Conversion to electronic health record and retention of paper records

Editor’s Note: Due to the continued popularity of this post, this article was reviewed and updated on September 30, 2013. For the later version, click here.

Update: On August 8, 2010, Medicare issued MLN Matters Article SE1022 on Medical Record Retention and Media Formats for Medical Records, which states that the Centers for Medicare and Medicaid Services (CMS) requires records of providers submitting cost reports (most hospitals) to be retained in their original or legally reproduced form (which may be electronic), for at least 5 years after closure of the cost report.

Many hospitals have electronic health records (EHRs) that are hybrid digital records. While the hospital may be using electronic data entry in the ER, inpatient nursing care, pharmacy, lab, and pre-op anesthesia, oftentimes, these EHRs are not integrated and, thus, are not merged into a single EHR. The short-term solution may have been to scan printed records from some department, like lab or pharmacy, into the patient’s on-line digital record. As a result, the hospital’s “electronic health record” contains information that is not captured in a “coded format.”  For one, this will not meet the Stage One “meaningful use” criteria under the HITECH Act.

But let’s assume that the hospital can overcome this hurdle by working with vendors to integrate these records in a way that will meet HITECH EHR certification standards.  If the hospital has been maintaining certain portions of patient records in a paper format, what does it do with those paper records after converting to an EHR?   If the hospital scans all the paper patient records into its EHR, how long should the hospital retain the paper record after it is scanned into their EHR? 

Currently, there is very little specific guidance speaking to retention of paper records subsequent to EHR conversion.  In other words, once paper records are scanned, they are, in fact, being retained on electronic storage media.  However, if the paper record is being reentered into the EHR in  the required “coded format,” is that the same as the original record? Given that the broadening EHR world is in its infancy, retention of paper records for a sufficient period of time is likely the wisest course of action in either scenario.

Liability Insurance Requirements. As an initial matter, review your malpractice insurance and seek guidance as to the expectations of your insurer with regard to record retention.  Some carriers have actually issued direct policy-requirement statements covering record retention in the context of EHR conversion.  Your carrier may have a requirement or other guidance that would be useful in formulating or revising your record retention policy.

Malpractice Claims. Another important consideration is to determine the appropriate malpractice or negligence statute of limitations under applicable state law.  For example, in Kentucky, under KRS 413.140(1)(e) “an action against a physician, surgeon, dentist, or hospital . . . for negligence or malpractice” must be brought within one (1) year.  Under KRS 413.140(2), the one-year clock starts when the injury is first discovered or when “in the exercise of reasonable care should have been discovered.”  Ultimately, an action must be commenced within five (5) years from the date on which the alleged negligence is said to have occurred.  This five-year limitation places a cap on how long a potential negligence/malpractice plaintiff has to bring suit against the health care provider and, therefore, how long such records are generally relevant in the malpractice context.  However, the paper record may need to be kept longer in cases involving minors, an individual with a “disability”, or in death cases where statutes of limitation may be extended to allow time to appoint a representative of the estate.

State licensing authorities. Review the licensing and Medicaid regulations applicable to your organization. And, speak to your state licensing agency to get their take on how long to keep paper records that have been either scanned to PDF or entered into the EHR in a coded format. Individuals within the Kentucky OIG, for example, have indicated that as long as the records can be accessed and accurately produced, there is no requirement to retain the paper versions. It is essential to weigh the regulatory authority viewpoint against the risk of exposure to a spoliation claim.

Federal Law and Medicare. Consider the ramifications of defending a federal fraud and abuse action in the absence of the “original” paper record.  The Civil False Claims Act, 31 U.S.C. § 3729, is most often cited when establishing the upper limits of federal fraud and abuse statutes of limitation.  Section 3731(b)(2) provides that in no event may such an action be brought more than ten (10) years after the date on which the violation is committed.  This may not mean that you keep all paper records for ten years, but this must weigh into the development of your retention policy. 

Other federal law considerations include the Medicare conditions of participation for hospitals, which require that medical records “be retained in their original or legally reproduced form for a period of at least five (5) years.” (42 C.F.R. 482.24(b)(1).) Though it would seem extremely unlikely that conversion of a record to an EHR would not be viewed as a “legally reproduced form,” retaining the paper records of Medicare patients for five (5) years is a consideration.  Also consider applicable FDA regulations if any research is conducted in your facilities, as well as any occupational health regulations related to retention of occupational health records.

Electronic record image must be identical to the paper. The Medicare General Information, Eligibility and Entitlement Manual, Pub. 100-01, Ch. 7, § (the “General Manual”) contains a section addressing “Disposition For Medicare Records that are Imaged/Scanned.” The General Manual provides that imaging can be used to replace paper documents “only when the image will be identical to the paper . . . .” (emphasis in original).  The General Manual goes on to state that a contractor “must retain the paper records until their certification/quality assurance process . . . has been completed and the imaged information . . . is verified as an identical replication of the paper document.  Only then can the paper records be destroyed.” The General Manual also sets forth a “sample quality assurance procedure,” which illustrates the emphasis CMS places on quality control when scanning records into an EHR.

