Practice Guidelines for LTC Health Information and Record Systems
- Policies and procedures exist to facilitate the storage of both active and inactive health records and resident-identifiable data and are evaluated periodically to ensure that health records and data are well organized, are kept confidential and secure, and are readily available for resident care, research, education, and other authorized uses.
- The storage system is designed and implemented to ensure the safety, security, and accuracy of health records and resident identifiable data.
- When storage plans are developed, consideration is given to the amount of space needed and available, the expected future demand for storage space, the costs of various storage alternatives and associated personnel, and the healthcare organization’s health record and data retention policies.
- Storage systems need to address the hardware equipment that operates the electronic information systems. This area may be referred to as the wiring closet, server room etc. Large organizations may refer to this area as the data center. Generally, the servers, cables and other equipment that operate electronic information systems must be stored in a designated area with appropriate physical safeguards and access limited to authorized employees.
- Long term care facilities must invest in adequate storage systems and storage space for their health records and hardware that operate electronic information systems. The storage methods and systems must be secure and protect the confidentiality of resident information maintained both in paper and electronic format. The storage system and space must be adequate to protect the physical integrity of the record and hardware equipment and prevent loss, destruction, and unauthorized use.
Storage System Options
Health record storage systems should be of professional quality to house and protect the health records. Office supply and health record file and storage vendors offer various products ranging from simple file cabinets to mobile file storage systems. The most common found in long term care are open shelf filing systems (with or without locking doors) or metal drawer file cabinets. The storage method selected is dependent on the security of the health information office and the amount of storage. If the office is to be shared with another staff member or department not in health information, the shelves or file cabinets must be lockable and kept locked whenever health information staff are not in attendance.
The goal in each facility should be to keep accessible as many years as possible of discharge records.
- Open shelf filing: Open shelf filing is a common filing method for health records in various practice settings in health care. Open shelf filing allows for easy access to files. The file folders used with open shelf filing must have side tabs for viewing demographic information for identification. If medical record files are retained in the health information office that is not shared with other staff or in a separate locked file room, open shelf filing without lockable doors is acceptable. The office should always be locked when staff is not in attendance. If the office is shared, the open shelf filing should have doors that are lockable. When the health information staff member is out of the office, all health records should be in locked files.
- File cabinets: Two, four or five drawer metal file cabinets are also commonly used in long term care facilities. File cabinets work well when there are few discharges in a year and storage space is minimal. Because file cabinets are bigger and bulkier than open shelf filing, they are not the optimal choice for large storage rooms or offices with a large volume of discharge health records. Locked file cabinets should be used when the health information office is shared with another staff member. The cabinets should be locked whenever the health information staff is not in the office.
Security Issues: Locking of Office and Storage Areas
The health information office and storage areas must be kept secure at all times if health records are filed and stored in that area. If the office is only used for health information staff, open shelf filing can be used in the office.
When health information staff leaves the office, all doors or access to the office must be locked. The office should not be unattended when there are records on open shelving. If the office is not to be locked, then all filing shelves or file cabinets must be locked. No records should be out in the open and left unattended.
If the office is to be shared with another staff member or department not in health information, the shelves or file cabinets must be lockable and kept locked whenever health information staff is not in attendance.
Storage areas outside of the health information office should be locked with access limited to only those who need access. Health information department policies should identify who has keys and training on access, security, and the log-out process for records and access to the information processing area.
Storage areas that house the electronic information systems hardware need to have appropriate physical safeguards in place to protect the hardware and prevent unauthorized access. Appropriate physical safeguards may include access controls (locks, token, biometric controls) raised flooring, dry pipe sprinklers, temperature controls and a back-up electrical source/generator.
Alternative Storage Areas
When space is not adequate in the health information office to store all discharge health records for the defined retention period, it is necessary to locate alternative storage. Optimally the storage should be in the facility to facilitate retrieval, but when storage space is limited it may be necessary to utilize storage space outside of the facility. When an alternative storage space is needed, the space selected must be secure and must protect the records from damage, loss or destruction.
