Retention and Destruction of Health Information

Editor's note: This update supplants and combines the 2002 practice briefs "Destruction of Patient Health Information" and "Retention of Health Information."

Health information management professionals traditionally have performed retention and destruction functions using all media, including paper, images, optical disk, microfilm, DVD, and CD-ROM. The warehouses or resources from which to retrieve, store, and maintain data and information include, but are not limited to, application-specific databases, diagnostic biomedical devices, master patient indexes, and patient medical records and health information. To ensure the availability of timely, relevant data and information for patient care purposes; to meet federal, state, and local legal requirements; and to reduce the risk of legal discovery, organizations must establish appropriate retention and destruction schedules.† This practice brief provides guidance on record retention standards and destruction of health information for all healthcare settings.

Records Retention

The life cycle of records management begins when information is created and ends when the information is destroyed. The picture below provides a simple reflection of the entire records retention process. The goal for organizations is to manage each step in the record life cycle to ensure record availability. The creation of information is easy to establish, and most organizations do not have concerns when creating or using information. However, when maintaining information, various issues may arise.

Lack of file space and volumes of information are just a couple of issues that create labor-intensive maintenance processes for retrieval of health records. These issues necessitate a record retention schedule. Historical health record maintenance processes include various methods such as scanning to optical disk, use of microfilm or microfiche, and off-site storage of records. As new technology and media are developed and implemented, many organizations do not have the capability to go backward and scan records to free up storage space. As a result, health information resides in multiple storage media and locations creating the need for a clearly defined record retention plan.

At a minimum, record retention schedules must:†

• Ensure patient health information is available to meet the needs of continued patient care, legal requirements, research, education, and other legitimate uses of the organization
• Include guidelines that specify what information is kept, the time period for which it is kept, and the storage medium on which it will be maintained (e.g., paper, microfilm, optical disk, magnetic tape)
• Include clear destruction policies and procedures that include appropriate methods of destruction for each medium on which information is maintained

Federal Record Retention Requirements

There is no single standardized record retention schedule that organizations and providers must follow. Instead, a variety of retention requirements must be reviewed to create a compliant retention program.

To begin creating a record retention schedule, organizations and providers should use federal record retention requirements found within the Federal Register, and numerous acts such as the Higher Education Act of 1965 disclosure requirements (20 USC §1232g). The challenge is to ensure that these requirements are compared with state-specific requirements and that all records are maintained to the more restrictive timeline. See appendix A (table 3 from the June 2002 update of this practice brief) for a list of federal record retention requirements.

State Record Retention Requirements

Individual states have specific retention requirements that should be used to establish the organization's retention policy. Refer to your state laws for state-specific record retention requirements.

In the absence of specific state requirements, providers should keep health information for at least the period specified by the state's statute of limitations or for a sufficient length of time for compliance with laws and regulations. If the patient is a minor, the provider should retain health information until the patient reaches the age of majority (as defined by state law) plus the period of the statute of limitations. A longer retention period is prudent, since the statute may not begin until the potential plaintiff learns of the causal relationship between an injury and the care received.

In addition, under the False Claims Act (31 USC 3729), claims may be brought up to seven years after the incident; however, on occasion, the time has been extended to 10 years.

Organizations and providers should compare state retention requirements and statute of limitations with legal counsel when developing a record retention schedule.

Accreditation Agency Record Retention Requirements

Another mechanism that provides record retention guidelines is accreditation agency standards. Agencies such as the Commission on Accreditation of Rehabilitation Facilities , Det Norske Veritas, Medicare Conditions of Participation, and the Joint Commission have incorporated record retention schedules into their accreditation survey processes. See appendix C for a sample list of accreditation agency retention standards.

AHIMA Record Retention Recommendation

A final resource for record retention guidelines is AHIMA's recommendation for retention. Appendix D outlines AHIMA's recommendations for minimum record retention time periods in the absence of any federal, state, or accreditation requirements.

Additional Considerations

In addition, organizations with special patient populations need to go one step further in developing a records retention schedule. Special populations such as minors, behavioral health, or research patients may be governed by other regulations. The Food and Drug Administration, for example, requires research records pertaining to cancer patients be maintained for 30 years.

