Frequently Asked Questions: Medical Records Issues
Susan Shepard, MSN, RN, Director, Patient Safety and Risk Management Education, and Richard F. Cahill, JD, Vice President, Associate General Counsel, The Doctors Company.
How long should records be kept?
Although states may have different guidelines or laws, The Doctors Company recommends the following:
Adult patients, 10 years from the date the patient was last seen.
Minor patients, 28 years from the patient's birth.
Deceased patients, five years from the date of death.
In California, where there is no statutory requirement regarding physician offices, the California Medical Association recommends that medical records be retained indefinitely or for at least 25 years after the patient's last visit. Due to the impracticality of this recommendation, The Doctors Company suggests using the same criteria mentioned above as minimum standards in California.
Is information stored in other formats, such as videos, x-ray films, ECGs, fetal monitor strips, and photos, part of the medical record?
Yes. Regardless of format, any and all data collected at the time of a patient encounter is part of the medical/legal document.
Does the medical record include financial information, such as billing and insurance data?
It is recommended that physicians check with their business attorney or state medical board for retention laws on billing and insurance records, especially as the laws may relate to Medicare, Medicaid, or Medi-Cal patients.
How long should billing records, telephone calls/messages, and appointment books be kept?
The Doctors Company recommends the following:
Billing records in all states should be retained for seven years according to Internal Revenue Service standards. They may be kept in a separate file
Telephone calls that pertain to medical care should be documented in the medical record and kept according to the above-referenced medical record retention guidelines.
Appointment books may be kept for one year.
If a patient brings his or her past medical records to my office, am I required to maintain all of the copies?
No, however, the physician should review, extract, and photocopy any information that he or she might need from that record and then return the original documents to the patient. The retained information or documentation then becomes part of the patient’s permanent office record. Be aware that if the physician keeps all of the patient’s medical records, he or she could be held liable for information related to other specialties.
How should hard copy paper records be destroyed?
The only safe methods for destroying paper records are incineration or shredding. A destruction method for electronic medical records has yet to be determined.
Where can medical records be stored?
Inactive records may be thinned from the active patient cases and stored outside the office suite. Take the following factors into consideration when making arrangements for long-term storage:
Privacy. Will the records be protected from unauthorized persons in a manner that is consistent with federal and state privacy laws?
Safety. Will the records be protected from fire or flood damage and from unauthorized access or theft?
Accessibility. Will the records be easy to retrieve and copy?
Can records be transferred to microfilm, microfiche, or disk or stored in a computer?
Yes. The factors in the previous question can also guide you on transferring records to microfilm, microfiche, or disk and on storing records in a computer. As of March 26, 2013, protected health information (PHI) transferred or stored electronically must be encrypted. Computer data should be backed up at regular intervals and stored off site, as in the previous question.
Is it sufficient to back up a copy of an electronic health record (EHR) onto a disk?
Yes. However, you should store a copy of the EHR software, along with the data itself, to make sure the records can be read in the future. Alternatively, you could save the data in PDF format so it can be read without special software. Regardless, all PHI stored electronically must be encrypted. If you use an application service provider—where your data is stored by the EHR vendor and you access it online—your contract should include terms that ensure your data will be available to you when you're ready to make arrangements for long-term storage.
Can I thin and purge medical records prior to storage?
Yes. Copies of other healthcare providers' medical records, such as hospital records, can be purged because the originals will be maintained by the hospital.
Can I sell my records when I sell my practice?
Yes. We suggest that you include the recommended retention time and access capability as part of your sales agreement.
If I move to another state, can I take my records with me?
Yes, with the same condition for retention and accessibility that prevails in a sale. It might be reasonable to alert your active/current caseload of your move in order to give patients an opportunity to request a copy of their medical records.
If a patient requests a copy before I move, can I hand over the original record?
No. The original is the property of the physician, who has a duty to maintain the record.
Can a physician take medical records home for documentation completion?
No. The only time an active, original medical record should be out of an office is when it is required to be present in a court of law.
If someone claiming to be a representative of a deceased patient's estate requests a copy of the chart, what should I do?
You must first verify through your own records or from a death certificate that the patient has expired. Then, ensure that the individual is a qualified representative of the decedent's estate (for example, the executor). The individual should provide a copy of an official document from the state as proof.
The guidelines suggested here are not rules, do not constitute legal advice, and do not ensure a successful outcome. The ultimate decision regarding the appropriateness of any treatment must be made by each healthcare provider considering the circumstances of the individual situation and in accordance with the laws of the jurisdiction in which the care is rendered.