Coping with Copious Records

Patient charts, financial reports, employee records, tax documents--your practice generates an overwhelming volume of paper and electronic records. How long must they be saved?

There's no simple answer. Retention periods for some types of records are mandated by law (federal, state and/or local). When there is no established legal timeline, the holding period should be determined by common sense and a prudent approach to managing risk. For example, discarding records used to prepare a federal income-tax return before the IRS audit period expires isn't illegal, but it could result in a costly fine or penalty.

Business Records

Medical Records

What about medical records? According to the American Medical Association (AMA) Code of Medical Ethics (Opinion 7.05), physicians are obligated to keep records that may "reasonably be of value" to a patient. The AMA offers several guidelines, including the following.

• Medical considerations are the primary basis for deciding how long to keep a patient's medical records.
• In all cases, pertinent state law (if any) should be followed.
• Records should be kept at least as long as the statute of limitations for medical malpractice claims measured from the physician's last professional contact with the patient. (Laws vary by state.)
• Immunization records should be kept indefinitely.
• Records for patients covered by Medicare or Medicaid must be kept for five years or more.

Privacy Concerns

It's extremely important to safeguard both your patients' records and your business records. For electronic data, these precautions should be standard practice:

• Require the use of unique user IDs and passwords for all computer equipment.
• Protect laptops and peripheral memory devices with encryption.
• Program computers to lock automatically after a brief period of inactivity.
• Keep operating systems and virus protection software updated.

Take precautions to secure your paper records, too:

• Limit access to the chart storage area during office hours.
• Shred items that may have personally identifiable information
• Secure your office by restricting key and alarm code access after closing.

Please contact us with any questions.