Retention and Destruction of Health Information

Editor's note: This update supersedes the August 2011 practice brief "Retention and Destruction of Health Information."


Health information management professionals traditionally have performed retention and destruction functions using all media, including paper, images, optical disk, microfilm, DVD, and CD-ROM. The warehouses or resources from which to retrieve, store, and maintain data and information include, but are not limited to, application-specific databases, diagnostic biomedical devices, master patient indexes, and patient medical records and health information. To ensure the availability of timely, relevant data and information for patient care purposes; to meet federal, state, and local legal requirements; and to reduce the risk of legal discovery, organizations must establish appropriate retention and destruction schedules. This practice brief provides guidance on record retention standards and destruction of health information for all healthcare settings.

Records Retention

The life cycle of records management begins when information is created and ends when the information is destroyed. The picture below provides a simple reflection of the entire records retention process. The goal for organizations is to manage each step in the record life cycle to ensure record availability. The creation of information is easy to establish, and most organizations do not have concerns when creating or using information. However, when maintaining information, various issues may arise.

Lack of file space and volumes of information are just a couple of issues that create labor-intensive maintenance processes for retrieval of health records. These issues necessitate a record retention schedule. Historical health record maintenance processes include various methods such as scanning to optical disk, use of microfilm or microfiche, and off-site storage of records. As new technology and media are developed and implemented, many organizations do not have the capability to go backward and scan records to free up storage space. As a result, health information resides in multiple storage media and locations creating the need for a clearly defined record retention plan.

At a minimum, record retention schedules must:

  • Ensure patient health information is available to meet the needs of continued patient care, legal requirements, research, education, and other legitimate uses of the organization
  • Include guidelines that specify what information is kept, the time period for which it is kept, and the storage medium on which it will be maintained (e.g., paper, microfilm, optical disk, magnetic tape)
  • Include clear destruction policies and procedures that include appropriate methods of destruction for each medium on which information is maintained

Federal Record Retention Requirements

There is no single standardized record retention schedule that organizations and providers must follow. Instead, a variety of retention requirements must be reviewed to create a compliant retention program.

To begin creating a record retention schedule, organizations and providers should use federal record retention requirements found within the Federal Register, and numerous acts such as the Higher Education Act of 1965 disclosure requirements (20 USC §1232g). The challenge is to ensure that these requirements are compared with state-specific requirements and that all records are maintained to the more restrictive timeline. See appendix A for a list of federal record retention requirements.

State Record Retention Requirements

Individual states have specific retention requirements that should be used to establish the organization's retention policy. Refer to your state laws for state-specific record retention requirements.

In the absence of specific state requirements, providers should keep health information for at least the period specified by the state's statute of limitations or for a sufficient length of time for compliance with laws and regulations. If the patient is a minor, the provider should retain health information until the patient reaches the age of majority (as defined by state law) plus the period of the statute of limitations. A longer retention period is prudent, since the statute may not begin until the potential plaintiff learns of the causal relationship between an injury and the care received.

In addition, under the False Claims Act (31 USC 3729), claims may be brought up to seven years after the incident; however, on occasion, the time has been extended to 10 years.

Organizations and providers should compare state retention requirements and statute of limitations with legal counsel when developing a record retention schedule.

Accreditation Agency Record Retention Requirements

Another mechanism that provides record retention guidelines is accreditation agency standards. Agencies such as the Commission on Accreditation of Rehabilitation Facilities, Det Norske Veritas, Medicare Conditions of Participation, and the Joint Commission have incorporated record retention schedules into their accreditation survey processes. See appendix B for a sample list of accreditation agency retention standards.

AHIMA Record Retention Recommendation

A final resource for record retention guidelines is AHIMA's recommendation for retention. Appendix C outlines AHIMA's recommendations for minimum record retention time periods in the absence of any federal, state, or accreditation requirements.

Additional Considerations

In addition, organizations with special patient populations need to go one step further in developing a records retention schedule. Special populations such as minors, behavioral health, or research patients may be governed by other regulations. The Food and Drug Administration, for example, requires research records pertaining to cancer patients be maintained for 30 years.

