Editor's note: This update supplants the November 2003, March 1999, and September 1996 practice briefs "Protecting Patient Information after a Facility Closure."
Today's healthcare environment fosters competitiveness and complex business relationships. These environmental stressors demand that organizations strategically plan for maintenance of business records as a part of mergers, acquisitions, divestitures, or closures. In the midst of this turmoil often lies the patient struggling to receive healthcare. Patients trust healthcare providers and organizations to preserve their health records in addition to respecting their privacy, maintaining the confidentiality of their health information, and ensuring its availability for their continuing care. Organizations and providers must be concerned with the availability and protection of health information when healthcare facilities close or medical practices dissolve. This practice brief provides guidance on managing health information during a facility closure in all practice settings.
Health information management (HIM) professionals often find themselves addressing these record management issues. The financial pressures associated with closures sometimes cause organizations to sift through large volumes of data, documents, and paper or electronic health records (EHRs) in a short time period. Generally, an organization or provider remains liable for accidental or incidental disclosure of health information during or after a closure. Therefore, organizations must take appropriate actions to protect the integrity, retrieval, and storage of health records during a facility closure and ensure that records are available for continued patient care purposes.†
Organizations must take several factors into consideration when preparing for the disposition of patient records, including:†
- State laws regarding record retention and disposal, historic record protection, and statutes of limitation
- State licensing standards
- Medicare and Medicaid requirements
- Federal laws governing treatment for alcohol and drug abuse (if applicable)
- Guidelines issued by professional organizations
- The needs and wishes of patients
- The needs of physicians, other providers, and public health organizations for follow-up and research
- Review of current organizational policies
General Guidelines
How a facility or practice manages the disposition of its patient records will depend on the circumstances of its sale or closure. In general, the following guidelines apply:†
- Once the decision has been made to dissolve, records management discussions should begin immediately.
- If a healthcare facility or medical practice is sold to another healthcare provider, patient records may be considered assets and included in the sale of the property.
- If a facility closes or a practice dissolves without a sale, records should be transferred to another healthcare provider that agrees to accept the responsibility (see appendix A for a sample notice).
- If records are not transferred to another healthcare provider, records may be archived with a reputable commercial storage firm (see appendix B for a sample notice).
- If a healthcare facility or medical practice sells a part of the entity, such as one clinic, to another healthcare provider, patient records created while the clinic was part of the first entity should remain with the original facility, since care was provided under that legal entity. In this circumstance, a process to provide access to medical records for any patients who may continue care at the new clinic should be arranged in advance of the transaction.
- Patients should be notified, if possible, and given an opportunity to obtain copies of their health information or transfer their records before closure.†
- Patients may be notified of the opportunity to obtain copies by publishing a series of notices in the local newspaper, facility Web site, Facebook page, or other social media.
- Copies of the legal health record should be given to patients.
- In the event that no type of transfer is feasible and destruction of health records must occur, the provider must destroy all information in accordance with retention rules and the HIPAA rules rendering the data unreadable.
- Circumstances involving the transfer of health records as the result of closure are within the HIPAA definition of healthcare operations, so organizations must refer to applicable state and other federal laws to determine if stricter requirements exist before transferring records.
State Laws and Licensure Requirements
Organizations and providers are bound by applicable federal and state laws and regulations after closure, as well as during operation. Many state health departments and licensing authorities govern healthcare facility closures and may outline to whom records should be transferred (see appendix C for a list of state laws, regulations, or guidelines). In some states, a state archive or health department will store health records from closed facilities. More commonly, state regulations recommend records be transferred to another healthcare provider.
If records cannot be transferred to a state archive or state health department, the state's requirements for record retention for both adult and minor patients should be reviewed before a policy is formulated. (Note: many states require approval from the state department of health or licensing authority before any plan is implemented.)
