VA Medical Records: How to Request the Audit Trail and Full Operative Record a General Request Misses

Last Updated: September 22, 2026

Most veterans requesting their VA medical records get a stack of clinic notes and discharge summaries back — and assume that is everything. It usually is not. A general request typically returns the visible chart, not the system-level records that show whether a test result was actually reviewed, when a note was edited after the fact, or what a surgical team did in the operating room. Getting those records requires asking for them specifically, using the correct form, and knowing what to call them.

Why Does a General VA Records Request Often Come Back Incomplete?

Because a general request usually pulls the clinical chart — notes, orders, results, discharge summaries — and stops there. It does not automatically include the electronic audit trail showing who accessed or edited your record and when, or the full operative record beyond the surgeon's own operative report. Federal regulation requires both categories of documentation to exist; it does not require a facility to volunteer them without a specific request.

What Is an EHR Audit Trail, and Why Does It Matter?

An audit trail is the electronic log of who opened, edited, or printed a record, and when. It exists because federal law requires it to: under 45 C.F.R. § 164.312(b), a covered entity's information systems handling electronic protected health information must "implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information." VA facilities, as HIPAA-covered entities, are required to maintain this — which means the audit trail exists whether or not it was included in your initial records production.

Our guide to getting VA medical records covers this in overview as one red flag to watch for; this post covers how to request it specifically. The audit trail matters because it can show things a clinical note alone will not — whether an abnormal test result was ever opened by the ordering provider, whether a note was edited after a related adverse event, and the actual sequence in which entries were made rather than the sequence they were dated.

Which VA Form Should You Actually Use?

It depends on who is asking. If you are requesting your own records for your own use, VA Form 10-5345a ("Individuals' Request for a Copy of Their Own Health Information") is the correct form, submitted to your facility's Release of Information office. VA Form 10-5345 ("Request for and Authorization to Release Health Information") is a different form — it authorizes the VA to disclose your health information to a third party, such as your attorney, and is the form an FTCA attorney typically uses once you have signed an authorization.

Your underlying right to your own VA records comes from two overlapping sources: the Privacy Act, implemented at the VA through 38 C.F.R. § 1.577 ("any individual upon request may gain access to his or her record or to any information pertaining to him or her which is contained in any system of records maintained by the Department of Veterans Affairs"), and HIPAA's separate right of access at 45 C.F.R. § 164.524. Either basis supports a specific, itemized request — you are not limited to whatever fields a general intake form happens to check.

What Does the "Full Operative Record" Actually Include?

If your case involves a surgical error, the operative report is only the starting point. Federal regulation requires hospitals participating in Medicare and Medicaid — which includes VA facilities — to produce a written or dictated operative report "describing techniques, findings, and tissues removed or altered," signed by the surgeon, under 42 C.F.R. § 482.51. That report is a summary, written after the fact. If intraoperative monitoring, an instrument or sponge count, or anesthesia monitoring was performed during your procedure, those underlying records are generated separately and are worth requesting by name — ask your facility's Release of Information office to confirm what perioperative documentation exists for your specific procedure and request each item individually, rather than assuming the operative report alone covers it.

How Long Does the VA Have to Respond?

Under HIPAA's right-of-access rule, 45 C.F.R. § 164.524 requires a covered entity to act on a request "no later than 30 days after receipt," with one permitted extension of up to 30 additional days if the facility provides written notice within the original window explaining the delay. The VA's own published guidance tracks this closely in practice: electronic records are generally produced within 30 calendar days, paper records (typically pre-1998) within 60 calendar days, and the VA advises contacting the medical records office if you have not heard anything after 20 calendar days.

If your facility does not respond, or responds incompletely, a Freedom of Information Act request is a documented fallback. 5 U.S.C. § 552(a)(3)(A) entitles any person to agency records that "reasonably describe" what is being requested, and § 552(a)(6)(A)(i) requires the agency to determine whether to comply within 20 business days. A FOIA request creates a separate paper trail and a separate statutory deadline if your Privacy Act/HIPAA request stalls.

