Medical Records Retention, Storage and Destruction
By Caryl A. Serbin, RN, BSN, LHRM
The length of time to retain medical records is usually based on state laws and regulations, federal payor policies, and on its use for patient care, legal, research, and educational activities.
State laws vary in requirements from three to 30 years. Accreditation agencies have not mandated specific retention periods for medical records but advise following state laws and regulations. The following recommendations are general and may be pre-empted by your state guidelines.
- Medical records should be retained in the center in their original form for a minimum of one year. Following review by your performance improvement committee and approval by the governing body, medical records that have had no activity for one year may be removed from the ambulatory surgery center’s in-house files for placement on electronic media or stored in a contracted offsite storage facility with provisions for strict maintenance of confidentiality and prompt retrieval of records on demand. Properly investigate off-site storage facilities and their processes prior to sending medical records to determine their ability to meet HIPAA confidentiality requirements.
- Only complete medical records should be stored off-site or on electronic media (electronic medical records). Medical records stored on electronic media may be stored on or off-site but are under the same confidentiality and safe storage constraints as medical record charts.
- For the adult patient, medical records should be retained as original records or on electronic storage media for 10 years after the most recent patient usage or death, in absence of any legal considerations or state regulations requiring a longer period of retention.
- For the minor patient, medical records should be retained as original records or on electronic storage media for 10 years after reaching majority or death, in absence of any legal considerations or state regulations requiring a longer period of retention.
- For the patient with mental disability, medical records should be retained as original records or on electronic storage media indefinitely or for 10 years after the death of the patient, or if a minor, majority plus 10 years or for 10 years after the death of the patient, in absence of any legal considerations or state regulations requiring a longer period of retention.
- For deceased patients, medical records should be retained as original records or on electronic storage media long enough for the probate of the estate to close, usually five years.
- All records that have been the subject of an incident that could lead to litigation and all records that have been requested by an attorney or administrative agency should be excepted from the general retention policy.
These records should not be destroyed until the matter is fully resolved and only with the advice of your center’s attorney.
After the record retention requirements as described above are met, records may be destroyed, unless specifically prohibited by statute, ordinance, regulation, or law. The ASC should retain indefinitely the following basic information on destroyed records:
- Patient’s name, address, social security number, birth date
- Dates of admission and discharge
- Names of responsible physician(s)
- Records of diagnoses
- Records of operations
- Surgical procedure reports
- Pathology reports
- Discharge summaries
Retention of medical records may be for longer periods of time than those stated above if requested in writing by one of the following:
- An attending or consultant physician of the patient
- The patient or someone acting legally in his/her behalf
- Legal counsel for a party having an interest affected by the patient medical records
Logs and registers (i.e. surgical procedure, pathology, laboratory logs, etc.) should be maintained permanently in their original form.
1. Paper Medical Records Record destruction should be performed by a contracted company with the ability to strictly maintain the confidentiality of the record. The company must provide proof of record destruction.
2. Electronic Medical Records Before you dispose, recycle, or donate any magnetic computer media, including floppy disks, hard drives, tapes, etc., the media must be wiped. Reformatting or deleting data is not enough. There is technology available that can rebuild file structures and recover deleted data. This can be accomplished in one of two ways:
- Degaussing using a strong magnetic field to scramble the media
- Zeroization: a process where you write zeros, or anything else, over the entire media record area Alternatively, you can destroy electronic media by:
- Drilling holes in disk packs or other physical destruction of the media.
- Dousing disk packs with any kind of cola.
The acid in the cola will dissolve the data.
Your center should have written policies and procedures regarding medical records retention, storage, and destruction. All members of your staff should be aware of these rules and assure that they are followed on a consistent basis. By instituting and enforcing these policies and procedures, your center ensures consistency in security measures and leaves no opportunity for breaches of confidentiality.
Caryl A. Serbin, RN, BSN, LHRM, is president and founder of Surgery Consultants of America, Inc. and Surgery Center Billing, LLC.