Comparing

Because no clear-cut standard has been established for record retention, comparing the variety of record retention requirements is often time-consuming and labor-intensive. Every organization should review and compare the varying retention schedules to follow the more restrictive requirement. An example comparison among federal, state, and accreditation requirements and AHIMA recommendations is shown below; the more restrictive requirement is shaded.

Federal Requirement State Requirement Accreditation Requirement AHIMA Recommendation
Hospitals: five years. Conditions of Participation 42 CFR 482.24(b)(1) Healthcare facilities must retain medical records for a minimum of five years beyond the date the patient was last seen or a minimum of three years beyond the date of the patient's death. Oklahoma Dept. of Health Reg. Ch. 13, Section 13.13A Joint Commission RC.01.05.01: The hospital retains its medical records. The retention time of the original or legally reproduced medical record is determined by its use and hospital policy, in accordance with law and regulation. Patient health and medical records (adults): 10 years after the most recent encounter.

Active and Inactive Records

Once the retention schedule has been determined, the next step is to identify active and inactive records. "Active" means that the records are consulted or used on a routine basis. Routine functions may include activities such as release of information requests, revenue integrity audits, or quality reviews.

"Inactive" means that the records are used rarely but must be retained for reference or to meet the full retention requirement. Inactive records usually involve a patient who has not sought treatment for a period of time or one who completed his or her course of treatment.

Defining active and inactive records also may depend on other issues such as physical file space, the amount of research done, and availability of off-site storage. For example, because of limited file space, an organization may determine that records are active for a period of one year from the discharge date. After one year, the record is moved to off-site storage or scanned to a DVD and considered inactive. In this instance, inactive does not mean that the record can be destroyed because the record has not yet met its full retention requirement.

Each organization should determine a cutoff point (usually a discharge date) that signals the time at which a record becomes inactive. In determining the appropriate cutoff, consider the following:

  • How often are the records accessed (e.g., daily, weekly, monthly)?
  • What is the total retention requirement?
  • What is the size of the record (a large long-stay record or a short emergency record)?
  • What are the physical constraints (e.g., lack of file space, lack of off-site storage)?
  • What activities or functions require routine access to the record (e.g., quality reviews, release of information)?

Identifying and maintaining active and inactive records is an important step in the successful maintenance of a filing system. Once the organization defines active and inactive records, the purge process can begin.

Purging

Purging is the act of separating active from inactive records in a filing system or database according to the retention schedule. Without a clear-cut purging method, the task can be daunting.

If the organization uses the discharge date as the cutoff date for inactive records, an additional consideration regarding the unit records is needed. A unit record is one in which the patient is assigned one medical record number. That medical record number remains the same for every visit the patient has, and individual visits are assigned unique account numbers that change with each new visit. Subsequently, when the record is filed, the patient may have one folder (based on the single medical record number) with multiple visits (account numbers) inside.

Maintaining the entire folder, with multiple discharge dates, on the shelf may not yield the purge results expected. Instead, organizations may choose to purge from the unit file all discharge dates identified as inactive. In this instance, file space is gained because only the most recent discharge date would remain as an active file on the shelf.

For example, Hospital A identified inactive records as any record with a discharge date before December 31, 2008. To purge, file clerks open each unit record and separate all discharges (inpatient and outpatient) before that date. The older files are sent to off-site storage. Below is an example of a unit record purge in which records before December 31, 2008, are considered inactive. The shaded records are those that would be sent to off-site storage for the remainder of the record retention schedule.

Record Number: 00-00-01

Record Type Discharge Date
Emergency Department June 15, 2010
Inpatient Stay May 12, 2009
Inpatient Stay August 31, 2008
Same-Day Surgery July 10, 2007
Emergency Department December 20, 2006
Urgent Care Clinic November 12, 2006

If Hospital A, listed in the example above, purges records every two years, the off-site storage location would continue to grow as records are added. To ensure that the organization is not trading one capacity-filled file room for another, records should be destroyed once the record retention period has been fulfilled.

The life cycle of a good record retention program does not end until information has been destroyed. Destruction is an important component to the record retention program because it completes the life cycle of a record. Because of storage capacity, fiscal restraints, and legal constraints, most organizations and providers are unable to maintain records indefinitely. There are requirements regarding record destruction that organizations need to be aware of when destroying information.