Comparing

Because no clear-cut standard has been established for record retention, comparing the variety of record retention requirements is often time-consuming and labor-intensive. Every organization should review and compare the varying retention schedules to follow the more restrictive requirement. An example comparison among federal, state, and accreditation requirements and AHIMA recommendations is shown below; the more restrictive requirement is shaded.

Active and Inactive Records

Once the retention schedule has been determined, the next step is to identify active and inactive records. "Active" means that the records are consulted or used on a routine basis. Routine functions may include activities such as release of information requests, revenue integrity audits, or quality reviews.

"Inactive" means that the records are used rarely but must be retained for reference or to meet the full retention requirement. Inactive records usually involve a patient who has not sought treatment for a period of time or one who completed his or her course of treatment.

Defining active and inactive records also may depend on other issues such as physical file space, the amount of research done, and availability of off-site storage. For example, because of limited file space, an organization may determine that records are active for a period of one year from the discharge date. After one year, the record is moved to off-site storage or scanned to a DVD and considered inactive. In this instance, inactive does not mean that the record can be destroyed because the record has not yet met its full retention requirement.

Each organization should determine a cutoff point (usually a discharge date) that signals the time at which a record becomes inactive. In determining the appropriate cutoff, consider the following:

• How often are the records accessed (e.g., daily, weekly, monthly)?
• What is the total retention requirement?
• What is the size of the record (a large long-stay record or a short emergency record)?
• What are the physical constraints (e.g., lack of file space, lack of off-site storage)?
• What activities or functions require routine access to the record (e.g., quality reviews, release of information)?

Identifying and maintaining active and inactive records is an important step in the successful maintenance of a filing system. Once the organization defines active and inactive records, the purge process can begin.

Purging

Purging is the act of separating active from inactive records in a filing system or database according to the retention schedule. Without a clear-cut purging method, the task can be daunting.

If the organization uses the discharge date as the cutoff date for inactive records, an additional consideration regarding the unit records is needed. A unit record is one in which the patient is assigned one medical record number. That medical record number remains the same for every visit the patient has, and individual visits are assigned unique account numbers that change with each new visit. Subsequently, when the record is filed, the patient may have one folder (based on the single medical record number) with multiple visits (account numbers) inside.

Maintaining the entire folder, with multiple discharge dates, on the shelf may not yield the purge results expected. Instead, organizations may choose to purge from the unit file all discharge dates identified as inactive. In this instance, file space is gained because only the most recent discharge date would remain as an active file on the shelf.

For example, Hospital A identified inactive records as any record with a discharge date before December 31, 2008. To purge, file clerks open each unit record and separate all discharges (inpatient and outpatient) before that date. The older files are sent to off-site storage. Below is an example of a unit record purge in which records before December 31, 2008, are considered inactive. The shaded records are those that would be sent to off-site storage for the remainder of the record retention schedule.

Record Number: 00-00-01

If Hospital A, listed in the example above, purges records every two years, the off-site storage location would continue to grow as records are added. To ensure that the organization is not trading one capacity-filled file room for another, records should be destroyed once the record retention period has been fulfilled.

The life cycle of a good record retention program does not end until information has been destroyed. Destruction is an important component to the record retention program because it completes the life cycle of a record. Because of storage capacity, fiscal restraints, and legal constraints, most organizations and providers are unable to maintain records indefinitely. There are requirements regarding record destruction that organizations need to be aware of when destroying information.

Destruction of Patient Health Information

Destruction of patient health information by an organization or provider must be carried out in accordance with federal and state law pursuant to a proper written retention schedule and destruction policy approved by appropriate organizational parties. Records involved in any open investigation, audit, or litigation must not be destroyed until the litigation case has been closed.

As with record retention, there is no single standard destruction requirement. Some states require organizations create an abstract of the destroyed patient information, notify patients when destroying patient information, or specify the method of destruction used to render the information unreadable. Organizations should reassess the method of destruction annually based on current technology, accepted practices, and availability of timely and cost-effective destruction services.

