Practice Brief: Protecting Patient Information after a Facility Closure (Updated)

Patients trust their healthcare providers to respect their privacy, maintain the confidentiality of their health information, and assure its availability for their continuing care. Providers must be concerned with the protection of health information when healthcare facilities close or medical practices dissolve.

Procedures for disposition of patient records¹ must take several factors into consideration, including:

• state laws regarding record retention and disposal, as well as statutes of limitation
  
• state licensing standards
  
• Medicare and Medicaid requirements
  
• federal laws governing treatment for alcohol and drug abuse (if applicable)
  
• guidelines issued by professional organizations
  
• the needs and wishes of patients
  

In some states, a state archive or health department will store health records from closed facilities. Generally, state regulations recommend records be transferred to another healthcare provider. If a healthcare facility or medical practice is sold to another healthcare provider, patient records may be considered assets and included in the sale of the property. If a facility closes or a practice dissolves without a sale, records should be transferred to another healthcare provider that agrees to accept the responsibility. If this is not feasible, records may be archived with a reputable commercial storage firm. Before records are transferred to an archive or another provider, patients should be notified, if possible, and given an opportunity to obtain copies of their health information. Patients may be notified of the opportunity to obtain copies by publishing a series of notices in the local newspaper. Only copies of the health records should be given to patients unless the required retention period has expired.

Background

During the course of treatment, patients share private details of their lives with physicians and other healthcare providers. Patients trust their healthcare providers to respect their privacy, maintain the confidentiality of their health information, protect the integrity of the information, and assure its availability for their continuing care. Because of this trust, healthcare providers must be concerned with the protection of health information when facilities close or medical practices dissolve.

Liability Issues

Generally, a healthcare provider remains liable for accidental or incidental disclosure of health information during or after a closure. Therefore, the provider must make appropriate plans to protect the integrity of the records and the confidentiality of the information they contain, while assuring access for continued patient care. State laws and regulations addressing facility or practice closure should be followed. These are usually available from the state department of health. If state laws and regulations are silent on how to proceed, the provider should consider several other factors, as outlined below.

Retention Issues

State Laws/Licensure Requirements

A provider is bound by applicable federal and state laws and regulations after closure, as well as during its operation. Many state health departments and licensing authorities govern healthcare facility closures and may outline to whom records should be transferred. In some states, a state archive or health department will store health records from closed facilities. More commonly, state regulations recommend records be transferred to another healthcare provider.

If records cannot be transferred to a state archive or state health department, the state's requirements for record retention for both adult and minor patients should be reviewed before a policy is formulated. (Note: Many states require approval from the state department of health or licensing authority before any plan is implemented.)

To minimize storage and/or transfer costs, the provider may wish to destroy records that are past the period of required retention. For example, if state law requires that records be retained for 10 years after the patient's last encounter, records that are more than 10 years old could be destroyed. If state law does not specify the length of time records must be kept, the provider must consider the state's malpractice statute of limitations for both adults and minors and assure that records are maintained for at least the period of time specified by the state's statutes of limitations. A longer retention period is prudent, since the statute may not begin to run until the potential plaintiff learns of the causal relation between an injury and the care received. If the patient was a minor, the provider should retain health information until the patient reaches the age of majority (as defined by state law) plus the period of the statute of limitations, unless otherwise provided by state law.

The provider should also contact its malpractice insurance carrier. Both the provider and the carrier must have access to patient records after the closure in the event a malpractice claim is filed.

Medicare Requirements

If the provider participates in the Medicare program, records must be kept in their original or legally reproduced form for at least five years from the date of the settlement of the claim to comply with the Medicare Conditions of Participation. Skilled Nursing Facilities and Home Care Agencies must retain their records for 5 years after the month the cost report was filed. (For example: Cost report for 1998 was submitted on 01/15/99 the records must be retained until 02/01/04.)

