about having cancer, it did nothing to stop the pain in her right breast. Her primary care physician, Dr. Amanda Applegate, had told her it was most likely a staph infection and would be cured with antibiotics.
Applegate, who’d ordered Johnson’s mammogram, acknowledged in a 2017 deposition that she never followed up to learn the results, arguing that it was the responsibility of the radiologist who took the scans to share the findings with Johnson. Applegate and her lawyers did not respond to messages seeking comment.
Unaware that her mammogram had indicated a need for additional testing, Johnson spent nine months trying different prescriptions to treat infection, but the lump in her breast kept growing. Finally, in September 2015, Applegate wrote her a referral for another opinion.
On an overcast fall day, Johnson drove more than 80 miles to St. Elizabeth Fort Thomas Hospital in northern Kentucky, near Cincinnati. After examining Johnson’s breast, Dr. Heidi Murley ordered an emergency biopsy. Within days, Johnson returned to the hospital to receive the diagnosis she’d been dreading: The doctor told her that she had stage 4 cancer and that it had spread from her breast to her lymph nodes and bones.
The news came with a grim prognosis. An oncologist advised her to get her affairs in order. Based on how far the cancer had already spread, she might have just six months to live — maybe a year.
Murley, who’d reviewed Johnson’s earlier scans from Fleming County Hospital, asked why she hadn’t gotten the biopsy sooner, Johnson recalled. Medical experts who reviewed the case on Johnson’s behalf as part of her lawsuit later said that based on the initial scans, Johnson should have had a biopsy within 30 days of the first mammogram nearly a year earlier.
One of those medical experts, radiologist Dr. Linda Griska, said Johnson’s initial mammogram results were “highly suspicious of malignancy” and warranted a biopsy, according to an expert report filed as part of Johnson’s lawsuit.
Johnson was confused. No one ever told her she needed to return for additional tests.
She was shaking and disoriented as she drove away from St. Elizabeth Hospital. Unable to remember which way to go on the highway, she pulled to the side of the road and sobbed.
She began to wonder: Was this all her fault?
“Did I miss a letter? Or misread a letter?” she said.
After arriving home, Johnson went straight to the plastic bin in the closet where she keeps all her medical paperwork. After several minutes of frantic digging, she held the January 2015 letter in her hands. It could not have been more clear: “No evidence of cancer.”
“I was mad. Why did they send me this letter?”
'Somebody's got to stand up'
Johnson might never have learned what her medical records contained if it wasn’t for a nurse at Dr. Murley’s office. At a follow-up appointment, after it became clear that the delay in Johnson’s diagnosis might cost her her life, she said the nurse pulled her aside and offered some advice.
“She told me that Dr. Murley has never done this in her career, but that you need to seek legal help,” Johnson said. “When she said that I was like, ‘Gosh, this must be serious.’”
A lawyer representing Murley declined to comment and St. Elizabeth, the hospital she works for, said it’s the hospital’s policy not to comment on ongoing litigation.
“I had a lot of back and forth in my mind about whether I should do this or give them a pass,” Johnson said of filing the lawsuit. “I’m a Christian woman and this is just not something we do. But I feel like somebody’s got to stand up for people.”
In September 2016, Johnson sued the hospital that sent her the cancer-free letter and other medical workers involved in her care. Fleming County Hospital responded with a legal filing claiming that it had actually sent Johnson two other letters telling her the results of her mammogram were indeterminate and that she needed to come back for a follow-up screening within four months.
Johnson was baffled. She insisted she’d never seen the letters. Despite the disagreement, Johnson and Fleming County Hospital reached a $1.25 million settlement in April 2018 — enough to at least defray the significant cost of her ongoing cancer treatments. The hospital’s new owner, LifePoint Health, was not part of the settlement. Johnson’s case continued against Fleming County Hospital, now owned by the for-profit hospital chain, and other medical providers.
Johnson and her attorneys, Dale Golden and Laraclay Parker, said they would never have settled for that amount had they known what they would discover a year later: that the two follow-up letters appeared to have been created only after Johnson filed her lawsuit. That was the conclusion of Andrew Garrett, the digital forensics expert hired by Golden and Parker as part of the ongoing lawsuit against Fleming County Hospital.
Garrett, who was paid tens of thousands of dollars for his work on the case, trawled back-ups of the hospital’s electronic medical record system during a court-ordered site visit to check Johnson’s record at five points in time before and after the lawsuit was filed, as well as the audit trail of who accessed and altered the record.
His forensic report pieced together a timeline of events that showed how two hospital employees edited Johnson’s mammogram record three times within six weeks of her filing the 2016 lawsuit. These changes not only deleted records that supported Johnson’s claims of medical negligence, Garrett wrote, but also allowed the hospital to generate the fake letters that formed the basis of their defense.
Garrett’s report, which was filed as part of Johnson’s lawsuit, states that after Johnson’s mammogram in 2015, a radiology technician named Barb Hafer left a comment in the medical record stating that Johnson needed to return for a biopsy. However, according to Garrett’s report, the code she entered in the dropdown menu that dictates which notification letter is automatically generated and mailed to the patient was “NEG,” standing for “negative.” This explains why Johnson received the cancer-free letter.
For nearly two years, according to Garrett’s report, those notations remained in Johnson’s medical record. But that changed after she filed her lawsuit in late 2016.
A week after the suit was filed, according to Garrett’s report, a person who signed in under Hafer’s name accessed Johnson’s 2015 records and changed the mammogram code from “NEG” to “ABN,” standing for “abnormal.” A month later, that code was altered again, this time under the name of another radiology technician, Kristal Humphries, to retroactively direct Johnson to get a four-month follow-up. A third change by someone using Hafer’s login deleted her initial comment calling for a biopsy and replaced it with a comment to match the edits made under Humphries’ name, recommending a four-month follow-up.