To minimize storage or transfer costs, the provider may wish to destroy records that are past the period of required retention. For example, if state law requires that records be retained for 10 years after the patient's last encounter, records that are more than 10 years old could be destroyed. If state law does not specify the length of time records must be kept, the provider must consider the state's malpractice statute of limitations for both adults and minors and ensure that records are maintained for at least the time specified by the state's statute of limitations.
A longer retention period is sometimes prudent, since the statute may not take into consideration potential litigation claims. If the patient was a minor, the provider should retain health information until the patient reaches the age of majority (as defined by state law) plus the period of the statute of limitations, unless otherwise provided by state law.
The provider also should contact its malpractice insurance carrier. Both the provider and the carrier must have access to patient records after the closure in the event a malpractice claim is filed.
Public, county, state, or municipal facilities also should review statutes and rules surrounding historic documents. Some states require that all records, including medical records of public or teaching facilities, are considered historic. Historic record retention guidelines should be followed in these circumstances.
Medicare Requirements
If the provider participates in the Medicare program, records must be kept in their original or legally reproduced form for at least five years from the date of the settlement of the claim to comply with the Medicare Conditions of Participation. Skilled nursing facilities and home care agencies must retain their records for five years after the month the cost report was filed. For example, a 1998 cost report that was submitted on January 15, 1999, must be retained until February 1, 2004.
Effect of the HITECH Act
The Health Information Technology for Economic and Clinical Health (HITECH) Act prohibited the sale of protected health information. The act states that a covered entity or business associate is prohibited from receiving a direct or indirect payment in exchange for protected health information unless the covered entity has obtained a valid authorization from the affected individual. The interim final rule allows for exceptions to the authorization requirement, which includes an exception for activities related to the sale, transfer, merger, or consolidation of all or part of the covered entity. The HITECH final rule is not available at the time this article was printed.
Proposed Revisions for Long-Term Care Facilities
In January 2011, the Centers for Medicare and Medicaid Services announced the development of an interim final rule for long-term care facilities. This proposed interim final rule will complement section 6113 of the Affordable Care Act (Public Law 111-148). Section 6113 currently requires that the administrator of the long-term care facility provide written notification of the closure and define the plan for the relocation of residents at least 60 days in advance of the closure. The section also allows the Health and Human Services Secretary to terminate a facility's participation in the Medicare or Medicaid program and assign a closure date deemed appropriate. The rule is expected to be available for public comment but was not yet released at the time of publication.
Federal Regulations for Alcohol and Drug Abuse Treatment Records
If the provider has offered services pertaining to alcohol or drug abuse education, training, treatment, rehabilitation, or research, disposition of these records must meet requirements outlined by federal law. When a program discontinues operations or is acquired by another program, this law requires the patient's written authorization for records to be transferred to the acquiring program or any other program named in the patient's authorization. If records are required by law to be kept for a specified period that does not expire until after the discontinuation or acquisition of the program and the patient has not authorized transfer of the records, these records must be sealed in envelopes or other containers and labeled as follows:
"Records of [insert name of program] required to be maintained pursuant to [insert citation to law or regulation requiring that records be kept] until a date not later than December 31, [insert appropriate year]."
Records marked and sealed as prescribed may be held by any lawful custodian, but the custodian must follow the procedures outlined by law for disclosure. If the patient does not authorize transfer of his or her records to another program, the records may be destroyed after the required retention period.
Correctional Health Records
Maintaining correctional health records after a closure will depend on whether the facility is owned by the federal government or the state or is privately owned. For the Federal Bureau of Prisons, all records, paper and electronic, are maintained through a single inmate identifier. While in the system, the record is transferred with the inmate throughout his or her incarceration and maintained in regional archive centers. If a facility were to close, the records would be sent with the inmate to the transferring facility. Consult with legal counsel for closures related to state or private facilities.
Recommendations from Professional Organizations
Professional organizations should be contacted for recommendations. Such professional organizations may include local or state:
- HIM associations
- Hospital associations
- Medical societies
- Other associations as appropriate (e.g., Medical Group Management Association)
Physicians who are closing their practices may wish to contact the American Medical Association and their state licensure board for guidance.
