Retaining Patients’ Psychiatric Records

Psychiatrists frequently ask how long they must keep a patient’s medical records. Although it is not required by law, psychiatrists should retain their patients’ records indefinitely. Retaining the records may be important for a variety of reasons, such as what medications the patient was on previously and compliance with treatment, and, in the event of an adverse outcome, may be vital in the defense of a lawsuit.

If storing patient records indefinitely is not an option, psychiatrists must at least retain their patients’ medical record for a required period of time under state law. The Health Insurance Portability and Accountability Act (HIPAA) does not include medical record retention requirements. Since most states have their own regulations, it is important for you to know your state’s required retention period. If you have questions, contact your local attorney, risk manager, or state board of medicine.

Factors affecting the length of time that medical records must be retained may include the following:

• Whether the patient is an adult or a child/adolescent

• How long you must retain a patient’s medical record after his/her death

• Whether you are an independent provider versus employed by a hospital

Some states do not regulate how long providers are required to retain medical records. In those states, psychiatrists should keep the records for at least as long as the statute of limitations for filing a medical malpractice suit.

Disposing of Records

When it is no longer legally required and you no longer wish to retain the records, you should dispose of the patient’s protected health information (PHI) contained in the records in compliance with federal and state laws. Under HIPAA, covered entities (CEs) implement policies and procedures to address record disposal, both for electronic and paper records. Moreover, under HIPAA, any employee (or volunteer) involved in disposing of PHI must receive training on proper disposal.

Although HIPAA does not specify a disposal method, CEs are expected to take reasonable precautions to protect PHI from improper disclosure during disposal and are not permitted to simply abandon/dispose of records in containers accessible to the public. Examples of proper disposal methods may include the following:

• Shredding, burning, pulping, or pulverizing the records so that PHI in paper records is rendered essentially unreadable and indecipherable and otherwise cannot be reconstructed.

• Maintaining labeled prescription bottles and other PHI in opaque bags in a secure area.

• Using a disposal vendor as a business associate to pick up and shred or otherwise destroy PHI.

• For electronic PHI, clearing (using software or hardware products to overwrite media with nonsensitive data), purging, demagnetizing, or destroying through methods such as disintegration, pulverization, melting, incinerating, or shredding.

There may be other suitable methods for destruction, and psychiatrists should consult with a local attorney and/or risk management professional to determine current state and federal requirements for proper disposal of PHI. Additionally, if using an outside vendor to assist with the disposal, a business associate agreement should be in place prior to the vendor’s assuming possession of the PHI.

For more information on this topic, see the online risk management courses, “Clinical Documentation after HITECH: It’s Back to Risk Management Basics” and “Clinical Documentation With a Jury in Mind,” available on APA’s Learning Center Risk Management page. ■