Transferring Patient Health Records When Selling or Closing a Healthcare Practice

When providers sell their practices, they may not realize that they cannot simply transfer their patient health records to the purchasing practitioner or entity. Many providers also may not realize that individual states might have privacy regulations, some of which are more stringent than national regulations.¹ However, most providers do understand the requirements to protect patients’ personal protected health information (PHI) as specified by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

HIPAA allows for the exchange of PHI without a written authorization between current and prior practitioners or contemporaneously treating practitioners (including practitioners who are treating the patient at the same time, such as consultants). However, when a practice is being sold, HIPAA does not permit the transfer of PHI from one provider to another without the patient’s written authorization. Although transferring the records to the purchasing practitioner or corporate entity might seem to be the most expedient solution, it is not permissible under HIPAA.

State statutes and administrative rules may further complicate the process. For example, states can require practitioners to maintain patients’ health records for specified periods, dating from the last treatment date. Many states impose a 7-year or longer record maintenance requirement, and many states impose separate — and often more rigorous — requirements for retaining pediatric records. HIPAA does not diminish the authority of these laws.²

Self-Storage

To comply with HIPAA’s record retention requirements, some practitioners who are selling or closing their practices choose to provide storage for their records. Electronic health records (EHRs) help simplify the self-storage process because they do not require much physical space and can be easily secured. However, many retiring practitioners today do not have EHRs, or they have a mix of EHRs and paper health records.

If providers choose to store their own paper records, they may face different storage challenges. Besides the space requirements, storing paper health records can be problematic if the information has not been maintained in an ordered system and a former patient requests a copy of his/her health record (to which the patient is entitled to under HIPAA).³

Records Storage Companies

Providers who do not want to assume the responsibility of storing their own records might choose to contract with a records storage company. Although records storage companies may charge substantial fees, they offer several advantages:

• They will pick up the health records and store them in a climate-controlled facility, which can protect them from environmental damage (e.g., dampness, mold, vermin, etc.).
• They are usually bonded or insured, thereby reducing providers’ risk exposure if stored records are damaged, destroyed, or stolen while in the records storage company’s possession.
• They can easily respond to patients’ requests for health records. Patients can be referred directly to the records storage company, which then will locate and copy the health records and collect the applicable fee from the patient.⁴

At the time of records transfer, a records storage company will execute a legal document called a business associate agreement (BAA) with the storing practitioner. This HIPAA-required document obligates the records storage company to appropriately safeguard the PHI contained in patient health records to the same standard that the practitioner must protect it. Through the BAA, the practitioner and the patient are assured that the PHI will be secure.

Custodianship

When a practice is sold, many (but not all) patients remain and continue their care with the purchasing practitioner. This potential for continuity is convenient for patients, and it also enhances the practice’s value.

It is ideal when patient health records are immediately accessible to the new practitioner. If the purchasing practitioner becomes the custodian of the selling practitioner’s records through the execution of a BAA, then he or she will have immediate access to the patient health records.

In this case, in addition to compliance with HIPAA privacy and security regulations, the BAA should specify that the custodian will provide the selling practitioner with access to the physical health records upon reasonable notice (such as 2 business days), and that the custodian will not release or dispose of any original health records without the seller’s written authorization.

As needed, patients who continue their relationship with the practice will be asked to provide written authorization to release their health records from the selling practitioner to the purchasing practitioner. Once the release is authorized, the purchasing practitioner (who is in physical possession of the records) can use the health records as he/she would with any other active patient. Health records of patients who leave the practice would ultimately be placed in storage or archived, which is permissible under HIPAA.⁵

In Summary

HIPAA has been valuable in providing uniformity in administration and enhanced protection of patients’ PHI — an important consideration in this age of medical identity theft. With proper planning, practitioners wishing to sell or close their healthcare practices can provide continuity in ongoing patient care and, when necessary, the transfer of patient information, while fully complying with HIPAA requirements.

Endnotes

1. For example, many state privacy laws end their jurisdiction at the time of a patient’s death; however, HIPAA does not. Following the death of a patient, the only person who can authorize the release of the patient’s PHI is usually the executor or personal representative of the deceased’s estate. If an estate does not exist, a court order might be required to authorize the release of the information.
2. Practitioners should know exactly what the retention requirements are in the state(s) in which they practice. State medical or dental societies are good resources for this information.
3. Under HIPAA, a practitioner’s responsibility to provide patients with copies of their health records does not terminate with the practitioner’s retirement. As long as the practitioner still possesses the health records, he/ she must provide copies if patients request them.
4. HIPAA allows a reasonable fee to be charged for labor and copying. Many states also have laws related to health record copying fees; if these laws are not consistent with HIPAA, then providers must abide by the federal HIPAA regulations.
5. In the case of EHRs, the selling practitioner would transfer all health records electronically to the purchaser (in an encrypted format and after executing a BAA). The purchasing practitioner would then, with the patient’s written authorization, transfer individual health records to active files when needed. The health records of patients who do not remain with the practice would be stored as inactive/archived records. The selling practitioner could also easily retain a copy of all patient health records for his/her future use.