CMS Releases Record Retention Guidelines

A updated post on record retention with a simple record retention schedule can be found here.

State laws generally govern how long medical records are to be retained.

However, the Health Insurance Portability and Accountability Act (HIPAA) of 1996  administrative simplification rules require a covered entity, such as a physician billing Medicare, to retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. HIPAA requirements preempt State laws if they require shorter periods. Your State may require a longer retention period.

While the HIPAA Privacy Rule does not include medical record retention requirements, it does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal.

The Centers for Medicare & Medicaid Services (CMS) requires records of providers submitting cost reports to be retained in their original or legally reproduced form for a period of at least 5 years after the closure of the cost report.

CMS requires Medicare managed care program providers to retain records for 10 years.

A medical record folder being pulled from the ...

Image via Wikipedia

Additional information:

  1. Providers/suppliers should maintain a medical record for each Medicare beneficiary that is their patient.
  2. Medical records must be accurately written, promptly completed, accessible, properly filed and retained.
  3. Using a system of author identification and record maintenance that ensures the integrity of the authentication and protects the security of all record entries is a good practice.
  4. The Medicare program does not have requirements for the media formats for medical records. However, the medical record needs to be in its original form or in a legally reproduced form, which may be electronic, so that medical records may be reviewed and audited by authorized entities.
  5. Providers must have a medical record system that ensures that the record may be accessed and retrieved promptly.
  6. Providers may want to obtain legal advice concerning record retention after CMS-required time periods.
Enhanced by Zemanta

Posted in: Electronic Medical Records, Medicare & Reimbursement

Leave a Comment (55) ↓


  1. Kurt Brewster MD March 3, 2013

    Buyer beware! While docs are on the hook for electronic medical storage, EMR vendors don’t have to have an archivable storage ability. That means they can charge you a monthly license fee for 10 years if that’s the only way patients, insurers, government agencies or legal entities can access the complete patient record. If you do not keep the record you can be liable for “spoilage”. Make sure it’s explicitly spelled out in your EMR record two things: chart migration and archiving. You’ll save yourself a LOT of headaches down the road. This is another reason solo practitioners are a dying breed. Who can afford a decades long licensing fee unless you’re a large corporation?

  2. Mary Pat Whaley March 3, 2013

    Hi Kurt,

    You makes some great points, but I beg to differ on medical record archiving.

    Most, if not all EMR systems allow you to upload record copies to cloud storage, just as you can upload charts for chart audits to a secure server for the auditing firm to retrieve.

    Practices can easily store medical records securely, then destroy them when they are no longer liable for them.

    We are resellers for the only HIPAA-compliant (they sign a BAA) cloud product that allows practices to purge records to a file for any future need. Physicians do not need to pay licensing fees indefinitely if they are no longer using the product. Our program from costs $75/month for unlimited storage – it’s the best-kept secret around!

    Best wishes,

    Mary Pat

  3. Robin Wheeler April 22, 2014

    When a medicare patient discharges for a SNF facility, the medical record is closed. Is this correct? So if the same patient comes back to the SNF facility, whether it be 2 days or a week later, a new chart would be started? All disciplines would need to do a new assessment, or pull information from the last admission?

  4. Mary Pat Whaley May 3, 2014

    Hi Robin,

    You are correct. Every admission is considered a new episode and a new assessment must be done.

    Best wishes,

    Mary Pat

Leave a Comment