ENTITY:

I.          OBJECTIVE

In compliance with Section OAC 5101:3-3-26 of the Ohio Administrative Code, Sections 42 CFR485.721(d), 42 CFR 486.161(d),42 CFR 491.10(c), 42 CFR 493.1777(d)(2)(3),42 CFR 493.1780(e)(3)(4), 42CFR 493.1259(b), 42CFR 493.1109,and 21 CFR  900.12(e)(1)(i) of the Code of the Federal Registrar, and AHIMA’s recommended retention standards “updated”. Records at the University Osteopathic Medical Center shall be retained, and properly destroyed as follows (see policy).

II.         DEFINITION

Records management: the application of systematic controls to records required in the operation of an organization.  Records are managed throughout their life cycle from creation or receipt through maintenance and use, storage and retrieval, to ultimate disposition or destruction.                         

Record:  a record is recorded information (regardless of physical format) that can be retrieved at any time.  Its various forms include all original documents, papers, letters, x-rays, cards, books, photographs, blueprints, sound or video recordings, microfilm, magnetic tape, electronic media, and any other information recording medium that are generated and /or received in connection with business or healthcare transactions and is related to Health First’s legal obligations.  Duplicate copies of original records used for short- or long-term reference purposes may also be considered records in a legal sense; therefore, they are subject to the same guidelines provided in this policy.

Non-record: its various forms include blank forms, magazines, and publications from professional organizations, newspapers, public phone directories, and transitory messages used primarily for informal communication of information.  Transitory messages do not set policy, establish guidelines or procedures certify a transaction or become a receipt.  These messages may include e-mail with short-lived or no administrative value, voice mail, self-sticking notes, and telephone messages.  Non-records are not subject to the retention schedule and are maintained for as long as administratively needed and may be discarded when their value has been exhausted.

Business record: business records include, but are not limited to, letterhead correspondence, legal opinions, real estate documents, directives and policies, official meeting minutes, personnel records, benefit programs, purchasing requisitions and invoices, accounts payable and receivable documents, tax documents, reimbursement documents, completed and signed forms, contracts, insurance documents, general ledgers, audit reports and financial reports.  Duplicate copies of any of these records, in the same or different medium, may also be considered records in a legal sense.

Medical record:  all documents, regardless of physical format, that holds demographic and medical information about a patient.  Duplicate copies of any of these documents, in the same or different medium, may also be considered records.  Only the documents that are part of the designated record set (IM 2.07 Designated Record Set) are subject to the retention schedule.

Protected Health Information (PHI):  individually identifiable health information that is transmitted by electronic media transmitted or maintained in any other form or medium.  Individually identifiable health information (IIHI) is information that is a subset of health information.  IIHI includes demographic information collected from an individual, and is created or received by a health care provider, health plan, employer, or health care clearinghouse.  This information relates to the past, present, or future physical or mental health or condition of an individual and the provision of health care to an individual.  IIHI can identify the individual or there is a reasonable basis to believe that the information can be used to identify the individual.

 Duplicate record:  a copy of the original or master record.  The retention schedule pertains only to the original document in its original format, or an official copy of the record if the original is no longer available.  A duplicate record should be retained only until the purpose for which the copy was obtained is served, at which time it should be destroyed appropriately.

Electronic record:  any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.  Electronic technology is technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities.  Electronic records must be capable of generation in both human-readable and electronic form suitable for inspection, review, and copying.  Electronic records may be considered legal records, and are managed according to their content.

 Retention period:  the period of time during which records must be maintained by an organization because the records have administrative, fiscal, legal, medical, or other value.  The records are eligible for disposal at the end of the retention period.

Record retention schedule:  a schedule of standard and/or legally required retention periods for each type of record, taking into account the administrative, fiscal, legal, medical, and historical value of those records.

 Active records:  those records that still have sufficient administrative, fiscal, legal, medical, and/or historical value.

 Inactive records:  those records which have lost some of their value or have been superseded by new records, but which have not reached the end of their specified retention period.  These are records that are usually referenced or accessed infrequently.

 Business continuity records:  those records considered vital to University Osteopathic Medical Center operations.   These records have been identified as essential for the reestablishment of the organization after a natural or man-made disaster.

Disposal and/or destruction of records:  any action that prevents the recovery of information from the storage medium on which it is recorded including, but not limited to, shredding, pulping, incineration, erasure, and destruction of the hardware or medium used to store and/or recovers the information.

 Proprietary records: records that University Osteopathic Medical Center has the exclusive right to use, make, or market.

 Transitory messages: records that are created primarily for the communication of information, as opposed to the perpetuation or formalization of knowledge. The informal nature of transitory messages might be compared to a communication taking place during a telephone conversation, or verbal communications in an office hallway. Transitory messages are messages with short-lived administrative value and may include, but would not be limited to, many e-mail messages, telephone voice mail, many messages on "post-it" notes, and most written telephone messages.

 Storage medium:  any technology (including devices and materials) used to place, keep, and retrieve data on a long-term basis.  Some examples include hard disks, floppy disks, CD-ROMs, optical disks, and magnetic tape.

III.        POLICY

              RETENTION SCHEDULE:

IV.        PROCEDURE

To be compliant with all applicable federal and state regulations, this policy will adhere to guidelines established by any pertinent regulatory or accrediting agencies as long as the guidelines meet or exceed federal or state regulations. Annual review of this policy will ensure continued compliance with federal, state, and any other applicable regulations.

