Records retention: What records, for how long?

Requirements vary by state, institution

A patient’s record is invariably going to be with a health care provider far longer than the patient will be. How facilities handle records retention — what records they keep, in what format they’re stored, and for how long — varies from state to state, by specialty, and sometimes, by accreditation regulations. With the exception of Maine, every state and the District of Columbia have statutory requirements for the retention of health care records. The requirements range from five years to forever, with seven to 10 years being the average range.

Like many of her peers, Carol Carder, medical records manager for Levindale Hebrew Geriatric Center and Hospital in Baltimore, operates under a records retention policy based on state law and the requirements of her facility’s accrediting body, the Joint Commission for Accreditation of Healthcare Organizations (JCAHO). JCAHO, like the Com-mission on Accreditation of Rehabilitation Facilities (CARF), requires hospitals and long-term care facilities to establish records retention policies that conform to state law. (See chart, below.)

CARF, Tucson, AZ; JCAHO, Oakbrook Terrace, IL.

"In our case, that’s seven years. We keep them in house for two to 2½ years following discharge, and then they’re stored off-site," Carder notes. After seven years, the records are destroyed.

Most patient records in use and in storage are paper-based, requiring secure, fireproof storage facilities. Electronic records are making inroads into patient record keeping at Levindale Hebrew, Carder says, "but I probably won’t see records become fully electronic-based in my lifetime."

The American Health Information Management Association (AHIMA) recommends that specific patient health information be retained for established minimum time periods, based upon state and federal regulations. AHIMA advises health care providers to develop a retention schedule for patient health information that meets the needs of patients, physicians, researchers, and other legitimate users, and to keep the information available for use in continued patient care, in the event of legal action, and for applicable research purposes.

Keeping the records for at least seven years — or in the case of minors, for a period equal to the statute of limitations following the age at which the child reaches the age of majority (18 or 21 in most states) — offers protection in cases of legal action. In some cases, the statute of limitations does not commence until the potential plaintiff learns of a potential relationship between an injury and the care he or she received, and the federal False Claim Act allows claims for injury to be brought up to seven years after the incident, though that time has been extended to 10 years in some cases.

Availability of needed records is an issue when, like Carder, accessing a stored patient record means going to a locked, off-site storage facility and digging through paper records.

Electronic record keeping makes records more accessible by allowing them to be located via computer, but even electronic records are not perfect. "There’s no such thing as a totally secure system," says Ron Miller, MD, president of Chart Links, a New Haven, CT-based electronic information management company. "Electronic records can’t burn up in a warehouse fire, but even they are not totally secure. What they do offer, however, is accessibility and organization, and are easily redundant [copied], which is nearly impossible in a paper-based system," he adds.

AHIMA advises facilities to establish a retention schedule that spells out exactly what records are kept, where they’re stored, in what format (paper, microfilm, optical disk, magnetic tape, etc.), and for how long. This provides not only a guideline that staff can refer to, but offers protection in case of legal challenges.

The information to be retained should include clinical and medical records, health records, claims documentation, and compliance documentation; compliance documentation includes all records necessary to protect the integrity of the compliance process and confirm the effectiveness of the program, including employee training documentation, reports from hotlines, results of internal investigations, results of auditing and monitoring, modifications to the compliance program, and self-disclosures, according to AHIMA. To be safe, a facility should consult with its legal counsel in drafting its retention schedule.

Need more information?

  • Carol Carder, Medical Records Manager, Levindale Hebrew Geriatric Center and Hospital, 2434 W. Belvedere Ave., Baltimore, MD 21215. Phone: (410) 601-2276. Fax: (410) 601-2700.
  • Ron Miller, MD, President, Chart Links, 315 Peck St., Building 5, Suite 2A, New Haven, CT 06513. Phone: (203) 624-3844.
  • American Health Information Management Association, 233 N. Michigan Ave., Suite 2150, Chicago, IL 60601. Phone: (312) 233-1100.