Medical Record Retention Guidelines

When it comes to medical record retention laws, most states have their own rules as to how long medical records should be held by physicians and hospitals. But with the enactment of HIPAA in 1996, Medicare record retention requirements in some instances supersede state laws. HIPAA’s administrative simplification rules require a covered entity, including health plans, healthcare clearing houses, and healthcare providers who transmit any health information (a physician billing Medicare), to retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. Individual states may require a longer retention period. If not, the HIPAA requirements preempt the shorter state laws. A full explanation of HIPAA documentation rules can be found under Standard 45 CFR 164.316(b)(2).

Under the HIPAA Privacy Rule, covered entities must apply appropriate administrative, technical and physical safeguards when it comes to protecting the privacy of medical records and other protected health information (PHI) for the period that the entity must maintain the records and through disposal. For examples of proper disposal methods and other requirements, refer to the Privacy Rule at 45 CFR 164.530(c).

When it comes to cost reports, the Centers for Medicare & Medicaid Services (CMS) requires these records to be maintained in their original or legally reproduced form for a period of at least five years after the closure of the cost report. Further details on all CMS records disposition schedules  can be accessed at the CMS Records Schedule.

CMS does not have specific requirements for the media formats for medical records, but documents do need to be in their original form or a legally reproduced form (which can be electronic) so that medical records may be reviewed and audited by authorized entities.

Physicians, non-physician practitioners, suppliers and providers should maintain a medical record for each Medicare beneficiary who is their patient. These records must be completed promptly, accurately written, easily accessible, properly filed and maintained. It’s a good practice to implement a system of author identification and record maintenance to safeguard all medical record entries and protect their security.

The KB Healthcare Consulting team works with healthcare providers to adopt medical records retention systems for their practices. Providers may also want to work with their legal partners for up-to-date information on changes in regulations and statutes when it comes to medical records retention, maintaining records after these time periods and proper medical document formats.

If you’re a healthcare provider and need further information regarding medical record retention requirements, contact Kathleen A. Hargreaves with KB Healthcare Consulting at 941-365-4617 or .