All types of sensitive documentation requires secure destruction at the end of its lifecycle. However, medical records require extra attention. They contain such a high volume of personally identifiable information that criminals and hackers target.
The best way to protect patient health records is to shred expired records on time. Keeping a strict shredding schedule for medical records not only helps keep offices organized, it keeps them in compliance with strict laws that apply specifically to the medical industry, including HIPAA.
Learn more in the video below about medical recording shredding processes and guidelines. Additionally, learn about what the HIPAA Privacy Rule is and how it affects medical record management.
Medical Records Destruction: Stricter Than Most Shredding
With any type of sensitive information, secure document destruction is a priority. There are data breaches to prevent, laws that require information protection, and other factors to consider when disposing records.
HIPAA requires even more attention to security when disposing of medical records. It’s designed to protect patient information, and its strict requirements dictate how medical records should be handled and destroyed.
HIPAA Privacy Rule
The HIPAA Privacy Rule requires covered entities (health care providers, health plans, and health care clearinghouses) to implement reasonable safeguards to limit incidental and avoid prohibited uses and disclosures of protected health information (PHI), including during disposal.
This includes protecting certain types of PHI which require more security like an individual’s name, social security number, driver’s license number, treatment information, or other identifying information.
The privacy rule also includes a financial incentive for compliance. For unknowing HIPAA violations, there are civil penalties of $100 for each failure up to $25,000 per year. For intentional violations, criminal penalties range from $50,000 to $250,000 along with 1–10 years in prison.
Planning Medical Records Management
HIPAA requires medical practices, facilities, and hospitals to have procedures in place to safeguard medical records during their lifecycle.
An example of common storage methods is using off-site storage facilities as they include multiple safeguards.
Medical Records Storage and Retention
While medical records are stored, covered entities are also required to retain the medical documentation outlined by HIPAA until 6 years after the date of the record’s creation or its last effective date.
If state laws require shorter retention periods, they are preempted by HIPAA’s retention requirements before they can be legally disposed.
When medical records are at an off-site facility during their retention period, safeguards for records include protection methods like fire suppression and climate-control systems, on-premise video surveillance, and locked facilities to prevent unauthorized access or environmental damage while they’re being stored.
Medical Records Shredding and Certificates of Destruction
HIPAA’s privacy rule extends to include medical records disposal.
Like storage and retention requirements, disposing medical records needs the same safeguards to prevent accidental and intentional PHI disclosures.
Common disposal methods for records with PHI include shredding, pulverizing, or pulping the records. These methods make the information unreadable, indecipherable, and unable to be reconstructed.
A Certificate of Destruction Proves HIPAA Compliance
Besides following HIPAA’s rules, you also need physical proof of compliance.
When shredding medical records, one of the most valuable aspects of using shredding services is the formal certificate of destruction that’s provided after shredding is completed.
This document includes security details including the medical records’ chain of custody, the date and time of shredding, location, witnesses, and most importantly a unique serialized transaction number to be used in compliance audits.
Have Medical Records to Shred?
Shred Nations will match you with medical records shredding and storage service providers that’ve been trusted by the Red Cross, United Healthcare, and the department of health .
Give us a call at (800) 747-3365, fill out the form, or contact us directly using our live chat for free quotes on fast, reliable, and custom-designed shredding services in your area.
