We have discussed choosing the right EMR. You have picked your system, gotten the training, and gone live. You are living happily-ever-after with your electronic charts. But what about all of those paper charts that are lurking in your practice? What should happen to them? There are rules and regulations about when and how they can be disposed of.
When?
There are several factors that dictate how long a practice must retain paper records. It is important to look at state laws, Medicare and Medicaid and insurance regulations, and the statute of limitations for malpractice or other legal actions. The North Carolina Medical Board guidelines, updated in 2009, state:
- Medicare and Medicaid: 7 years
- Medical Malpractice: consult your malpractice insurance carrier
- Immunization Records: must be kept indefinitely
The board also issued the following statement concerning how to determine the length of times records should be kept: “The board, therefore, recognizes that the retention policies of physicians giving one time, brief episodic care may differ from those physicians providing continuing care for patients.” Therefore, it is important to use best judgment when determining which records to retain. A practice such as an urgent care may use the minimum requirement. In a practice that is providing long term care for a patient, especially in the case of disease treatment, the records may be kept longer. HIPAA does not provide any guidelines about the length of time that records must be kept, but advises that providers should defer to state law. It is also important to note that the “seven years” starts on the date of the last encounter.
How?
The destroying of records is strictly governed by HIPAA regulations. According to the US Department of Health and Human Services, the entity that implements HIPAA, “covered entities must implement reasonable safeguards to limit incidental, and avoid prohibited uses and disclosures of PHI, including in connection with the disposal of such information.” It is illegal to dispose of any PHI, including paper charts, in a way that is accessible to the public. That includes, but is not limited to, dumpsters, recycling centers, and public trashcans. There is no one way that charts must be disposed of, as long as they are rendered “unreadable, indecipherable, and otherwise cannot be reconstructed.” The most popular way to accomplish this is to have the records shredded. Burning, pulping, and pulverizing are also options. The company that is hired to destroy the records is considered by HIPAA to be a business associate, and a contract for safe and appropriate disposal must be created. For more information see this entry about vendor agreements.
Once you are prepared to destroy your practice’s paper charts, contact your attorney. Together you can form an action plan that includes an appropriate vendor and meets the requirements for what information needs to be saved and what does not. It is important to consult with an experienced healthcare lawyer who is well-versed in the latest state law. Fines for misappropriation of PHI are steep, and the negative exposure that surrounds breaches is immense. Protect your patient’s privacy rights and keep your practice safe by following the law to the letter.
Revolution Law Group is located in Greensboro, NC, and serves individuals and small businesses throughout the Triad and surrounding areas. To contact us please visit Revolution.law or call 336-333-7907.
The information included here is for informational purposes only, is not exhaustive of all considerations when creating documents, is not intended to be legal advice, and should not be relied upon for that purpose. We strongly recommend you consult with an attorney and do not attempt to create your own documents.
Sources
Waller Lansden Dortch & Davis LLP. (March 26, 2008). Retaining Medical Records: How Long is Long Enough. FindLaw. Retrieved November 8, 2012. https://corporate.findlaw.com/law-library/retaining-medical-records-how-long-is-long-enough.html
Retention of Medical Records. (May 1, 1998, modified May 2009). North Carolina Medical Board. Retrieved November 8, 2012. https://www.ncmedboard.org/position_statements/detail/ retention_of_medical_records/
Department of Health and Human Services. (n.d.) Frequently Asked Questions About the Disposal of Protected Health Information. HHS.gov. Retrived November 8, 2012. https://www.hhs.gov/ocr/privacy/hipaa/ enforcement/ examples/disposalfaqs.pdf