While there are no specific time periods for general records under HIPAA, there are some periods for certain records. Under HIPAA, documents relating to uses and disclosures, authorization forms, business partner contracts
, notices of your information practice, responses to a patient who wants to amend or correct their information, the patient's statement of disagreement, and a complaint record must be maintained for 6 years. (See 64 Fed. Reg. 59994). This is the federal statute of limitation for civil penalties. (42 CFR Part 1003). It is the amendment why hospitals and other health care providers maintain medical records as well as billing records on Medicare (Title
XVIII), Medicaid (Title XIX), and Maternal and Child Health (Title V) for at least 6 years. Records must also be retained for two years after a patient's death under HIPAA. The Medicare Conditions of Participation, section 42 CFR 482.24 (b), states that all hospitals must retain medical records in their original or legally produced form for a period of 5 years.
Facilities should also give consideration to the statute of limitation, or time period for suing, in determining their retention policy
. Many facilities will retain the medical records of minors for longer periods of time, sometimes until they are at least 21 years of age. The medical records should be retained for a patient who institutes a malpractice or wrongful suit against a facility. Generally, facilities select longer retention periods because of the concern of having the medical records available for defense purposes for litigation
There are a number of other record keeping laws required by the federal laws that have specific record-keeping requirements. These are as follows:
* Fair Labor Standards Act: The Department of Labor
requires employers to comply with several record-keeping regulations related to wages, hours, sex, occupation, condition of employment for three years. This concerns records containing employment information, payroll, and certificates and for two years of basic employment and earning records, wage rate tables, work time schedules, order shipping and billing records, job evaluations, merit seniority systems and other documents that explain wage differences to employees
of the opposite sex in the same establishment. This also includes any deductions from or additions to pay. (29 CFR 516.2-516.6 and 516.11-29).
* Occupations Safety and Health Administration (OSHA): OSHA requires employers to keep records of both medical and other employees who are exposed to toxic substances and harmful agents. Employers must maintain these records for 30 years.
* Health and Human Services: Hospitals that participate in Medicare must keep medical records on each inpatient and outpatient, records of radiologic service, nuclear medicine including records for the receipt and disposition of radipaharmaceutics for five years. (42 CFR 482.24, .26, and .53). Psychiatric hospitals must maintain special records including development of assessment/diagnostic data, treatment plan, record progress, discharge planning, and discharge summary for 5 years.
* Health and Human Services: Facilities certified as comprehensive outpatient rehabilitation facilities (CORFs) under the Medicare program must maintain clinical records to justify the diagnosis and treatment plan. These must be maintained for 5 years after the patient is discharged. (452 CFR 485.60).
* Health and Human Services: Rural Health clinics that qualify for Medicare and Medicaid reimbursement must maintain medical records for at least six years from the date of the last entry. This retention period is longer in some states because they have a specific statute.
* Health and Human Services: Nursing facilities must retain records for clinical records for five years from discharge if no state requirement. The medical records of minors must be kept for three years after they reach the age of majority. (42 CFR 483.75).
* Health and Human Services: There are other many specific record retention requirements for various programs administered by the Public Health Service under 42 CFR, such as:
1. Institutions receiving grants for research projects (52.8),
2. Public or not for profit hospitals or schools receiving National Heart, Lung, and Blood institute grants under the National Cancer Research Demonstration Center. (52.8), and
3. Agencies receiving National Institute Grants (526.6).
* Internal Revenue Service (IRS): Facilities should keep copies of employment tax records (Social Security documents) for four years after the due date of the tax. If a claimant files a claim, it should be for four years after the date of the filing. (26 CFR 31.6001).
* Food and Drug Administration (FDA): Investigators of new drugs are required to keep records to show they did not discriminate against workers because of their age. (29 CFR 1627). Records of each employee with addresses, occupation, date of birth, and compensation earned must be kept for three years. Personnel records related to job applications such as promotion, physical examination results, aptitude tests, and advertisements have to be kept for one year.
* Employers Retirement Security Act: Any hospital or employer that has an employee benefit or pension plan must file a summary of the plan with the Department of Labor under the Employee Security Act of 1974 and keep records for not less than six years. (29 USC chapter 18).
* Welfare and Pension Plans Disclosure Act: Records must be kept for five years as required under this act for reports under the Welfare and Pension Plan. (29 USC 308).
* Federal Employee's Compensation Act: Hospitals and doctors who treat patients covered by this act must keep records of all injury cases including history, description of the injury, degree of disability, x-ray findings, treatment provided and other essential information. (20 CFR 10.410). This federal law only requires what information must be retained but not for how long.
* Civil Rights
Act and Equal Pay Act: Any employers that are covered by this act must maintain employment and personnel records of hiring, promotion, demotion, termination, transfer, layoff, pay raises, et al for six months from the making of the record of personnel action involved. They must be maintained until final disposition of any discrimination case. (29 CFR 1602.14).
The best advice is to send notices to all of the patients requesting instructions for their records. After that refer to the above periods, which would suggest 6 years would probably be a reasonable period.
I hope you found my answer helpful, please click on the GREEN ACCEPT button so that I can get credit for assisting you. Your question will not close, and you will still have the opportunity to follow-up if needed. Leaving a bonus and positive feedback is not required, but doing so is certainly appreciated!