Healthcare providers retire, relocate, or cease practicing for numerous reasons. Healthcare facilities merge with other facilities, and occasionally cease operations. Those healthcare providers and facilities are still required to maintain their records so that patients can access their records when needed, even if it is several years after the patient received care from the healthcare provider or facility. The records of active patients are fairly easy to transition to another healthcare provider or facility. Old patient records are almost impossible to transition to another provider or facility. Usually, a healthcare provider or facility will need to pay a record custodian to maintain their old medical records. While a paid record custodian is not cheap, a paid record custodian will usually cost less than $800,000.
Parkview inadvertently became the record custodian of the retiring physician by agreeing to take custody of the physician's medical recors. Once Parkview took custody of the retiring physician's medical records, it had an obligation to maintain the confidentiality of those records as required by HIPAA. Parkview's attempt to return the medical records to the physician was not in compliance with HIPAA and resulted in a significant penalties imposed on Parkview by the OCR.
All healthcare providers and healthcare facilities need to be cautious about inadvertently becoming responsible for maintaining the medical records of another provider or facility. Before healthcare providers and facilities that take control of another provider's medical records, they should have an unambiguous agreement on how those records will be returned to the original provider or facility. Apparently, Parkside did not have such an agreement with the retiring physician, which allowed the physician to refuse the return of the records.
The settlement with Parkview should also serve as a reminder to covered entities that HIPAA applies to paper records. While most of the recent settlements announced by the OCR have involved electronic records, the improper disclosure of paper records is still a significant problem. The incidence of dumping paper records may actually increase as healthcare providers and facilities transition to electronic records. The HIPAA regulations require healthcare providers and facilities to destroy paper records. Paper records are destroyed by shredding, burning, or otherwise rendering the information unreadable. A paper record is destroyed if it cannot be reconstructed. Disposing of paper records in dumpsters does not destroy the record.
The $800,000 settlement with Parkview is higher than previous cases involving paper records. The OCR has imposed significantly higher fines for HIPAA breaches in the last year. More importantly, the OCR intends to impose even higher fines in the future. In comments made at a recent American Bar Association conference, Jerome B. Meites, OCR chief regional counsel for Chicago, stated the OCR intends to impose even larger fines for HIPAA breaches in 2014.
Michael L. Smith, JD, RRT is board certified in health law by The Florida Bar and practices at The Health Law Firm in Altamonte Springs, Fla. This article is for general information only and is not a substitute for formal legal advice.