Recent trends indicate that more physicians are considering retirement or selling their private practice to a health care system or other physician practice. If you are one of these physicians, then it is important to think about and understand medical record retention requirements. Below are the key medical record retention considerations physicians should think about when planning to retire from or sell their practice.
Q: How long do you need to retain your patient medical records?
A: It depends on the location of the medical practice and the type of medical records that the physician maintains (e.g., medical records of Medicare managed care program beneficiaries, medical records of minors, etc.). As state and federal requirements vary, physicians must retain the records based on whichever requirement is the longest. For example:
- Federal HIPAA requirements related to accounting of disclosures require physicians to retain medical records for at least 6 years.
- Missouri law requires physicians to retain patient records for a minimum of 7 years from the date of the last professional service provided.
- Illinois doesn’t have a law regarding medical record retention which is specific to physicians. Instead, it is recommended that Illinois physicians maintain medical records for at least 10 years after the last patient visit.
- CMS requires physicians who participate in the Medicare managed care program to retain medical records for at least 10 years.
Q: How and why should medical records be maintained?
A: To comply with HIPAA, records may be maintained in electronic or paper form and must be secure, accessible and able to be transferred, if necessary. Maintaining adequate and complete records is not only important for patient care but also for helping physicians to defend against medical malpractice claims, disciplinary proceedings, and payor or governmental audits/investigations.
Q: What are some alternatives to maintaining the records yourself?
A: Physicians are allowed to transfer medical records during the sale of their practice to another health care provider and/or to enter into a medical record custody agreement with a qualified HIPAA covered entity (e.g., another local physician or hospital) who is willing to be the custodian of their medical records. It is important to ensure that any medical record custody agreement complies with state and federal laws (including HIPAA) regarding confidentiality, security, access and disclosure.
Q: What are the patient notification requirements?
A: Notice requirements vary by state. In Illinois, before a physician who is planning to retire or to join a different physician group can close their current practice, such physician must provide 30 days' notice to the public. Such notice may be given by publication in a newspaper of general circulation where the physician is located and must include an explanation of how copies of the medical records may be accessed by patients. Missouri does not have such a clear requirement for notice. The American Medical Association’s Ethical Opinions state that any time a physician leaves a practice, the party responsible for maintaining custody of the medical record should send a notice to such physician’s patients.
The content requirements of the notice also vary by state but generally require information such as when the physician will stop providing medical services; if the physician will be practicing medicine at another location; updated contact information; contact information of an alternative practitioner at the current practice, if applicable; and information about how the patients can obtain their medical records.
Q: Are there consequences for not maintaining the patient medical records in accordance with state laws and HIPAA?
A: HIPAA provides for monetary penalties (and/or corrective action plans) for physicians who fail to properly secure and maintain records and/or to provide access to such medical records and also permits state attorney generals to issue fines and/or file civil lawsuits on behalf of the residents whose medical record access rights were violated. State law consequences for improper maintenance of patient medical records vary. For example, in Missouri, while the licensing board does not initiate disciplinary action against a physician solely for failing to maintain patient medical records properly and in accordance with the state minimum of 7 years, violations of the state medical record retention requirements can be additional causes for discipline if the board initiates an action against a physician for other reasons. In Illinois, the improper destruction or release of medical records can lead to civil and/or criminal liability. Physicians should also be mindful that failing to maintain patient medical records can also present challenges in the face of medical malpractice claims
April Kirkley is a member of Thompson Coburn’s Health Care group.