Accordingly, quality control becomes extremely important when scanning paper documents onto electronic storage media. Your policy should include a method to verify that the image maintained on electronic media is identical in every way to its paper source – this includes all writing and text in margins, footnotes, etc.  Quality control in record conversion and retention is crucial to ensuring that text that runs to the edge of a page does not get cut off or become illegible after the document is scanned.  If you are considering converting paper records to a “coded format,” the resulting record would not seem to meet the “identical” image requirement, especially if you are unable to retain the context in which notes on the original record were made.

Destruction of Evidence. Destroying records in compliance with an established, written internal policy is extremely important. In  U.S. and Aflatooni v. Kitsap Physicians Service, et al., 314 F.3d 995 (9th Cir., 2002),  the Court found that the defendant, a pathology group, did not engage in spoliation of evidence in a qui tam action when it destroyed relevant billing records after six years pursuant to a retention policy implemented in accordance with state and federal regulations, in the normal course of business, and more than two years before the relator initiated the action. However, the Court noted that the defendant would have engaged in spoliation of evidence as a matter of law if it had notice that the documents were potentially relevant to the litigation prior to destruction.

Summary. There is no single answer for how long to keep the original paper patient records. The CMS view seems to be that once records are converted to electronic storage media, and the converted image is identical to the original, the paper versions may not actually need to be retained at all.  However, if you have notice of possible litigation or a fraud enforcement action, it would be prudent to retain the paper versions. Even in the absence of litigation or an impending federal enforcement action, you may decide to retain the paper records for the minimum of the applicable limitation period for a malpractice action, the five-year period indicated by Medicare, or as long as the ten-year False Claims Act statute of limitations.  At a minimum, have a written retention policy that contains quality control procedures and that ensures paper records are not destroyed before their scheduled backup to an identical image.

The Editor thanks Steve Gossman, Esq., who gathered information for this article.

8 thoughts on “Conversion to electronic health record and retention of paper records

  1. Apologies for commenting but not answer your question, but I have a more fundamental question about scanned records.

    The way I understand it, EHR is supposed to help address the problem of the physicians not having all the information about a patient to provide quality care. One of the ways the EHR can help is for the computer to generate recommendations or alerts based on the patient’s medical records.

    If the notes are scanned and uploaded to an EHR, how would they be different from the good old paper charts? They maybe more available as multiple care givers can now review the documents from different computers. Other than that, I don’t see how these scanned documents improve quality of care. What do you think?


  2. I agree that HITECH envisions a fully electronic, coded medical record rather than an image of a paper record. If the ability to access the medical history of a patient is a key to improving quality of care for that patient by a provider who has never seen the patient before, then we are a very long way off from reaching that level of access. There are just too many hospitals and physician offices without the resources to do a complete conversion from paper to electronic, which raises other questions. Even with a full conversion from paper to an electronic record in cases where a provider spent the money to interpret what’s on paper into a coded electronic record, we are still faced with retaining the paper record for some period of time from a preservation of evidence standpoint.


  3. Grand unification theories are hard to ideate, and even harder to put into practice. The fellows who left HP to develop HIMSS, originally envisioned as a software standard which, if applied to development of every type of medical record, could pull together all aspects of a patient’s record–blood work, xrays, etc–onto the terminal of the PCP or hospitalist. While it did not come to fruition, the company they founded, Sentillion, is still around, and they continue to pursue the Grail.
    I’m intrigued by your mention of a way for exact reproductions of images to be shared among providers (and, of course, payers). Check out, for example.
    Let me know your thoughts.
    Best regards,
    Seth Kaplan


  4. Good information! Too bad that, in my opinion, most people are oblivious to many of the regulations and other practical considerations you’ve presented regarding the move from legacy paper to EHR’s.

    Big Business, for sure!

    Details! Details!



  5. Nice post. Seem true on most accounts but I also think that today medical practitioners are looking to avail of this federal incentive by trying to comply with the definition of meaningful use but at the same time EHR providers are looking at their own set of profits.
    This misunderstanding is mostly I believe as a result of wrong interpretation of the federal guidelines. The EHR providers need to look at these guidelines from the prospective of the practitioners who deal with different specialties.
    Each specialty EHR has its own set of challenges or requirements which I believe is overlooked by in most EHR vendors in a effort to merely follows federal guidelines. This is resulting in low usability to the practitioners, thus less ROI, finally redundancy of the EHR solution in place.
    I think ROI is very important factor that should be duly considered when look achieve a ‘meaning use’ out of a EHR solution. Though one may get vendors providing ‘meaning use’ at a lower cost, their ROI / savings through the use of their EHR might be pretty low when compared to costlier initial investment. Found a pretty useful ROI tool that is pretty customizable and easy to use. It also accounts for the different specialty EHR’s too.

    Some of the other useful resources on this topic:
    REC’s putting EHR’s to meaningful use
    Certification criteria for EHR

    Also the introduction of REC’s through the HITECH act. is a great way to avail of quality EHR solutions at competitive prices. The stiff competition among not only these REC’s but also among EHR vendors ( to become a preferred vendor of a given REC) will result in lot of positives to medical practioners.
    Looking the funding provided to the REC’s, the staggered grant allocation system also promises to be an unbiased way of allocating funds. It will also help in the concept of REC’s helping out each with their own unique business models. It can be one of the possible answers to the
    ’safe vendor challenge’ as discussed by many critics.


Leave a reply. Please note that although this blog may be helpful in informing clients and others who have an interest in information privacy and security, it is not intended to be legal advice. The information on this blog also should not be relied upon to form an attorney-client relationship.

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.