What If a Record You Requested Is Withheld as Privileged?

Not every VA document generated after an adverse event is a treatment record you are entitled to on request. A Root Cause Analysis conducted under the VA's patient-safety program is generally confidential and privileged under 38 U.S.C. § 5705, with narrow statutory exceptions that do not include ordinary civil discovery. Our guide to the § 5705 quality-assurance privilege covers what that privilege protects, what it does not, and how an attorney can still reach the underlying facts through other records. If a request comes back with an RCA or similar document withheld, that guide — not this one — explains the legal mechanics of the withholding.

How to Request the Records a General Request Misses

1. Identify who is asking. If you are requesting your own records for your own use, use VA Form 10-5345a. If you want your attorney to receive them directly, VA Form 10-5345 authorizes that disclosure.
2. Name the specific items, not just a date range. Ask by name for the EHR audit/access log for your chart, and — if applicable — the full perioperative record (anesthesia record, any intraoperative monitoring, instrument/sponge count documentation) for the specific procedure and date, not just the operative report.
3. Submit to the facility's Release of Information office and keep a dated copy of exactly what you requested — it is your evidence of what was and was not produced.
4. Track the clock. Expect a response within 30 days for electronic records (up to 60 for older paper records); follow up after 20 days if you have heard nothing.
5. If the facility does not produce what you specifically requested, file a FOIA request under 5 U.S.C. § 552 as a documented follow-up — it carries its own 20-business-day determination deadline.
6. Do not let a slow records request delay your SF-95. The two-year deadline runs regardless; present your claim and supplement it with records as they arrive.

Frequently Asked Questions

What's the difference between VA Form 10-5345 and VA Form 10-5345a? Form 10-5345a is for requesting your own records for your own use. Form 10-5345 authorizes the VA to disclose your health information to a third party, such as an attorney, once you have signed it.

Can I really request the EHR audit trail for my own chart? Yes. It is a system record about your own information, and VA information systems are required under 45 C.F.R. § 164.312(b) to maintain audit controls. Request it by name — "the EHR access/audit log for my chart" — rather than assuming a general records request includes it.

How long does the VA have to respond to a medical records request? Under HIPAA, up to 30 days, with one possible 30-day extension if the facility notifies you in writing. In practice, VA guidance points to roughly 30 days for electronic records and 60 for older paper records, with a suggestion to follow up after 20 days of silence.

Does requesting my records pause my FTCA deadline? No. The two-year presentment deadline under 28 U.S.C. § 2401(b) keeps running while a records request is pending. If your deadline is approaching, present your SF-95 and continue gathering records afterward rather than waiting.

What if I request the audit trail or operative record and the facility says it doesn't have it or won't produce it? Document exactly what you asked for and what you received. A Freedom of Information Act request under 5 U.S.C. § 552 is a documented next step, and an attorney can evaluate whether what remains missing suggests a discovery or litigation issue rather than a simple processing gap.

Related Articles

• How to Get VA Medical Records for a Malpractice Case → — the five general methods for requesting your VA records
• Can You Get the VA's Root Cause Analysis After a Surgical Error? → — what's privileged under 38 U.S.C. § 5705, and what isn't
• Standard Form 95 (SF-95): How to File an FTCA Claim → — presenting your claim while records are still being gathered
• FTCA Statute of Limitations → — the two-year deadline that keeps running during a records request
• Veterans Medical Malpractice & the FTCA → — our national FTCA practice overview

The information provided on this website does not, and is not intended to, constitute legal advice. All information, content, and materials available on this site are for general informational purposes only. Readers should contact their attorney to obtain advice concerning any legal matter.

The author, EJ Archuleta, J.D., is a 13-year federal practice lawyer. He is licensed to practice law in the courts of the State of Texas, is a member of the State Bar of Texas, and is admitted to the United States District Court for the Western District of Texas. He has helped hundreds of military service members, veterans, and their families receive compensation for injuries and wrongful death caused by the Department of Veterans Affairs.