Physician practices and even hospitals sometimes make the mistake of putting off decisions on record retention until they think it is time to clear out a storage facility or reduce their data storage expenses.

A better approach is to determine how long certain records should be kept and then establish a destruction date, says Jonna Eimer, JD, principal with Much in Chicago.

“Rather than looking at documents and asking if you’ve held on to this one long enough and can we throw it now, it is more effective to establish up front how long you are going to keep a document from the time it is generated,” Eimer says. “A lot of physicians don’t think about it until they are retiring or selling their practices, and then they have to look at these records and determine whether they can be destroyed, maintained in storage, or handed over to the purchaser of the practice.”

Failure to retain records long enough will run the risk of a lawsuit from a patient who needs access to past records that no longer exist, Eimer says. State and federal compliance penalties also are possible.

Retention periods vary according to state law, federal law, and the requirements of liability insurers. Eimer recommends assessing them and determining the longest retention period that applies to the organization. For instance, Illinois requires hospitals to maintain medical records for 10 years, but does not provide guidance for physician practices. Medicare and Medicaid require five years for some documents, HIPAA generally requires six years, and the Centers for Medicare & Medicaid Services requires 10 years for some managed care programs.

Malpractice insurers also usually have required retention periods, often five years or less, but they vary among insurers and states, she says.

“My thought is that I like to err on the side of caution, and that means for providers in my state I would recommend 10 years,” Eimer says. “I recommend that hospitals and physicians here retain records for 10 years since the last patient encounter, with the caveat that the statute of limitations might be longer in some situations and require a longer retention. The same formula can be applied for any provider in any state.”