Managing patient records these days is tricky business indeed. From OSHA and HIPAA to malpractice carriers and third-party payers, it seems everyone has a position on how healthcare providers must retain medical charts and to whom they can safely disclose them. If that’s not enough, most states have their own regulations for record retention — not to mention limits on how much practices can charge patients for copies of their chart. And now, with EHRs changing the rules of the game, it’s more important than ever that practices establish consistent record-keeping policies that minimize the risk of privacy violations, court sanctions, and even litigation.
“There are so many organizations out there with so many rules and regulations that it gets confusing,” says Cindy Dunn, a consultant with MGMA Health Care Consulting Group, adding that all practices should make record management a priority. “It’s best to put it down on paper. Make yourself a spreadsheet and list how long you’ll keep medical records, employment records, correspondence from vendors, and other important documents, and communicate your policy clearly to the staff.”
It helps, too, to put someone on staff (usually a CEO or administrator) in charge of compliance. After all, regulatory reform is a moving target. (For example, is your practice aware that under the Health Information Technology for Economic and Clinical Health Act of 2009 healthcare providers are now required to notify patients if their medical information was accessed by or disclosed to an unauthorized person?)
Here’s a look at some of the key points to remember when crafting a medical records policy that protects both your practice and your patients.
Record retention
For many providers, record retention is an endless source of confusion, in part because it falls under the purview of both federal and state regulators, but also because of the vast number of laws that address it — more than 10,000 federal, state, and local regulations specific to healthcare organizations, according to Mark Willard, a partner with Pittsburgh-based law firm Eckert Seamans Cherin & Mellott.
Typically, however, state health officials dictate a defined period for how long providers must maintain patient records, in what format they must be stored (secured databases for EHRs, locked and weather-proofed facilities for paper charts), and how they must be destroyed. Some states, including Michigan, also require providers to notify patients before their records are destroyed.
Absent state mandates, a good rule of thumb is to keep patient records for seven to 10 years after the last date of service, says Lydia Washington, director of practice leadership for the Chicago-based American Health Information Management Association.
There are a few exceptions. Records for minors, for example, should be held for two years past the patient’s age of majority, which is 20 in most states. Records related to workplace injuries in which the Occupational Safety and Health Administration was involved must be held for 30 years, and charts for veterans must be held for 75 years. If you have information that legal action is pending from one of your patients, you are also obligated to hold relevant records, or preserve them from destruction, “even if they’ve passed the retention deadline,” says Washington.
All practices should also be aware of their state’s statute of limitations for medical malpractice lawsuits, which may differ from the required record retention period, says Robert Iwrey, a healthcare attorney with The Health Law Partners in Southfield, Mich. “It’s very important that providers are cognizant of what those statutes are, because if you can be sued for malpractice over, say, a six-year period, you want to make sure that you keep those records at least that long regardless of any other state or federal requirement,” he says. Indeed, records are your best defense against future legal claims. “You might need to defend yourself based on your records and if you don’t have them it’s going to be a foregone conclusion.”
Lastly, providers should check the requirements of third-party payers (including Medicare) to ensure they keep their records for at least the length of time they can be requested. Under most contracts, insurance companies are entitled to audit your records for a fixed number of years. “If you don’t have those records, guess what? They get their money back,” says Iwrey. What’s worse, he notes, is if the insurance company detects a pattern of incomplete record keeping, it could result in civil monetary penalties, or even criminal charges. “If they start to question whether services were performed at all, they could go after you criminally for intent to defraud, says Iwrey.
Some states also require that every interaction with a patient be entered into their medical record. “That makes sense when someone comes to your office, but where physicians get into trouble is a scenario where a relative, friend, or patient runs into them outside the office and says, ‘Hey Doc, I’ve got a sore throat,’ and the doctor says, ‘No problem,’ and writes them off a quick prescription. Or, there’s a short e-mail communication where the doctor gives some type of advice or prescribes something,” he says. “In some states, those interactions must be entered into a medical record.”
Failure to do so in Michigan, for example, can lead to licensing action. “If something happens to that patient and there was no record of the prescription or interaction, not only did you violate statute, but you also cast further suspicion upon your prescribing practices which can lead to licensing issues,” says Iwrey. “In healthcare today, unfortunately, documentation is everything.”
Though much of the focus on record retention concerns keeping documents long enough to protect your practice, bear in mind there is also a potential risk in holding onto them too long — particularly electronic data, says Willard. Federal rules have been recently amended (and adopted by many states) regarding the storage of electronic information, including health records, e-mail, and instant messaging, and their use in court proceedings.
If your electronic data is not properly maintained and produced as part of litigation, you can be charged with spoliation, which is the tampering with or destruction of data, says Willard. “A good policy is to destroy those records after the retention period has passed to protect yourself,” he says. It’s equally important, though, to destroy records consistently. “If the court finds out you destroyed relevant documents because they were old or past their retention deadline, but you kept others that were just as old, it appears you destroyed them knowingly,” says Willard. “That’s the risk of keeping them around.”
There’s also the expense to consider. By law, you’re required to provide to the courts any records they request at your own expense. “Most of these services used to retrieve electronic data charge by the gigabyte so it can cost hundreds of thousands of dollars just to produce the documents,” says Willard. “The plaintiff’s attorney is quite aware of that and they may use it to induce a settlement.”
