Physician Practices and Records Transfer in the HIPAA Era

In the current environment, it seems that businesses are constantly changing hands, merging or dissolving. The question then is what happens with a patient’s medical records when a medically-based business is bought, sold or dissolved? State laws and HIPAA inform the answer.

In Missouri, patient records under the care, custody and control of a medical licensee must be maintained for a minimum of seven years from the date of when the last professional service was provided. (R.S.Mo. § 334.097).

If selling a practice, a series of steps must be accomplished when notifying patients of the sale, including notifying the patient of the process for obtaining a copy of medical records and the potential need for the written authorization before medical records can be transferred to another provider. Moreover, under HIPAA, a specific authorization is required for the release of information considered sensitive, such as HIV/AIDS status, psychiatric history, drug or alcohol abuse, or sexual abuse.

Since the physical record is considered the property of the practice and the information in the record is considered the property of the patient, a practitioner who is leaving one practice to go to another should not simply take the records with him of those patients who will continue in his or her care.

For instance, if a practice is dissolved, a custodian of patient records may have to be located and a business associate agreement obtained requiring that custodian or receiving physician to respect the confidentiality of the records in accordance with HIPAA. The state medical board or department of health should also be notified where the records are being stored in case patients, at some point in the future, need to access their records if the former physician or custodian cannot be located.

In addition, the Code of Ethics of the American Medical Association at E-7.03 provides similarly. Patients should initially be notified and informed that upon authorization, their records will be sent to their choice of physician. Any records not forwarded to a new physician should be retained, either by the treating physician, another physician, or such other person lawfully permitted to act as a custodian of the records. If the physician is leaving a group practice, after notification, the patients should also be informed of the physician’s new address and offered the opportunity to have their medical records forwarded to the departing physician at his or her new practice location. The Code warns that it is unethical to withhold such information upon request of a patient.

In the case of a retiring physician, it may be most practical to transfer the records to a hospital. The hospital should agree to treat the records as if they were their own for HIPAA purposes and only transfer the records to another physician upon the patient’s written authorization. Essentially, the hospital becomes a business associate of the retiring physician and is subject to the business associate requirements of HIPAA.

As you can see, many issues and precautions must be taken into account when a physician retires, moves from an existing practice, or sells a practice with regard to patient records.

View PDF