Forensic infrastructure for investigating medical crimes in the digital era

Authors

  • Constantin Pisarenco Free International University of Moldova
  • Serghei Pisarenco Chiril Draganiuc Institute of Pneumology

Keywords:

Audit Logs, Criminal Investigation, Digital Evidence, Electronic Health Records, Forensic Infrastructure, Forensic Readiness, Medical Crimes

Abstract

Healthcare digitalization has reshaped the evidentiary landscape of investigations into harmful medical incidents with potential criminal-law relevance. Electronic health records, medication administration systems, laboratory and radiology platforms, and telemedicine tools record not only clinical information but also metadata, including user actions, timestamps, version histories, and intersystem transactions. Taken together, these layers create a complex digital trace whose evidentiary value depends not only on content, but also on provenance, integrity, completeness, lawfulness of acquisition, and a verifiable chain of custody. This article develops a conceptual and doctrinal-comparative framework for analysing the use of electronic medical data in criminal proceedings. The study does not rely on a structured empirical dataset or statistical testing; instead, it draws on a comparative analysis of seven jurisdictions—France, Germany, the United Kingdom, the United States, Romania, Moldova, and Ukraine—alongside the case law of the European Court of Human Rights, digital forensics standards, and the regulatory framework of digital health. The article proposes a four-level model of forensic infrastructure—digital, procedural, expert, and judicial—and introduces a heuristic functional test of investigative readiness based on independence, sufficiency, timeliness, and reproducibility. It argues that electronic medical data can function as reliable evidence only where institutional mechanisms ensure traceable origin, timely preservation, sufficiently complete extraction, and reproducible expert analysis.

Downloads

Download data is not yet available.

References

AL MAMUN, A.; AZAM, S.; GRITTI, C. “Blockchain-Based Electronic Health Records Management: A Comprehensive Review and Future Research Direction”, IEEE Access, vol. 10, 2022, p. 5768–5789. https://doi.org/10.1109/ACCESS.2022.3141079

BOWMAN S. “Impact of electronic health record systems on information integrity: quality and safety implications“, Perspectives in Health Information Management, 2013, vol. 10 (Fall), 1c. Available at: https://pubmed.ncbi.nlm.nih.gov/24159271/ (accessed on 12 January 2026).

CASEY E. “Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet“, 3rd ed., Waltham, MA: Academic Press, 2011. Available at: https://rishikeshpansare.wordpress.com/wp-content/uploads/2016/02/digital-evidence-and-computer-crime-third-edition.pdf (accessed on 12 January 2026).

CASEY E., BARNUM S., GRIFFITH R., SNYDER J., VAN BEEK H., NELSON A. “Advancing coordinated cyber-investigations and tool interoperability using a community developed specification language”, Digital Investigation, 2017, vol. 22, pp. 14–45. https://doi.org/10.1016/j.diin.2017.08.002

CHEN B., ALRIFAI W., GAO C., JONES B., NOVAK L., LORENZI N., FRANCE D., MALIN B., CHEN Y. “Mining tasks and task characteristics from electronic health record audit logs with unsupervised machine learning”, Journal of the American Medical Informatics Association, 2021, vol. 28(6), pp. 1168–1177. https://doi.org/10.1093/jamia/ocaa338

D’ANNA T., PUNTARELLO M., CANNELLA G., SCALZO G., BUSCEMI R., ZERBO S., ARGO A. “The chain of custody in the era of modern forensics: from the classic procedures for gathering evidence to the new challenges related to digital data“, Healthcare, 2023, vol. 11(5), p. 634. https://doi.org/10.3390/healthcare11050634

DETTMEYER R. B.; VERHOFF M. A.; SCHÜTZ H. F. “Forensic Medicine: Fundamentals and Perspectives”. Berlin, Heidelberg: Springer, 2014. https://doi.org/10.1007/978-3-642-38818-7

EUROPEAN COURT OF HUMAN RIGHTS. Case of Arskaya v. Ukraine, no. 45076/05, 2013. Available at: https://hudoc.echr.coe.int/eng?i=001-138590 (accessed on 12 January 2026).

EUROPEAN COURT OF HUMAN RIGHTS. Case of Calvelli and and Ciglio v. Italy, no. 32967/96. 2002. Available at: https://hudoc.echr.coe.int/eng?i=001-60329 (accessed on 12 January 2026).

EUROPEAN COURT OF HUMAN RIGHTS. Case of Lopes de Sousa Fernandes v. Portugal, no. 56080/13. 2017. Available at: https://hudoc.echr.coe.int/eng?i=001-179556 (accessed on 12 January 2026).

EUROPEAN COURT OF HUMAN RIGHTS. Case of Šilih v. Slovenia, no. 71463/01. 2009. Available at: https://hudoc.echr.coe.int/fre?i=001-92142 (accessed on 12 January 2026).

EUROPEAN COURT OF HUMAN RIGHTS. Case of Tretyakova v. Ukraine, no. 63126/13, 2021. Available at: https://hudoc.echr.coe.int/eng?i=001-212963 (accessed on 12 January 2026).