Destruction of Patient Health Information

Destruction of patient health information by an organization or provider must be carried out in accordance with federal and state law pursuant to a proper written retention schedule and destruction policy approved by appropriate organizational parties. Records involved in any open investigation, audit, or litigation must not be destroyed until the litigation case has been closed.

As with record retention, there is no single standard destruction requirement. Some states require organizations create an abstract of the destroyed patient information, notify patients when destroying patient information, or specify the method of destruction used to render the information unreadable. Organizations should reassess the method of destruction annually based on current technology, accepted practices, and availability of timely and cost-effective destruction services.

In the absence of any state law to the contrary, organizations must ensure paper and electronic records are destroyed with a method that provides for no possibility of reconstruction of information.

Examples of destruction methods are provided below:

  • Paper record methods of destruction include burning, shredding, pulping, and pulverizing.
  • Microfilm or microfiche methods of destruction include recycling and pulverizing.
  • Laser discs used in write once-read many document-imaging applications are destroyed by pulverizing.
  • Computerized data are destroyed by magnetic degaussing.
  • DVDs are destroyed by shredding or cutting.
  • Magnetic tapes are destroyed by demagnetizing.

Organizations must maintain documentation of the destruction of health records permanently and include the following (see appendix D for a sample form):

  • Date of destruction
  • Method of destruction
  • Description of the disposed records
  • Inclusive dates
  • A statement that the records were destroyed in the normal course of business
  • The signatures of the individuals supervising and witnessing the destruction

Under the HIPAA privacy rule (45 CFR, Parts 160 and 164), when destruction services are outsourced to a business associate the contract must provide that the business associate will establish the permitted and required uses and disclosures and include the following elements:

  • The method of destruction or disposal
  • The time that will elapse between acquisition and destruction or disposal
  • Safeguards against breaches
  • Indemnification for the organization or provide for loss due to unauthorized disclosure
  • Require the business associate to maintain liability insurance in specified amounts at all times

References

AHIMA. "Enterprise Content and Record Management for Healthcare." Journal of AHIMA 79, no. 10 (2008): 91–98.

May, Michael L., and Christina M. Martinez. "HIM Professional's Role in Enterprise Content Management: Stepping Out of the Department and Into the Organization." 2008 AHIMA Convention Proceedings, October 2008.

Nunn, Sandra. "Enterprise Content Management from the Ground Up." Journal of AHIMA 79, no. 2 (2008): 46–47.

Office of the Federal Register. Guide to Record Retention Requirements in the Code of Federal Regulations. Washington, DC: National Archives and Records Administration, 1994.

Prophet, Sue. Health Information Management Compliance: Model Program for Healthcare Organizations. Chicago, IL: AHIMA, 1998.

Russo, Ruthann. Seven Steps to HIM Compliance. Marblehead, MA: Opus Communications, 1998.

Strong, Karen. "Enterprise Content and Records Management." Journal of AHIMA 80, no. 2 (2008): 38–42.

Tomes, Jonathan P. Healthcare Records Manual. Boston, MA: Warren Gorham Lamont, 1993.

Washington, Lydia. "From Custodian to Steward: Evolving Roles in the E-HIM Transition." Journal of AHIMA 81, no. 5 (2010): 42–43.


