November 7, 2019
When decommissioning an EMR or PM system, it is important to know which records you need and how long you need to retain them. Your medical record retention plan need to accomodate both your practice’s data needs and the regulations with which you must comply. Several factors will influence your medical record retention needs: HIPAA requirements, federal regulations, accrediting agency regulations, state laws, the age of your patients, and the limits of your providers’ medical malpractice coverage. Due to the many influential factors at play, we always recommend that you consult with an attorney when planning a data archive or migration. Additionally, AHIMA is a good reference for up-to-date best practices. However, we have learned a thing or two over our 20+ years archiving healthcare data. These are our top medical record retention tips:
As a first step, it is helpful to research and document a medical record retention policy you can reference in the event of staff changes and emergencies. This policy should include where and how you plan to store records, appropriate length of retention times, and how staff will be trained to access the data and ensure HIPAA compliance.
You have several medical record storage options. They each have pros and cons. You can keep your legacy systems, but that requires continuing to pay for system licensing and support. Additionally, operating systems change frequently, and your old system can become a security risk as it becomes obsolete. PHI (patient health information) must be stored in a way that is compliant with both current and future standards. To that end, we recommend archiving data in an easy-to-access, cost-effective PDF archive. Decommissioning a legacy EMR system using a PDF archive as a retention platform delivers the best long-term savings because it requires no special supporting applications or operating environment.
Your data archive should not only comply with industry regulations, it should also meet your operational needs. Think about which types of records you may need to access in the future and how often. For example, patients may need to have their records forwarded to other providers, you may need to assemble statistics for CMS audits, or (depending on your specialty) your providers may need to pull records from your system when a patient returns after several years. Searching for and accessing those records should be just as easy or easier than it was in your original system. Your data archive vendor can work with you to set up organization and filtering within the PDF archive that makes sense for your practice. In our experience, patient name, record number, date of birth, and date of service are all good search options.
You can host your archive within your own network environment or in a cloud-based environment. Your hosting solution should align with the needs of those who will access the records. If information is primarily accessed by internal staff or providers, then you may wish to set up the archive in a secure internal network. If outside parties (such as attorneys or collection agencies) need access, or if the practice will be disbanded, it is more advantageous to host the archive in the cloud. A cloud-based solution allows multiple points of access. It is also a good option of your practice relocates to a closed environment, such as a hospital or university network. Those entities may not allow installation of an archive in their network. Cloud hosting is also preferred if you wish to minimize your internal IT responsibilities.
If you are decommissioning a legacy system, the considerations described above will provide a roadmap to secure, compliant, functional and cost-effective medical records retention.