Medical Record Retention Recommendations for Physician Office Practices and Hospitals
Patients' medical records are among the most vital documents maintained by a health care facility. A comprehensive medical record is essential for proper patient care. In addition, a well-documented record greatly aids the defense of potential malpractice lawsuits. The physician practice, provider, or healthcare facility owns the physical medical record; however, the information contained in the medical record is the confidential property of the patient.
Each organization must determine the content of its legal medical record. For example, "At XXX Organization, the medical record includes clinical documents such as but not limited to: provider documentation, clinical support staff documentation, results of diagnostic procedures including images, consents, consultant reports, treatment-specific communications between providers or between patient and provider, patient education and instructions, etc." To assist in the development of the definition, please reference Fundamentals of the Legal Health Record and Designated Record Set (ahima.org)
Listed below are both Medical Mutual's recommendations for record retention and state-specific requirements for Maine, New Hampshire, Vermont, and Massachusetts for physician office practices and hospitals. While permanent retention of medical records would be ideal, permanent storage of hard copy records may be impractical. However, with the implementation of electronic health records, permanent record retention may become the norm.
Age of Majority: (ME, NH, VT, MA): 18
Statute of Limitations: (ME, NH, VT, MA): 3 years (It is important to note that the statute of limitations may not begin to run until the injured person knew or should have known of the injury and of its negligent cause, whichever occurs first.
MMIC Medical Record Retention Recommendations (unless state regulations/laws require a longer retention period.):
- Adults: 10 years from the date of the last medical service for which a medical entry is required. (Exception Massachusetts: Inpatient: 20 years.)
- Minors: Age of majority plus state statute of limitations. (Exception Maine: Hospital: age of majority plus 6 years.)
Note: Once a minor reaches 18, the adult retention recommendation applies, e.g., 10 years from the last medical service for which a medical entry is required.
- Deceased adult patients: 10 years from the time of death. (Exception Massachusetts: Inpatient death: permanent.)
- Hospitals: Newborns and Mothers of Newborns: Retain the mother's record and the electronic fetal monitoring (EFM) strips for the same period of time the newborn record is retained. The records of both patients would be needed in defense of any potential birth injury claim.
**MMIC retention suggestions are in accordance with the American Health Information Management Association's (AHIMA) medical record retention guidelines.
Hospital-owned Physician Practice
Hospital-owned physician practices may be obligated to retain records according to hospital policy. Consult the hospital risk manager or health information management director to determine requirements.
Physician Office Practice: Medical Records Received from Other Provider or Patients
It is unnecessary to maintain medical information (records) received that are not pertinent to the specialty consult or applicable to treatment of the patient's condition. In cases where documents are not necessary records should be returned to their originator or destroyed through a confidential process.
Use professional document storage companies for off-site record storage of paper records. General commercial storage units do not provide the same level of security as a document storage company. Additionally, most professional storage companies are designed with environmental control systems to protect the records from damage due to moisture and temperature extremes. The fire protection systems in professional record storage companies utilize fire suppression techniques that do not cause additional damage to the records in the event of a fire.
State and Federal Regulations for Retention of Medical Records
No state law governs retention of medical records in the private physician office practice. The Maine Medical Association (MMA) provides guidance in the Physician's Guide to Maine Law. The principal guidance is the American Medical Association's (AMA) ethics opinions and Maine's statute of limitations for bringing lawsuits. The minimum length of time the MMA recommends for record retention is six years. However, Maine hospital licensing regulations specify a seven (7) year retention period, which would likely apply to hospital-based practices. It is common for physicians to keep records for as long as ten years, and some malpractice carriers recommend this retention period.
The New Hampshire Board of Medicine Rules states: "The licensee shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient's last contact with the licensee, unless, before that date, the patient has requested that the file be transferred to another health care provider." Med 501.02 (f)
New Hampshire Hospitals: NH Code of Administrative Rules addresses the issue in NH (h) Patient records shall be retained 7 years after discharge of a patient, and in the case of minors, patient records shall be retained until at least one year after reaching age 18, but in no case shall they be retained for less than 7 years after discharge.
The following is excerpted from the Vermont Guide to Health Care Law, "Hospitals are required to retain medical records for a minimum of ten years as part of their state licensure obligations. The licensure laws are silent for other providers. However, based on the statute of limitations for certain causes of action under Vermont and federal law, all health care providers are advised to retain medical records for at least ten years after the patient was last treated by the provider. As a general rule, it is recommended that a provider retain records of deceased patients for no less than three years after the patient's death.
Children's records should be retained until at least three years following their eighteenth birthday."
The HIPAA Privacy Regulations, 45 C.F.R. 164.530 (j)(2), state "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later." These documents include business partner contracts, disclosures of protected health information, responses to a patient who wants to amend a record or correct a record, and other documents. In addition, the Privacy Rule, 45 C.F.R. 164.524, generally gives patients a right of access to inspect and obtain a copy of their medical records, for as long as those records are maintained.
Destruction of Medical Records
Healthcare facilities must use a confidential destruction process. Your local hospital may have the capacity to safely dispose of medical records or contact an attorney to locate a secure record destruction service. HIPAA requires a business associate agreement when using a destruction service.
Centers for Medicare and Medicaid Services
State Operations Manual
Statute of Limitations by State
For more detail on the statutes, please reference the following:
New Hampshire Statutes: CHAPTER 508: LIMITATION OF ACTIONS (508.4)
Vermont Guide to Health Care Law
Massachusetts General Law
Medical Mutual Insurance Company of Maine's "Practice Tips" are offered as reference information only and are not intended to establish practice standards or serve as legal advice. MMIC recommends you obtain a legal opinion from a qualified attorney for any specific application to your practice.