Self-authenticating medical imaging under FRE 902(13) and 902(14)

The problem the amendments solved

Authentication is the threshold, not the argument: under FRE 901, the proponent must produce evidence sufficient to support a finding that the exhibit is what the proponent claims it is. For imaging, the traditional route was testimony — a records custodian, a PACS administrator, or the treating radiologist taking the stand to say that this MRI is the MRI, acquired on that date, of that patient, and unaltered since. That witness costs money, scheduling, and a slot in the trial day, and in the ordinary case says nothing contested: opposing counsel rarely disputes that the hospital’s scanner produced the study. The expense bought a formality.

Rule 902 has long exempted categories of evidence whose authenticity is sufficiently self-evident — and, in 902(11) and 902(12), let business records be authenticated by a custodian’s written certification with notice to the adversary, moving the fight from the trial to the run-up. The 2017 amendments extended that certification machinery to electronic evidence as such.

What 902(13) and 902(14) actually add

FRE 902(13) covers a record “generated by an electronic process or system” that produces an accurate result, shown by a written certification of a qualified person. FRE 902(14) covers “data copied from an electronic device,” storage medium, or file, where a qualified person certifies that the copy was verified by a process of digital identification — in practice, a cryptographic hash: compute the hash of the original, compute the hash of the copy, and identical values mean identical bytes. Both rules borrow the notice procedure of 902(11): the certification is served in advance, and the opponent gets a fair opportunity to challenge it before trial.

The effect is procedural, not magical. Nothing becomes admissible that was not admissible before; what changes is who has to show up. The foundation that once required a live witness can now arrive as a declaration, and an opponent who wants to contest authenticity has to do it in a motion, with particulars — not by waiting to see whether the proponent’s custodian survives the trial subpoena.

Why DICOM fits 902(13) unusually well

A DICOM study is close to the paradigm of a record generated by an electronic process. The scanner writes the file, and writes into it the circumstances of its own creation: the acquisition date and time, the modality and manufacturer, the institution, the ordering physician, the protocol and acquisition parameters, the patient identity as registered, the unique identifiers that bind every slice to its series and every series to its study. None of that is a human’s after-the-fact narration — it is the machine’s contemporaneous output, which is exactly the kind of evidence 902(13) was written for. The older vendor literature argued, loosely, that this metadata “self-authenticates” imaging. The loose version had no procedure attached. The 2017 rules supply the procedure: the metadata is the showing, and the certification is the vehicle that carries it into evidence without a witness.

The certification still has to come from a qualified person — someone who can speak to the process or system and its accuracy, typically a records or imaging custodian at the producing institution, or a qualified technical declarant for the copying step. The rule moves the testimony onto paper; it does not abolish the need for a human who knows what they are certifying.

902(14) is about the copy — which is the copy you actually use

Nobody tries a case on the hospital’s PACS. The imaging that reaches the expert, the mediation, and the exhibit list is a copy of a copy: burned to disc, pulled from a portal, produced by a records vendor, forwarded again. Every generation is a chance for silent alteration — recompression, format conversion, a well-meaning technician “fixing” a patient name — and every generation is a question opposing counsel is entitled to ask. 902(14) answers it arithmetically: hash the original, hash the working copy, certify the match. A challenge to the copy then has to explain how two byte streams with the same cryptographic hash could differ, which is not a cross-examination anyone wins.

The practical prerequisite is discipline you cannot retrofit: the original bytes must still exist, unmodified, when the certification is drafted. A workflow that transcodes on ingest, or lets anyone touch the files, has quietly spent the argument before it was made.

What certification does not do

Authenticity is one hurdle of several, and 902 clears only that one. The images remain subject to the hearsay rules to the extent they are offered with the records around them: the imaging record typically travels under FRE 803(6) as a business record — conveniently, via the same 902(11) certification mechanics — and statements in the clinical record made for diagnosis or treatment have their own path under FRE 803(4). Relevance and the balance of probative value against prejudice are untouched. And nothing in Rule 902 makes an image mean anything: what the study shows, whether the finding was visible, whether the read fell below the standard of care — that is the expert’s testimony, and no certification substitutes for it. Where the process itself is genuinely contested, or the exhibit falls outside the certified categories, 901 remains the general route it always was.

Building the record the certification describes

A 902(13)/(14) showing is only as good as the custody story underneath it, and this is where the platform holding the imaging either helps or quietly hurts. Slicefield is built to be the helpful case: studies are immutable once ingested, and the original files are kept byte-for-byte as received — the disc’s contents, the vendor ZIP, the portal download — so the original that a hash certification refers to still exists, untouched, whenever the declaration is drafted. Every consequential event lands on an append-only audit ledger that nothing in the product can edit, and one click renders the matter’s printable chain-of-custody report: what was received, who accessed it, through which links, when. That is the paper a certifying declarant wants in front of them — and the paper an opponent’s challenge has to argue past. The mechanisms are described in full on the security & chain of custody page.

For what the production itself should look like — originals as received, no transcoding, a hash manifest — see Production formats for medical imaging.

This article is general background for litigators, not legal advice, and reading it creates no attorney–client relationship. How any rule applies turns on the jurisdiction, the court and the facts of the particular case — those judgments belong to counsel.

All articles · Security & chain of custody · Open the first disc free