Record (not to be picky- but I assume we are referring to “medical record”) retention is a huge legal topic. I would group the topic based on the legal requirements as opposed to mixing the entities. Also, electronic health records have some nuances not to be discussed here. Occupational Employee Health is a large tent which involves not only the usual medical practice but also state/federal workers’ compensation laws and Occupational Health & Safety Act (federal or state or both) and other legal issues especially disability related. They all have different rules.  

Here is a “brief” summary (no pun intended) of what I understand as a physician and attorney with emphasis on California:

1. For general medical practice as licensed healthcare professional: There is no general law requiring a physician (includes NP/PA) to maintain medical records for a specific period of time. The general rule is based on statute of limitation for potential medical/professional malpractice claims. It is worth noting that “copies” of medical records are not as good as original medical records. However, there are situations or government health plans that require a provider/physician to maintain their records for a certain period of time. Several laws specify a three-year retention period: Welfare and Institutions Code section 14124.1 (which relates to Medi-Cal patients), Health and Safety Code section 1797.98(e) (for services reimbursed by Emergency Medical Services Fund), and Health and Safety Code section 11191 (when a physician prescribes, dispenses or administers a Schedule II controlled substance). The Knox-Keene Act requires that HMO medical records be maintained a minimum of two years to ensure that compliance with the act can be validated by the Department of Corporations.

2. How long must I keep records if I am a HIPAA covered entity? The Office of Civil Rights (OCR) indicates that HIPAA regulations do not include medical record retention requirements. Instead, the laws in your state regarding record retention would apply. HIPAA rules do require that you apply appropriate administrative, technical, and physical safeguards to protect the privacy of information for as long as you maintain records. There is a 6 year retention period for HIPAA policies and procedures. As a side note, individual patients cannot sue under HIPAA for privacy violation, only OCR can, but patients can sue for defamation.

3. What are Medicare's requirements for record retention? The Centers for Medicare and Medicaid Services (CMS) requires that patient records for Medicare beneficiaries be retained for a period of 5 years (see 42CFR482.24 (b)). Medicaid requirements may vary by state.

4. Workers’ Comp: The rules for workers' comp records retention depends on the state. Except for federal employees, each state manages its own no-fault workers' compensation program. The nature of an employee's injury can also affect how long you must keep these records. First-aid or medical-only cases usually can be closed and records archived sooner than in indemnity cases, which sometimes takes years before the case closes or settles. In some states, even after a workers' comp case has closed, it can be reopened. In California, retention on Open Claims- 5 years from date of injury or last date for benefit payment, whichever is later; Closed Claims- 2 years after claim closed; All Claims- 5 years after date of injury, whether claim is open or closed. Wisconsin requires 30 years retention. Other states vary and have confusing legal languages that are not suitable for medical consumption.

5. OSHA has some confusing rules (be careful there are state OSHAs which may have more stringent rules): medical records under Access to Employee Exposure and Medical Records Standard (29 CFR 1910.1020). Each employer (this is the key word, so whether a provider is an employer’s agent can be controversial) must assure that all employee medical records (including x-ray and whatever is considered as part of medical record) of employees exposed to toxic substances or harmful physical agents are preserved and maintained for at least the duration of the employee's employment, plus 30 years.

6. What about ADA and FMLA or similar state law? This is another confusing area because ADA, FMLA, SSA, Work Comp, VA, Jones Act etc. may intermingle and create further confusion. Most insurance and legal professionals would advise at least 10 years retention.

Hope the above is helpful but I must put a disclaimer here. This is for educational purposes not as legal opinion to be relied on. Consult your legal professional for your specific circumstances. Thanks.  

Fred Fung  

From: MCOH-EH [mailto:mcoh-eh-bounces@mylist.net] On Behalf Of Dr Amber H Mitchell
Sent: Wednesday, April 08, 2015 9:41 AM
To: MCOH list (mcoh-eh@mylist.net)
Subject: Re: [MCOH-EH] Record retention

The Compliance Directive for the BPS outlines what is required from multi-employer scenarios like the one you describe: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=2570

See Section XI.  I’d say to be safe as well – 30 years, as day to day supervision of those employees is the deciding qualifier.

From: <Paradis>, Connie <cparadis@glensfallshosp.org>
Reply-To: "MCOH list (mcoh-eh@mylist.net)" <mcoh-eh@mylist.net>
Date: Wednesday, April 8, 2015 at 10:49 AM
To: "MCOH list (mcoh-eh@mylist.net)" <mcoh-eh@mylist.net>
Subject: [MCOH-EH] Record retention

Back to basics… How long do healthcare providers (occupational medicine) have to keep health records performed for contracted employers/employees?  Can someone point me to the appropriate reference citation?

I’ve heard an opinion that since we’re not the employer we don’t have to keep them the OSHA 30 year requisite cited in 1910.1020 (d) (1) (i).

Connie Paradis

Center for Occupational Health

Glens Falls Hospital

102 Park Street, Suite B-2

Glens Falls, NY   12801

P: (518) 926-2143

F: (518) 926-2165

E: cparadis@glensfallshosp.org