EMR audit pitfalls