Practice Brief: Retention of Health Information (Updated)

Health information management professionals traditionally perform data and information warehousing functions (e.g., purging) utilizing all media including paper, images, optical disk, computer disk, microfilm, and CD-ROM. These warehouses or resources from which to retrieve, store, and maintain data and information include, but are not limited to, application-specific databases, diagnostic biomedical devices, master patient indexes, and patient medical records and health information.

One data integrity characteristic of warehousing is relevancy of data or information. To ensure the availability of relevant data and information, appropriate retention schedules must be established. To support this requirement, the following information has been compiled. It includes AHIMA's retention recommendations (see Table 1), accreditation agency retention standards (see Table 2), federal health record retention requirements (see Table 3--PDF file), and state laws or regulations pertaining to retention of health information (see Table 4--PDF file).

Recommendations

• Each healthcare provider should ensure that patient health information is available to meet the needs of continued patient care, legal requirements, research, education, and other legitimate uses
  
  
• Each healthcare provider should develop a retention schedule for patient health information that meets the needs of its patients, physicians, researchers, and other legitimate users, and complies with legal, regulatory, and accreditation requirements
  
  
• The retention schedule should include guidelines that specify what information should be kept, the time period for which it should be kept, and the storage medium (paper, microfilm, optical disk, magnetic tape, or other)
  
  
• Compliance documentation
  • Compliance programs should establish written policies to address the retention of all types of documentation. This documentation includes clinical and medical records, health records, claims documentation, and compliance documentation. Compliance documentation includes all records necessary to protect the integrity of the compliance process and confirm the effectiveness of the program, including employee training documentation, reports from hot lines, results of internal investigations, results of auditing and monitoring, modifications to the compliance program, and self-disclosures
    
    
  • The documentation should be retained according to applicable federal and state law and regulations and must be maintained for a sufficient length of time to ensure their availability to prove compliance with laws and regulations
    
    
  • The organization's legal counsel should be consulted regarding the retention of compliance documentation
    
    
• The majority of states have specific retention requirements that should be used to establish a facility's retention policy. In the absence of specific state requirements for record retention, providers should keep health information for at least the period specified by the state's statutes of limitations or for a sufficient length of time to prove compliance with laws and regulations. If the patient was a minor, the provider should retain health information until the patient reaches the age of majority (as defined by state law) plus the period of the statute of limitations, unless otherwise provided by state law. A longer retention period is prudent, since the statute may not begin until the potential plaintiff learns of the causal relationship between an injury and the care received. In addition, under the False Claims Act (31 USC 3729), claims may be brought for up to seven years after the incident; however, on occasion, the time has been extended to 10 years
  
  
• Unless longer periods of time are required by state or federal law, the American Health Information Management Association recommends that specific patient health information be retained for established minimum time periods. (See Table 1.)

Table 2: Accreditation Agency Retention Standards

Table 3 & 4 are saved as PDF files. You can download and view the files using Adobe Acrobat Reader.

Table 3

Table 4

Prepared by

Harry Rhodes, MBA, RHIA, Director of HIM Products and Services

originally prepared by
Donna M. Fletcher, MPA, RRA, HIM practice manager

Acknowledgments

Roberta Aiello
Jennifer Carpenter, RHIA
CSA central office coordinators, executive directors, presidents, and legislative committee officers
Sandra Fuller, MA, RHIA
Margaret Joichi, MLIS
Harry Rhodes, MBA, RHIA
Julie Welch, RHIA

Notes

This practice brief replaces an earlier practice brief published in the January 1997 Journal of AHIMA.

Laws addressing health information continue to evolve. Consult with legal counsel regarding recent legislation and/or the advisability of retaining records for longer periods of time.

Prior to disposing of records, review AHIMA's practice brief "Destruction of Patient Health Information," originally published in 1996, updated in the April 2000 Journal of AHIMA.

References

Department of Health and Human Services. Office of Inspector General's Compliance Program Guidance for Hospitals, February 1998. Available at OIG Releases Compliance Program Guidance for Hospitals .

Legal Issues for School-based Programs Handbook. New York, NY: Legal Action Center, 1996.

Office of the Federal Register. Guide to Record Retention Requirements in the Code of Federal Regulations. National Archives and Records Administration, Washington, DC: 1994.

Prophet, Sue. Health Information Management Compliance: Model Program for Healthcare Organizations. Chicago, IL: AHIMA, 1998.

Russo, Ruthann. Seven Steps to HIM Compliance. Marblehead, MA: Opus Communications, 1998.

Tomes, Jonathan P. Healthcare Records Manual. New York, NY: Warren Gorham LaMont, 1994.

Related AHIMA practice briefs:

• Protecting Patient Information After a Facility Closure (March 1999)
• Data Quality Management Model (June 1998)
• Destruction of Patient Health Information (January 1996- Updated April 2000)

Issued June 1999 (Updated June 2002)