Before closing a medical practice know your information management obligations

Published On February 01, 2018

Although you may be in the process of closing a medical practice, once closed the secure storage of, and access to, patient medical records doesn’t stop. Healthcare providers are required to ensure that patient medical records remain secure as well as readily accessible to authorized requesters throughout the required retention period even if the medical practice closes down. Given the hybrid environment of both physical and electronic records that exist today, this can be a challenge.

Here are 3 best practices to consider when closing a medical practice in order to ensure secure storage and access of patient records.

1: Storage risks and management challenges

When figuring out long-term storage for patient records, the first hurdle medical practices face is the storage of both physical paper records and electronic medical records (EMRs).

With physical paper medical records, the risks of using a private residence or self-storage facility are often overlooked by medical practices. It is important to keep in mind that the location where patient records are stored can create risk of unauthorized access and impact compliance with meeting the required turnaround times for Release of Information. Rather than taking on the burden of managing these risks, many providers look to outsource this task to a HIPAA-compliant third-party vendor that can address the unique challenges that come along with storing and managing patient records post-closure.

When it comes to the long-term storage of EMRs, this process can be even more complex. Providers need to consider the number of electronic patient records they have, the required retention period, and the anticipated activity against the records in order to manage those records securely and cost-effectively. In some cases, it makes the most sense for medical practices to print and store paper copies of patients’ health records from the EMR system in order to avoid the cost of supporting the legacy systems and avoid the increasing digital security risks.

Whether handling the long-term storage of physical paper records or EMRs, medical practices that are planning to close should store their medical records in a HIPAA compliant manner as well as make sure a process is in place to facilitate the timely response to requests for Release of Information.

2) Providing the secure release of medical records

Medical practices are also responsible for making sure there is a process for the secure release of medical records to authorized users until the end of the medical records’ retention period. This ensures the continuation of patient care by making sure medical records are available even after the practice has officially closed down.

What this means is that medical practices need to make sure that they have a secure and sustainable process in place to validate requestors, process release and maintain compliance with regulatory requirements. HIPAA, for example, requires that an Accounting of Disclosures be maintained in order to track ROI activity. Therefore, it’s important to understand the legal and business requirements of the Release of Information as well as make sure the technology, staff and safeguards are in place to avoid compliance violations.

3) Inform patients of how to access their medical records

Practices in the process of closing are required to provide details to patients on where patients’ medical records are being stored, how the patient can request access, and for what period of time the medical records will remain available. It’s important to make it clear to patients what the retention period is for their medical records and that after this time period their medical records will be destroyed and no longer available. Medical practices should consult with a healthcare attorney to ensure their notification to patients complies with all the requirements for closing a medical practice.

While the secure storage and access of medical records is an important part of closing a medical practice, it is not the only aspect of information management you must consider when closing your practice. To learn more about information management best practices for closing practices, click here.