Supported document type
Detect tampered and deepfake Medical Report
A medical report is altered where its conclusions are worth something: the examination findings, the date the patient was seen, and the credentials of the clinician who signed it. A report is read closely, so forgers work inside a genuine document rather than building one, retyping a paragraph of findings or moving an examination date so a condition falls the right side of a policy start. The edited text sits on authentic letterhead, which is why it survives review until the file itself is analysed.
API slug: medical_report
Last updated:
What a genuine medical report contains
A medical report sets out what a clinician found when they examined a named patient. It opens with the hospital or practice letterhead, the patient's name, date of birth and record number, the referring party, and the date and place of examination. The body carries the presenting history, findings organised by system, the investigations relied on, a diagnosis usually accompanied by a classification code, and an opinion on treatment, prognosis, or fitness. It closes with the clinician's name, qualifications, registration number, signature, and stamp.
The opinion at the end is only as good as the findings above it, and that dependency is what edits break. A prognosis cannot describe a severity the examination section never recorded, and a diagnosis code has to name the same condition the narrative does. Dates run in one direction: investigations are performed before they are reported, and the report is dated on or after the examination. Multi-page reports also number their own pages, so a page added or removed leaves a sequence that no longer closes.
How medical report forgeries are made
Findings paragraph rewrite
A block of clinical narrative is replaced to raise or lower the severity recorded, because severity is what an insurer, employer, or panel acts on. Rewritten prose introduces a second font rendering into a document otherwise produced by one printer, and the paragraph justification shifts where the new text does not fill the original line lengths.
Examination date manipulation
The date of examination is moved so a condition appears to have been identified after a policy began rather than before it, which decides whether a pre-existing exclusion applies. A single field changes, and it usually stops agreeing with the investigation dates the same report cites.
Clinician credential substitution
The signing doctor is swapped for a specialist whose registration and qualifications carry more weight with the reviewing party. The borrowed name and number pass a register lookup, but the specialty, the practice address, and sometimes the signature block alignment no longer match the letterhead the report is printed on.
Letterhead transplant
A hospital's letterhead is lifted from a real document and placed above a body that the hospital never produced. Transplanted branding carries its own resolution and colour profile, and its edges show a resampling boundary that the surrounding text, printed in a single pass, does not.
Page insertion in a multi-page report
An extra page of findings is inserted, or an inconvenient one is removed, in a report several pages long. Page numbering, the repeated header, and the running patient identifier are where this shows, along with a font or margin that drifts on exactly one page of the set.
Language-model report bodies
The clinical narrative is drafted by a language model and laid into a real template, which produces fluent, plausible text with no editing artefacts at all. Detection moves to the document layer: the print and scan characteristics of the text block, and whether it was rendered at the same time as the page around it.
What TamperCheck checks on a medical report
TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.
Stamp authenticity and placement
Stamps are assessed for whether the ink was impressed onto the page or printed as part of it, and for whether the impression was placed digitally after the fact.
Signature forgery analysis
Signature regions are assessed for ink consistency and for how the stroke sits on the page, which distinguishes a genuine pen stroke from a pasted image of one.
Letterhead, logo, and issuer plausibility
Issuer branding is checked for resolution and compression consistency against the body text it sits on. A logo lifted from a website carries the signature of its source, not of the document.
And many more checks
The three above are the layers that carry the most weight on a medical report. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.
Who verifies a medical report, and why
Insurers, employers, and immigration medical panels reviewing health status. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.
How to verify a medical report in 4 steps
Check the fields against each other
Read clinical findings, examination date, and physician credentials together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.
Inspect the file metadata
Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.
Ask for a second document
Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.
Run a forensic check
Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a medical report and returns a risk score from 0 to 100 within seconds, at $0.50 per document.
Frequently asked questions
How do insurers verify medical reports?
Insurers verify a report by contacting the treating institution directly and by reading the document against itself, checking that the diagnosis matches the findings, that the examination date sits correctly against the investigation dates cited, and that the signing clinician's registration matches the specialty claimed. Reports arriving in volume are screened forensically first, so only the ones showing edits go to a manual review.
Can a medical report be altered?
Yes, and the alteration is usually a paragraph rather than a number, since the value of a medical report lies in its conclusions. Rewriting a findings section in a PDF editor leaves that text block with a different rendering history from the rest of the page, and per-region analysis separates the two even when the visible result looks continuous.
How can you tell if a medical report is genuine?
Look for agreement between the report's own parts: the diagnosis should name what the findings describe, the classification code should match the diagnosis, and the examination date should precede the report date and follow nothing it cites. Then confirm the letterhead, the stamp, and the signature block all refer to the same institution and the same clinician.
Can AI-generated medical reports be detected?
Yes. A report written by a model reads coherently and contains no internal contradictions, so cross-field checks alone will clear it. It is identified instead through generation signatures and substrate analysis, which measure whether the page has the noise and texture characteristics of something printed and scanned or the characteristics of an image that was synthesised.
TamperCheck analyses medical report uploads with a hybrid forensic and AI pipeline tuned for this document class. Upload endpoints accept PDF and common image formats; class is inferred automatically. See the API & MCP documentation for authentication, async jobs, and webhooks.