When it comes to medical records, do you know the laws for retention and formatting? Historically, state laws have governed how long a patient’s medical records were retained; however, the Health Insurance and Portability Act of 1996 (HIPAA) outlines specific administrative simplification rules that require a covered entity (such as a physician billing Medicare) to retain required documentation for 6 years from the date of creation, or the date when last in effect, whichever is later. While some states require a longer retention period, for those states requiring less than 6 years, HIPAA requirements would preempt state law.
Of course, the HIPAA Privacy Rule encompasses more than medical record retention requirements, setting forth rules for appropriate administrative, technical and physical safeguards to be put into place to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, which includes disposal. The Privacy Rule can be reviewed in its entirety at 45 CFR 164.530(c).
For Medicare managed care program providers, the CMS requires retention of a patient’s medical records for 10 years. Providers/suppliers should maintain a record for each Medicare beneficiary who is a patient. Medical records must be accurately written, promptly completed, accessible, properly filed and retained. It’s a good practice to use a system of author identification and record maintenance to ensure the integrity of the authentication and protect the security of all record entries. Details of this CMS requirement can be accessed at 42 CFR 422.504 [d][iii].
When it comes to media formats for medical records, the Medicare program does not currently have specific requirements; however, the medical record needs to be in its original form or in a legally reproduced form (which may be electronic), so that medical records may be reviewed and audited by authorized entities. Providers must have a medical record system that provides for prompt access and retrieval of files.
To ensure proper compliance with medical record retention beyond standard time periods and appropriate formatting of records, providers may want to obtain legal advice from an attorney who specializes in health care law.