The Record Storage Company is responsible for compliance with this policy as it pertains to records in their custody.  The director or manager will be responsible for the physical safety and security of the records located on-site. They are also responsible for annual purging of documents, including identifying and destroying unnecessary duplicates; reviewing and destroying records which exceed the retention period; identifying, labeling, and storing records which require retention, and transferring them to the appropriate storage site.  Facilities and departments which do not maintain custody of the medical records they create must forward these records to the appropriate Health Information Storage Company in a timely manner.

Upon receipt of notice regarding the initiation of an investigation, service of a subpoena, legal process, or audit, the Storage/Compliance Company will promptly notify all departments and facilities in possession of potentially relevant records. All tangible records (e.g. paper, film, etc.) will be designated “Secure File”, and transferred to the designated secure location.  Access to the “Secure file” will be restricted to prevent loss, tampering, or alteration of the records.  Access to electronic records will be coordinated with the appropriate individual or department to ensure the access or release is documented properly and in accordance with the OUCOM Policy.

All records containing OUCOM proprietary information will be subject to strict safety and security standards.  It is the role of the Storage Company workforce to maintain the confidentiality and security of these records.  Guidance, direction, and authority for privacy and security activities are the responsibility of the Corporate Compliance Office, the HIPAA Compliance Office, the Information Security Office, the Health Information Management Storage Company, and department - or facility-specific policies and procedures.

Reproductions, duplicates or copies of records often have the same legal effect as the original or master record.   Copies may be subpoenaed and used in litigation even if the originals have been properly destroyed.  Copies of originals must be destroyed prior to or along with the originals as outlined in the retention schedule.

Any unauthorized access, use, reproduction, alteration, or destruction of OUCOM records by associates or other persons must be reported immediately to the appropriate member of management. 

A record in its original format is known as the record (master) copy.  An electronic record (master) copy may be created from the non-electronic record (master) copy as long as the appropriate standards are met.  The only formats that can be used for the new record (master) copy include microfiche, microfilm, and optical scanning. The electronic record then becomes the legal master record and the original records may be destroyed.  The electronic medium and electronic record-keeping system must provide access to the records throughout that record’s retention period.

V.         RETENTION AND STORAGE

Pertinent business records and medical records must be retained for the entire retention period as specified in the OUCOM Records Retention Schedule. During the retention period the records must be protected from alteration, tampering, loss, and physical damage. 

On a periodic and scheduled basis, the storage company should review the continued value and usefulness of the records.  Inactive records should be assessed for conversion to a format that would require less space, as with microfiche or electronic scanning.    

Tangible records must be boxed and the boxes labeled to permit efficient access and retrieval.  The label should contain, at a minimum, the originating department and department number, the contact name and telephone number, the retention code and title of the records, the type of media, and the inclusive dates. The date the records are eligible for destruction should also be prominently displayed. 

Any records involved in litigation or investigation are considered to be active records and should be stored on site and protected accordingly. Communication with the Corporate Compliance Office and the Risk Management regarding these records is required. 

Short-term and long-term storage facilities must meet appropriate environmental standards to minimize the chance of damage to the records from water, fire, theft, natural disasters, serious man-made accidents, and other potential threats. The storage facilities must provide proper storage with temperature and humidity controls to maintain the viability of the different storage media for the duration of the retention period.

VI.        DESTRUCTION

Records that have satisfied their legal, fiscal, administrative, and archival requirements may be destroyed in accordance with the OUCOM Records Retention Schedule. On a periodic and scheduled basis, the storage facility should review the records under their custody to assess the continued value and usefulness of the information contained in the records. Destruction of certain records may occur prior to the end of the retention period if the record (master) copy has been transferred to an approved medium, such as microfilm or optical DVD.

Records that should not be destroyed include records involved in litigation or records with a permanent retention.  In the event of a lawsuit or government investigation, the applicable records that do not have permanent destruction cannot be destroyed until the lawsuit or investigation has been finalized.  Once the litigation/investigation has been finalized, the records may be destroyed in accordance with the OUCOM Records Retention Schedule.

Destruction is any action that prevents the recovery of information from the storage medium, regardless of physical format.  The method of destruction for a particular type of record must be appropriate to the medium.   Methods of destruction include, but are not limited to, shredding, pulping, pulverizing, recycling, magnetizing, encryption, burning, erasure, and destruction of the hardware or medium used to store and/or recover the information on the records.  Disposal of information systems equipment, including the irreversible removal of information and software, must be carried out in accordance with approved procedures (IM 5.02 Data/Media Destruction).

OUCOM records must be destroyed in a manner that maintains the confidentiality of the records and renders the information no longer retrievable or recognizable as OUCOM records. Destruction of records must be carried out by bonded destruction service that handles sensitive and confidential records. 

VII.      REFERENCES 

            Sections 42 CFR485.721(d), 42 CFR 486.161(d),42 CFR 491.10(c), 42 CFR 493.1777(d)(2)(3),42 CFR 493.1780(e)(3)(4), 42CFR 493.1259(b), 42CFR 493.1109,and 21 CFR  900.12(e)(1)(i) of the Code of the Federal Registrar 

 AHIMA Practice Brief – Document Imaging as a Bridge to the HER

 Section OAC 5101:3-3-26 of the Ohio Administrative Code

Last updated: 02/28/2012