Risk Management

Questions About Medical Record Retention

By Paul Weber, JD

OMIC Vice President of Risk Management

Digest, Winter 1998; reviewed 6/26/17.  Click here for our guidelines:  https://www.omic.com/medical-record-retention-guidelines/

Quite often, medical records are the determining factor in the outcome of a malpractice case so it is not surprising that the question I am most frequently asked concerns how long a physician should keep a patient’s records after treatment has ended. Unfortunately, there is no simple answer to this question because of the numerous exceptions to each state’s statute of limitations for bringing suit against a physician. Many defense attorneys will tell you that the best risk management policy is to keep all patient records forever. While this may be the safest advice, it is often impractical. The following questions address both general and specific situations that dictate how long a patient’s records should be kept.

Q How do lawsuits affect medical record retention?
A Lawsuits against physicians for malpractice must be filed by the (allegedly) injured patient within the statute of limitations. However, this time period can be “tolled” or suspended if the patient is incompetent or a minor, or if the provider fraudulently concealed the malpractice, or if a foreign body with no therapeutic or diagnostic purpose was left in the person of the injured patient. In some states, the statute does not begin running from the time the alleged substandard act occurred, but from the time the patient should have been aware that the substandard care caused the problem. This is frequently indefinite and may be subject to the discretion of the judge. Defense attorneys know that before a lawsuit is dismissed by a trial judge because of being untimely filed, the judge will construe the statute of limitations very liberally to allow the plaintiff his or her “day in court.” What might mitigate a liberal construction is whether the defendant physician has been prejudiced by an unjustified delay. If prejudice cannot be shown, the lawsuit may go forward because of a “loophole” in the statute of limitations.

Q How long should I maintain the records of adult patients?
A It is advisable to keep the records of adult patients for ten years after their last contact with the practice.

Q How long should I maintain the records of minor patients?
A For most patients under 18, it is prudent to keep records for ten years after their last contact with the practice (same as adults) or four years beyond their 18th birthday, whichever is longer. For minor patients who will always be considered “incompetent” because of a mental or physical disability, records should be maintained indefinitely or five years after the patient has died.

Q How long should I maintain the records of deceased patients?
A It is recommended that records of deceased patients be kept long enough for the probate of the estate to close, usually five years.

Q How long should I maintain the records of incompetent patients?
A Because of the tolling of the statute of limitations for incompetent patients, their medical records should be kept indefinitely or five years after the patient has died.

Q What other factors influence record retention?
A All records that have been the subject of an incident that could lead to litigation and all records that have been requested by an attorney or administrative agency should be excepted from the general retention policy. These records should not be destroyed until the matter is fully resolved and only with the advice of OMIC or your assigned attorney. If these files are not retained appropriately, the result may be a claim of spoliation, whereby a plaintiff charges that evidence was destroyed that the physician had a duty to retain. Also, federal and state laws and regulations (e.g., Medicare and OSHA) will determine the length of time that a medical record is retained. Managed care contracts should be scrutinized to determine if your general retention policy meets the contract requirements.

Q How should patient records be destroyed?
A Every practice should have a written record retention and destruction policy in place, and staff should be familiar with the policy to ensure uniform record handling and minimize claims that a patient’s records were destroyed improperly. Even when it has been decided to dispose of records, the practice should maintain some basic information, including the patient’s name, date of birth, Social Security number, dates of first and last visit, general problems and procedures done in the office. Destruction of records must be accomplished in a manner that protects the confidentiality of the documents being destroyed. Documents should be shredded or burned rather than simply disposed of in a garbage receptacle. Horror stories abound regarding incomplete record destruction resulting in public disclosure of confidential information.