4.5.A HIPAA/Privacy: Other Requirements - Retention of PHI Policy

  • POLICY:

    PHI contained in the designated record set will be retained according to state and federal regulations whichever requires retention for the longer period of time.

    PHI, including medical and financial records contained in the designated record set, will be retained for a minimum of 6 years as required by HIPAA.

    PROCEDURE:

    LHCC will retain a designated record set, utilizing the chart below(which includes Alabama laws):

    Type of Record

    Retention

    All hospital records

    6 years after discharge

    Hospital records of patient with multiple admissions

    6 years after most recent discharge

    Hospital records of minor patient at time of discharge

    Until patient reaches 24 years of age

    General medical office records

    10 years after last visit or discharge

    Medical office records of minors

    10 years after last visit or discharge

    X-rays

    10 years after last visit or discharge and/or as long as the medical record

    Superbills

    If information documented on the superbill is not included in the medical record, then the superbills would need to be retained as long as the medical record

    Office records for deceased patients

    Minimum of 10 years

    Immunization

    Indefinitely

    Medicare/Medicaid

    10 years after last visit or discharge

    Medical Records should be kept indefinitely for the following situations:

    • When there is less than a desirable outcome;
    • when patients are unhappy with results; and
    • anytime a patient threatens or files a lawsuit.

    Revised 12/2013

  • Date Format: MM slash DD slash YYYY