When a Patient Dies, How Long Must the Medical Records Be Kept by the Medical Facility?

Understanding Medical Records Retention: The Legal Perspective

Ensuring the accurate retention and secure disposal of medical records remains a cornerstone of effective healthcare. Adherence to regulations protects patient privacy and maintains the integrity of the healthcare system. This article aims to provide clarity on the required retention timeframe for patient medical records after a patient's death.

Legal Regulations for Record Retention

Medical record retention regulations are not identical across the board. Various factors influence the duration a facility is required to retain a patient's medical records. These factors can include the specific healthcare sector involved (e.g., physical or occupational therapy), the patient's age, and whether the patient is alive or deceased.

Federal Law and Medical Records

Federal law places certain stipulations on medical record retention. For instance, in compliance with the Health Insurance Portability and Accountability Act (HIPAA), healthcare facilities are typically required to keep records for a minimum of six years from the record's creation or the last patient encounter. However, this timeframe can be longer depending on the patient's age at the last encounter, the type of record, and state laws.

State Regulations and Medical Records

State laws regarding medical record retention can vary significantly. Some states mandate a retention period longer than what is required by HIPAA, while others might have shorter or more specific timelines. This is why it's crucial to be familiar with the medical record laws applicable in your state.

Special Cases: Physical Therapy and Occupational Therapy

For physical and occupational therapies, patient record retention adheres to state laws and professional guidelines. The American Physical Therapy Association (APTA) and the American Occupational Therapy Association (AOTA) advise keeping patient records for at least seven years post-discharge, or until the patient reaches legal age plus seven years, whichever is longer.

Medical Records Retention Period by State

Medical record retention laws vary by state and the type of record. Generally, the law requires medical records to be kept anywhere from five to ten years after the last patient encounter, with some exceptions:

State	Retention Period
New York	6 years for adults, 6 years or 1 year after a minor reaches adulthood
Florida	5 years
Illinois	10 years
Texas	Minimum of 7 years
Massachusetts	30 years
New Jersey	10 years, or until a minor reaches 23 years old
Georgia	Minimum of 10 years
Ohio	6 years for healthcare facilities, 5 years for healthcare services
California	10 years for Medi-Cal patients, minimum of 2 years for HMOs

Understanding the Medical Record Retention and Destruction Policy

The complexities of medical record retention and destruction are dictated by a combination of policies and legislation. It's necessary to comprehend these policies to ensure compliance and appropriate handling of patient records.

Retention Policy

The HIPAA Privacy Rule was introduced in 1996 to enforce accountability for healthcare providers in retaining and protecting patient information. Although HIPAA does not specifically outline a retention period for different types of medical records, it does mandate that they must be retained for at least six years from the creation date.

State laws can require retention for longer than six years, varying depending on the specific state's legislation. These requirements can apply to the retention of both paper records and Electronic Medical Records (EMRs). When the retention period has concluded, healthcare providers can delete EMR files automatically, simplifying the management process.

Destruction Policy

When it comes to the destruction of medical records, there are also policies to consider. Paper records can be securely shredded, either on-site or through an off-site shredding provider. A formal certificate of destruction should be obtained, detailing the witness, location, and date of the destruction, mitigating potential legal repercussions.

Similarly, for EMRs, files can be deleted automatically upon the end of the retention period. However, files may still remain on hard drives, necessitating their destruction as well. As with paper records, a certificate of destruction is recommended.

While HIPAA does not specifically require document retention, it does emphasize preventing unwarranted disclosure. Compliance with state laws is a must for all medical entities regarding the retention period for medical records.

Length of Medical Record Retention for Doctors

Medical practitioners are also subject to guidelines for retaining medical records. Similar to hospitals, the timelines vary and are dictated by HIPAA laws, federal laws, and individual state legislation.

The timeframe can range from six years (as per HIPAA regulations) to seven years after the provision of medical services (as per federal law), and can even extend to ten years for Medicare patients. Therefore, it's crucial for practitioners to consult the specific regulations of their state.

Maintaining Medical Records Following a Patient's Death

The process of maintaining medical records following a patient's death is a critical aspect of healthcare administration that requires a meticulous approach. It involves a careful balance of legal obligations, ethical considerations, and practical necessities.