EUROPEAN COURT OF HUMAN RIGHTS. Cauza Eugenia Lazăr v. Romania, no. 32146/05, 2010. Available at: https://hudoc.echr.coe.int/eng?i=001-123214 (accessed on 12 January 2026).

EUROPEAN UNION. Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (Text with EEA relevance). Official Journal of the European Union, 2025. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0327 (accessed on 12 January 2026).

FRANCE. Code de la santé publique, art. L1111-7. Paris: Legifrance, current version. Available at: https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000042685313 (accessed on 12 January 2026).

FRANCE. Code de procédure pénale. Paris: Legifrance, current version. Available at: https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006071154 (accessed on 12 May 2026).

FRANCE. Code pénal. Paris: Legifrance, current version. Available at: https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006070719 (accessed on 12 May 2026).

GERMANY. Bürgerliches Gesetzbuch (BGB), 630f–630g. Berlin: Federal Ministry of Justice of Germany, current version. Available at: https://www.gesetze-im-internet.de/bgb/index.html#BJNR001950896BJNE271701360 (accessed on 12 January 2026).

GERMANY. Sozialgesetzbuch V (SGB V), 342. Berlin: Federal Ministry of Justice of Germany, current version. Available at: https://www.gesetze-im-internet.de/sgb_5/index.html#BJNR024820988BJNE079305126 (accessed on 12 January 2026).

GERMANY. Sozialgesetzbuch V (SGB V), 355. Berlin: Federal Ministry of Justice of Germany, current version. Available at: https://www.gesetze-im-internet.de/sgb_5/index.html#BJNR024820988BJNE080606126 (accessed on 12 January 2026).

GERMANY. Strafprozessordnung (StPO). Berlin: Federal Ministry of Justice of Germany, current version. Available at: https://www.gesetze-im-internet.de/stpo/ (accessed on 12 January 2026).

ISO/IEC. ISO/IEC 27037:2012 – Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence. Geneva: International Organization for Standardization, 2012. Available at: https://www.iso.org/standard/44381.html (accessed on 12 January 2026).

KENT K.; CHEVALIER S.; GRANCE T.; DANG H. “Guide to Integrating Forensic Techniques into Incident Response”. NIST Special Publication 800-86. Gaithersburg, MD: National Institute of Standards and Technology, 2006. Available at: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf (accessed on 12 January 2026).

KOHN L. T.; CORRIGAN J. M.; DONALDSON M. S. (eds.). “To Err Is Human: Building a Safer Health System”, Washington, DC: National Academies Press, 2000. https://doi.org/10.17226/9728

MERRY A. F.; BROOKBANKS W. “The Place of the Criminal Law in Healthcare”, in: MERRY A. F.; MCCALL SMITH A. (eds.), Errors, Medicine and the Law, 2nd ed., Cambridge: CUP, 2017, pp. 310–345. https://doi.org/10.1017/9781316848050.011

REPUBLIC OF MOLDOVA. Codul de procedură penală al Republicii Moldova nr. 122-XV din 14 martie 2003. Chișinău: Legis.md, current version. Available at: https://www.legis.md/cautare/getResults?doc_id=154997〈=ro (accessed on 12 January 2026).

REPUBLIC OF MOLDOVA. Legea nr. 133 din 8 iulie 2011 privind protecția datelor cu caracter personal. Chișinău: Legis.md, current version. Available at: https://www.legis.md/cautare/getResults?doc_id=148996〈=ro# (accessed on 12 January 2026). At the date of this study, Law No. 133/2011 remained applicable in the Republic of Moldova; however, it was scheduled to be repealed and replaced by Law No. 195/2024 on 23 August 2026.

REPUBLIC OF MOLDOVA. Legea nr. 411-XIII din 28 martie 1995 privind ocrotirii sănătății. Chișinău: Legis.md, current version. Available at: https://www.legis.md/cautare/getResults?doc_id=151100〈=ro (accessed on 12 January 2026).

ROMANIA. Codul de procedură penală (Legea nr. 135/2010). Bucharest: Portal Legislativ, current version. Available at: https://legislatie.just.ro/Public/DetaliiDocument/210279 (accessed on 12 January 2026).

ROMANIA. LEGE nr. 95 din 14 aprilie 2006 privind reforma în domeniul sănătății. Bucharest: Portal Legislativ, current version. 2015. Available at: https://legislatie.just.ro/Public/DetaliiDocument/71139 (accessed on 12 January 2026).

ROMANIA. LEGEA drepturilor pacientului nr. 46 din 21 ianuarie 2003. Bucharest: Portal Legislativ, current version. Available at: https://legislatie.just.ro/Public/DetaliiDocument/296139 (accessed on 12 January 2026).