Appendix A: Federal Record Retention Requirements

Type of Documentation Retention Period Citation/Reference
Abortions and related medical services documentation Maintain for three years. 42 CFR 50.309
Ambulatory surgical services Retention periods are not specified 42 CFR 416.47
Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services As determined by the respective state statute, or the statute of limitations in the state. In the absence of a state statute, five years after the date of discharge; or in the case of a minor, three years after the patient becomes of age under the state law or five years after the date of discharge, whichever is longer. 42 CFR 485.721 (d)
Clinics, rural health Six years from date of last entry and longer if required by state statute. 42 CFR 491.10 (c)
Competitive medical plans (See HMOs, competitive medical plans, healthcare prepayment plans)
Comprehensive outpatient rehabilitation facilities (CORFs) Five years after patient discharge. 42 CFR 485.60 (c)
Critical access hospitals (CAHs) Six years from date of last entry, and longer if required by state statute, or if the records may be needed in any pending proceeding. 42 CFR 485.628 (c)
Department of Veterans Affairs
Diagnostic and operation index file Destroy monthly listing after receipt of consolidated biannual listing. Destroy consolidated biannual listing or prior equivalent 20 years after date of report. Records Control Schedule (RCS) 10-1, General and Administrative Records, Item # 78
Disposition data files (PTF) Destroy after one year and after a PTF master record has been created at the data processing center. Records Control Schedule (RCS) 10-1, General and Administrative Records, Item # 76
Gains and losses file Destroy master set after one year. Records Control Schedule (RCS) 10-1, General and Administrative Service, Item # 100
Medical record or consolidated health record 75 years from the last date of activity. Records Control Schedule (RCS) 10-1, Section XLIII-1—Health Information Management Service
Patient locator file Destroy 75 years after last episode of care and/or only after perpetual medical record is destroyed. Records Control Schedule (RCS) 10-1, General and Administrative Service, Item # 71
Register file Destroy when no longer needed. Records Control Schedule (RCS) 10-1
Tumor registry records and index cards Retain at VA health care facility; destroy 75 years after date of last activity. Records Control Schedule (RCS) 10-1, General and Administrative Service, Item # 70
Device tracking (See Medical Device Tracking)
Drug test results, student Education records are those records that are directly related to a student and maintained by an education agency or institution or by a party acting for the agency or institution. Disclosure of education records is addressed. However, record retention periods are not specified. 34 CFR 99 Family Education Rights and Privacy Act (20 U.S.C. §1232 g)
Drug use review (DUR) (see Outpatient drug claims- Pharmacists participating in DUR program and electronic claims management system)
End Stage Renal disease (ESRD) services In accordance with 42 CFR 164.530(j)(2), all patient records must be retained for 6 years from the date of patient’s discharge, transfer, or death. 42 CFR 494.170 (c) 42 CFR 441.40
HMOs, competitive medical plans, healthcare prepayment plans Retention periods are not specified. 42 CFR 417
Healthcare prepayment plans (see HMOs, competitive medical plans, healthcare prepayment plans)
Hearing aid devices, dispensers The dispenser shall retain for three years after dispensing of a hearing aid a copy of any written statement from a physician or any written statement waiving medical evaluation. 21 CFR 801.421 (d)
Home Health agencies Five years after the month the cost report to which the records apply is filed with the intermediary, unless state law stipulates a longer period of time. 42 CFR 484.48 (a)
Hospice care Retention periods are not specified. 42 CFR 418.74
Hospitals Five years. 42 CFR 482.24 (b) (1)
Hospitals-Nuclear medicine services Report copies will be retained for five years. 42 CFR 482.53 (d)
Hospitals-Radiologic services Report copies and printouts, films, scans, and other image records will be retained for five years. 42 CFR 482.26 (d)
Hospitals and other dispensers of drugs used for treatment of narcotic addicts, i.e., methadone Three years 42 CFR 8.12 (g) 1)
Hospitals, critical access (see Critical access hospitals)
Immunization (see Vaccine)
Institutional review board (IRB) for clinical devices Two years after the latter of the following two dates: The date on which the investigation is terminated or completed, or the date that the records are no longer required for purposes of supporting a pre-market approval application or notice of completion of a production development protocol. 21 CFR 812.140 (d)