Key Considerations	Description
Understanding HIPAA Guidelines	HIPAA requires healthcare providers to retain medical records for a minimum of six years from the date of a patient's death.
Adherence to State Laws and Local Policies	Different states may have different laws regarding the retention and disposal of deceased patients' records. It's important to understand and comply with these rules.
Efficient Record-Keeping System	An organized record-keeping system, especially Electronic Health Record systems, can make managing, accessing, and disposing of deceased patients' records easier.
Maintaining Confidentiality	The confidentiality of the deceased's medical records should be protected as you would for any living patient. Any use or disclosure of the deceased's health information should be in line with HIPAA regulations and other relevant laws.
Planning for Record Disposal	When it's time to dispose of a deceased patient's records, it should be done in a way that maintains confidentiality. This typically involves shredding paper records or permanently deleting electronic ones.
Communication with Family Members	Clear policies should be in place for scenarios where a deceased patient's family members or loved ones need access to medical records. These policies should be communicated in a compassionate, transparent way.

Consequences of Retaining Medical Records Longer Than Required

While it may seem prudent to retain medical records for as long as possible, doing so can have several consequences. These include:

• Increased risk of data breaches and identity theft due to the prolonged storage of sensitive information.
• Increased storage costs for healthcare providers.
• Increased risk of malpractice lawsuits if the records are used as evidence in a case.
• Legal and financial penalties for non-compliance with state and federal regulations.
• Potential harm to patients' privacy and confidentiality if the records are not properly secured or destroyed.

Therefore, healthcare providers must strike a balance between retaining medical records for necessary periods and ensuring the privacy and security of such information.

Accessing Medical Records From the Past

Retrieving medical records from many years ago can be a challenging task, especially if the healthcare facility has closed down or the doctor has retired. However, there are several avenues you can explore:

Check Personal Documents

Firstly, check your personal documents. You might find copies of prescriptions, medical reports, or test results that you've saved over the years.

Request the Hospital

If you're unable to find records within your personal files, you can make a formal request to the hospital or clinic where you received treatment. The hospital might have a formal process in place for such requests.

Contact Insurance Companies & Doctors

If the hospital or clinic is unable to provide the records, you can contact your insurance company. Insurance companies tend to keep detailed records of treatments and medical procedures, and they may be able to provide you with the information you need.

In addition, you can also reach out to the doctor who treated you. If they are still practicing, they might still have your records or be able to guide you to where they may be stored.

Health Information Exchange (HIE)

In some cases, you can also approach a Health Information Exchange (HIE). HIEs are organizations that facilitate the sharing of health information electronically across different healthcare settings. They may have your old records if your healthcare providers participate in an HIE.

Release of Medical Records Laws

The release of medical records is governed by specific laws and regulations. These laws ensure that patient information is protected and only disclosed with appropriate authorization. Key points to remember include:

• All medical records belong to patients, and they have the right to control the information released to themselves or others.
• Information about a patient’s medical chart cannot be released without the patient's written permission. This permission must be dated and state who can access the released information, what type of information is being released, and the expiration date of the permission.
• Physicians or doctors must ensure that the medical records are being released only to authorized parties and individuals.

Conclusion

Navigating the complexities of medical record retention post-patient demise can be challenging for healthcare providers. Ensuring adherence to both legal regulations and institutional requirements is crucial.

These guidelines provide a general overview, but the specifics can vary depending on state laws, the type of facility, and any contracted healthcare plans. Staying informed about these requirements is instrumental in fulfilling our professional obligations while contributing to ongoing research and the improvement of healthcare services. As always, when in doubt, seeking legal advice is recommended.

FAQ

What happens to a patient's medical records when a healthcare facility closes?

When a healthcare facility closes, it is typically required to notify patients and provide them with information on how to obtain copies of their records. The records may be transferred to another healthcare provider or stored with a medical records custodian.

Can a patient request to have their medical records destroyed?

While patients have the right to access and amend their medical records, they generally do not have the right to have their records destroyed before the end of the legally mandated retention period. This is to ensure that necessary medical information is available for future care and legal purposes.

What are the potential consequences for healthcare providers who fail to retain medical records for the required period?

Healthcare providers who fail to retain medical records for the required period can face serious consequences. These can include fines, penalties, loss of licensure, and potential legal action if a patient's care is negatively impacted.

Who can access a deceased patient's medical records?

Access to a deceased patient's medical records is typically limited to the executor or administrator of the patient's estate or a person who has been designated by the patient in a HIPAA Release form. Laws vary by state, so it's important to consult with a legal professional to understand the specific rules in your area.

How are medical records typically destroyed after the retention period ends?

Medical records must be destroyed in a manner that protects patient privacy and complies with HIPAA regulations. This typically involves shredding, pulping, or burning paper records, and degaussing or physically destroying electronic media. A certificate of destruction is often required to document the process.