Legal Advice
Organizations and providers always should request advice from experienced healthcare legal counsel to determine the appropriate retention period, ensure compliance with federal and state laws and regulatory agencies, and help plan for an orderly closure.
EHRs
Traditionally, managing records during a practice closure required collection and maintenance of paper records. As the healthcare industry moves toward EHRs, management of additional types of media may occur. Planning for archiving and retention of EHRs requires long-term vision. Closures may occur in organizations with stand-alone disparate systems or those in various phases of the HER transition. Without some basic level of understanding of the systems used, it will be difficult to store these electronic records appropriately.
Electronic information can be stored in a variety of forms such as floppy disks, hard disks, CDs, DVDs, and magnetic tapes. A clear understanding of the types of data, information, media formats, and source systems is critical in ensuring the proper management of health records. Because many organizations convert to an EHR in stages, most organizations may still have historical records in paper format. Bringing both the paper and electronic components together will be important in managing information. To plan for these types of occurrences, HIM and IT professionals should work together as health records are identified during the acquisition or closure process.
Potential risks can arise if EHRs are simply sent to the receiving organization, provider, or storage center. The receiving organizations must have compatible systems that ensure the information is retained in a meaningful format. Audit trails with the metadata also may be of interest in litigation and may need to be retained in their original format. Planning for these types of issues and decisions requires due diligence surrounding the electronic system of both the sending and receiving organizations.
Budgeting for a Closure
Regardless of which plan of action a facility institutes to deal with patient records, budgetary resources will need to be allocated to carry out the plan. Some of the resources that need to be budgeted for include:
- Labor
- Copy equipment and supplies
- Postage
- Telephone and fax
- Utilities
- Storage boxes and supplies
- Transportation costs (to storage unit)
- Storage and retrieval costs regarding paper records for required retention period
- Storage and retrieval costs regarding electronic information for required retention period
- Notification costs (e.g., newspaper advertisements)
- Costs associated with storage such as transferring information to a new medium, purchasing a system to read media, contract with a vendor, and so on
- Legal fees
- Consultation fees
Closure and Dissolution with a Sale
If a healthcare facility or medical practice is sold to another healthcare provider, patient records may be considered assets and included in the sale of the property. As part of the agreement, the original provider who created the records should retain the right to access the records and obtain copies in response to litigation. All other requests for information or disclosures should be forwarded to the new owners. In addition, if the new owner considers a sale to a third party, the original provider should retain the right to reclaim the patient records.
If the facility or medical practice is sold to a nonhealthcare entity, patient records should not be included in the assets available for purchase. The provider should make arrangements to transfer the records to an archive facility or another provider that agrees to accept responsibility for maintaining them.
If, as a result of a sale, a noncompete contract is generated to limit a physician's ability to treat patients within a certain geographical region, this contractual agreement does not preclude the requirement to provide patients with an opportunity to obtain their health information. See appendix D for an activity checklist.
Closure and Dissolution without a Sale
Because the nature of a closure is to cease operations, these instances are poised potentially to lose vital health information. In the event of a facility closure or dissolution without a sale, it is important for HIM professionals to begin long-term planning as quickly as possible to avoid potentially losing vital health information. The original provider is responsible for ensuring the final disposition of health records, which may include safely storing the records for an appropriate length of time. Arrangements also can be made with another healthcare provider where patients may seek future care, unless otherwise required by state law. The new owner should agree to maintain the records, permit access by authorized persons, and destroy the records when applicable time periods have expired.
HIM professionals at the receiving facility should be familiar with record retention, destruction requirements, and confidentiality concerns and have systems in place to allow patients and other legitimate users access to the information. Before transferring the records, a written agreement outlining terms and obligations should be executed.
