Management of Medical Records

In keeping with the professional responsibility to safeguard the confidentiality of patients’ personal information, physicians have an ethical obligation to manage medical records appropriately.

This obligation encompasses not only managing the records of current patients, but also retaining old records against possible future need, and providing copies or transferring records to a third party as requested by the patient or the patient’s authorized representative when the physician leaves a practice, sells his or her practice, retires, or dies.

To manage medical records responsibly, physicians (or the individual responsible for the practice’s medical records) should:

1. Ensure that the practice or institution has and enforces clear policy prohibiting access to patients’ medical records by unauthorized staff.
2. Use medical considerations to determine how long to keep records, retaining information that another physician seeing the patient for the first time could reasonably be expected to need or want to know unless otherwise required by law, including:
   1. immunization records, which should be kept indefinitely;
   2. records of significant health events or conditions and interventions that could be expected to have a bearing on the patient’s future health care needs, such as records of chemotherapy.
3. Make the medical record available:
   1. as requested or authorized by the patient (or the patient’s authorized representative);
   2. to the succeeding physician or other authorized person when the physician discontinues his or her practice (whether through departure, sale of the practice, retirement, or death);
   3. as otherwise required by law.
4. Never refuse to transfer the record on request by the patient or the patient’s authorized representative, for any reason.
5. Charge a reasonable fee (if any) for the cost of transferring the record.
6. Appropriately store records not transferred to the patient’s current physician.
7. Notify the patient about how to access the stored record and for how long the record will be available.
8. Ensure that records that are to be discarded are destroyed to protect confidentiality.