There is no single, simple, definitive answer to the question of how long you need to keep patient records in Virginia. While it is not a multiple-part question, it has a multiple-part answer, with a lot of “if, then” potential alternatives. Ultimately, the answer depends on the facts of your situation, and how those facts are addressed by Virginia and federal laws and regulations.
Let’s start with Virginia law. VA Code §54.1-2400 gives the health regulatory boards – in this instance the Virginia Board of Medicine – the power to promulgate regulations. The Regulations Governing the Practice of Medicine, Osteopathic Medicine, Podiatry, and Chiropractic are found in Virginia’s Administrative Code (VAC) at Title 18, Agency 85, Chapter 20.* Section 26, at subsection D., states: “Practitioners shall maintain a patient record for a minimum of six years following the last patient encounter…” 18VAC85-20-26). That part is straight-forward enough, but then there are three stated exceptions.
First, the records of a minor child must be maintained until the child reaches the age of 18, or becomes emancipated, with a minimum time for record retention of six years from the last patient encounter. So, if you treat an infant less than one-year of age, you must keep that child’s patient record for the next 17 years (plus however many months and days) unless the child is sooner emancipated. Consequently, if you deliver care to him or her through the age of 18, you must keep their patient record until they are 24. In other words, depending on the facts, you may be legally compelled to keep a patient record for 24 years, 364 days. (Although, as we’ll see below, it could be – and for your protection, should be – be even longer.)
Second, you do not have to keep patient records for a minimum of six years if they have been transferred before that period elapses to another provider or to the patient or the patient’s personal representative. One fairly common example involving the transfer of records is when a practice is sold. So, if you sell your practice, you shed the record keeping requirement (although compliance with VA Code §54.1-2405 regarding patient notification must be addressed). Or if you provide copies to the patient or the patient’s personal representative, you short-circuit the requirement. As a related aside, please note the term “personal representative” is often associated with a decedent’s estate, but that term is not so limited here. Just as with federal law (e.g., HIPAA) a living person also may have a personal representative.
Third, the six-year minimum may be extended by a contractual obligation (e.g., a third-party payer insurance agreement), or by federal law (e.g., OSHA requirements). Actually, the six-year minimum may be extended by other provisions of Virginia law should they come into play.
Some provisions of Virginia law which could extend the six year minimum, and even some of the periods addressed by the three exceptions, involve malpractice actions. Most suits for medical malpractice are subject to a two-year statute of limitations. 8.01-243) However, in cases involving a foreign object being left inside the body, any complaint must be filed within one year from the date the object was, or reasonably should have been, discovered. Yet, no such action may be filed more than ten years after the date the object was left inside the body, unless it is brought by or on behalf of a disabled person. (VA Code §8.01-243 referencing §8.01-229.A.2.)
________________________
In the federal category, probably the most well-known federal law applicable to patient records is HIPAA (an acronym for the “Health Insurance Portability and Accountability Act of 1986”). However, in the HIPAA regulations promulgated by the Department of Health and Human Services, it is clear that HIPAA applies only to the privacy of patient records or, as the regulations phrase it, “the use and disclosure of protected health information (PHI)…” (45CFR164.530(j)(1)). HIPAA requires “covered entities” to maintain records of the use and disclosure of PHI for six years. Since most practitioners – as a general rule – don’t segregate the use and disclosure of PHI from the patient record containing the PHI, it would seem appropriate to act on HIPAA mandates as if they were applicable to the patient record itself. (Moreover, and in reality, you’re going to need to know what the PHI actually is, or was, in the event of an audit or legal action.)
The federal law which can ultimately impose the longest period for medical record retention is the Occupational Safety and Health Act of 1970. While excluding many service-sector businesses, OSHA regulations require employers with more than ten employees to maintain certain medical records for “at least the duration of employment plus thirty (30) years…” (29CFR1910.1020(d)(i)). Please note this regulation speaks to employers rather than practitioners per se. Nevertheless, if you are a physician employing ten or more employees, it’s not too hard to imagine a scenario under which the obligation to retain an employee’s medical records could last a veritable lifetime, and then some. (However, OSHA regulations do have provisions under which, if applicable, you can transfer records to the agency.)
________________________
So, if there is no single, simple, definitive answer to the question then what’s the practical answer? In my opinion it is simply this: establish the ability to electronically store and retrieve patient records, then keep them permanently (unless you are legally compelled to transfer them to a third party, or destroy them, which can happen in certain situations that are beyond the scope of this writing).
As a lawyer, I use to take in and generate voluminous amounts of paperwork, seemingly without end. But not anymore. I think I’m about as close to being paperless as I can get. And you can get there, too. If you have a sizeable practice and the resources to outsource, put a full-fledged, health information technology infrastructure in place in your practice. But if you’re a solo or small group, consider doing it yourself.
I’m on a Macintosh platform. I have a Fujitsu ScanSnap® sheet-fed scanner (36-ppm in duplex) and software from DEVONtechnologies, LLC called “DEVONthink Pro Office.” The scanner captures document images which the software subjects to optical character recognition processing. The software then sends the resulting, text-string searchable, image-preserved file to a database I have previously designated, pausing only long enough for me to name the file (and give it additional searchable criteria if I so choose). There are similar programs available on Windows and Vista platforms.
Is this a viable solution for you? Only you can answer that question. But it yields multiple rewards including – for purposes of this discussion – the ability to permanently store searchable patient records and retrieve them whenever the need arises. It makes the fact there is no single, simple, definitive answer to much less vexing. Whatever the answer may turn out to be given the facts of your situation – as they currently exist or as they evolve over time – the demands of that answer can be addressed in the routine course of business without hardship.
[END]
*The Regulations Governing the Practice of , Osteopathic Medicine, Podiatry, and Chiropractic can be downloaded from the Virginia Board of Medicine website, which is within the Virginia Department of Health Professions website. See the Resources page at physicianlegalservices.com for these and other links.
________________________
If you have questions about this article, or about other legal issues affecting your practice, please contact:
David F. Boleyn, Esq. Physician Legal Services, PLLCFor a printable version of this article, click here.