IRB or institution that review a clinical investigation Three years after completion of research. 21 CFR 56.115 (b) 38 CFR 16.115 (b)
Intermediate care, mentally retarded Retention periods are not specified. 42 CFR 456
Investigator-Investigators in clinical devices Two years after the latter of the following two dates: The date on which the investigation is terminated or completed, or the date that the records are no longer required for purposes of supporting a pre-market approval application or notice of completion of a production development protocol. 21 CFR 812.140 (d)
Investigator- Investigators of new drugs and antibiotic drugs for investigational use Two years following the date a marketing application is approved for the drug for the indication for which it is being investigated. If no application is to be filed or if the application is not approved for such indication, until two years after the investigation is discontinued and the FDA is notified. 21 CFR 312.62 (c)
Laboratory- immunohematology Five years 42 CFR 493.1105
Laboratory- pathology tests Ten years after the date of reporting. 42 CFR 493.1105
Laboratory-all other records Two years. 42 CFR 493.1105
Laboratory stains and specimen blocks- histopathology, oral pathology Stained slides- 10 years from the date of examination. Specimen blocks- two years from the date of examination. 42 CFR 493.1105 (a) (7) (B)
Long-term care facilities As required by state law; or five years from the date of discharge when there is no requirement in state law; or for a minor, three years after a resident reaches legal age under state law. 42 CFR 483.75 (l) (2)
Mammography-screening and/or diagnostic mammography services Five years, or not less than 10 years, if no additional mammograms of the patient are performed at the facility, or longer if mandated by state or local law. 21 CFR 900.12 (e) (l) (4) (i)
Medical device tracking Maintain such records for the useful life of each tracked device manufactured or distributed. The useful life of a device is the time a device is in use or in distribution for use. 21 CFR 821.60
Mental retardation intermediate care (see Intermediate care, mentally retarded)
Methadone (see Hospitals and other dispensers of drugs used for treatment of narcotic addicts)
Mine Safety and Health Administration-MSHA Form 50003 The mine operator shall have MSHA form 5000-3 certifying medical fitness completed and signed by the examining physician for each member of a mine rescue team. These forms shall be kept on file at the mine rescue station for a period of one year. 30 CFR 49.7 (c)
Narcotic addict treatment (See Hospitals and other dispensers of drugs used for treatment of narcotic addicts)
Nuclear medicine services, hospitals (se Hospitals-Nuclear medicine services)
Nursing home or skilled nursing home (see Long-term care facilities)
Occupational Safety and Health Administration (OSHA)- employee exposure records Employee exposure record means a record containing any of the following kinds of information:
  • Environmental (workplace) monitoring or measuring of a toxic substance or harmful physical agent including personal, area, grab, wipe, or other form of sampling, as well as related collection and analytical methodologies, calculation, and other background data relevant to interpretation of the results obtained
  • Biological monitoring results that directly assess the absorption of a toxic substance or harmful physical agent by body systems (e.g. the level of a chemical in the blood, urine, breath, hair, fingernails) but not including results that assess the biological effect of a substance or agent or which assess an employee's use of alcohol or drugs
  • Material safety data sheets indicating that the material may pose a hazard to human health, or
  • In the absence of the above, a chemical inventory or any record that reveals where and when used and the identity (e.g., chemical, common, or trade name) of a toxic substance or harmful physical agent.
  • Unless otherwise specified, each employee exposure record shall be preserved and maintained for at least 30 years, except that:
  • Background data to environmental (workplace) monitoring or measuring, such as laboratory reports and worksheets, need only be retained for one year as long as the sampling results, the collection methodology (sampling plan), a description of the analytical and mathematical methods used, and a summary of other background data relevant to interpretation of the results obtained, are retained for at least 30 years, and
  • Material safety data sheets and paragraph (c)(5)(iv) records concerning the identity of a substance or agent need not be retained for any specified period as long as some record of the identity (chemical name if known) of the substance or agent, where it was used, and when it was used is retained for at least 30 years; and material safety data sheets must be kept for those chemicals currently in use that are affected by the Hazard Communication Standard in accordance with 29 CFR 1910.1200(g)
