Question
Is it Legal to Shred Archived Patient Records After a Certain Amount of Time?
Answer
Yes it is legal to shred patient records only after a certain period of time has passed. The question is, what amount of time? The typical time frame is 6-10 years. According to HIPAA rules, medical records must be retained for six years from the date of its creation or last use—whichever comes later. To meet HIPAA standards, it is best to use a cross-cut shredder and be sure to document which records were destroyed, how they were destroyed, and by whom in your Record Retention and Purge Log. If you use a destruction company, you also need to have a Business Associate Agreement in place.
Be sure that you have an official Destruction Policy in your practice's Policies and Procedures Manual.
Please note that "CMS requires Medicare managed care program providers to retain records for 10 years," we recommend that you keep them at least 10 years unless your state has a mandate that is more stringent. Check with an attorney in your state to ensure that you are meeting your state requirement as well as these federal laws.
Note: Essential destruction logs and sample policies are available in the Complete & Easy HIPAA Compliance publication.
