Transfer of Patient Records When Selling or Closing an OMS Practice

Most Oral and Maxillofacial Surgeons (OMS) are aware of the requirements to protect patients’ personal protected health information (PHI) as specified by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). However, some OMS who are selling their practices do not realize that they cannot simply hand over their patient health records to a purchasing practitioner or entity. Many OMS also are not aware that individual states might have privacy regulations, some of which are more stringent than national regulations.¹

HIPAA allows for the exchange of PHI without a written authorization between current and prior practitioners or contemporaneously treating practitioners (including practitioners who are treating the patient at the same time, such as consultants). However, when a practice is being sold, HIPAA does not permit the transfer of PHI from one OMS to another without the patient’s written authorization. Although transferring the records to the purchasing practitioner or corporate entity might seem to be the most expedient solution, it is not permissible under HIPAA.

State statutes and administrative rules may further complicate the process. For example, states can require practitioners to maintain patients’ health records for specified periods, dating from the last treatment date. Many states impose a 7-year or longer record maintenance requirement, and many states impose separate — and often more rigorous — requirements for retaining pediatric records. HIPAA does not diminish the authority of these laws.²

Self-Storage

To comply with HIPAA’s records retention requirements, some OMS who are selling or closing their practices choose to store their records themselves. Electronic health records (EHRs) help simplify the self-storage process because they do not take up much physical space and can be easily secured. However, many retiring OMS today do not have EHRs, or they have a mix of EHRs and paper records.

Paper records present different storage challenges. Besides the space requirements, storing paper records can be problematic if the information has not been maintained in an ordered system and a former patient requests a copy of his/her record (to which the patient is entitled to under HIPAA).³

Record Storage Companies

OMS who do not want to assume the responsibility of storing their own records might choose to contract with a records storage company. Although record storage companies can have substantial fees, they offer several advantages:

• They will pick up the records and store them in a climate-controlled facility, which can protect them from environmental damage (e.g., dampness, mold, vermin, etc.).
• They are usually bonded or insured, thereby reducing providers’ risk exposure if stored records are damaged, destroyed, or stolen while in the records storage company’s possession.
• They can easily respond to patients’ requests for records. Patients can be referred directly to the records storage company, which then will locate and copy the records and collect the applicable fee from the patient.⁴

At the time of records transfer, a records storage company will execute a legal document called a business associate agreement (BAA) with the storing OMS. This HIPAA-required document obligates the storage company to appropriately safeguard the PHI contained in patient health records to the same standard that the practitioner must protect it. Through the BAA, the practitioner and the patient are assured that the PHI will be secure.

Custodianship

When a practice is sold, many (but not all) patients remain and continue their care with the purchasing practitioner. This potential for continuity is convenient for patients, and it also enhances the practice’s value.

It is ideal when patient health records are immediately accessible to the new practitioner. This can happen if the purchasing OMS becomes the custodian of the selling practitioner’s records through execution of a BAA.

In this case, in addition to compliance with HIPAA privacy and security regulations, the BAA should specify that the custodian will provide the selling OMS with access to the physical health records upon reasonable notice (such as 2 business days), and that the custodian will not release or dispose of any original health records without the seller’s written authorization.

As needed, patients who continue their relationship with the practice will be asked to provide written authorization to release their records from the seller to the purchaser. Once the release is authorized, the purchaser (who is in physical possession of the records) can use the records as he/she would with any other active patient. Health records of patients who leave the practice would ultimately be placed in storage or archived, which is permissible under HIPAA.⁵

Conclusion

HIPAA has been valuable in providing uniformity in administration and enhanced protection of patients’ PHI — an important consideration in this age of medical identity theft. With proper planning, OMS wishing to sell or close their practices can provide continuity in ongoing patient care and, when necessary, the transfer of patient information, while fully complying with HIPAA requirements.

1. For example, many state privacy laws end their jurisdiction at the time of a patient’s death; however, HIPAA does not. Following the death of a patient, the only person who can authorize the release of the patient’s PHI is usually the executor or personal representative of the deceased’s estate. If an estate does not exist, a court order might be required to authorize the release of the information.
2. Practitioners should know exactly what the retention requirements are in the state(s) in which they practice. State medical or dental societies are good resources for this information.
3. Under HIPAA, a practitioner’s responsibility to provide patients with copies of their records does not terminate with the practitioner’s retirement. As long as the practitioner still possesses the records, he/ she must provide copies if patients request them.
4. HIPAA allows a reasonable fee to be charged for labor and copying. Many states also have laws related to health record copying fees; if these laws are not consistent with HIPAA, then providers must abide by the federal HIPAA regulations.
5. In the case of EHRs, the selling practitioner would transfer all records electronically to the purchaser (in an encrypted format and after executing a BAA). The purchasing practitioner would then, with the patient’s written authorization, transfer individual records to active files when needed. The health records of patients who do not remain with the practice would be stored as inactive/archived records. The selling practitioner could also easily retain a copy of all patient health records for his/her future use.