  • Biological monitoring results designated as exposure records by specific occupational safety and health standards shall be preserved and maintained as required by the specific standard
  • Each analysis using exposure or medical records shall be preserved and maintained for at least 30 years.
  • 29 CFR 1910.1020 (d) (1)
    29 CFR 1915.1020
    , 29 CFR 1926.33
    1,2- dibromo-e-chloroprane (DBCP)- The employer shall maintain this record for at least 40 years or the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1044 (p) (1) (iii)
    1,3-butadiene—Retain in accordance with 29 CFR 1910.1020 29 CFR 910.1051 (m) (2) (III)
    Acrylonitrile (vinyl cyanide)—The employer shall maintain this record for at least 40 years, or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1045 (q) (2) (iii)
    29 CFR 1915.1045
    , 29 CFR 1926.1145
    Asbestos—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1001 (m) (3)
    29 CFR 1015.1001 (n) (2) (iii)
    Benzene—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1028 (k) (1) (iii)
    29 CFR 1915.1028
    , 29 CFR 1926.1128
    Carcinogens—Records shall be maintained for the duration of the employee’s employment. Upon termination of the employee’s employment, including retirement or death, or in the event that the employer ceases business without a successor, records, or notarized true copies thereof, shall be forwarded by registered mail to the director. 29 CFR 1910.1003 (g) (2)
    29 CFR 1910.1004
    , 29 CFR 1910.1006-1016
    1915.1003-1004 29 CFR
    29 CFR 1915.1006-1016
    1926.1103-1104 29 CFR
    29 CFR 1926.1106-1116
    Coke oven emissions—The employer shall maintain this record for at least 20 years or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1029 (m) (1) (ii),
    29 CFR 1926.1129
    Inorganic arsenic—The employer shall maintain these records for at least 40 years or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1018 (q) (l) (iii)
    29 CFR 1915.1018
    , 29 CFR 1926.1118
    Laboratory use of hazardous chemicals—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1450 (j) (2)
    29 CFR 1915.1450
    Lead—The employer shall maintain these monitoring records for at least 40 years or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1450 (n) (1) (III)
    29 CFR 1915.1025
    Methylene chloride—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1052 (m) (2) (iv)
    29 CFR 1915.1052
    Methylenedianiline—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1050 (n) (3) (iii)
    29 CFR 1915.1050
    , 29 CFR 1926.60
    OSHA—employee medical records Employee medical records means a record concerning the health status of an employee that is made or maintained by a physician, nurse, or other healthcare personnel or technician, including:
  • Medical and employment questionnaires or histories (including job description and occupational exposures)
  • The result of medical examinations (preemployment, pre-assignment, periodic, or episodic) and laboratory tests (including chest and other x-ray examinations taken for the purposes of establishing a baseline or detecting occupation illness, and all biological monitoring not defined as an employee exposure record)
  • Medical opinions, diagnosis, progress notes, and recommendations
  • First aid records
  • Descriptions of treatment and prescriptions, and Employee medical complaints
  • Unless otherwise specified, the medical record for each employee shall be preserved and maintained for at least the duration of employment plus 30 years, except that the following types of records need not be retained for any specified period:
  • Health insurance claims records maintained separately from the employer’s medical program and its records
  • First aid (not including medical histories) of one-time treatment and subsequent observation of minor scratches, cuts, burns, splinters, and the likes, which do not involve medical treatment, loss of consciousness, restriction of work or motion, to transfer to another job, if made on site by a nonphysician and if maintained separately from the employer’s medical program and its records, and
  • The medical records of employees who have worked for less than one year for the employer need not be retained beyond the term of employment if they are provided to the employee upon the termination of employment.
  • 29 CFR 1910.1020 (d) (1)
    29 CFR 1915.1020
    , 29 CFR 1926.33
    1,2- dibromo-e-chloroprane (DBCP)- The employer shall maintain this record for at least 40 years or the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1044 (p) (2) (iii)
    29 CFR 1915.1044
    , 29 CFR 1926.1144
    1,3-butadiene—Retain in accordance with 29 CFR 1910.1020 29 CFR 910.1051 (m) (4) (III)