Federal Regulations re: Alcohol and Drug Abuse Treatment

If the provider has offered services pertaining to alcohol and/or drug abuse education, training, treatment, rehabilitation, or research, disposition of these records must meet requirements outlined by federal law.² When a program discontinues operations or is acquired by another program, this law requires the patient's written authorization for records to be transferred to the acquiring program or any other program named in the patient's authorization. If records are required by law to be kept for a specified period which does not expire until after the discontinuation or acquisition of the program and the patient has not authorized transfer of the records, these records must be sealed in envelopes or other containers and labeled as follows:

"Records of [insert name of program] required to be maintained pursuant to [insert citation to law or regulation requiring that records be kept] until a date not later than December 31, [insert appropriate year]."

Records marked and sealed as prescribed may be held by any lawful custodian, but the custodian must follow the procedures outlined by law for disclosure. If the patient does not authorize transfer of his records to another program, they may be destroyed after the required retention period.

Recommendations from Professional Organizations

Professional organizations should be contacted for guidelines or recommendations. Such professional organizations may include local or state:

• health information management associations
  
• hospital associations
  
• medical societies
  

Physicians who are closing their practices may wish to contact the American Medical Association and their state licensure board for guidance.

Legal Advice

Advice from legal counsel should be sought to determine the appropriate retention period, assure compliance with state laws and regulatory agencies, and help plan for an orderly closure or transfer.

Budgeting for a Closure

Regardless of which plan of action your facility institutes to deal with the patient records, resources will need to be allocated to carry out the plan. Some of the resources that need to be budgeted for include:

• labor
  
• copy equipment and supplies
  
• postage
  
• telephone
  
• utilities
  
• storage boxes and supplies
  
• transportation costs (to storage unit)
  
• storage and retrieval costs for required retention period
  

Recommendations

As soon as a healthcare provider anticipates a facility closure or dissolution of a medical practice, the provider should begin planning for proper disposition of patient health records. The primary objective is to assure future access by patients, future healthcare providers, and other legitimate users.

The second objective should be to protect the confidentiality of the information contained in the records.

To ensure accurate information for continuing care, all health information documentation must be completed before the records are archived. This includes transcription of all dictated reports and interpretation of any diagnostic tests.

Before records are transferred to an archive or another provider, patients should be notified, if possible, and given an opportunity to obtain copies of their records. Letters and or e-mail messages may be sent to former patients, or announcements may be repeated in local newspapers and professional journals to notify patients and their physicians about the upcoming closure/practice dissolution and let them know how to access their information.

Patients should be given a reasonable amount of time (at least one month, unless a longer time period is required by state law) to request copies of their records.

Elements to consider including in the letter and/or e-mail to the patient are as follows:

• the date the facility will close
  
• notification of where the records will be stored and how to access them
  
• a release of information authorization form to be completed to receive a copy of their medical record
  
• notification that only written requests for copies of health information will be honored
  
• notification of any time limitations (submission deadlines) on the period of time during which requests will be accepted
  
• instructions on how to seek a new healthcare provider
  

The custodian of the retained records should retain a copy of the actual letter and/or e-mail sent to patients, along with the mailing list, broadcast e-mail list, post office receipt, all returned (undeliverable) envelopes, and a list of returned or undeliverable e-mails.

If the records pertain to treatment for alcohol and/or drug abuse, specific federal regulations³ must be followed.

Closure/Dissolution with a Sale

If a healthcare facility or medical practice is sold to another healthcare provider, patient records may be considered assets and included in the sale of the property. As part of the agreement, the original provider who created the records should retain the right to access the records and obtain copies, if needed, from the new owners. In addition, if the new owner considers a sale to a third party, the original provider should retain the right to reclaim the patient records.

If the facility or medical practice is sold to a non-healthcare entity, patient records should not be included in the assets available for purchase. The provider should make arrangements to either transfer the records to an archive or another provider who agrees to accept responsibility for maintaining them.

Closure/Dissolution without a Sale

If a facility closes or a practice dissolves without a sale, arrangements should be made with another healthcare provider where patients may seek future care, unless otherwise required by state law. That provider should agree to maintain the records, permit access by authorized persons, and destroy the records when applicable time periods have expired.

Health information management professionals at the receiving facility should be familiar with record retention and destruction requirements and confidentiality concerns and have systems in place to allow patients and other legitimate users access to the information. Prior to transferring the records, a written agreement outlining terms and obligations should be executed. The original provider is responsible for assuring that records are stored safely for an appropriate length of time.

