Records retention is challenging for healthcare entities. The requirements are complex and there is a lack of harmony among state, federal, and accreditation requirements. State and federal regulations identify different documents you must maintain in a patient’s medical record and mandate different retention periods for the medical record.
Federal law typically requires the retention of medical records for five years. In contrast, states tend to mandate longer retention periods that average seven to ten years after a patient’s most recent visit. However, there are exceptions, such as Massachusetts, which requires the retention of medical records for at least twenty years. Mississippi is another exception, which requires different retention periods based on the type of patient, but mandates the destruction of certain medical records after twenty-eight years.
Nuances in state law may also require specific retention methods or impose additional requirements for certain healthcare entities. For example, Alabama requires hospitals to retain records for five years, but only requires physicians to retain medical records for as long as necessary to treat the patient. Similarly, Minnesota has a stringent requirement that requires hospitals to digitize medical records and retain them permanently, but allows nursing homes to forego the conversion and delete records after five years.
Although state law tends to mandate longer retention periods for medical records, federal law has more stringent requirements for medical records related to specialized services and treatments. These regulations may expand the scope of medical records, mandate longer retention periods, or identify different retention triggers not required by state laws.
For example, consider the distinct record requirements for medical imaging or dialysis services. Federal regulations require healthcare entities that perform mammography services to retain all film and reports for no less than ten years. Healthcare entities that perform dialysis services must centralize all clinical information in the patient medical record and retain it for at least six years after the patient’s discharge, transfer, or death.
There are also specific retention requirements imposed on healthcare entities that perform outpatient services, such as rehabilitation facilities and home health agencies. For instance, outpatient rehab facilities must retain medical records for five years from the date of a patient’s discharge, and the regulations dictate very specific content that must be retained as part of the record. Home health agencies must retain medical records for five years as well, but the retention period does not begin until the agency files the cost report related to the patient.
Finally, federal regulations allow government agencies to audit certain types of records maintained by a healthcare entity. Where you have knowledge of industry practices, such as government audits, you should account for the frequency and scope of the practices when determining appropriate retention requirements.
Accrediting agencies add an additional layer to the complexity. These agencies generally don’t mandate specific retention requirements, but they do require healthcare entities to have records readily available for surveyor review, and impose specific requirements on the types of records you must retain.
The Joint Commission, for example, allows healthcare entities to retain records in accordance with state and federal law, but requires entities to have records available dating back to the last full survey. Similarly, Det Norske Veritas requires the retention of receipt and disposition records for radiopharmaceuticals, but does not identify a retention period.
Since a deficiency can lead to a corrective action plan or worse, it is important to incorporate the accreditation standards into your retention policy alongside state and federal regulations.
Because of the competing retention requirements, healthcare entities often retain medical records permanently. But this is not an ideal or long-term solution. Permanent retention increases storage costs, is inefficient to manage, and exposes entities to heightened risks of data breaches. Instead, healthcare entities can benefit from a functional records retention schedule that allows for the disposal of medical records at specific intervals. A critical part of this task is to analyze the competing retention requirements and identify a retention baseline that walks the fine line between under- and over- retention of medical records.
Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.