EMRs pose new legal risks