When the chat becomes the chart: radiologists should pause a beat and think before an Epic Secure Chat

In October 2024, Catholic Health in Buffalo, New York did something that should get the attention of every radiologist in the country. The health system's Chief Physician Executive and Chief Nursing Officer issued a joint memorandum to all medical staff and Epic users, warning them about the legal risks of Epic Secure Chat. The memo's most critical line was buried under routine guidance about availability settings and message etiquette: "These messages are subject to discovery in legal proceedings." That single sentence, issued not by a plaintiffs' lawyer but by the physicians' own health system, should be the canary in the coal mine for every doctor who has ever dashed off a casual comment on Secure Chat without a second thought.

For those unfamiliar, Epic Secure Chat is a HIPAA-compliant messaging tool built directly into Epic's electronic health record (EHR) system. It helps care teams coordinate non-urgent patient care without relying on traditional pagers. Think of it as a text messaging platform that lives inside the EHR. It supports group messages, push notifications, and read receipts. And because it is integrated with the patient chart, conversations can be linked to specific patients, which is exactly where the legal exposure begins. Sometimes these comments are unguarded and not at all appropriate.

The Catholic Health memo made clear that while Secure Chat messages are not formally part of the medical record, they are discoverable in litigation. This distinction matters enormously. Physicians may feel they are having a private sidebar with a colleague, but in the eyes of the law, those messages can be subpoenaed, printed, and read aloud in a courtroom.

The Hallway Consult That No Longer Disappears

The danger is not hypothetical. As Curi Insurance, a physician-founded malpractice insurer, explained in a September 2026 analysis: "A curbside consult used to happen in a hallway and disappear the moment both doctors walked away. Today, it happens over text, and it doesn't disappear. It sits on a phone, syncs to a cloud backup, and waits to be discovered."

Psychologists have a name for what happens when clinicians move their conversations to digital platforms: the "online disinhibition effect." People behave differently behind a screen than they do face to face. Comments that a physician would never put in a formal radiology report flow freely in what feels like a private chat window. Dismissive asides about a patient's complaints, gallows humor about a clinical outcome, offhand criticisms of a colleague's judgment: these are the kinds of remarks that malpractice insurers are increasingly warning about, because they are now preserved in discoverable digital form.

The problems multiply from there. If a Secure Chat message says "I'm worried about a PE" but the radiologist's report never mentions pulmonary embolism, a plaintiff's attorney will argue the condition was recognized and ignored. If a radiologist flags a concerning finding via Secure Chat at 2:00 p.m. but the formal report is not finalized until 5:30 p.m., that three-and-a-half-hour gap becomes the centerpiece of a delay-in-diagnosis claim. And if the post-event chat thread captures second-guessing or frustration, it will be reframed as consciousness of guilt. Inconsistencies between the chat record and the formal chart undermine credibility. Informal language sounds dismissive or careless when read aloud in a courtroom, stripped of context and tone, years after the fact.

What Physicians Should Do Now

For radiologists and other specialists who use Epic Secure Chat daily, the risk mitigation guidance from malpractice insurers is consistent and urgent.

First, assume every message will be read aloud in a courtroom. Before you send a Secure Chat message, ask yourself how it would sound to a jury, stripped of context and tone, three years from now. Second, do not create a second chart. If a Secure Chat exchange changes clinical thinking, confirms a plan, or documents a handoff, that information belongs in the formal medical record immediately. Third, avoid venting, sarcasm, and gallows humor. The patient whose complaints you dismiss as "dramatic" today may be the plaintiff whose attorney reads that message to a jury tomorrow. Fourth, remember that deleted messages are recoverable. Text messages are stored in multiple locations, including cloud backups and system metadata. Deleting them from your device does not make them disappear from the world.

The convenience of Epic Secure Chat is real, and no one is suggesting physicians return to the era of pagers and unanswered phone calls. But the Catholic Health memo was not issued as a theoretical exercise. It was issued because the legal risk is real, it is growing, and most physicians have not yet internalized it. The hallway consult has moved online, and it has become part of the permanent record.