“The changes to Johnson’s medical record were designed to hide the wrongdoing of Johnson’s medical providers and shift the blame to Johnson,” said Parker, Johnson’s attorney.
For more of NBC News' in-depth reporting, download the NBC News app
Lawyers for the hospital and other defendants, including Hafer and Humphries, have argued in court that the electronic medical record system in use at the time was “error prone and glitchy” and that the initial note calling for a biopsy in Johnson’s record was the result of Hafer getting her confused with another patient with the same last name. Although the hospital has not submitted its own expert report disputing Garrett’s findings, it has argued in legal filings that the audit trail cannot be relied on to prove his conclusions.
During a deposition last November, Hafer acknowledged that the audit trail appeared to show her making changes in Johnson’s record, but she denied doing so. Hafer also said she had no memory of getting Johnson mixed up with another patient and did not know how hospital lawyers came up with that theory. Humphries has not been questioned under oath since Garrett wrote his report showing edits made under her name. Neither Hafer nor Humphries responded to messages sent to them or their lawyers requesting interviews.
Perhaps the most unusual aspect of Johnson’s case, according to some experts, is that her lawyers were able to discover the alleged changes. Lawyers representing both hospitals and patients say it’s gotten easier to cover up medical mistakes since the advent of electronic recordkeeping systems. Previously, handwriting experts could often detect when medical staff made substantive changes in written notes.
Keris, the lawyer who specializes in defending hospitals in malpractice cases, said the back-end data stored in electronic medical record systems is remarkably complex, making any case involving an audit trail far more difficult and expensive for both plaintiffs and defendants.
“They're horrible for malpractice cases,” Keris said of electronic medical record systems. “It's very difficult to put together a chronology or timeline of events as to what occurred.”
In Johnson’s case, getting a hold of the complete audit trail of her records was an uphill struggle that required a court order as well as intricate knowledge of the hospital’s software and data storage systems — knowledge that many medical malpractice attorneys don’t have. And hospital lawyers have repeatedly disputed whether it's even possible to track changes made to Johnson's medical record — a claim that Garrett dismisses as “patently false”
“Every defendant fights to the death to keep you out of the system,” Garrett said. “They say it’s a fishing expedition, that it’s overly burdensome, that it’s intellectual property, that the data doesn’t exist.”
“What I have seen over the last decade in medical malpractice cases is staggering.”
An ongoing battle
Days after her cancer diagnosis, Johnson received the first of more than 50 rounds of chemotherapy through a port surgically implanted into a vein in her chest. She had her first of more than 40 radiation treatments soon after.
The cocktail of drugs turned her skin gray and her toenails and fingernails black. Teeth and clumps of dark brown hair started falling out.
“I was just a zombie,” she said.
One day in the spring of 2016, she asked Delbert to shave the tufts of hair that remained on her head.
“It was one of the hardest things I’ve ever done,” Delbert said.
They both went into the bathroom while their son Sam, who lived at home at the time, sat outside. He listened to his mother sob over the buzz of the clippers.
“She walked out, wiped a tear and said, ‘What do you guys want for dinner?’” Sam, now 21 and a welder, said over the phone from Arkansas. “She does not let cancer define who she is.”
More than five years after her diagnosis, Johnson is still fighting, both in court and outside of it.
Johnson’s doctors tell her she’s a walking miracle. “They can’t understand how I’m still here,” she said.
After discovering the alleged changes to her medical records in 2019, Johnson’s legal team filed motions to undo her original settlement, force Fleming County Hospital to rejoin the case and to demand further damages for the alleged effort to alter Johnson’s medical records.
The trial judge ruled they couldn’t undo the settlement unless Johnson repaid the money, which she says she needs to cover medical bills. The judge also dismissed Johnson’s conspiracy allegation, noting that there’s no statute under Kentucky law that allows patients to seek civil damages for falsified medical records. An appeals court upheld that decision in November, and now Johnson’s lawyers are appealing to the Kentucky Supreme Court.
Rather than dwell on the legal fight, Johnson, now 59, said she pours what energy she’s got left into taking care of her farm, the three children still in her care, and herself — a busy daily routine for someone who’s been battling cancer for half a decade.
Although the medications she takes sap her energy, Johnson wakes up at 5:30 a.m. to feed the horses, cows and chickens, before waking the kids, ages 6, 11 and 12, to get them ready for school. When she returns home, she starts her daily cancer regimen, informed by hours online reading the latest research and alternative treatments. She drinks 40 ounces of carrot juice, spends two hours in an infrared sauna and walks for 2 miles on a treadmill set up in what she and Delbert call her “she shed.”
“My life is pretty well occupied by cancer and the kids,” she said. “But I’m here to take care of them, so it’s important I do whatever it takes.”
Even though she’s beaten the odds so far, the cancer has continued to spread. Johnson had surgery to remove a new tumor from her neck in January, but doctors couldn’t get it all — it was wrapped around her jugular vein and a bundle of nerves. She worries the cancer doesn’t have far to go to reach her brain.
Johnson thinks often about her mother’s nearly decadelong cancer fight. She fears becoming a burden to the people she loves — a thought that’s all the more upsetting when she considers that all of this might have been preventable.
“What I worry about the most is the kids,” Johnson said. “If they just would have sent me for a biopsy, maybe I would have more time to spend with them.”
CORRECTION (March 17, 2021, 8:46 a.m. ET): A previous version of this article misidentified the defendant in Johnson’s ongoing lawsuit. The lawsuit is against Fleming County Hospital, which is owned by LifePoint Health; it is not against LifePoint Health.