RULE A., KANNAMPALLIL T., HRIBAR M. R., DZIORNY A. C., THOMBLEY R., APATHY N. C., ADLER-MILSTEIN J. “Guidance for reporting analyses of metadata on electronic health record use”, Journal of the American Medical Informatics Association, 2024, vol. 31(3), pp. 784–789. https://doi.org/10.1093/jamia/ocad254

RULE A.; CHIANG M. F.; HRIBAR M. R. “Using electronic health record audit logs to study clinical activity: a systematic review of aims, measures, and methods”, Journal of the American Medical Informatics Association, 2020, vol. 27(3), pp. 480–490. https://doi.org/10.1093/jamia/ocz196

TABARI, P.; COSTAGLIOLA, G.; DE ROSA, M.; BOEKER, M. “State-of-the-Art Fast Healthcare Interoperability Resources (FHIR)–Based Data Model and Structure Implementations: Systematic Scoping Review”, JMIR Medical Informatics, vol. 12, 2024, e58445. https://doi.org/10.2196/58445

UKRAINE. CABINET OF MINISTERS. Деякі питання електронної системи охорони здоров’я [Some Issues of the Electronic Health Care System]: Resolution No. 411 of 25 April 2018, revision of 4 February 2025. Legislation of Ukraine database / Verkhovna Rada of Ukraine. Available at: https://zakon.rada.gov.ua/go/411-2018-%D0%BF (accessed on 12 January 2026).

UKRAINE. MINISTRY OF HEALTH. Деякі питання ведення Реєстру медичних записів, записів про направлення та рецептів в електронній системі охорони здоров’я [Some issues relating to the maintenance of the Register of medical records, referral records and prescriptions in the electronic healthcare system]: Order No. 587 of 28 February 2020; registered by the Ministry of Justice of Ukraine on 5 March 2020 under No. 236/34519; revision of 21 November 2025. Legislation of Ukraine database / Verkhovna Rada of Ukraine. Available at: https://zakon.rada.gov.ua/go/z0236-20 (accessed on 12 January 2026).

UKRAINE. The Criminal Procedural Code of Ukraine: Code of Ukraine, Law No. 4651-VI of 13 April 2012, revision of 1 August 2025. Legislation of Ukraine database / Verkhovna Rada of Ukraine. Available at: https://zakon.rada.gov.ua/go/4651-17 (accessed on 12 January 2026).

UNITED KINGDOM. Data Protection Act 2018. London: legislation.gov.uk, current version. Available at: https://www.legislation.gov.uk/ukpga/2018/12 (accessed on 12 January 2026).

UNITED KINGDOM. Health and Care Act 2022. London: legislation.gov.uk, current version. Available at: https://www.legislation.gov.uk/ukpga/2022/31 (accessed on 12 January 2026).

UNITED KINGDOM. Police and Criminal Evidence Act 1984. London: legislation.gov.uk, current version. Available at: https://www.legislation.gov.uk/ukpga/1984/60 (accessed on 12 January 2026).

UNITED STATES. 21st Century Cures Act; ONC Certification Criteria (45 CFR § 170.315). Washington, DC: Office of the National Coordinator for Health Information Technology, current version. Available at: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/section-170.315 (accessed on 12 January 2026).

UNITED STATES. Federal Rules of Criminal Procedure, Rule 41. Washington, DC: United States Courts, current version. Available at: https://www.law.cornell.edu/rules/frcrmp/rule_41 (accessed on 12 January 2026).

UNITED STATES. Health Insurance Portability and Accountability Act (HIPAA), 45 CFR § 164.312. Washington, DC: Electronic Code of Federal Regulations, current version. Available at: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312 (accessed on 12 January 2026).

UNITED STATES. Health Insurance Portability and Accountability Act (HIPAA), 45 CFR § 164.512(f). Washington, DC: Electronic Code of Federal Regulations, current version. Available at: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512 (accessed on 12 January 2026).

VULETIĆ, I. “Medical Malpractice as a Separate Criminal Offense: A Higher Degree of Patient Protection or Merely a Sword Above the Doctors’ Heads? The Example of the Croatian Legislative Model and the Experiences of its Implementation”, Medicine, Law & Society, 12(2), 2019, pp. 39-60. https://doi.org/10.18690/10.18690/mls.12.2.39-60.2019

WASSERMAN L.; WASSERMAN Y. “Hospital cybersecurity risks and gaps: Review (for the non-cyber professional)”, Frontiers in Digital Health, 2022, vol. 4, 862221. https://doi.org/10.3389/fdgth.2022.862221

WORLD HEALTH ORGANIZATION. Global Patient Safety Action Plan 2021–2030: Towards Eliminating Avoidable Harm in Health Care. Geneva: WHO, 2021. Available at: https://iris.who.int/handle/10665/343477 (accessed on 12 January 2026).

Downloads

Published

30-06-2026

How to Cite

“Forensic infrastructure for investigating medical crimes in the digital era” (2026) Cadernos de Dereito Actual, (32), pp. 130–154. Available at: https://cadernosdedereitoactual.es/index.php/cadernos/article/view/1515 (Accessed: 30 June 2026).