The methodology and requirements for medical record shredding were changed significantly with the Health Insurance Portability and Accountability Act (HIPAA) that became law in 1996.
The ever increasing need to protect patient privacy along with stifling penalties and repercussions for violating that privacy has helped reshape the way the healthcare industry handles the distribution and destruction of medical records.
One of the most important things in a medical record destruction plan is to have a system in place to monitor and document which records have been destroyed to guard against legal action and potential data breaches.
An easy way to ensure this doesn’t happen is to maintain a medical record destruction log.
Simply put, this log is a permanent record that documents every medical record that was deemed inactive and shredded. The more detailed the log is (without exposing personal information), the better off you are.
Why Is Medical Record Shredding So Different from Regular Shredding?
Hospitals, medical practices, dentists, and many other services that offer healthcare-related services gather information that’s protected by law.
This info, whether it’s in their medical record or included in documentation that’s collected by these healthcare facilities, is known as protected health information, or PHI.
Protected health information is any information that you can connect to an individual, from information and payments to their health status. PHI (and the files, documents, and records that contain them) are protected by HIPAA and need to be handled with care.
That’s why you need to be sure that you document every paper medical record that is destroyed properly and securely. It’s not worth risking hundreds of thousands of dollars worth of fines and bad public relations for a mishandled medical record disposal that ended up causing a data breach. Common types of PHI include:
- Names (full or last name and initial)
- Local Geographical Identifiers
- Dates (other than year) directly related to an individual
- Phone Numbers
- Email Addresses
- Medical Record and Account Numbers
Disposing of Medical Records and Protected Health Information
Healthcare facilities and their business associates need to ensure all medical records and PHI is properly destroyed—including anytime anyone in the company is granted access to any file or record containing health information.
One of the best ways to ensure proper destruction is to hire a shredding service to shred medical records securely.
Mobile Shredding
Mobile shredding is where a shredding truck comes to your location and shreds all your documents right before your eyes. This makes sure that any PHI is securely destroyed. Plus, it saves you the time and hassle of transferring medical records to a different location to be shredded.
Off-Site Shredding
Off-site shredding is the option to hire a shredding truck to come to your site and transport your documents to a secure offsite shredding plant. This is one of the better options if you have a large amount of files to shred. Any documents containing PHI are stored in locked containers while in transport then destroyed in a large industrial shredder.
Whether you choose mobile shredding or offsite shredding, you’ll receive a certificate of destruction to prove compliance with HIPAA.
When you’re disposing of medical records, it’s vital to keep track of what files were destroyed. Keep in mind that you need to verify each record was properly destroyed, and have enough information documented to identify the record, but not expose PHI. That’s where a medical record destruction log will keep your facility out of trouble.
What Information Should I Include in a Medical Record Destruction Log?
There are several different reputable organizations that have made suggestions on what information needs to be included.
The American Health Information Management Association (AHIMA) recommends that medical record destruction logs be kept permanently. Every time a record is destroyed, it should include:
- The date and method of destruction.
- A description of the disposed of records.
- Inclusive dates covered.
- A statement that the records were destroyed in the normal course of business.
- The signatures of the individuals supervising and witnessing the destruction.
The Healthcare Information and Management Systems Society (HIMSS) also makes suggestions for what should be included in a medical record destruction log. They say you should document the following information:
- Patient name, ID number, and other key identifiers (eg, dates of service).
- A description of records being destroyed.
- General record content.
- Type of media (paper, fiche, CD, etc).
- The date the records were destroyed and the method of destruction.
- The name and signature of the person or the company destroying the records.
As you can see, there’s information that can help verify that the record was destroyed, but there is no specific protected health information exposed by these logs. By maintaining this detail in your medical record destruction logs, you avoid some of the pitfalls of mismanaging medical records, including hefty fines and penalties.
Get Free, No-Hassle Quotes on Medical Record Shredding Today
Shred Nations specializes in helping you find the medical record shredding contractor that’s right for your businesses regardless of the size of the job. If you’re looking for a quote on medical record shredding services, please fill out the form to the right, or give us a call at (800) 747-3365.
Within minutes of receiving your request, you will receive quotes from shredding contractors in your area so that you can select the company that fits your project or your office best.
