Part 3

2. Part 3 Legal and Ethical Issues Central to Health Information Management

3. Chapter 8: Patient Record Requirements

4. Introduction • Health information may be kept in different formats: • Paper health record or chart • Electronic health record (EHR) • Abstract of patient information • Health record is legal record of care • Subject to stringent legal requirements

5. Health Record:Functions and Uses • Health record is a document that: • Describes patient’s history, diagnoses, therapies, and results of treatments • Includes personal, medical, financial, and social data about the patient • Serves both clinical and non-clinical uses • Is a chronological document of clinical care • Is created at the time care is given • Is used by providers to communicate with each other about the patient’s care

6. Health Record:Functions and Uses • Additional clinical uses of records are: • Research activities • Public health monitoring • Quality improvement activities • Non-clinical uses of records include: • Billing and reimbursement • Verification of disability • Legal document of care

7. Legal Health Record • Traditionally paper based • Today, growth in electronic records and hybrids (part paper/part electronic) • Regardless of medium, business record • Generated at or by the health care provider or organization • Addresses the patient’s episode of care

8. Content of the Health Record • Various sources supply requirements

9. Content of Health Records: Statutory Provisions • Federal, state, or municipal codes • Patchwork of laws on the subject • Generally limited to requirement that health care provider must create a record • Some state statutes do define content • Usually in context of hospital licensing • Tennessee Medical Records Act of 1974

10. Content of Health Records: Regulations • Power delegated to executive agency to promulgate rules/regulations • State and federal regulations may • Generally require that health record be kept • List broadly the content requirements • Detail specific provisions for content • Some states adopt CMS requirements • Others adopt accreditation standards (JC)

11. Content of Health Records: Regulations • Example of specific detail in regulation: • CMS Conditions of Participation The medical record must contain information to justify admission and continued hospitalization, support the diagnosis, and describe the patient’s progress and response to medications and services . . . Must be legible, complete, dated, timed and authenticated in written or electronic form by the person responsible for providing or evaluating services 42 CFR § 482.24 (2009)

12. Content of Health Records: Accrediting Standards • Do not have the force of law • Do establish standard of care • Voluntary accrediting bodies • Joint Commission (JC) • AOA Healthcare Facilities Accreditation Program (HFAP) • Det Norske Veritas (DNV) • National Committee for Quality Assurance

13. Content of Health Records: Accrediting Standards • Some states adopt standards as regulatory requirements • Deeming authority • Compliance with accreditation requirements and standards • May substitute for compliance with federal CMS Conditions of Participation • Accreditation also enhances reputation. • Standards include requirement to maintain health record

14. Content of Health Records: Other Standards • Institutional standards • Health care institutions may create own or adopt accreditation standards • Guide health care content for institution • Do not carry the force of law • Professional guidelines • Address existence and content of records • Publish practice statements and practice briefs (AHIMA) • Helpful to health information manager

15. Health Records:Timely and Complete • All records must be • Authored: identity of provider who made entry • In writing • By dictation, keyboard, or keyless data entry • Authenticated: confirmation of content • By signature, initials, or code • Implies that entry is accurate

16. Health Records:Timely and Complete • Authorship complications related to EHR • Ability to cut, copy, and paste may compromise integrity of records • Risk for misidentification of author or misfiling of patient information • Policies/procedures to reduce risk are essential • Rubber stamp signatures • May be prohibited (CMS does not allow) • CMS accepts physician signatures that are • Handwritten, electronic, or facsimile

17. Health Records:Timely and Complete • Only the author of entry may authenticate • The record must be reliable • Made by person with first-hand knowledge • Made at or near the time of the actual occurrence of event (contemporaneous) • Reliability is critical for • Delivery of quality care • Meeting licensing and accreditation requirements • Admission of record into evidence in legal action

18. Health Records:Timely and Complete • Incomplete record • Impairs quality of patient care • Impairs provider’s defense against lawsuit • May violate laws and accreditation standards • Role of health information management • Concurrent and post-discharge chart reviews • Identify and attend to deficiencies • If it wasn’t documented, it wasn’t done

