Editor’s Note: Due to the continued popularity of this post, this article was reviewed and updated on September 30, 2013. For the later version, click here.

Update: On August 8, 2010, Medicare issued MLN Matters Article SE1022 on Medical Record Retention and Media Formats for Medical Records, which states that the Centers for Medicare and Medicaid Services (CMS) requires records of providers submitting cost reports (most hospitals) to be retained in their original or legally reproduced form (which may be electronic), for at least 5 years after closure of the cost report.

Many hospitals have electronic health records (EHRs) that are hybrid digital records. While the hospital may be using electronic data entry in the ER, inpatient nursing care, pharmacy, lab, and pre-op anesthesia, oftentimes, these EHRs are not integrated and, thus, are not merged into a single EHR. The short-term solution may have been to scan printed records from some department, like lab or pharmacy, into the patient’s on-line digital record. As a result, the hospital’s “electronic health record” contains information that is not captured in a “coded format.”  For one, this will not meet the Stage One “meaningful use” criteria under the HITECH Act.

But let’s assume that the hospital can overcome this hurdle by working with vendors to integrate these records in a way that will meet HITECH EHR certification standards.  If the hospital has been maintaining certain portions of patient records in a paper format, what does it do with those paper records after converting to an EHR?   If the hospital scans all the paper patient records into its EHR, how long should the hospital retain the paper record after it is scanned into their EHR? 

Currently, there is very little specific guidance speaking to retention of paper records subsequent to EHR conversion.  In other words, once paper records are scanned, they are, in fact, being retained on electronic storage media.  However, if the paper record is being reentered into the EHR in  the required “coded format,” is that the same as the original record? Given that the broadening EHR world is in its infancy, retention of paper records for a sufficient period of time is likely the wisest course of action in either scenario.

Liability Insurance Requirements. As an initial matter, review your malpractice insurance and seek guidance as to the expectations of your insurer with regard to record retention.  Some carriers have actually issued direct policy-requirement statements covering record retention in the context of EHR conversion.  Your carrier may have a requirement or other guidance that would be useful in formulating or revising your record retention policy.

Malpractice Claims. Another important consideration is to determine the appropriate malpractice or negligence statute of limitations under applicable state law.  For example, in Kentucky, under KRS 413.140(1)(e) “an action against a physician, surgeon, dentist, or hospital . . . for negligence or malpractice” must be brought within one (1) year.  Under KRS 413.140(2), the one-year clock starts when the injury is first discovered or when “in the exercise of reasonable care should have been discovered.”  Ultimately, an action must be commenced within five (5) years from the date on which the alleged negligence is said to have occurred.  This five-year limitation places a cap on how long a potential negligence/malpractice plaintiff has to bring suit against the health care provider and, therefore, how long such records are generally relevant in the malpractice context.  However, the paper record may need to be kept longer in cases involving minors, an individual with a “disability”, or in death cases where statutes of limitation may be extended to allow time to appoint a representative of the estate.

State licensing authorities. Review the licensing and Medicaid regulations applicable to your organization. And, speak to your state licensing agency to get their take on how long to keep paper records that have been either scanned to PDF or entered into the EHR in a coded format. Individuals within the Kentucky OIG, for example, have indicated that as long as the records can be accessed and accurately produced, there is no requirement to retain the paper versions. It is essential to weigh the regulatory authority viewpoint against the risk of exposure to a spoliation claim.

Federal Law and Medicare. Consider the ramifications of defending a federal fraud and abuse action in the absence of the “original” paper record.  The Civil False Claims Act, 31 U.S.C. § 3729, is most often cited when establishing the upper limits of federal fraud and abuse statutes of limitation.  Section 3731(b)(2) provides that in no event may such an action be brought more than ten (10) years after the date on which the violation is committed.  This may not mean that you keep all paper records for ten years, but this must weigh into the development of your retention policy. 

Other federal law considerations include the Medicare conditions of participation for hospitals, which require that medical records “be retained in their original or legally reproduced form for a period of at least five (5) years.” (42 C.F.R. 482.24(b)(1).) Though it would seem extremely unlikely that conversion of a record to an EHR would not be viewed as a “legally reproduced form,” retaining the paper records of Medicare patients for five (5) years is a consideration.  Also consider applicable FDA regulations if any research is conducted in your facilities, as well as any occupational health regulations related to retention of occupational health records.

Electronic record image must be identical to the paper. The Medicare General Information, Eligibility and Entitlement Manual, Pub. 100-01, Ch. 7, § 30.30.1.4 (the “General Manual”) contains a section addressing “Disposition For Medicare Records that are Imaged/Scanned.” The General Manual provides that imaging can be used to replace paper documents “only when the image will be identical to the paper . . . .” (emphasis in original).  The General Manual goes on to state that a contractor “must retain the paper records until their certification/quality assurance process . . . has been completed and the imaged information . . . is verified as an identical replication of the paper document.  Only then can the paper records be destroyed.” The General Manual also sets forth a “sample quality assurance procedure,” which illustrates the emphasis CMS places on quality control when scanning records into an EHR.

Accordingly, quality control becomes extremely important when scanning paper documents onto electronic storage media. Your policy should include a method to verify that the image maintained on electronic media is identical in every way to its paper source – this includes all writing and text in margins, footnotes, etc.  Quality control in record conversion and retention is crucial to ensuring that text that runs to the edge of a page does not get cut off or become illegible after the document is scanned.  If you are considering converting paper records to a “coded format,” the resulting record would not seem to meet the “identical” image requirement, especially if you are unable to retain the context in which notes on the original record were made.

Destruction of Evidence. Destroying records in compliance with an established, written internal policy is extremely important. In  U.S. and Aflatooni v. Kitsap Physicians Service, et al., 314 F.3d 995 (9th Cir., 2002),  the Court found that the defendant, a pathology group, did not engage in spoliation of evidence in a qui tam action when it destroyed relevant billing records after six years pursuant to a retention policy implemented in accordance with state and federal regulations, in the normal course of business, and more than two years before the relator initiated the action. However, the Court noted that the defendant would have engaged in spoliation of evidence as a matter of law if it had notice that the documents were potentially relevant to the litigation prior to destruction.

Summary. There is no single answer for how long to keep the original paper patient records. The CMS view seems to be that once records are converted to electronic storage media, and the converted image is identical to the original, the paper versions may not actually need to be retained at all.  However, if you have notice of possible litigation or a fraud enforcement action, it would be prudent to retain the paper versions. Even in the absence of litigation or an impending federal enforcement action, you may decide to retain the paper records for the minimum of the applicable limitation period for a malpractice action, the five-year period indicated by Medicare, or as long as the ten-year False Claims Act statute of limitations.  At a minimum, have a written retention policy that contains quality control procedures and that ensures paper records are not destroyed before their scheduled backup to an identical image.

The Editor thanks Steve Gossman, Esq., who gathered information for this article.