Storage rooms must be organized allowing for ease in location and retrieval of records and documents. Similar documents should be retained together. One method for tracking the location of documents that are retained is to maintain an index log for records/documents (other than personnel files and health records) which identifies the contents of different storage containers and locations. A log would contain information on the box number and a description including dates of items in the box.
- Storage Boxes: When it becomes necessary to store inactive discharge records and other resident-specific documents, storage boxes may be used. Storage boxes should not be considered for recent years of discharge records when records are accessed more frequently. Storage boxes purchased should be of adequate quality and durability for record/document storage purposes.
If storage boxes are used they must be adequately labeled with the content of the box, the year, and the year the records may be destroyed (per facility retention guidelines). It is recommended that similar types of documents are kept together in a storage box to facilitate ease in destruction.
When storage boxes are used, they should not be stacked on top of each other. Boxes should be placed on shelves to facilitate easy retrieval of records and documents. Boxes should be placed off the floor and below sprinkler heads following state fire safety standards. In absence of a standard, boxes should be at least 18" off of the floor and 18" below sprinkler heads.
- Storage Rooms: If storage rooms are used for health records and other confidential records, they should be kept organized with adequate shelving, lighting and security. Multiple use storage rooms in which multiple staff members have access or keys must have a separate area that is caged and locked to protect the security of confidential records and documents. The storage room environment should not cause damage to the records and documents (such as moisture or rodents). It is acceptable to use storage boxes, but it would be optimal to use metal files or cabinets.
- Storage Buildings/Sheds/Rented Storage: When storage buildings or sheds are used for confidential documents, records and documents must be secure and protected from loss or destruction. The same standards apply to storage buildings, sheds and rented storage that applies for storage rooms within a facility. If multiple staff have access to the shed and store items, the records and documents must be placed in a separate locked area with access by select staff. The storage building must protect records from the elements such as moisture and rodents. The storage area must be organized to facilitate location and retrieval of information. Although it is acceptable to use storage boxes, it is optimal to use metal cabinets or files. In some states prior approval is required from the Department of Health for use of off-site storage.
- Storage Companies: If a storage company is selected, they should have written policies on the security and safety of confidential records and documents. If using a storage company there should be a written contract or agreement in place outlining the storage company’s responsibility in securing documents, protecting documents from loss or destruction, and outlining how facilities will access records and the time frame for obtaining records. Additionally, business associate language must be incorporated into the main contract or attached as an addendum. The long term care facility should have a list of all resident health records and other documents retained at the storage company and have mechanism to access to those records in an emergency situation.
- Redundant/Back up Information Sites: When a redundant electronic information system is utilized, this should be housed in a location that is a reasonable distance away from the primary information processing area. Policies and procedures should address specific positions that may access the storage media, retention time periods for the backed-up information and appropriate destruction practices.
- Storage of Back-up Media: If an electronic information system is utilized, the information is generally backed-up on a regular basis. Back up media may include tapes, CDs, diskettes or other some other type of storage medium. Special precautions must be implemented to ensure the safeguarding and availability of storage media.
- Storage media should be stored at an off-site location or at a different, secure location within the campus.
- If the media is stored off-site a bonded company should be utilized. An appropriate contract should be obtained and business associate language incorporated into the contract or attached as an addendum. The selected company should be located in a location that is a reasonable distance away from the primary information processing area.
- Policies and procedures should address specific positions that may access the storage media, retention time periods for the backed-up information and appropriate destruction practices.
Copyright ©2014 American Health Information Management Association. All rights reserved. All contents, including images and graphics, on this Web site are copyrighted by AHIMA unless otherwise noted. You must obtain permission to reproduce any information, graphics, or images from this site. You do not need to obtain permission to cite, reference, or briefly quote this material as long as proper citation of the source of the information is made. Please contact Publications to obtain permission. Please include the title and URL of the content you wish to reprint in your request.