Medical retention laws and policy frameworks

Health Care -- Medical Retention Laws

Medical records retention requirements, whether Federal or State, are apparently aimed at maintaining records for a significant length of time after a patient's discharge. HIPAA does not impose a specific requirement for retention of a patient's medical records and leaves that task to State legislatures. California meets and far exceeds Federal requirements in multiple requirements from multiple laws. Meanwhile, Nevada takes a far simpler tack while still adhering to Federal requirements.

Federal

HIPAA does not impose a length of time for which patients' medical records must be retained (U.S. Department of Health and Human Services, 2009); rather, that requirement is left to the states. However 45 C.F.R. §164.530(j) does require that an entity governed by HIPAA must retain its "privacy policies/procedures, privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented" (U.S. Department of Health and Human Services, 2012) for six years of the records' creation or last effective date, whichever comes later (U.S. Department of Health and Human Services, 2012). Of course, if we leave HIPAA and venture into federal programs such as OSHA, for example, there are myriad records retention requirements depending on various circumstances.

California

California's record retention laws are at least as strict as federal law, as required, and are often stricter. Beyond the HIPAA requirements binding covered entities, California has various strict retention requirements stemming from several laws. California's Code of Regulations §70751(c) (22 C.C.R. §70751(c) requires hospitals to keep patients' medical records for a minimum of 7 years after any patient's discharge and, if the patient is a minor, the records must also be retained for a minimum of 1 year after the minor has reached the age of 18 (California State Legislature, 2013). Also, the Welfare & Institutions Code §14124.1 states that the medical records of Medi-Cal patients must be kept by the provider for 3 years after the last date of service rendered under the Medi-Cal Program (California State Legislature, n.d.). In addition, the Health & Safety Code §1797.98e (b) states that providers reimbursed by the Emergency Medical Services Fund must keep patients' records for 3 years after the last reimbursed service was rendered (California State Legislature, n.d.). The Health & Safety Code under §11191 also requires that prescription books with issued prescription copies must be kept for 3 years after the last noted prescription was issued and that a provider who "prescribes, dispenses or administers a controlled substance classified in Schedule II" is required to make and keep a record of each such transaction for 3 years (California State Legislature, n.d.). Furthermore, under California's Code of Regulations §1300.67.8 (28 C.C.R. §1300.67.8), managed care plans governed by the Knox-Keene Act must also retain all "records, books, and papers of a plan" for 2 years, keeping the records available for inspection by the Commissioner of Corporations (California State Legislature, 2009, p. 54.5). California's Code of Regulations §39.5 also requires that in cases of Worker's Compensation, all qualified medical evaluators must retain patients' medical-legal reports for 5 years after the employees' evaluation (California State Legislature, 2013). Finally, regarding its state Occupational Safety and Health Administration (OSHA) program, California's Code of Regulations §3204(d) (8 C.C.R. §3204(d) requires that in cases of employees who were exposed to "toxic substances or harmful physical agents," providers must keep medical records for a minimum of the duration of employment plus thirty years (California State Legislature, 2013).