NOTE: On February 18, 2010, we posted an article about what to do with paper medical records when converting to an electronic health record (EHR). To date, this has been the most popular article on the HITECH Law Blog. We decided to re-review the topic, update it, and repost it. Actually, not much has changed in the way of the law applicable to this topic. So, the article below reiterates most of the tips from our original article with a few refinements, including additional information about retention periods. This article also is relevant to deciding on the retention period for legacy EHR records when converting to another EHR.

Many hospitals have electronic health records (EHRs) that are hybrid digital records. While the hospital may be using electronic data entry in the emergency department, inpatient nursing care, pharmacy, lab, and pre-op anesthesia, oftentimes, these EHRs are not integrated and, thus, are not merged into a single EHR. The short-term solution may have been to scan printed records from some department, like lab or pharmacy, into the patient’s on-line digital record. As a result, the hospital’s “electronic health record” contains information that is not captured in a “coded format.” For one, this will not meet the “meaningful use” criteria under the HITECH Act.

But let’s assume that the hospital can overcome this hurdle by working with vendors to integrate these records in a way that will meet HITECH EHR certification standards. If the hospital has been maintaining certain portions of patient records in a paper format, what does it do with those paper records after converting to an EHR? If the hospital scans all the paper patient records into its EHR, how long should the hospital retain the paper record after it is scanned into their EHR?

Currently, there is little specific guidance speaking to retention of paper records subsequent to EHR conversion. In other words, once paper records are scanned, they are, in fact, being retained on electronic storage media. However, if the paper record is being reentered into the EHR in the required “coded format,” is that the same as the original record? Given that the broadening EHR world is in its infancy, retention of paper records for a sufficient period of time is likely the wisest course of action in either scenario. What follows are some of the factors to consider when deciding whether and how long to keep paper medical records.

Liability Insurance Requirements. As an initial matter, review your malpractice insurance and seek guidance as to the expectations of your insurer with regard to record retention. Some carriers have actually issued direct policy-requirement statements covering record retention in the context of EHR conversion. Your carrier may have a requirement or other guidance that would be useful in formulating or revising your record retention policy.

Malpractice Claims. Another important consideration is to determine the appropriate malpractice or negligence statute of limitations under applicable state law. For example, in Kentucky, under KRS 413.140(1)(e) “an action against a physician, surgeon, dentist, or hospital . . . for negligence or malpractice” must be brought within one (1) year. This is lengthened to up to two (2) years in the case of wrongful death. Under KRS 413.140(2), the statute of limitations starts when the injury is first discovered or when “in the exercise of reasonable care should have been discovered.” Ultimately, an action must be commenced within five (5) years from the date on which the alleged negligence is said to have occurred. This five-year limitation places a cap on how long a potential negligence/malpractice plaintiff has to bring suit against the health care provider and, therefore, how long such records are generally relevant in the malpractice context. However, the paper record may need to be kept longer in cases involving minors, an individual with a ”disability”, or in death cases where statutes of limitation may be extended to allow time to appoint a representative of the estate. Further, consider whether, under applicable state law, destroying an original paper record is needed to defend a plaintiff’s claim that certain entries were “inked” into the record after the fact in order to establish a defense and the original is needed for a forensics expert to determine how long the ink has been dry. See discussion below under Destruction of Evidence.

State Licensing Authorities. Review the licensing and Medicaid regulations applicable to your organization. And, speak to your state licensing agency to get their take on how long to keep paper records that have been either scanned to PDF or entered into the EHR in a coded format. Individuals within the Kentucky OIG, for example, have indicated that as long as the records can be accessed and accurately produced, there is no requirement to retain the paper versions. It is essential to weigh the regulatory authority viewpoint against the risk of exposure to a spoliation claim.

Federal Law and Medicare. Consider the ramifications of defending a federal fraud and abuse action in the absence of the “original” paper record.  The Civil False Claims Act, 31 U.S.C. § 3729, is most often cited when establishing the upper limits of federal fraud and abuse statutes of limitation.  Section 3731(b)(2) provides that in no event may such an action be brought more than ten (10) years after the date on which the violation is committed.  It may not mean that you keep all paper records for ten years, but this factor must weigh into the development of your retention policy.

