3.2.1: MEDICAL RECORDS – Documentation, Electronic Health Records, Access, and Retention

Documentation

An accurate, current, and complete medical record is an essential component of patient care.  Licensees shall maintain a medical record for each patient to whom they provide care.  The medical record should be legible.  When the caregiver does not write legibly, notes should be dictated, transcribed, reviewed, and signed within a reasonable time.  It is incumbent upon the licensee to ensure that the transcription of notes is accurate (particularly in those instances where medical records are generated with the assistance of dictation software or artificial intelligence). 

The medical record is a chronological document that: 

• Records pertinent facts about an individual’s health and wellness;
• Enables the treating care licensee to plan and evaluate treatments or interventions;
• Enhances communication between professionals, assuring the patient optimum continuity of care;
• Assists both patient and licensee in communication with third party participants;
• Allows the licensee to develop an ongoing quality assurance program;
• Provides a legal document to verify the delivery of care;
• With appropriate consent, may be used as a source of clinical data for research and education; and
• Assists with compliant billing and coding.

The following required elements should be present in all medical records:

• The purpose of each patient encounter and appropriate information about the patient’s history and examination;
• The patient’s past medical history including an updated problem list, surgical history, family history, and social history;
• The licensee’s clinical decision making including the plan for any treatment and the care and treatment provided;
• Prominent notation of current medications (including all prescribed, recommended, or provided medications, and notation of medications actually taken) and other significant allergies, or a statement of their absence; and
• Clearly documented informed consent obtained from the patient when appropriate.

Licensees are also encouraged to include patient learning needs, barriers to care, and other factors as part of the medical record.

The following additional elements reflect commonly accepted standards for medical record documentation:  

• Each page in the medical record contains the patient’s name or ID number.
• Include all personal, biographical information such as home address, employer, marital status, and all telephone numbers, including home, work, and mobile phone numbers.
• All entries shall contain the author’s identification and the date.  Author identification may be a handwritten signature, initials, or a unique electronic identifier.
• All drug therapies are listed, including dosage instructions and, when appropriate, indication of refill limits.  Prescription refills should be recorded.
• Appropriate plans and specified times for follow-up care should be included.
• All consultation, laboratory, and imaging reports should be entered into the patient’s record, reviewed, and the review documented by the licensee who ordered them.  Abnormal reports should be noted in the record, along with corresponding follow-up plans and actions taken.
• An appropriate immunization record is evident and kept up to date.
• Appropriate preventive screening and services are offered in accordance with the accepted practice guidelines.

Electronic Health Records

The Board recognizes and encourages the use of electronic health records (“EHR”).  The promise and potential of information technology in health care, particularly the use of EHR, presents licensees with distinct challenges.  While the Board encourages the adoption and appropriate use of various forms of EHR, there are some unique aspects and problems associated with EHR that have been repeatedly encountered by the Board, some of which are discussed below.  This subsection is meant to identify issues which the Board has repeatedly found to be problematic in malpractice and complaint cases coming to the Board’s attention.    Basic, well-established principles of medical record documentation, as outlined above, apply to all forms of medical record documentation, including EHR.  

The following guidelines are offered to assist licensees in meeting their ethical and legal obligations:

• EHR Deficiencies.  Licensees must be aware of the idiosyncrasies and weaknesses of the EHR system they are using and adjust their practice accordingly.  Licensees are ultimately responsible for the adequacy of their EHR entries and documentation.
• Responsibility of Licensees.  Licensees remain responsible for clinical decision making.  EHR are becoming increasingly sophisticated and may provide flags for follow-up care or other clinical decision-making support, such as health maintenance recommendations.  While an EHR system may assist in the clinical decision-making process, it is not responsible for decision making.  The licensee is.  For example, it is not acceptable to blame an EHR because it failed to recommend particular testing or it failed to prompt clinical follow-up.  Increasingly elaborate documentation, clinical management, and productivity tools may also result in increased opportunities for errors or omissions.  These errors or omissions result from the failure of the licensee to assume appropriate responsibility for the care of the patient.  In the end, decision-making responsibility rests solely with the licensee; regardless of the information or notices provided by the EHR.
• Use of Templates.  The Board cautions against overuse of template content or reliance on EHR software which pre-populates, carries forward, or clones information from one encounter to the next, or from different licensees, without the licensee carefully reviewing and updating all information.  Documentation of clinical findings for each patient encounter must accurately and contemporaneously reflect the actual care provided.  The use of “copy-and-paste” should only be employed in circumstances when the totality of copied material from prior interactions is pertinent to the current situation.
• Availability of, or Access to, EHR.  Licensees must be able to provide patient medical records under their control in a timely*  manner for various situations, such as consultations, transfer of care to another licensee, or practice closure.  The Board has encountered situations where licensees were unable to access their patients’ medical records due to either fee or other disputes with the EHR vendor.  This is particularly common when the medical records are maintained off site (e.g., cloud storage).  Licensees must understand provisions of their contract with the EHR vendor in this regard.
• Breakdown of Patient-Licensee Communication.  Misunderstandings and miscommunications between patients, patient family members, licensed health care professionals, and office staff generate a substantial percentage of complaints received by the Board.  Many EHR systems allow direct licensee-patient communication (i.e. via a “patient portal”).  While this form of communication can facilitate communication, such as follow-up of lab or x-ray results or medication refills, it also places a responsibility on the licensee to provide timely responses to legitimate requests from patients for feedback or information.
• Employed Licensees and Independent Contractors.  The Board recommends all employed licensees/independent contractors review their employment agreements regarding ownership of the EHR.  There should be explicit provisions which set forth the rights and duties of the practice and the licensee upon termination of employment, with regards to notification of patients and access to medical records.
• Artificial Intelligence.  Once a licensee chooses to use AI, they accept responsibility for responding appropriately to the AI’s recommendations.  For example, if a licensee chooses to follow the course of treatment provided by an AI-generated response, then they should be prepared to provide a rationale for why they made that decision.  Simply implementing the recommendations of the AI without a corresponding rationale may not be within the standard of care.  Alternatively, if the licensee uses AI and suggests a course of treatment that deviates from one delineated by AI, then they should document the rationale behind the deviation and be prepared to defend the course of action.  Generally, the reason a licensee provides for disagreeing with any AI recommendation should be because following that recommendation would not be consistent with the applicable standard of care.

