Understanding the Need for Tailored Records Retention
Questions about records retention flood my inbox weekly. They pop up in compliance team discussions, audit prep meetings, and urgent emails from administrators who realize their pediatric practice has been prematurely destroying records. Navigating healthcare records retention can seem straightforward until you start crafting the actual policy. You'll find that HIPAA says one thing, state statutes say another, and Medicare participation agreements introduce yet another timeline. Meanwhile, your malpractice carrier might recommend a longer retention period than all of them. Plus, your storage vendor keeps sending invoices for boxes you're unsure about destroying legally.
These are the common questions from compliance officers, health information managers, and practice administrators trying to build defensible retention programs.
HIPAA vs. State Requirements
Q1: "HIPAA says six years, right? So why is our attorney telling us to keep records for ten?"
HIPAA generally requires covered entities to retain compliance documentation for at least six years. This includes policies, training records, security documentation, and compliance materials. However, HIPAA doesn't set a universal retention period for patient medical charts. State laws do that, and many require seven to ten years for adult records, depending on provider type and facility classification.
Your attorney is likely considering your state statute, which may require longer retention than HIPAA's compliance documentation rule. The confusion often arises from conflating HIPAA's compliance-doc requirement with patient records. Follow the rule that requires the longer retention. If your state says ten years and HIPAA compliance docs say six, keep records for ten.
Retention for Pediatric Records
Q2: "We're a pediatric practice. Do we really need to keep a six-year-old's chart until they're 25?"
Yes, and possibly longer depending on your state. Many states require providers to retain minor-patient records until the patient reaches the age of majority plus additional years. If your state mandates retention until age 18 plus seven years, that six-year-old's record stays accessible for nearly 20 years.
This isn't just risk management; it's statutory. Minors can't file certain claims until adulthood, so the statute of limitations doesn't start until then. Your retention schedule must account for this extended timeline. Pediatric practices need separate retention rules for minor patients. If storage costs are a concern, consider secure offsite storage or digital Accessioning for long-term records. But don't destroy them early due to costs.
Medicare and State Law
Q3: "Our state law says seven years, but we're a Medicare provider. Does that change anything?"
It can. Medicare participation requirements don't override state retention law but often extend retention timelines. Audits, reimbursement reviews, and appeals can occur years after services were provided. Destroying records at your state's minimum retention period could create compliance issues if Medicare requests documentation later.
Many healthcare organizations retain records longer than state minimums due to operational and reimbursement realities. Build your retention schedule around the longest applicable requirement, not the shortest. Medicare participation often effectively extends your retention timeline beyond state minimums.
Risks of Indefinite Retention
Q4: "Can we just keep everything forever? Isn't that safer?"
No. Indefinite retention creates legal and operational risks. Older records become discoverable during litigation. If sued, you'll have to produce everything kept, even records from 20 years ago that could have been legally destroyed. This increases exposure.
Excessive retention also raises storage costs, complicates audits, creates privacy risks, and makes retrieval harder. When every record from the past 30 years is accessible, finding relevant documents during an audit or legal hold becomes challenging.
Defensible destruction is part of good records management. Once records exceed required retention timelines and no legal hold applies, destroy them securely and consistently. Document the destruction with certificates or logs. This isn't hiding evidence; it's following your retention schedule.
Acquired Practice Records
Q5: "We have records from a practice we acquired five years ago. Whose retention rules apply?"
Yours. When you acquire another practice, you inherit responsibility for their records and retention obligations. The retention clock doesn't reset with acquisition. If a record was created in 2015 and your state requires ten-year retention, it must stay accessible until 2025, regardless of acquisition date.
Due diligence is crucial during acquisitions. Know what records you're inheriting, how long they must be retained, where they're stored, and whether the previous practice followed defensible retention practices. If records were prematurely destroyed or lack documentation, you may inherit compliance gaps.
Build acquisition agreements that address records transfer, retention responsibility, and storage costs. Integrate acquired records into your retention schedule immediately.
Consequences of Early Destruction
Q6: "What happens if we destroy records too early?"
Early destruction creates legal, regulatory, reimbursement, and operational problems. If audited, litigated, or faced with a patient request or payer dispute, you can't produce required documentation. This can lead to adverse inferences in litigation, audit findings, reimbursement denials, and regulatory penalties.
Early destruction suggests poor recordkeeping, damaging credibility during audits and investigations. Regulators and opposing counsel may question whether other records are missing or mismanaged.
If you've been destroying records too early, stop immediately. Consult legal counsel. Document what happened, when it started, and how many records were affected. Revise your retention schedule and implement controls to prevent future premature destruction. While you can't undo past destruction, you can demonstrate corrective actions.
Next Steps for Your Records Control Schedule
Start with your state statute and medical board regulations to establish baseline retention requirements. Then layer in Medicare participation agreements if you're a federal program participant. Add malpractice considerations based on your state's statute of repose. Consult legal counsel before finalizing your retention schedule.
Your Records Control Schedule should define retention periods by record type, include rules for minors, establish litigation hold procedures, specify storage locations, document destruction timelines, and define access controls. Aim for consistency across all departments, providers, and locations.
For long-term retention of pediatric records or managing storage costs for old files, secure offsite storage or digital Accessioning can help. When records reach the end of their retention period, use professional destruction services that provide certificates of destruction to document your defensible destruction process.