In the absence of any state law to the contrary, organizations must ensure paper and electronic records are destroyed with a method that provides for no possibility of reconstruction of information.

Examples of destruction methods are provided below:

• Paper record methods of destruction include burning, shredding, pulping, and pulverizing.
• Microfilm or microfiche methods of destruction include recycling and pulverizing.
• Laser discs used in write once-read many document-imaging applications are destroyed by pulverizing.
• Computerized data are destroyed by magnetic degaussing.
• DVDs are destroyed by shredding or cutting.
• Magnetic tapes are destroyed by demagnetizing.

Organizations must maintain documentation of the destruction of health records permanently and include the following (see appendix E for a sample form):†

• Date of destruction
• Method of destruction
• Description of the disposed records
• Inclusive dates
• A statement that the records were destroyed in the normal course of business
• The signatures of the individuals supervising and witnessing the destruction

Under the HIPAA privacy rule (45 CFR, Parts 160 and 164), when destruction services are outsourced to a business associate the contract must provide that the business associate will establish the permitted and required uses and disclosures and include the following elements:

• The method of destruction or disposal
• The time that will elapse between acquisition and destruction or disposal
• Safeguards against breaches
• Indemnification for the organization or provide for loss due to unauthorized disclosure
• Require the business associate to maintain liability insurance in specified amounts at all times

References

AHIMA. "Enterprise Content and Record Management for Healthcare." Journal of AHIMA 79, no. 10 (2008): 91–98.

May, Michael L., and Christina M. Martinez. "HIM Professional's Role in Enterprise Content Management: Stepping Out of the Department and Into the Organization." 2008 AHIMA Convention Proceedings, October 2008.

Nunn, Sandra. "Enterprise Content Management from the Ground Up." Journal of AHIMA 79, no. 2 (2008): 46–47.

Office of the Federal Register. Guide to Record Retention Requirements in the Code of Federal Regulations. Washington, DC: National Archives and Records Administration, 1994.

Prophet, Sue. Health Information Management Compliance: Model Program for Healthcare Organizations. Chicago, IL: AHIMA, 1998.

Russo, Ruthann. Seven Steps to HIM Compliance. Marblehead, MA: Opus Communications, 1998.

Strong, Karen. "Enterprise Content and Records Management." Journal of AHIMA 80, no. 2 (2008): 38–42.

Tomes, Jonathan P. Healthcare Records Manual. Boston, MA: Warren Gorham Lamont, 1993.

Washington, Lydia. "From Custodian to Steward: Evolving Roles in the E-HIM Transition." Journal of AHIMA 81, no. 5 (2010): 42–43.

Prepared by

Patricia Cunningham, MS, RHIA
Lou Ann Wiedemann, MS, RHIA, FAHIMA, CPEHR

Acknowledgments

Amber Bartlett, RHIA
Jill S. Clark, MBA, RHIA
Jane DeSpiegelaere, RHIA, CCS
Angela Dinh, MHA, RHIA, CHPS
Julie Dooling, RHIT
Colleen Goethals, MS, RHIA, FAHIMA
Angela Hammond, RHIT
Loretta Horton, MEd, RHIA
Gwen Jimenez, RHIA
Karen Kostick, RHIT, CCS, CCS-P
Monna Nabers, MBA, RHIA
Lori Nobles, RHIA
Mary Stanfill, MBI, RHIA, CCS, CCS-P, FAHIMA
Diana Warner, MS, RHIA, CHPS
Lydia Washington, MS, RHIA, CPHIMS

Prepared by (original)

Donna M. Fletcher, MPA, RHIA
Gwen Hughes, RHIA
Harry Rhodes, MBA, RHIA

Acknowledgments (original)

Roberta Aiello
Jill Burrington-Brown, MS, RHIA, FAHIMA
Jill Callahan Dennis, JD, RHIA
Jennifer Carpenter, RHIA
Sandra Fuller, MA, RHIA, FAHIMA
Margaret Joichi, MLIS
Kelly McClendon, RHIA
Julie Welch, RHIA