July 19, 2018

Medical records serve multiple roles in the delivery of healthcare. The primary role is to provide documentation through the course of a patient’s illness, diagnoses, and plan of treatment. Beyond that, medical records provide an effective means of communication between healthcare professionals when treatment involves more than one provider. The medical record is also the largest component of the billing process and contains information about treatment, tests, and procedures carried out on behalf of the patient.

Another important role served by medical records is their role in legal proceedings. Properly maintained records will aid the provider in defending an action for substandard care. Conversely, when records are poorly kept, or they evidence inadequate treatment, they serve the patient’s benefit in the same action.

A. Ownership of Medical Records

Generally, medical records are the property of the healthcare provider. In New Hampshire, the information contained in a client’s record, and in the possession of a healthcare provider, is the client’s property.1 The client is entitled to a copy of his/her record upon request.2

Under new HIPAA rules, a patient is entitled to an electronic version of his or her records if the provider keeps records in an electronic form.3 All requests for PHI by a patient must now be “acted upon” – either provided or denied with a full written explanation within 30 days.4 For paper records, the maximum cost that can be charged is $15 for the first thirty pages or $.50 per page, whichever is greater.5 For filmed records such as x-rays, a “reasonable cost” is permitted. A “healthcare provider” includes almost all persons related in any way to the delivery of healthcare services to the client.6 In short, the physical record belongs to the treating healthcare provider that generates it. However the information contained therein is the property of the client undergoing treatment.

B. Legal Requirements for Contents

Although the provider maintains much of the detail in the medical record, the record’s contents are governed by legal requirements. State and federal laws as well as the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) are the primary sources establishing requirements for the content of medical records.

1. State Law

Authorized by statute, the Commissioner of Health and Human Services for New Hampshire is charged with creating and implementing regulations that govern the licensure of healthcare facilities within the state.7 The regulations promulgated under that directive vary based on the services offered by the provider. For instance, an acute care facility would most likely generate much more information on a particular patient than a walk-in clinic. New Hampshire Code of Administrative Rules, chapter He-P 800, specifically involves the licensing of health facilities while chapter He-M 500 involves mental health records. The complete set of regulations is found at

listagencies.html>. These regulations are occasionally updated, so it is wise to contact the Department of Health and Human Services or the Division of Administrative Rules at the Office of Legislative Services to ensure that your regulations are the most current. The New Hampshire Patient’s Bill of Rights8 requires that medical records include some specific information:

The patient shall be fully informed by a health care provider of his or her medical condition, health care needs, and diagnostic test results, including the manner by which such results will be provided and the expected time interval between testing and receiving results, unless medically inadvisable and so documented in the medical record, and shall be given the opportunity to participate in the planning of his or her total care and medical treatment, to refuse treatment, and to be involved in experimental research upon the patient’s written consent only.9

Another example is when a patient needs to be physically restrained: “In an emergency, restraints may be authorized by the designated professional staff member in order to protect the patient or others from injury. The staff member must promptly report such action to the physician and document same in the medical records.”10

2. Federal Law

Federal regulations outline the conditions of a provider’s participation in the Medicare program.11 For example, participating hospitals must keep records that “contain information to justify admission and continued hospitalization, support the diagnosis, and describe the patient's progress and response to medications and services.”12 The Code of Federal Regulations contains several provisions dictating the specific contents of medical records. The following are some examples of what is required:

- evidence of a physical examination, including a health history, performed no more than 30 days prior to admission or within 24 hours after admission;
- admitting diagnosis;
- results of all consultative evaluations of the patient and appropriate findings by clinical and other staff involved in the care of the patient;
- documentation of complications, hospital acquired infections, and unfavorable reactions to drugs and anesthesia;
- properly executed informed consent forms for procedures and treatments specified by the medical staff, or by Federal or State law if applicable, which require written patient consent;
- all practitioners’ orders, nursing notes, reports of treatment, medication records, radiology and laboratory reports, and vital signs and other information necessary to monitor the patient’s condition;
- discharge summary with outcome of hospitalization, disposition of case, and provisions for follow-up care; and
- final diagnosis with completion of medical records within 30 days following discharge.13 Individual private practitioners must follow fewer requirements, but those who receive payment for services through Medicaid and Medicare are subject to a greater number of those regulations. Ignoring the regulations and improper record keeping could result in exclusion from the Medicare program. It should also be noted that federally funded drug and alcohol treatment programs are required to maintain records in a secure room, and further in a locked file cabinet, a safe, or other secure container when not in use.14 Such programs are also required to adopt written procedures to address record confidentiality.15

3. The Joint Commission on Accreditation of Health Care Organizations

The Joint Commission on Accreditation of Healthcare Organizations (JCAHO), a private organization based out of Illinois, conducts comprehensive accreditation of healthcare facilities throughout the United States.16 Their standards are extremely thorough and so widely accepted that some states do not require additional licensure when a healthcare facility has been approved by JCAHO. Such is the case in New Hampshire, where statutory law allows the Commissioner of Health and Human Services to require JCAHO accreditation.17

JCAHO publishes its requirements for accreditation. Some of the requirements pertain to the management of medical records. The American Health Lawyers Association stated that a hospital must maintain medical records that “contain sufficient information to identify the patient, support the diagnosis, justify the treatment, document the course and results, and promote continuity of care among health care providers.”18 The standards also provide that medical records demonstrate that “the environment in which patient-specific information is provided supports timely, accurate, secure, and confidential recording and use of patient-specific information.”19 JCAHO offers specific guidelines for what a medical record should contain.20

Some examples are as follows:

- the patient’s name, address, date of birth, and the name of any legally authorized representative;
- emergency care provided to the patient prior to arrival, if any;
- conclusions or impressions drawn from the medical history and physical examination;
- the diagnosis or diagnostic impressions;
- the reasons for admission or treatment;
- the goals of treatment and the treatment plan; and
- evidence of informed consent, when required by hospital policy.

