Mid-Atlantic Health Law TOPICS

The Maryland Department of Health and Mental Hygiene has recently finalized new regulations about the storage and disposal of medical records in accordance with Maryland's Medical Records Destruction law. The following is a list of eight things you should know about medical record storage, some of which are new concepts articulated for the first time in the new regulations, and some of which are existing principles that are either reiterated in the new regulations or otherwise still apply.
1. Medical Records Ownership. Medical records are the personal property of the entity providing the health care. Periodically, patients argue that they own their medical record, and demand their original files. This is incorrect. Patients can demand, and should receive, only copies of their medical record.
2. Retention Schedule. Every health care entity must have a medical record retention schedule that includes a list and description of the medical records, the retention period for each medical record, and destruction instructions. The schedule, as a matter of good housekeeping, should include storage and maintenance procedures and disposal methods.
3. Storage. Medical records must be stored in an office that has access restricted to authorized staff. Electronic medical records must be stored on an electronic medium with passwords or data encryption. Health care entities must keep current back-up copies of those electronic medical records. If medical records are stored at a commercial records storage site, that site must have environmental and security access controls.
4. Paper Record Destruction. Medical records kept on paper must be destroyed by shredding, incineration, or pulping or any other process that makes the record permanently unreadable.
5. Electronic or Other Media Destruction. Medical records stored in electronic media, such as computer hard drives, must be destroyed by completely sanitizing the media with no possibility of recovery. For example, mere deletion of a file is not enough. Medical records on other media, such as film or photos, must be destroyed without the possibility of recovery.
6. Other Laws. Medical records in Maryland cannot be destroyed until after five years or, for a minor patient, the longer of three years after the minor turns 18 or five years after the medical record was made. Good business practices and other laws, including Medicare Advantage regulations, generally require the retention of medical records for at least ten (10) years.
7. Early Destruction. Before a health care entity can destroy a medical record prematurely, written notice must be sent to the patient (or the patient's guardian in some cases) at least thirty (30) days before the destruction date.
8. Violations. Health care entities that violate the Medical Records Destruction law are subject to fines of up to $10,000 per day. Individual health care providers or administrators may be fined up to $5,000 per day.