Access to Medical Records

A licensee’s policies and practices relating to medical records under their control should be designed to benefit the health and welfare of patients, whether current or past, and should facilitate the transfer of clear and reliable information about a patient’s care.  Such policies and practices should conform to applicable federal and state laws governing health information.  These principles of medical record access also apply to licensees practicing via telemedicine.  

It is the position of the Board that notes made by a licensee in the course of diagnosing and treating patients are primarily for the licensee’s use and to promote continuity of care.  Patients, however, have a substantial right of access to their medical records and a qualified right to amend their medical records pursuant to HIPAA privacy regulations.

Medical records are confidential documents and should only be released when permitted by law or with proper written authorization of the patient.  Licensees are responsible for safeguarding and protecting the medical records under their direct control and for providing adequate security measures.

Each licensee has a duty on the request of a patient or the patient’s representative to facilitate release of a copy of the record in a timely manner to the patient or the patient’s representative, unless the licensee believes that such release would endanger the patient’s life or cause harm to another person.  This includes medical records received from other licensees’ offices or health care facilities.  A summary may be provided in lieu of providing access to or copies of medical records only if the patient agrees in advance to such a summary and to any fees imposed for its production.

Licensees may charge a reasonable fee for the preparation and/or the photocopying of medical records, keeping in mind that state law limits fees a licensee can charge for copies of medical records in certain cases, including liability claims for personal injury, social security disability claims, and workers’ compensation claims.  To assist in avoiding misunderstandings, and for a reasonable fee, the licensee should be willing to review the medical records with the patient at the patient’s request.  Medical records should not be withheld because payment of a patient’s account is overdue (including charges for copies or summaries of medical records).

Should it be the licensee’s policy to complete insurance or other forms for established patients, then it is the position of the Board that the licensee should complete those forms in a timely manner.  If a form is simple, then the licensee should perform this task for no fee.  If a form is complex, the licensee may charge a reasonable fee.

To prevent misunderstandings, the licensee’s policies or those of the licensee’s employer about providing copies or summaries of medical records and about completing forms should be made available in writing to patients when the licensee-patient relationship begins.

Licensees should not relinquish control over their patients’ medical records to third parties unless there is an enforceable agreement that includes adequate provisions to protect patient confidentiality and to ensure access by both the licensee and patient to those medical records.**

When responding to subpoenas for medical records, unless there is a court or administrative order, licensees should follow the applicable federal and/or state regulations.

Retention of Medical Records 

Licensees have both a legal and ethical obligation to retain patient medical records under their control.  The Board, therefore, recognizes the necessity and importance of a licensee’s proper maintenance, retention, and disposition of medical records.  Patient interests related to present and future healthcare needs should be a licensee’s primary consideration when determining how long to retain medical records.

Other Considerations and Board Expectations:

• Patients should be notified regarding how long the licensee will retain medical records.
• In order to preserve confidentiality when discarding old medical records, all medical records should be retained and destroyed in a HIPAA compliant manner, including both paper medical records and EHR.  If it is feasible, patients should be given an opportunity to claim the medical records or have them sent to another care licensee before old medical records are discarded.
• The licensee should respond in a timely manner to requests from patients for access to, or copies of, their medical records.
• Licensees should notify patients of the amount, and under what circumstances, the licensee will charge for copies of a patient’s medical record.
• Those licensees providing episodic care should attempt to provide a copy of the patient’s medical record to the patient, the patient’s primary care licensee, or, if applicable, the referring licensee.

It should be noted that these expectations relate solely to Board inquiries and do not preempt other legal or ethical record retention requirements.  Licensees are encouraged to seek advice from private legal counsel and/or their malpractice insurance carrier, particularly when responding to a subpoena to produce records.

*In evaluating timeliness, the Board will look at the responsiveness of the licensee and the efforts undertaken to provide the requested records or information to the intended recipient.  

**NOTE: refer also to the Board’s Position Statement on “Departures from or Closings of Medical Practices.”