The fallout from COVID-19 on medical practices includes more than eight percent (around 16,000 medical practices) closing, with another seven percent unsure of their long-term survival. With more than 108,000 physicians leaving private practice from 2019-2022, industry analysts say many more are teetering on the economic brink. Recent announcements like Amazon acquiring One Medical, with the intent to deliver virtual and community-based care with a membership fee, may further disrupt the healthcare delivery system. For those medical practices that do not close their doors, survival sometimes comes in the form of being acquired. Hospitals and other groups acquired 36,200 additional physician practices between 2019-2022, charting a 38 percent increase of hospital or corporate-owned practices from 38.9 percent in January 2019 to 53.6 percent in January 2022. Currently, more than 73 percent of U.S. physicians are employed by hospitals, health systems or corporate entities, up from 62 percent in 2019. What to do when your practice is closing or being acquired There are several steps involved in closing a medical practice to ensure overall business and legal obligations are met. The American Academy of Family Physicians has a checklist that covers the necessary actions to notify staff, patients, payers, suppliers, as well as tasks for patient scheduling, accounts receivable, equipment and more. AHIMA provides guidance for what to do with medical records. This includes guidance that: If records are not transferred to another healthcare provider, records may be archived with a reputable commercial storage firm. Further guidance from AHIMA: Circumstances involving the transfer of health records as the result of closure are within the HIPAA definition of healthcare operations, so organizations must refer to applicable state and other federal laws to determine if stricter requirements exist before transferring records. Stricter requirements may refer to unique record retention circumstances, such as Medicare records including skilled nursing facilities and home care agencies, correctional health records and records for alcohol and drug abuse treatment. For those practices that are being acquired, the best practice is to work through a legacy data management plan to determine which records may be migrated into the new organization’s EHR and which records should be stored in an active archive to meet long term record retention requirements. Checklist: Nine action steps to secure medical records and other records due to a practice closure or acquisition We have compiled a general list of steps to follow if your medical practice is facing a closure or acquisition. This list is intended as a starting point, as each organization’s unique needs would inform a more complete strategy. Contact your state government and/or liability insurer. This is the first call that needs to be made to gather all of the state-specific guidelines. Obtain legal advice. The second call is to consult with an attorney to make sure legal bases are covered in terms of notifying relevant parties in a timely manner and complying with medical retention and destruction laws. Review state record retention laws. HIPAA covered entities must keep EHR and other medical records that demonstrate compliance for at least six years. However, there may be additional state laws that expand medical retention requirements. Create a Legacy Data Management Plan. Creating or updating a long-term plan for historical records will look different for practices that are closing vs. being acquired, but each must include provisions to comply with HIPAA, state and federal laws. Key steps will include a documented system inventory and system prioritization for possibly converting and migrating some records to a new EHR (for those being acquired), with plans to decommission legacy servers and archive historical records. Obtain authorization to transfer patient records. Medical records cannot be transferred to another physician without patient consent. Patients must be given an option to choose another doctor and have a copy of their records sent to the physician of their choice. Keep a copy of this authorization in the original record. This includes written agreements for any other physician or practice who will hold the records and the arrangement to transfer records at patient requests. Contact any third parties who store the records. It can take several months’ notice to extract the records and allow for the decommissioning of the EHR system which stops the costly licensing or other fees. Transfer legacy clinical and business records into an active archive. A smart and economical option for retaining EMR and ERP data is to utilize a solution like HealthData Archiver® that supports the long-term data management strategy for your healthcare organization. An active archive meets retention requirements, cuts costs and supports cybersecurity efforts by consolidating information silos. It is important to compare apples to apples when reviewing archive vendor capabilities. This template can help you during the RFP process. And, this cybersecurity resource can help you ask your future archiving vendor partner some key questions related to their security practices. Choose a trusted agent to manage future Release of Information requests. Keeping in mind all of the regulatory requirements, including the 21st Century Cures Act, patient records must remain accessible after closure or M&A. Most records must remain available for six years to meet HIPAA regulations, while other factors may extend the number of years (including if the patient is a minor or certain medical conditions, such as behavioral health or oncology) up to 20+. A records custodian can take over the responsibility to process future release of information requests. It is important to trust this important role to an organization that offers assurances and proof that they will fully comply with HIPAA laws. Shred paper records that qualify for destruction. After confirming record retention requirements, use a professional to destroy the records that meet the criteria to be destroyed. Ensure there is a certificate of destruction. Choosing a trusted source for ongoing Records Release services is important as future requests may be needed for patient care, litigation, insurance audits, and other reasons. Medical practices are facing marketplace changes and financial pressures. With these challenges, some organizations will close, and others will be acquired. In either scenario, the Harmony Healthcare IT team is equipped to support healthcare practices to ensure there is a plan to keep patient, employee and other business records secure, accessible and deliverable to requestors. Now and in the future. It’s not too early to reach out. Let’s connect.