Before You Shred Old Medical Files

We have become a disposable society, particularly where paper is concerned. Just pop those old bills or files into the shredder and they’re history—reduced to a state where the chances of unscrupulous lifting of credit card or bank account numbers is less than slim. We do it routinely.

But taking that action where medical records are concerned requires a bit more foresight. That’s because where retaining medical records is concerned, there are state and federal retention requirements governing those retention periods. Premature destruction of medical records could mean serious consequences for a physician’s practice.

Know the law

Leslie Fox is a program manager for Iron Mountain, which stores nearly one-third of the total medical records in the U.S. She explains that, in addition to state and federal law, there can also be industry retention requirements that must be met, which center on malpractice issues, compliance obligations and when physicians or patients leave a practice.

“It’s really the physician’s obligation to know and understand what the retention requirements are, then to put a policy or procedure in place and communicate those procedures to their employees,” Fox says. “If [physicians] don’t do that, the courts would perceive that as a major gap in communicating and following a consistent retention policy.”

State laws can vary. According to Jonathan Bertman, MD, FAAFP, a practicing family physician based in Rhode Island who founded the electronic health record system Amazing Charts in 2001, California requires records to be retained for 25 years after a patient’s last visit, while Connecticut only requires records are retained for seven years. But regardless of state requirements, Bertman says he can’t imagine personally shredding medical records.

“Those records are going to save me when there’s a problem,” Bertman says. “I feel like I’m very conscientious and do a good job documenting and caring for patients. Those records are proof of that work.”

Other side of the coin

Fox explains that, just as Bertman does, there are many hospitals that are not destroying records even after retention requirements are met. Instead, they retain them forever. However, that practice, she explains, can expose a health care organization to risk due to increasing privacy requirements.

In Massachusetts, the hospital is obligated to destroy records that contain personal information once the state requirements have been met. But Fox adds that, as far as she knows, there are no penalties issued by the courts for keeping records too long. The risk has more to do with the damage some records could do to a physician.

“It might be a smoking gun email that was kept far longer than retention requirements,” she says. “And because it exists, the physician has the obligation to produce it in the event of litigation. That’s a potential problem, so physicians need to weigh that risk.”

Electronic medical records don’t necessarily alter the landscape where retention requirements are concerned. Fox points out that whether medical records are in paper or electronic format, retention requirements are the same.

The stakes, however, might be greater where EMRs are concerned, Bertman says.

“In some ways, in terms of accidental release of information, [EMRs] seem much more dangerous to me,” he says. “Rather than just having them all in one locked office building where the local hooligans can rob you, you now have them where any international hooligan might be able to hack in and take them.”

Consistent and reasonable

Fox suggests that if physicians choose to retain medical records beyond the legally required retention period, they remain consistent. The courts, she explains, tend to look negatively on any inconsistencies.

“If some records are destroyed per retention requirements while others are not, that exposes the physician to more risk,” she says.

Physicians, Fox adds, should protect their reputation by making sure that all of the employees in their practice understand the rules involved with retaining records, especially patient records, and that there are written procedures to follow, that have been communicated to everyone on their staff, at all levels.

“It doesn’t need to be cumbersome to follow,” Fox says. “Just adopt a policy, and consistently follow it.”

Courts also consider what is reasonable. Fox says that if a physician has made best efforts, has trained employees, has a policy to follow, including state requirements or even his or her own business requirements to keep records, and has made all good efforts to do so, they will be a very good standing with the court, even if there is a one-time incident where regular procedures were not followed.

One More Dance, a book about one family's courageous battle against time and glioblastoma brain cancer.

Ed Rabinowitz recently wrote