In addition to maintaining appropriate and thorough medical records on each patient, the U.S. Office of Inspector General recommends in its Compliance Program Guidance for Individual and Small Group Physician Practices that the physician’s medical record retention system include the following types of documents: all records and documentation required for participation in federal, state, and private payer health care programs; and all records necessary to demonstrate the integrity of the physician’s compliance process and to confirm the effectiveness of the program.21

C. Medical Records Entries

In addition to establishing criteria for the contents of medical records, the timeliness of entries into the record is also regulated. JCAHO has addressed this concern by noting that a medical record is delinquent if it is not completed within the time period “spelled out in the medical staff’s rules and regulations and cannot exceed 30 days.”22

The medical record often serves as the blueprint for one’s treatment and tells the story for those involved, whether it is peer review, continued or alternative treatment, or litigation. Everyone benefits by orderly-kept records. This means they are complete, legible, well documented and substantiated, and offered in a way to facilitate further discussion about the patient’s services, needs, diagnosis and treatment.

D. Retention Requirements: Destruction of the Records

The American Medical Association and other professional organizations have guidelines for record retention policies. Absent guidance from a professional organization or individual legal counsel, it is advisable that medical records are kept for at least seven years beyond the time of last contact with a patient. For those who are minors or legally incompetent, record retention should exist seven years after the individual becomes competent or reaches the age of majority.

Hospitals

Current New Hampshire rules for hospitals require medical records be kept for a minimum of seven years, with children’s records retained for at least three years after the child turns 18. In no case may the period of retention be less than seven years after discharge. 23

Additionally, hospitals are required to arrange for the storage of and access to medical records for seven years in the event the hospital ceases operation.24

State of New Hampshire

The Commissioner of New Hampshire Health and Human Services is empowered to “destroy any reports, records and other documents in the department which in his opinion are no longer of any value to the state.”25 However, all records containing information about payments to recipients of benefits under public welfare programs and medical audits are kept for at least ten (10) years from the date of filing or until they are audited.26

Decedent

Under prior law, the medical records became the property of the estate if the patient died and could only be disclosed or destroyed with the authorization of the executor of the estate.

Since 2011, however, the surviving spouse is entitled to access the decedent’s medical record irrespective of whether the surviving spouse is the decedent’s executor, unless the decedent objected to such a release prior to his or her death.27 Generally, however, the records of deceased patients belong to their estate and only the executor or administrator of the estate may release them. Parents of minor children or next of kin (besides a spouse) cannot access records of a deceased person unless they are appointed by the Probate Court as executor or administrator of the estate. It should be noted that a person holding a power of attorney or guardianship appointment cannot access or release records once a patient has died. An exception gives the state medical examiner the power to obtain medical records of any person’s death under investigation by that office.28

Under the revised HIPAA Omnibus Rule, the health records of someone who has been deceased for fifty years or more do not constitute protected health information and therefore do not need to be protected in accordance with HIPAA.29 However, there is no such exception under New Hampshire law. Therefore, because New Hampshire law is more protective of patients’ information on this point, the fifty year exception under the new HIPAA rules does not apply. Additionally, new federal rules allow the release of protected health information to a decedent’s “family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior express preference of the individual that is known to the covered entity.”30 This federal exception, too, does not apply in New Hampshire because New Hampshire law is more protective on this point.

Medicare

Federal Medicare regulations require that records be “retained in their original or legally reproduced form for a period of at least 5 years.”32

Business Associates

Healthcare providers must be vigilant that their “business associates” comply with both HIPAA privacy rules in handling their protected health information, as well as the record retention and destruction standards required in their business associate agreements. Most business associate agreements contain requirements for record retention and destruction during the course of and upon the termination of the agreement. Failure to ensure compliance with the terms of the business associate agreement could lead to severe consequences under HIPAA.

1 N.H. Rev. Stat. Ann. (“RSA”) §§ 332-I:1; 151:21, X.
2 RSA §§ 332-I;1; 151:21, X..
3 45 CFR §164.524(c)(2)(ii).
4 45 CFR §164.524(b)(2).
5 RSA § 332-I;1.
6 RSA § 332-I :1, II.
7 RSA § 151:9, I. See Appendix A for the complete statute.
8 RSA § 151:21.
9 RSA § 151:21, IV. See Appendix A for the complete statute.
10 RSA § 151:21, IX.
11 42 CFR. § 482.24. See Appendix A for the complete regulation.
12 42 CFR § 482.24(c).
13 42 CFR § 482.24(c)(2), (i)-(viii).
14 42 CFR. § 2.16(a).
15 42 CFR § 2.16(b).
16 JCAHO’s website can be accessed at http://www.jointcommission.org/.
17 RSA § 135-C:10, II(c).
18 Richard L. Grier et al, Health Law Practice Guide, § 3:4 (2002).
19 Id.
20 Id.
21 Richard G. Korman, “Medical Records Management,” Physician’s Monthly – New Hampshire Medical Society Newsletter, October 2000.
22 Id.
23 N.H. Admin. R. He-P 806.17(h).
24 N.H. Admin. R. He-P 806.17(i).
25 RSA § 161:5. See Appendix A for the complete statute.
26 Id.
27 RSA § 560:22.
28 RSA § 611-B:14-a.
29 45 CFR § 164.502(f).
30 45 CFR §164.510(b)(5).
32 42 C.F.R. § 482.24(b)(1).