Record Retention – Having a Policy in Place Will Pay Dividends Down the Road

Over the course of a year, I field a number of questions from medical practices on various topics relating to practice management. While these questions vary from staffing to salary to regulatory updates, there is one that stands out as being asked more frequently than all the others. That is, ‘how long do we need to retain our records?’

While this may appear to be a straightforward topic on the surface, it is anything but. Guidelines and regulations are being handed down from the Internal Revenue Service (IRS), State Departments of Revenue (DRS), Centers for Medicare and Medicaid Services (CMS) and Department of Labor (DOL), just to name a few. To make matters even more complicated, your practice also needs to factor in the costs associated with retaining documents and then determining what to do with those that need to be destroyed.

This article will help your practice understand the general guidelines as to how long documents should be retained, the fundamentals of setting up your own record-retention policy, and considerations for the proper destruction of your documents.

As noted previously, guidance on how long to retain certain documents comes from a variety of agencies. Resources for specific retention guidelines for those documents more commonly held in your medical practice can be located on the websites for the IRS, DRS, DOL, CMS, HIPAA and the various state medical societies. It is important to consult these agencies when determining exactly how long a certain document must be retained.

Please refer to the listings below for the general retention periods for some of the more commonly requested items:

• Permanent: Income tax returns and related payment support, financial statements, corporate documents and stock records, general ledgers, real estate documents, retirement plan agreements and related Form 5500 filings, payroll registers, payroll tax returns and W-2s

• Seven years: Bank statements, cash receipts and disbursement journals and back-up documentation, A/R and A/P listings — with invoices, time and expense reports, and employee records (seven years following termination from employment).

• Medical Records: Unless state laws require a longer period, HIPAA generally requires a date of the longer of six years from the records date of creation or the date the record was last in effect (per CMS MLN Matters News Flash #SE1022). Note: These are general guidelines and certain national associations, specialties, or even documents may require longer retention periods.

While the above may hold true in most instances, it is important to note that the specifics of a particular situation or transaction may require records to be held longer. Retention guidance on some of the more unusual documents that you might be storing should be discussed with your legal and tax advisors, as appropriate. When in doubt, it is recommended that the document be retained.

The main reason that the question of a retention policy arises so often is that so few medical practices seem to have a policy in place. While such a policy may require some up front dollar and labor costs, it will pay dividends in the future.

Your team will have one place to look when determining how long something should be retained, in what format, and how it should be destroyed, rather than asking over and over again. This can be particularly helpful in a practice that experiences turnover.

In order to create an effective policy, there must be buy-in from all of the stakeholders in the office, since many employees will help to carry the policy out. The best way to obtain this buy-in is to have the whole practice involved in its development. As this process is not the same for every medical practice, it is important to understand fully how your records are utilized, what records need to be maintained and how it would be most efficient to store these documents in a cost-effective manner. Enlisting all stakeholders at the design phase will only help to ease some of the headaches down the road.

Many practices have begun implementing electronic storage into their retention practices. This provides many benefits in terms of the archiving and retrieving of your documents, as well as being able to store them for a longer period of time at a lower cost. While the cost to store documents electronically may have come down considerably, there is still the cost of converting to an appropriate, secure file and maintaining the servers and equipment for storage over a period of time. As such, if you do not currently have an IT Team or specialist in house, one should be brought in for these discussions.

Once a document is converted to an electronic medium for retention purposes, or at a time when the retention period has passed, properly destroying the document is just as critical as making sure it is stored for the proper period of time. There are significant penalties related to the improper release of confidential data. Massachusetts released a general law (MGL c93H, further enforced by 201 CMR 17.00) effective in 2010 relative to the safeguarding and disposal of such data, leading to fines up to $50,000 for each case of improper disposal.

Rather than sending these records out with the weekly trash, it is imperative that a document-destruction specialist be brought in. There are local services available that will not only shred your paper documents, but can also completely destroy computers and other electronic devices. Certificates can be requested that such items were disposed of using proper means. And for those instances where you wish to re-use electronic equipment for another purpose, the services of an IT specialist should be sought out to ensure that all records were properly and completely removed from the device. Computers can be very complex, and with the penalties that are out there, this is not a task that should be left to a novice.

In conclusion, record retention is not often at the forefront of our daily tasks, however, it is something that should be considered on a regular basis. Understanding the rules and regulations in order to navigate this topic, as well as having an effective policy in place, will help to eliminate some of the stress involved the next time someone in the practice asks “how long do we need to keep this?”