Minimizing liability risks with effective records retention policy

By Angela L. Carr and Sara E. Sweeney

Rhode Island law requires medical practices to safely and confidentially maintain a patient’s records for a minimum of five years unless otherwise required by law or regulation.

An effective record retention policy can minimize the liability risks of this recordkeeping mandate.

What are those risks? Court sanctions and adverse jury instructions can result from the inadvertent destruction of patient records in the context of pending litigation or being on notice of potential litigation. Another risk is an inadvertent disclosure of medical information that violates laws protecting patient privacy.

Aside from legal risks, medical practices potentially face storage constraints and unnecessary costs if they store records beyond the time required under law. And if your practice has paper and electronic records, complications can arise if you do not maintain consistent storage and destruction procedures.

Benefits of formal records retention policy

A record retention policy essentially routinizes document retention and reduction, which:

  • minimizes inconsistent internal practices;
  • establishes benchmarks and rules consistent with Rhode Island and federal law; and
  • defines consistent practices and procedures for personnel to follow.

These objectives are particularly important for avoiding an inadvertent breach of patient privacy and/or an inadvertent destruction of records related to litigation or other legal actions.

Equally as important as having a records retention policy is consistently using and implementing it. A policy does not need to be lengthy or complicated. The key is to create one and follow it routinely.

An effective policy goes hand in hand with an organized system for keeping and maintaining paper and/or electronic records.

Litigation hold

An effective record retention policy will include a “litigation hold” provision. A litigation hold is triggered by notice of a claim, lawsuit, audit, or government action, and requires a medical practice to maintain all records/materials related to the claim.

A litigation hold preserves documents that would be otherwise destroyed pursuant to a records destruction policy. It should apply to a broad sweep of potentially relevant documents, including paper files, e-records, emails, attachments to emails, calendars, and internal notes.

To minimize business disruption, a record retention policy should identify the person or person(s) who will respond to documents requests.

Best practices

A new requirement under HIPAA requires medical providers to maintain “administrative documents” for six years. In light of this requirement, it is advisable to retain records for at least six years, even though Rhode Island regulations require medical records to be maintained for five years after the last contact with a patient (in the case of a minor, five years after the age of majority).

The HIPAA regulation is not entirely clear on whether the term “administrative” encompasses medical records. Nonetheless, it’s wiser to err on the side of caution and maintain all patient records for a minimum six years.

In addition to regulatory requirements for maintaining patient records, the American Medical Association has stated that medical considerations are the primary basis for deciding how long to retain patient records. AMA Ethics Opinion 7.05.

The AMA also advises medical practices to preserve patient confidentiality by destroying records no longer deemed medically necessary and that are beyond any regulatory retention period. AMA Ethics Opinion 7.05.

Patients should receive advance notice that records will be destroyed in accordance with a record retention policy, and should be given the opportunity to obtain copies. Another best practice is to send letters to patients advising them of records that have been destroyed.

To properly track the history of medical records, practitioners should include destruction notices in patient files that list what documents have been destroyed and when. This important administrative step will avoid any uncertainties in the future.

Other must-haves in a record retention policy are:

  • Stating the purpose of the policy;
  • Designating a person or person(s) responsible for overseeing the policy, overseeing the destruction or records, and responding to documents requests;
  • Specifying how long your organization will maintain records;
  • Indicating the method of storage of information (e.g., paper, electronic, microfilm); and
  • Detailing the method by which each storage medium is destroyed.

Angela Carr is a partner at Barton Gilman LLP. She has devoted her career to the defense of clients in medical professional liability cases. Angela also advises practice groups and medical institutions on health care risk management and employment issues. Sara Sweeney is a former Rhode Island Supreme Court Clerk and an experienced medical defense attorney who represents medical professionals in Rhode Island and Massachusetts.