Other federal law considerations include the Medicare conditions of participation for hospitals, which require that medical records “be retained in their original or legally reproduced form for a period of at least five (5) years.” (42 C.F.R. 482.24(b)(1).)  The Centers for Medicare and Medicaid Services (CMS) has verified that for its purposes, an electronic reproduction is a “legally reproduced form” of a Medicare patient’s record.  Here’s what CMS says about the media format of medical records:

The Medicare program does not have requirements for the media formats for medical records. However, the medical record needs to be in its original form or in a legally reproduced form, which may be electronic, so that medical records may be reviewed and audited by authorized entities. Providers must have a medical record system that ensures that the record may be accessed and retrieved promptly.

Providers may want to obtain legal advice concerning record retention after these time periods and medical document format.

Medicare Learning Network (MLN) Matters Article SE1022, titled “Medical Record Retention and Media Formats for Medical Records” (published in September 2010).  This CMS MLN notes that the retention period for cost reports is 5 years and the retention period for managed care program provider records is 10 years. Many managed care providers require health care providers to retain medical records for up to ten years in the managed care contracts so these documents should also be reviewed when developing your retention policy. (See the further discussion below about image quality requirements.) 

FDA and OSHA Record Retention Requirements. Consider also whether FDA regulations applicable to any research conducted in your facilities, or the U.S. Occupational Safety and Health Administration (OSHA) regulations related to retention of occupational health records, warrant the retention of pre-EHR or legacy EHR records.

Electronic Record Image Must Be Identical to the Paper. The Medicare General Information, Eligibility and Entitlement Manual, Pub. 100-01, Ch. 7, § 30.30.1.4 (the “General Manual”)(last revised 5-26-06 as of this writing) contains a section addressing “Disposition For Medicare Records that are Imaged/Scanned.” The General Manual provides that imaging can be used to replace paper documents “only when the image will be identical to the paper . . . .” (emphasis in original).  The General Manual goes on to state that a contractor “must retain the paper records until their certification/quality assurance process . . . has been completed and the imaged information . . . is verified as an identical replication of the paper document.  Only then can the paper records be destroyed.” Also, the scanned record must be “tamper-proof” according to the General Manual, and must maintain its ability to be accessed and read with changes in technology.  The General Manual also sets forth a “sample quality assurance procedure,” which illustrates the emphasis CMS places on quality control when scanning records into an EHR.

Accordingly, quality control becomes extremely important when scanning paper documents onto electronic storage media. Your policy should include a method to verify that the image maintained on electronic media is identical in every way to its paper source–this includes all writing and text in margins, footnotes, etc.  Quality control in record conversion and retention is crucial to ensuring that text that runs to the edge of a page does not get cut off or become illegible after the document is scanned.  If you are considering converting paper records to a “coded format,” the resulting record would not seem to meet the “identical” image requirement, especially if you are unable to retain the context in which notes on the original record were made.

Destruction of Evidence. Records should only be destroyed in compliance with an established, written internal policy. In  U.S. and Aflatooni v. Kitsap Physicians Service, et al., 314 F.3d 995 (9th Cir., 2002),  the Court found that the defendant, a pathology group, did not engage in spoliation of evidence in a qui tam action when it destroyed relevant billing records after six years pursuant to a retention policy implemented in accordance with state and federal regulations, in the normal course of business, and more than two years before the relator initiated the action. However, the Court noted that the defendant would have engaged in spoliation of evidence as a matter of law if it had notice that the documents were potentially relevant to the litigation prior to destruction.

Summary. There is no single answer for how long to keep the original paper medical records. The CMS view seems to be that once records are converted to electronic storage media, and the converted image is identical to the original, the paper versions need not actually be retained at all.  However, if you have notice of possible litigation or a fraud enforcement action, then it would be prudent to retain the paper versions. Even in the absence of litigation or an impending federal enforcement action, you may decide to retain the paper records for the minimum of the applicable limitation period for a malpractice action, the five-year period indicated by Medicare, or as long as the ten-year False Claims Act statute of limitations.  At a minimum, have a written retention policy that contains quality control procedures and that ensures paper records are not destroyed before their scheduled backup to an identical image.