Medical Records Retention Time-frames
If you Google “Medical Records Retention,” it says to keep records 4, 6, 7, up to 10 years or forever. That is why our call center at HCSI receives many questions about how long medical records need to be retained. Medical Records Retention (MRR) is a challenging issue. There are many variables. This entire newsletter is dedicated to helping explain a few of these variables.
The idea that records, either in paper or electronic form, should be saved for around ten years to comply with all requirements is an oft-touted rule of thumb. And it is often a good one. But, of course, there are exceptions. It is confusing! Unfortunately, there is no single "exact line" that describes federal, state, and other statutory laws that establish how long medical records must be maintained in every case. But we have assembled Ten MRR Rules to help you understand how long to keep your patient records. This list is not exhaustive, but it covers the majority of situations.
Why is it so important to properly maintain medical records?
Beyond the laws and regulations, at its core, your medical records retention policy should be based primarily on two principles:
1. Medical Considerations2. Continuity of Care for your practice and with other providers who care for your patients
Additional reasons for retaining medical records
1. Providing Patients with Information should they wish to access their records2. Protecting the Provider in case a legal claim is made in the future
a. Relying on the practitioner’s testimony of general habit and practice to show that the standard of care was met—without supporting documentation to establish the treatment that was rendered—often fails to convince a jury that the treatment the patient received was consistent with community standards.
3. Complying with Federal and State Laws for such things as billing audits4. MRR establishes the quality of care rendered in the event of a medical board or peer review inquiry.
a. Patient complaints are often based on an individual’s mistaken recollection of events or on a failure to understand the course of treatment or adverse consequences involved in the dispute. With complete charting, frivolous allegations are readily resolved, frequently well before a formal administrative process is even initiate
MMR Rule #1: Is it practical to keep all your records?
Should we begin thinking about keeping all records for 30 years or more?
With the advent of inexpensive high-speed storage, HCSI would like to suggest the idea that if all your medical records are electronic, they may be kept permanently. This would be helpful should access to patient information becomes necessary, as has been evidenced by litigation cases involving exposure to chemicals, drugs, or substances such as asbestos.
We realize that the storage of hard copy records makes permanent retention impractical; however,
Sound too expensive. It used to be. One estimate states that 2000 patient over 30 years could take up 4000 gigabytes of computer storage, or about 30 Terabytes. At today’s prices, a 30 TB hard drive can be purchased for under $1,000.
Another side of the coin
There’s another side of this that is sometimes suggested by law firms. Here’s the argument:
Destroying records, digital or otherwise, once their retention deadlines arrive lessens the volume of Protected Health Information (PHI) theft that is possible. Even if your backroom is locked and your health IT system offers top-notch encryption, security breaches and HIPAA violations can still occur.
There’s no reason to leave any patient information – especially data that’s unnecessary to retain – vulnerable to being compromised. As long as you keep documented records of all destructions, proper disposal of old data is the best way to ensure patient confidentiality is upheld. If you’ve got plenty of space at your practice for stowing old paper records, you may be tempted to hang on to them forever, if only to avoid the hassle of electronic archiving or digging through them to determine what you can pitch.
So comb through your old charts, dig through your electronic data and destroy what no longer needs to be retained.
MRR Rule #2: Coordinate State and Federal laws
Whichever law instructs you to keep medical records the longest prevails
Know your State Laws:
- Providers must comply with individual state regulations on Medical Record Retention (which often differ from the national standards) and their states’ statutes of limitations on malpractice lawsuits.
- If Federal laws require individual medical records to be kept 10 years and your state law says 12 years, keep them 12 years – and vice versa. This rule applies to all other retention laws.
- You can find the state laws on retention periods for your state and practice type at: (PDF)
MRR Rule #3: Maintain a policy for retaining your medical records
Share it with your staff and patients
Share your medical record retention rules with your entire staff and new employees
Even a simple practice such as holding a meeting (and making a record of it) to go through the rules in this newsletter will help your staff understand the importance of medical records. You can customize your policies based on your specialty and needs.
