Medical Records 101

Keeping Medical Records Safe

Medical record storage and release of records continues to cause problems. Although the patient owns the information, the physician is the keeper of the actual record. In order to safeguard medical records, practices need to know not only how to release the record but also how to safely store those records, especially since records must be kept for a number of years.

Are Your Medical Records Stored Safely?

One company apparently offers to release the original record when the patient signs a release or waiver. Another incident involved a record storage company that destroyed records without the physician’s knowledge or authorization. Initially, the company said that the records were destroyed pursuant to the physician’s written request but later acknowledged its error.

Every physician should review his or her contract with the record storage company carefully or seek a legal review to ensure that the storage company maintains the records securely and properly. You should confirm that the company cannot destroy records without your express, written authorization.

The Doctors Company recommends that, at a minimum, medical records for adults be retained for 10 years after the last date of treatment, and medical records for children be retained until their 28th birthday. In addition, make sure that the record storage company does not release the original record to the patient or to anyone, even if the company gets a “release” for the record. The original record should be retained in the event that there is future litigation and a copy needs to be provided to the patient or an authorized representative.

Medical Record Release

Since the medical record is a legal document that must remain confidential, knowledge of when a medical record can be released is essential to any medical facility and is a must for staff in the medical records department. Unauthorized release of medical information is a violation of the law.

Although the patient has the right to access his or her medical record, that record, including X-ray films, is the property of the medical facility. As such, the patient can be allowed to read his or her own medical records under supervision at a time when the staff is available. If there is information that would be medically or psychologically detrimental to the patient, a summary of the record can be prepared by the physician and given to the patient in lieu of reading the record. If the information is not considered to be detrimental, the patient may access either the record(s) or summary at a reasonable time that is convenient for the patient and the medical facility staff.

Generally, a patient’s records are accessible by the patient or his or her delegate upon completion of the appropriate authorization and payment of applicable fees.

When a provider determines that disclosure to the patient would be detrimental, the provider must still provide the patient’s records to a licensed medical practitioner or psychologist if authorized by the patient in writing. The provider may refuse to permit the patient to inspect or copy the record. In that case, the provider must do the following:

1. Document the date of the patient’s request and the reason(s) for the provider’s refusal, including a description of the anticipated detriment to the patient.
2. Inform the patient of the provider’s refusal.
3. Inform the patient of his or her right to require the provider to allow a licensed physician, licensed social worker, or licensed psychologist, designated in writing by the patient, to see or have copies of the patient’s records.

A patient has the right to refuse to disclose and to prevent others, including physicians, from disclosing confidential communications between the patient and his or her physicians except where the law requires or permits a provider to disclose patient records without the patient’s written authorization.

Staff Responsibilities

Staff responsibilities include the following:

• All healthcare employees are responsible for maintaining the security and confidentiality of patient records on behalf of the patient. This applies to the physical record and the information contained within it.
• Requests for information from the medical record should be referred to the office manager/physician.
• All copying of medical records for release to other individuals or agencies should be completed by, or coordinated with, the office manager/physician.
• A staff member who is uncertain about the appropriate response to a request for information, whether made by telephone or other communication, should not release the information until his or her supervisor has been consulted.
• All staff members should be aware of and responsive to the time constraints in responding to subpoenas.
• Inability to respond to release requests and subpoenas should be based on a legal or an administrative limitation.
• Special laws govern the release of mental health, substance abuse, and HIV test result information.

Note: For further information on retention of medical records, consult CMA ON-CALL document #1160, “Retention of Medical Records,” available free of charge to SDCMS-CMA members. To access CMA ON-CALL documents, visit www.cmanet.org. For further assistance, contact your SDCMS physician advocate, Marisol Gonzalez, at (858) 300-2783 or at MGonzalez@SDCMS.org.