Medical and Dental Record Retention

Retaining well-maintained patient records helps medical and dental professionals ensure continuity of care; protect against any future professional liability claims, licensing board complaints, and peer review inquiries; and can assist when responding to investigations by governmental compliance agencies and billing audits.

The following information can guide practitioners in developing record retention policies.

Basis for Keeping Medical and Dental Records

The most important reason for creating and keeping patient records is to provide information on a patient’s care to other healthcare professionals. An accurate record of an individual’s presenting complaints, physical examination findings, differential diagnoses, treatment plan, and response to treatment helps optimize patient well-being and promote more effective continuity of care.

Patient records also serve other vital functions. For example, billing audits by CMS or commercial third-party payers require clear documentation demonstrating medical or dental necessity and the nature and scope of the services provided.

Another major rationale is that a well-documented record increases support for the practitioner’s defense in the event of a malpractice action. Judges and juries generally regard entries made in the record at or near the time of the event as highly reliable evidence. The record and progress notes—key evidence in a professional liability action—are critical to helping refresh the practitioner’s recollection of events that might have occurred years earlier. The record establishes facts during a time when no conflict or other motivation influenced the circumstances at issue.

Without the patient’s record, a healthcare professional might not be able to show that the treatment was appropriate and that it met the standard of care. Simply relying on the practitioner’s testimony of general habit and practice to show that the standard of care was met—without supporting documentation to establish the treatment that was rendered—often fails to convince a jury that the treatment the patient received was consistent with professional standards.

Patient records also establish the quality of care rendered in the event of a professional licensing board complaint, peer review inquiry, or civil rights investigation. Patient grievances may be filed based on an individual’s faulty recollection of events, a failure to understand the course of treatment, or dissatisfaction that an adverse outcome occurred. When a patient record is well documented, allegations can often be resolved—frequently before a formal administrative process is initiated.

Federal Law, State Law, and Case Law

Federal laws impose mandatory record retention requirements on healthcare facilities and practices. For example, the Medicare Conditions of Participation require providers and suppliers to retain records for seven years from the date of service (42 CFR § 424.516[f]), whereas OSHA requires an employer to retain records for 30 years for employees who have been exposed to toxic substances and harmful agents (29 CFR § 1910.1020[d][1]). Additionally, HIPAA privacy regulations require that documents created in compliance with the Privacy Rule (such as policies, procedures, and accountings of disclosures) be retained for six years from when the document was created or the last effective date, whichever is later (45 CFR § 164.530[j][2]). (Find the Code of Federal Regulations at ecfr.gov.)

The healthcare professions have primarily been regulated by the states rather than by a federal oversight agency. As a result, record retention laws and regulations differ from state to state, so it is important to check and follow state requirements.

Record retention policies should not be based solely on the state statute of limitations. This is because case law in various jurisdictions may extend the allowable time for the patient to bring a malpractice action. An example of this situation is when a patient could not have discovered that the injuries were caused by wrongdoing within the statutory timeframe.

Contracts

Contracted healthcare plans can also affect the length of time records must be retained. For example, Medicare managed care program providers must retain records for 10 years (42 CFR § 422 504[d]). Check any signed managed care agreements or contracted healthcare plans to ensure compliance with the record retention requirements of those agreements.

Board and Association Policies and Recommendations

When state and federal laws and contracts are silent on record retention, your attorney, state licensing board, or professional association may be able to provide policies or recommendations on how long a practitioner should keep records.

For example, the Colorado Medical Board Policy 40-07 recommends retaining medical records for a minimum of seven years after the last date of treatment for an adult and for seven years after a minor has reached the age of majority, or age 25. In California, where no statutory requirement exists, the California Medical Association concluded that, while a retention period of at least 10 years may be sufficient, all medical records should be retained indefinitely or, in the alternative, for 25 years.¹

The Doctors Company Recommendations

Once a record has been destroyed, it is difficult—if not impossible—to defend a case. We encourage medical and dental professionals to consult with their legal counsel regarding how the law in the jurisdictions relevant to their practice has been interpreted by the judicial system.

You must follow your state’s specific guidelines or laws. Where no statutory requirement exists, The Doctors Company recommends the following for retaining patient records:

• Adult patients: 10 years from the date the patient was last seen.
• Minor patients: 28 years from the date of birth.
• Deceased patients: Five years from the date of death.

Patient records, whether paper or electronic, must be maintained in a HIPAA-compliant format. If using a commercial service, the records should be stored with a reputable document storage company. Many companies offer alternative methods for paper document management, such as electronic scanning and storage, and may offer storage of previous electronic records when software formats change. Storing closed or archived records at a residence or on a home computer puts records at risk of damage from fire, flood (or other weather-related disasters), vermin, loss due to theft, or unauthorized access.

If a practitioner chooses to destroy clinical records after the required retention period, confidentiality must not be compromised. Use a record destruction service that guarantees a method of destroying records that does not allow further access to the information. Records that are destroyed should be listed on a log with the date of destruction.

What Records Should You Retain?

Retain all records that reflect the clinical care provided to a patient, including practitioner notes, clinical staff notes, diagnostic testing, medication lists, photos, videos, x-ray films, ECG recordings, fetal monitoring strips, and/or dental models/casts. Additionally, records from other practitioners that directly relate to your care and are maintained as a regular part of your record should be kept for the same period that you retain your own records. This is especially true if you have relied on any of the previous records or information when making clinical decisions.

Review patient bills for any reference to care provided. For example, review a bill to determine if it shows a limited examination or a complete examination with diagnostic tests obtained or requested. If the billing document shows that care was provided, it may be in your best interest to keep the bill for as long as you retain the record. Otherwise, retain the bill for the same length of time as other business records and in accordance with federal and state income tax requirements.

Storing patient records for the recommended time can generate a financial expense for the practitioner or practice. Given the importance of records in ensuring continuity of care and defending malpractice actions, however, it is vital to ensure that records remain available.

For further assistance, see our comprehensive Medical and Dental Records Guide, or contact Patient Safety and Risk Management at (800) 421-2368 or by email.