    Acrylonitrile (vinyl cyanide)—The employer shall maintain this record for at least 40 years, or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1045 (q) (3) (iii)
    29 CFR 1915.1045
    , 29 CFR 1926.1145
    Asbestos—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1001 (m) (3)
    29 CFR 1015.1001 (n) (3) (iii)
    Benzene—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1028 (k) (2) (iii)
    29 CFR 1915.1028
    , 29 CFR 1926.1128
    Blood-borne pathogens—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1030 (h) (1) (iv)
    29 CFR 1915.1030
    Cadmium—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1027 (n) (3) (iii)
    29 CFR 1915.1027
    , 29 CFR 1926.1127
    Coke oven emissions—The employer shall maintain this record for at least 20 years or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1029 (m) (1) (ii),
    29 CFR 1926.1129
    Cotton dust—The employer shall maintain this record for at least 20 years. 29 CFR 1910.1043 (k) (2) (iii)
    Dive team member- five years 29 CFR 1910.440 (b) (3) (vii)
    Ethylene oxide—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1047 (k) (3) (iii)
    29 CFR 1915.1047
    , 29 CFR 1926.1147
    Formaldehyde—Records will be retained for duration of employment plus 30 years. 29 CFR 1910.1048 (o) (5) (ii)
    29 CFR 1915.1048
    , 29 CFR 1926.1148
    Laboratory use of hazardous chemicals—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1450 (j) (2)
    Lead—The employer shall maintain or assure that the physician maintains those medical records for at least 40 years, or for the duration of employment plus 20 years, whichever is longer. 29 CFR 1910.1025 (n) (2) (iv)
    29 CFR 1915.1025
    Methylene chloride—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1052 (m) (3) (iii)
    29 CFR 1915.1052
    Metheylenedianiline—Retain in accordance with 29 CFR 1910.1020 29 CFR 1910.1050 (n) (4) (iv)
    29 CFR 1915.1050
    , 29 CFR 1926.60
    Vinyl chloride—Medical records shall be maintained for the duration of the employment of each employee plus 20 years, or 30 years, whichever is longer. 29 CFR 1910.1017 (m) (2) (C) (iii)
    29 CFR 1915.1017
    , 29 CFR 1926.1117
    OSHA—employee medical removal records, lead The employer shall maintain each medical removal record for at least the duration of an employee’s employment. 29 CFR 1910.1025 (n) (3) (iii)
    29 CFR 1915.1025
    Outpatient drug clams—Pharmacist participating in drug use review (DUR) program and electronic claims management system Retention periods are not specified. 42 CFR 456.705
    42 CFR 456,709
    Outpatient physical therapy (see Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology)
    Outpatient rehabilitation facilities, comprehensive( see Comprehensive outpatient rehabilitation facilities)
    Psychiatric hospitals Retention period not specified. 42 CFR 482.61
    Public Health agencies (see Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology)
    Radiologic services, hospitals (see Hospitals—Radiologic services)
    Rehabilitation agencies (see Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology)
    Renal disease (see End stage renal disease services)
    Rural health clinics (see Clinics, rural health)
    Speech-language pathology (see Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology)
    Utilization review committee Retention periods are not specified. 42 CFR 456100-145
    Vaccine Retention periods are not specified. However, each healthcare provider who administers a vaccine set forth in the Vaccine Injury Table (42 CFR 100.3) to any person shall record, or ensure that there is recorded, in such person’s permanent medical record (or in a permanent office log or file to which a legal representative shall have access upon request) with respect to each such vaccine the date o f administration of the vaccine, the vaccine manufacturer and lot number of the vaccine, the name and address and, if appropriate, the title of the healthcare provider administering the vaccine, and any other identifying information on the vaccine required pursuant to regulation promulgated by the Secretary. Note: For injuries, claims can be filed within 36 months after the first symptoms appeared. In the case of death, the claim must be filed within 24 months of the death and within 48 months after the onset of the vaccine-related injury from which the death occurred. AHIMA recommends that records be retained at least through this period. 42 USC 300aa-1
    42 USC 300aa-14 (c)
    Veterans Administration (see Department of Veterans Affairs)    
    CFR: Code of Federal Regulations (include Conditions of Participation, Food and Drug Administration, Department of Health and Human Services, Health Care Financing Administration, Public Health Services, Occupational Safety and Health Administration, and other federal agencies)