If transfer to another provider is not feasible, records may be archived with a reputable commercial storage firm. Such a firm should be considered only if it:

• has experience in handling confidential patient information
  
• guarantees the security and confidentiality of the records
  
• assures that patients and other legitimate requestors will have access to the information
  

If a storage firm is used, specific provisions should be negotiated and included in the written agreement. Such provisions include but are not limited to:

• agreement to keep all information confidential, disclosing only to authorized representatives of the provider or upon written authorization from the patient/legal representative
  
• prompt return of all embodiments of confidential information without retaining copies thereof upon the provider's request
  
• prohibition against selling, sharing, discussing, assigning, transferring, or otherwise disclosing confidential information with any other individuals or business entities
  
• prohibition against use of confidential information for any purpose other than providing mutually agreed upon services
  
• agreement to protect information against theft, loss, unauthorized destruction, or other unauthorized access
  
• return or destruction of information at the end of the mutually agreed upon retention period
  
• assurance that providers, patients, and other legitimate users will have access to the information
  

Providers may consider giving original records directly to patients, but only copies should be given to patients unless the required retention period has expired. During the required retention period, the provider may need access to the original records for the provider's own business reasons.

Regardless of the archival method used, the provider must assure that the integrity and confidentiality of the patient health records will be maintained and that the records are accessible to the patient and other legitimate users.

Acknowledgements

Assistance from the following individuals on this update is gratefully acknowledged:

Mary D. Brandt, MBA, RHIA, CHE, CHP
Jill Burrington-Brown, MS, RHIA
Alane Combs, RHIA
Michelle Dougherty, RHIA
Sue Gentilli, RHIA
Reesa Gottschalk, RHIA
Beth Hjort, RHIA, CHP
Sherri Hutchins, RHIA
Carol Quinsey, RHIA
Tracey Stanich Witherow, RHIA

Special thanks to KelliSue Montague, AHIMA executive assistant, and to all AHIMA component state associations.

Updated by:

Originally prepared by:

Mary D. Brandt, MBA, RHIA, CHE, CHP
Harry Rhodes, MBA, RHIA, CHP

Notes

1. Patient records may include paper, microfilm, optical storage, or computer-based health information, diagnostic images (such as radiology films, nuclear medicine scans, and cineangiography films), fetal monitor recordings, videotaped operative procedures, and information stored on other media.
2. Code of Federal Regulations 42 CFR Ch. 1 (10-1-85). [42 CFR Part 2 Subpart B, Paragraph 2.19]
3. Ibid.

References

American Hospital Association. Guidelines for Managing Hospital Closures. Report of the Ad Hoc Committee for Hospital Closures. Chicago, IL: 1990.

Centers for Medicare and Medicaid Services. Medicare/Medicaid State Operations Manual. Appendix A. Hospitals Interpretive Guidelines and Survey Procedure. Springfield, VA: US Department of Commerce, 1995.

Jaklevic, Mary Chris. "Hospital Closures Open Opportunities." Modern Healthcare 30, no. 48 (2000): 34–38.

Jaklevic, Mary Chris. "Trouble in the City." Modern Healthcare 31, no. 2 (2001): 52.

Lillie, Celine M. "Legal Issues in Closing a Medical Record Department," Journal of AHIMA 64, no. 5 (1993): 28–29.

Murer, Cherilyn, Murer, Michael, and Brick, Lyndean Lenhoff. The Complete Legal Guide to Healthcare Records Management. New York, NY: McGraw- Hill. 1999.

Tomes, Jonathan P. Healthcare Records: A Practical Legal Guide. Dubuque, IA: Kendall Hunt Publishing Company for the Healthcare Financial Management Association, 1990.

Tomes, Jonathan P. Healthcare Records Manual. Boston, MA: Warren Gorham Lamont, 1993.

Woodcock, Elizabeth. "Plan Ahead for a Smooth Closure of Your Practice." American Medical News 39, no. 28 (1996): 16.

Exhibit 1 — States with Laws/Regulations/Guidelines Pertaining to Facility Closure