A doctor writes a note, notices an error, and edits it. In most software that is an UPDATE. The old text is gone.
Six months later there is a question about a decision made that day. What matters is not what the note says now — it is what it said then, because that is what the clinician was looking at.
Amendments, not edits
Every note version is a row. The current version is the newest; nothing is ever overwritten.
note_versions
note_id
version
body
authored_by
authored_at
supersedes -- previous version
amendment_reason -- required when version > 1The UI shows the current version with an indicator that it has been amended, and the history is one click away. That is how paper worked — you struck through and initialled, and the original stayed legible. Software regressed on this without meaning to.
Deletion is a status, never a delete
Records created against the wrong patient happen weekly in any busy clinic. The fix is not DELETE. It is marking the entry retracted, recording who retracted it and why, and excluding it from clinical views while keeping it in the audit view.
A row that vanishes leaves the receiving system, the billing extract, and the printed summary all disagreeing with the database, and nothing to explain why.
Time is two columns, not one
Every clinical fact has a time it happened and a time it was recorded. A symptom that began Tuesday, documented Thursday, has two dates and conflating them makes both the timeline and the audit wrong.
occurred_at -- clinical reality
recorded_at -- when the system learned itRetrospective documentation is normal. It only looks like backdating if you have one column and someone has to choose which truth to store.
What it costs
More rows and slightly more complex reads — usually one extra condition to select the latest version. In exchange, “what did we know and when” is answerable without a backup restore, which is the question every clinical incident review opens with.