19. Health Records:Timely and Complete • Mistakes happen • Corrections to a paper-based record • Draw a single line through the error • Write “error” beside it, date, time, and initial • NEVER obliterate, white out, or cover up error • Only the person who made error should correct it • Corrections to an EHR • Same principles, different system • Addendum to record with reference to original entry • Standards organizations have issued guidelines

20. Health Records:Timely and Complete • Providers rely on information in the record: • Never delete data from record • Deletion compromises integrity of record • Corrections of the record by the patient: • Under HIPAA, the patient has a right to request an amendment to record • If entity agrees to request, inform patient and insert amendment • Provider may deny request for limited reasons • State laws may also establish patient rights

21. Health Records: Retention • Record retention policies determine • Length of time heath records are stored • Form of storage: paper versus imaging or electronic form • Timing of EHR transfer to archival database • Record retention schedule details • What data will be retained • The retention period • Manner in which data is stored

22. Health Records: Retention • Statutes and regulations • Some states establish time frame for retention • Usually related to death or discharge of patient • CMS requires retention for period of state’s statute of limitations or 5 years after discharge • Influence of statute of limitations • Health care provider: ability to defend a lawsuit may depend on access to record • Hospital negligence: loss or destruction of records before time period in which patient can sue

23. Health Records: Retention • Other health care business records • Accounting and payroll • Compliance and quality related documents • Sales records and correspondence • Business record retention policies also needed • Based on statutes and regulations (HIPAA) • Include all forms of media: paper and electronic

24. Health Records: Retention • Retention of records of HIPAA compliance • Audit and monitoring results • Internal investigations and hotline reports • Employee training • HIPAA requires retention for a period of 6 years • AHIMA/AHA recommend retention for 10 years • Adult patient records from date of last visit • Additional concerns related to children; retain to age of majority plus statute of limitation period

25. Health Records: Retention • EHR and new technology • Less physical storage space needed than for paper charts • Storing massive amounts beyond required period makes search and production difficult. • Policies should address • Process for creating and retrieving data • What information will be stored • Reasonable retention period

26. Health Records: Retention • How long should records be retained? • No one answer • Period specified under statute or regulation • Also consider • Medical and administrative needs • Cost constraints • Technology and Storage constraints • Policies should be realistic, practical, and tailored to the needs of the organization

27. Health Records: Retention • Potential for increased costs for legal discovery process • Enterprise Content and Record Management (ECRM) • Systematic approach to e-discovery requests • Addresses both content and management principles • Technology and tools used by enterprise • Methods to capture, store, deliver, and preserve • Views all data from an enterprise perspective

28. Health Records: Destruction • Policies should follow controlling statutes or regulations • Method of destruction • Creation of abstract of data before destruction • Patient notification requirements • HIPAA security rule • Requirements for effective information security • Cover issue of destruction of PHI

29. Health Records: Destruction • Method must be specified in policy • Paper: shredding, burning, or recycling • Electronic media: • Magnetic degaussing or overwriting data • Destruction of back-up tapes or other media • Timing: after retention period has expired • Certificate of Destruction (COD) • Retain permanently as evidence • When, by whom, and how records were destroyed

30. Health Records: Destruction • HIPAA privacy rule • Maintenance of confidentiality is paramount • Civil fines and punishment for breach • Contracts with commercial vendor • Method of destruction • Safeguards to be followed to maintain privacy • Indemnification if unauthorized disclosure occurs • Certification that destruction was properly done

31. Health Records: Destruction Reasons for destruction • In the ordinary course of business • Ownership change • Due to sale of entity, retirement, or death • Health data and records are property assets • Contractual agreement should address what happens to records • Due to Closure or Dissolution of Practice • State laws vary • Transfer to another provider or deliver to state authority • Special federal regulations for addiction related care • If bankruptcy, federal law provides guidance