When closing a medical facility or practice, the first item that must be considered is how long the records must be stored. Mistakes often occur at this stage, because there are many sources of information on this topic, however these sources often conflict with each other. Typically, a provider will simply look up the medical records retention for their state or contact their malpractice insurer about state law, assuming that verification is sufficient. That chosen retention may fail to include different retention periods for certain record types or fall short of federal standards. While the HIPAA laws leave the patient medical record retention up to individual states, the HIPAA laws still require other related documents to be stored for six years, and the Centers for Medicare & Medicaid Services (CMS) requires Medicare and Medicaid records be held for ten years.

Once the correct retention is determined for your records, the decision on how to manage them should take into account the entire lifecycle of the records, to accurately determine your total cost of the solution. In addition to the cost analysis, you must decide if you (or whoever else you designate) will be available and willing to manage the required processes every day for the next six, ten, or twenty-plus years, depending on your record types. This is another common miscalculation – that once a practice closes, after the first few months, activity will subside. Immediately after closure, the records activity is initially high for patients, but continues on for years, as subpoenas, litigation, insurance claims, and audits require ongoing attention. The decision for managing closed facility records must include the potential ongoing and variable costs, along with the disruption associated with managing the records post-closure.

Looking at the entire life cycle of records beginning at the point of closure, here are the components that must be considered from a total cost of ownership perspective:

• Gather and/or Export records from physical and electronic sources, including the conversion cost and effort to eliminate ties to any external sources.
• Transport and transfer the records into the location where they will reside through the required retention period.
• Index or organize the records in a way that ensure they can be found when needed.
• Ensure the location where records will be stored, and the processes to retrieve them, are secure, including access, fire, and data redundancy protections.
• Store all records for the required retention period.
• Determine who is responsible for handling Release of Information, including receiving and managing the requests, accessing and copying the information, and sending the records in a HIPAA-compliant manner, which still includes numerous entities that require records to be printed, mailed, or faxed.
• Securely destroy all the records once retention is met.

Add up all the known costs, then factor in variable or uncapped costs, and the nuisance factor that comes with managing Release of Information for many years. Divide all those costs by the total number of months required, then compare that figure to an all-inclusive custodial solution. You may be surprised at the result. Whatever you decide, for your own sake, don’t take shortcuts as the risk and potential costs of managing the records either on your own, or with a Business Associate who does not strictly follow the laws, is exponentially greater than the few dollars in savings provided by such a move.  

For more information, check out our Solutions Brief here. If you need more information or would like to speak with one of our experts, contact us today.