    USC: United States Code


    Appendix B: Accreditation Agency Retention Standards

    Accreditation Agency Retention Standard Reference
    Accreditation Association for Ambulatory Health Care (AAAHC) Requires organizations to have policies that address retention of active clinical records, the retirement of inactive clinical records, and the retention of diagnostic images. Accreditation Handbook for Ambulatory Care
    American Accreditation Healthcare Commission/URAC Member Protection Standard #7 states "the network shall have storage and security of confidential health information, access to hard copy and computerized confidential health information; records retention; and release of confidential health information." Health Network Accreditation Manual
    CARF...the Rehabilitation Accreditation Commission Requires organizations to have policies that address record retention.

    Retention periods are not specified for behavioral health. However, policy must comply with applicable state, federal, or provincial laws.
    Retention periods are not specified for employment and community services.

    Requires organizations to have policies that address retention of records and electronic records.

    Requires organizations to have policies that address retention of records and electronic records.

    Adult Day Services Standards Manual

    Behavioral Health Standards Manual

     

    Assisted Living Standards Manual

    Medical Rehabilitation Standards Manual

    Community Health Accreditation Program (CHAP) C25C - Elements 1 & 2: Records of adult patients must be retained for at least five years from the date of service and patient records for minors must be retained for seven years beyond the age of majority. C27C - Element 5: The records of occupationally exposed patients must be kept for 30 years. CHAP Core Standards of Excellence

    The Joint Commission

    RC.01.05.01- The hospital retains its medical records. The retention time of the original or legally reproduced medical record is determined by its use and hospital policy, in accordance with law and regulation. Comprehensive Accreditation Manual for Ambulatory Care
      - RC.01.05.01- The hospital retains its medical records. The retention time of the original or legally reproduced medical record is determined by its use and hospital policy, in accordance with law and regulation. Comprehensive Accreditation Manual for Behavioral Care
      Data and information are retained for sufficient periods to comply with law and regulations and support member care, network management, legal documentation, research, and education. Comprehensive Accreditation Manual for Health Care Networks
      RC.01.01.01 The organization maintains complete and accurate medical records for each individual patient- Comprehensive Accreditation Manual For Home Care
      RC.01.05.01- The hospital retains its medical records. The retention time of the original or legally reproduced medical record is determined by its use and hospital policy, in accordance with law and regulation. - Comprehensive Accreditation Manual For Hospitals
      - RC.01.05.01- The organization retains its medical records. The retention time of medical record information is determined by law and regulation and by its use for resident care, legal, research or educational purposes.

    Intent of RC.01.05.01 Medical records are retained for the period of time required by state law, or five years from the discharge date when there is no requirement in state law. For a minor, the medical record is retained for the time period defined by state law or at least three years after a resident reaches legal age as defined by state law.

    Comprehensive Accreditation Manual for Long Term Care
    National Commission on Correctional Health Care (NCCHC) Inactive health records are retained according to legal requirements for the jurisdiction and are reactivated if a juvenile or inmate returns to the system or facility. Standards For Health Services in Juvenile Detention and Confinement Facilities
    Standards for Health Services in Jails
    Standards For Health Services in Prisons
    National Committee For Quality Assurance (NCQA) Retention periods are not specified.

    Prepared by (2013)

    Kathy Downing, MA, RHIA, CHP, PMP
    Marcy Pye, RHIA

    Acknowledgements (2013)

    Angela Rose Dinh, MHA, RHIA, GPS, FAHIMA
    Lesley Kadlec, MA, RHIA

    Prepared by (2011)

    Patricia Cunningham, MS, RHIA
    Lou Ann Wiedemann, MS, RHIA, FAHIMA, CPEHR

    Acknowledgments (2011)

    Amber Bartlett, RHIA
    Jill S. Clark, MBA, RHIA
    Jane DeSpiegelaere, RHIA, CCS
    Angela Dinh, MHA, RHIA, CHPS
    Julie Dooling, RHIT
    Colleen Goethals, MS, RHIA, FAHIMA
    Angela Hammond, RHIT
    Loretta Horton, MEd, RHIA
    Gwen Jimenez, RHIA
    Karen Kostick, RHIT, CCS, CCS-P
    Monna Nabers, MBA, RHIA
    Lori Nobles, RHIA
    Mary Stanfill, MBI, RHIA, CCS, CCS-P, FAHIMA
    Diana Warner, MS, RHIA, CHPS
    Lydia Washington, MS, RHIA, CPHIMS

    Prepared by (original)

    Donna M. Fletcher, MPA, RHIA
    Gwen Hughes, RHIA
    Harry Rhodes, MBA, RHIA

    Acknowledgments (original)

    Roberta Aiello
    Jill Burrington-Brown, MS, RHIA, FAHIMA
    Jill Callahan Dennis, JD, RHIA
    Jennifer Carpenter, RHIA 
    Sandra Fuller, MA, RHIA, FAHIMA
    Margaret Joichi, MLIS
    Kelly McClendon, RHIA
    Julie Welch, RHIA


    Article citation:
    AHIMA. "Retention and Destruction of Health Information." (Updated October 2013).