Some practices provide a summary MMR policy to new patients as part of their "introduction to the practice" materials.
When new patients are informed in advance about how their medical records will be handled, there is substantially less likelihood of a complaint to the Medical Board if/when a practice is closed. Be sure current and future patients at some point receive assurance about their medical records. This may be as simple as a paragraph at the top or bottom of an intake form that says something like. “At ABC Medical, we carefully maintain and protect your private medical records according to all federal and state laws. Should you at any time desire access to these records, please consult with your physician or our staff.”
Have your MMR policy reviewed
It is a wise idea to check with your medical liability insurance carrier and legal representative before finalizing your policy. They have experience defending other practice policies.
MRR Rule #4: MINORS: Typically 3 Years after they reach majority
Consult State/Federal/Hospital/etc. laws and retaining them for whichever is longest
- Typically Age of Majority is 18-20.
- A typical exception for minors is hospitals usually require age of majority plus 6 years.
- Once a minor reaches majority, the adult retention recommendation applies, e.g., 10 years from the last medical service for which a medical entry is required.
- If a lawsuit is filed, it is essential to note that the statute of limitations may not begin to run until the plaintiff (patient) learns of the causal relationship between an injury and the care received.
- The American Academy of Pediatrics recommends that, at a minimum, pediatric records should be retained for 10 years or the age of majority plus the applicable state statute of limitations (time to file a lawsuit), whichever is longer.
MRR Rule #5: Adults: 7-10 years
Measured from the date of the last medical service for which a medical entry is required.
- In some instances Federal law mandates that a provider keep and retain each record for a minimum of 7-10 years from the date of last service to the patient, we recommend keeping them for a minimum of 10 years.
- For Medicare Advantage patients, 10 years.
- Deceased adult patients: 10 years from the time of death. State exceptions may apply.
MRR Rule #6: Legal matters: Keep accruing’ ‘till they’re all done suin’
In other words, maintain medical records as long as they might be used to defend against a malpractice allegation.
- Should you ever discover or suspect that legal action is pending from a patient, be sure to save his relevant records, even if you’ve already kept them past their other retention deadlines.
- No destruction is allowed once you have knowledge of the litigation.
MRR Rule #7: OSHA: 30 years
For workplace injuries, if OSHA was involved, keep them for 30 years after the last date of service.
MRR Rule #8: Veterans: 70 years - Indefinitely
- Be prepared to store vet charts for a long time – 75 years.
- If a patient was not mentally competent at the time of treatment, retain the records indefinitely.
MRR Rule #9: HIPAA: 6 Years
Six years from when the document was created, or – for policies – from when it was last in effect
- According to the Department of Health and Human Services, the HIPAA Privacy Rule has no requirements for medical record retention at a doctor's office. Only HIPAA Related documents. How long a doctor is required to keep a chart is based on what each state's legislation decides. So, Tennessee's medical record retention rules may completely differ from Georgia's and so forth.
- Although there are no HIPAA retention requirements for medical records, there is a requirement covering how long HIPAA-related documents should be retained. This is covered in
- CFR §164.316(b)
- While the HIPAA Privacy Rule does not determine how long a chart must be kept at a doctor's office, it does; however, require that any covered entities apply all safety guidelines necessary to protect the privacy of all patients,
- As with all these rules, states requiring less than six years, health organizations must still retain HIPAA information for six years – the longer of the two rules.
- Notices of Privacy Practices.
- Authorizations for the Disclosure of PHI.
- Risk Assessments and Risk Analyses.
- Business Associate Agreements.
- Employee Sanction Policies.
- Incident and Breach Notification Documentation.
- Complaint and Resolution Documentation.
- IT Security System Reviews (including new procedures or technologies implemented).
MRR Rule #10: Rule of Thumb Rule: 10 years and 28 years
When all else fails
Where no statutory requirement exists, and no legal threat is imminent, HCSI makes the following
- Adult patients, 10 years from the date the patient was last seen.
- Minor patients, 28 years from the date of birth.
