It is important for each practice to establish, and consistently implement, medical record retention policies and procedures.

Medical record retention policies and procedures should include guidelines that specify what information should be kept, the time period for which it should be kept and the storage medium (electronic, paper, X-rays, etc.). Applicable federal health record retention requirements, state laws or regulations pertaining to retention of health information, and accreditation agency retention standards, if applicable, should be followed. It is recommended that a local attorney, familiar with such matters, be consulted when developing medical record retention policies.

Unless longer periods of time are required by state or federal law, records of adult patients should be retained for a minimum of 10 years after the most recent encounter and records of minor patients should be retained to the age of majority plus the state statute of limitations or 10 years after the most recent encounter, whichever is longest.

Yes. Under the HIPAA Privacy Rule, the patient has the right to inspect and receive a copy of his/her patient record (with some defined exceptions). The doctor may provide the patient with a summary of the records, if the patient agrees.

No. Original medical records, including radiological films, should not be removed from the office premises except as required by court order, valid subpoena* or statute. Copies of records may be released as necessary for treatment, payment and healthcare operations (as defined by HIPAA) or upon receipt of a written authorization of the patient or the patient’s representative.

*A subpoena usually requires the doctor to make arrangements to appear with the records or provide identical copies of the records to attorneys for each side in the matter. Should a subpoena require the doctor to send original medical records to an attorney, the doctor should promptly consult with a PICA Claims Specialist.

No. Federal law (HIPAA) gives patients the right to view or obtain a copy of the information contained in their patient record. Therefore, a copy of a patient’s record must be made available to the patient in a timely manner upon request by the patient.

Federal and state laws address fees that doctors may charge patients and others for copying medical records. HIPAA’s privacy rule addresses fees in section 164.524(c) (4) which allows a provider to charge a reasonable, cost-based fee for copying and postage. It also allows providers to charge for preparing an explanation or summary of the record, if the patient agrees in advance to a summary or explanation and to the fees imposed, if any.

It should be noted that an August 14, 2002 Federal Register update clarified the final privacy rule to say that Section 164.524(c)(4) (referenced above) limits only the fees that may be charged to individuals or to their personal representatives. The fee limitations do not apply to any other permissible disclosures, such as requests by attorneys with a valid patient authorization.

State regulations provide the most specific guidance regarding fees for medical record requests other than from patients. Most states have specific laws and regulations that should be used in establishing your copy cost fees.

Should you decide to charge a fee for copy costs, you are strongly encouraged to consult a local attorney familiar with such laws prior to implementing your office copy cost fee schedule. Once your fee schedule has been developed, it should be reviewed and updated on an annual basis.

You still have to retain the original X-rays and provide the requestor (with the patient’s written authorization, if not the patient) a copy. If you do not have access to a copier at the local hospital or another physician’s office, you can utilize an X-ray copy service to make the copies. Be sure to obtain a HIPAA Business Associate Agreement with the copy service provider. If the request is made by an attorney, you could ask the attorney to send over their copy service to make the copies.

The medical record (including radiological films) of a patient is the property of the doctor or the practice and is maintained for the benefit of the patient, physician and office. Patients have the right to request a copy (never give the original to a patient) of records or the right to request that a copy be forwarded to another party.

The HIPAA security rule requires that patient medical records are readily available and that you backup your electronic medical records on a regular basis. When a computer crashes and data is lost, you should have a backup of your data available to restore your patient information. HIPAA regulations require that you test your backups on a regular basis to insure that you can restore data from your backup files. In instances of loss of patient data, contact PICA’s Risk Management Department at (800) 251-5727 for assistance.

If the information is truly not retrievable, you should start a new patient record, indicating that the original record was lost or destroyed and the date of the occurrence. The patient should be treated as a new patient at the next visit (at no added cost to the patient or third party payor). Have the patient complete all forms that you would have a new patient complete such as the patient history form, current medication list, etc. and perform and document an initial history and physical exam and any other tests or workup that is needed. If you can obtain copies of prior lab work, X-rays, operative reports or other medical records from other healthcare providers, be sure to identify them as a copy.

Yes. If professional treatment is provided to an individual, even if that individual is a staff member or a friend, then a physician-patient relationship has been established and a complete medical record should be maintained. There have been numerous incidents of lawsuits filed by staff members or friends of providers following “informal” treatment resulting in a bad outcome. Without medical records, it is almost impossible to defend a claim. In addition, state laws or rules and regulations require practitioners to keep medical records on each patient.