If transfer to another provider is not feasible, records may be archived with a reputable commercial storage firm. Such a firm should be considered only if it:
- has experience in handling confidential patient information;
- has experience in handling the specific type of media, such as paper, electronic, or CD;
- guarantees the security and confidentiality of the records;
- ensures that patients and other legitimate requesters will have access to the information;
- maintains a climate-controlled environment.
If a storage firm is used, specific provisions should be negotiated and included in the written agreement. Such provisions include but are not limited to:
- Agreement to keep all information confidential
- Disclosing only to authorized representatives of the provider or on written authorization from the patient or his or her legal representative
- Prompt return of all embodiments of confidential information without retaining copies upon the provider's request
- Prohibition against selling, sharing, discussing, assigning, transferring, or otherwise disclosing confidential information with any other individuals or business entities
- Prohibition against use of confidential information for any purpose other than providing mutually agreed upon services
- Agreement to protect information against theft, loss, unauthorized destruction, or other unauthorized access
- Return or destruction of information at the end of the mutually agreed upon retention period
- Ensuring that providers, patients, and other legitimate users will have access to the information
Note
- Center for Medicare and Medicaid Services, Code of Federal Regulations 42 CFR Ch. 1 (10-1-85). [42 CFR Part 2 Subpart B, Paragraph 2.19]
References
American Hospital Association. Guidelines for Managing Hospital Closures. Report of the Ad Hoc Committee for Hospital Closures. Chicago, IL: American Hospital Association, 1990.
Centers for Medicare and Medicaid Services. Medicare/Medicaid State Operations Manual. Appendix A. Hospitals Interpretive Guidelines and Survey Procedure. Springfield, VA: US Department of Commerce, 1995.
Jaklevic, Mary Chris. "Hospital Closures Open Opportunities." Modern Healthcare 30, no. 48 (2000): 34–38.
Jaklevic, Mary Chris. "Trouble in the City." Modern Healthcare 31, no. 2 (2001): 52.
Lillie, Celine M. "Legal Issues in Closing a Medical Record Department." Journal of AHIMA 64, no. 5 (1993): 28–29.
Murer, Cherilyn, Michael Murer, and Lyndean Lenhoff Brick. The Complete Legal Guide to Healthcare Records Management. New York, NY: McGraw-Hill, 1999.
Tomes, Jonathan P. Healthcare Records: A Practical Legal Guide. Dubuque, IA: Kendall Hunt Publishing Company for the Healthcare Financial Management Association, 1990.
Tomes, Jonathan P. Healthcare Records Manual. Boston, MA: Warren Gorham Lamont, 1993.
Woodcock, Elizabeth. "Plan Ahead for a Smooth Closure of Your Practice." American Medical News 39, no. 28 (1996): 16.
Prepared by
Anne Tegen, RHIA
Diana Warner, MS, RHIA, CHPA, FAHIMA
Lou Ann Wiedemann, MS, RHIA, FAHIMA, CPEHR
Acknowledgments
Cecilia Backman, MBA, RHIA, CPHQ
Jill Clark, MBA, RHIA
Jane DeSpiegelaere, MBA, RHIA, CCS
Angela Dinh, MHA, RHIA, CHPS
Julie Dooling, RHIT
Gwen Jimenez, RHIA
Laura Rizzo, MHA, RHIA
Prepared by (original)
Mary D. Brandt, MBA, RHIA, CHE, CHP
Harry Rhodes, MBA, RHIA, CHP
Acknowledgments (original)
Mary D. Brandt, MBA, RHIA, CHE, CHP
Jill Burrington-Brown, MS, RHIA
Alane Combs, RHIA
Michelle Dougherty, RHIA
Sue Gentilli, RHIA
Reesa Gottschalk, RHIA
Beth Hjort, RHIA, CHP
Sherri Hutchins, RHIA
Carol Quinsey, RHIA
Tracey Stanich Witherow, RHIA
Article citation:
AHIMA. "Protecting Patient Information after a Facility Closure (2011 update)." Journal of AHIMA (Updated August 2011). |