Is the mountain of paper in your office growing out of control? Do you spend more and more time trying to scale that mountain to locate documents?

It would be nice to get rid of some of that paper, but how do you know what to keep on-site, what to store off-site, and what to throw away? Maybe it's time to review the basics of document retention. Developing a formal document retention policy for your practice — and following it — can help you sort through and manage the stacks of paper.

Begin by segregating office records into three basic categories: patient records (including HIPAA records), business records, and human resource-related records.

Storing patient records

Physicians have an obligation to retain medical records that may reasonably be of value to patients (Section E-7.05, Code of Ethics, American Medical Association). While this duty may not be legally binding for physicians, it strongly suggests that medical records should not be randomly disposed of.

Many factors go into determining which patient records to retain and which ones to toss. Many states have no requirements regarding storage of patient records, but to be safe, check with your state's medical licensing board. Your state medical society also may be able to guide you.

Next, consider the malpractice implications of record storage. Patient records are the written proof of your medical care and, thus, the best defense in any malpractice or other legal or administrative actions filed against you or your practice. At a minimum, store patient records for at least the duration of your state's statute of limitations.

If your state extends the statute of limitations for minors and persons who are incompetent, then you may need to permanently retain those records. Also, determine whether or not your state follows the "discovery rule" for filing malpractice cases. In states that follow this rule, the statute of limitations for plaintiffs to take action begins when they knew or should have known of the alleged malpractice. That rule extends even further the length of time that you must retain patient records.

Hang onto any records related to legal actions in which you have been named as a defendant or in which you think you may be called as a witness. Keep those records until the conclusion of the case and all applicable appeals have been exhausted.

Don't overlook other legal obligations regarding patient record retention. Medicare records must be maintained for a minimum of four years. Depending on the type of patient, Medicare may require an even longer retention period. Review your applicable third-party payer agreements to see what your contractual obligations are to maintain records of their insured patients.

HIPAA rules for records

HIPAA, of course, also impacts your record-keeping decisions. Patients who feel they have been subjected to a HIPAA violation can file complaints with the Office of Civil Rights (OCR). Generally, patients have 180 days from when they knew or should have known that a violation of HIPAA occurred to file the complaint with OCR.

OCR has the ability to extend this vague time frame with "good cause," and may pursue the action against your practice for up to six years. Prudence suggests that you retain patient records, documents related to uses and disclosures of HIPAA information, and other HIPAA-related documents for at least six years. Save copies of all patients' requests to amend their medical records and your responses to their requests for at least six years.

Don't toss business files

Record keeping doesn't stop at patient records. In sorting through your filing cabinets, think twice before discarding business records. Make sure to save all tax returns, as well as all supporting documentation for those tax returns for a minimum of six years.