It is not uncommon to walk into a medical office and find overflowing storage cabinets filled to the brim with patient files. One of the hardest jobs for a health facility is finding the space to store all their records.
What makes this task even more daunting is having to follow all state and federal regulations. A solution to this ever growing problem is document destruction. However, there are steps that all medical centers must take before the shredding is ever done.
Steps to Take Before you Shred
The actual shredding is easy, it’s preparing the documents for shredding that is the challenge. Though this can be time consuming it is well worth the effort as there are severe consequences for inadequately disposing health records. Let’s take a look at some of the steps all health providers must take before calling in a shredder.
Establish a Records Manager
Document destruction can get messy real quick if an organized system is not in place. To maintain order, you should establish a project manager. This person is responsible for overseeing the entire destruction process. Depending on the size of the facility and the volume of documents, you may choose to assign multiple people to watch over the project.
With older facilities, it is likely records were stored on microfiche, microfilm, or offsite storage. Seeing as it may not be cost effective to move the old records to the new storage system, it is the project manager’s job to keep track of all the documents, old and new. Keeping track of that many documents is a huge responsibility, making it ever more important to find a dependable, dedicated person to manage the project.
Research State Specific Retention Laws
One of the reasons medical record destruction can be complicated is HIPAA. However, this law only goes so far and leaves many decisions up to the state. Retention guidelines are one such aspect that HIPAA does not specify allowing each state to determine the retention times for medical records. Before shredding anything, it is critical you find out what the retention guidelines are for health records in your state.
Decide What to Shred
Once you have an idea of the retention schedule for your state, you can determine what needs to be shredded and what needs to be stored. Create a system to organize your collection of medical records. Old files that are well past their retention time can be shredded as soon as possible while newer records can be placed in storage.
Decide How to Shred
HIPAA does not give exact guidelines as to how you are to destroy medical documents. The law leaves it up to the facility to determine which destruction method will properly dispose of the records. Be aware that the term “proper disposal” does not mean you can toss medical files into a dumpster even if you consider a dumpster to be an appropriate disposal method.
You should not irresponsibly destroy patient records just because HIPAA does not explicitly state a method of destruction. It is important to note that state regulations are often not as flexible as HIPAA and may require you to dispose of the records through a specific method such as crosscut shredding.
Create a Document Destruction Plan for the Present and the Future
Document destruction is an ongoing process. For this reason, it is necessary to create a detailed document destruction plan that lays out guidelines for the present and the future. It should be clear to all employees what documents are to be stored and what ones are to be destroyed. The plan should also outline what documents are due for destruction in the future.
Since technology is always changing and producing new document management systems, it is important to do an annual review of your plan. Revising your destruction protocol on a yearly basis will keep your facility up to date with the current environment. This is also a good strategy as government regulations are constantly being updated and changed. You should regularly reassess your destruction plan to ensure your office is using the best document management practices all while being in accordance with present government regulations.
Time to Shred
Once you have taken the steps to prepare your documents for destruction, it is relatively simple to get your records demolished. The most common method is having a mobile shredder come to your office and shred the paper onsite.
It is recommended that medical facilities document all destruction jobs that take place at their location. This entails maintaining a record of when the shredding took place, who completed the job, and what documents were destroyed. Most shredding companies will provide a certificate of destruction detailing this information, however, part of a solid document destruction plan is keeping your own destruction log.
Another element to a destruction plan is a retention schedule. This idea was discussed briefly above but it is worth repeating again. Keeping track of the retention times of all your documents is a must. Not only does it open space in your office and protect your patient’s privacy by destroying any documents past their retention time but it also makes sure you do not accidentally throw out a document too soon.
Implications of Violating HIPAA
Breaching HIPAA regulations is considered a civil and criminal offense. You will receive fines that can cost a minimum penalty of $100 to a maximum penalty of $1.5 million. In rare cases, the Department of Justice may choose to prosecute a doctor or other healthcare professional in which jail time is a possible punishment. Though spending a few months in prison is rare, is jail time really worth the time or money you save by not following HIPAA guidelines?
Consider the damage a HIPAA violation would have on your facilities reputation as well. If a doctor from your office were to go to court, would your patients continue to trust you? Even if your organization only received a fine for breaking HIPAA, you may find it difficult to assure your patients their private records are not at risk. The combination of large fines and loss of patients could result in the end of your business.
Disobeying HIPAA can have a huge impact on any medical facility. There is no excuse not to protect your patient’s private medical information especially when document destruction can be made so simple. Don’t take a risk, ensure your office has a document destruction plan.
If you have a document destruction plan in place and are looking for a shredding company, Shred Nations is here to help. Our nationwide network of HIPAA compliant contractors can get the job done. For more information about shredding or record storage, please don’t hesitate to call us at (800) 747-3365 or fill out the form to the right.
