Hospitals and health systems across the country are grappling with rising labor costs, reimbursement pressures, and evolving regulatory demands, forcing some facilities to close their doors entirely and others to shutter critical departments such as labor and delivery and emergency services. When these transitions occur, healthcare organizations must ensure the long-term management, accessibility, and compliance of legacy patient records.
Managing legacy records during hospital closures, service line shutdowns, and acquisitions
Whether a facility is closing entirely, consolidating operations, or eliminating a service line such as labor and delivery, behavioral health, or oncology, healthcare organizations must ensure that health information remains accessible, secure, and compliant with applicable retention requirements.
Guidance from the Journal of AHIMA emphasizes that organizations remain responsible for protecting the privacy, confidentiality, integrity, and availability of patient records during and after a closure. HIM teams are often tasked with managing large volumes of paper and electronic records under tight timelines.
AHIMA notes that several factors should be considered when determining the disposition of patient records, including state record retention and disposal laws, licensing requirements, Medicare and Medicaid regulations, federal requirements for specialized records such as substance use treatment information, organizational policies, and the ongoing needs of patients, providers, and public health agencies.
For hospitals and health systems undergoing closure, acquisition, or service-line consolidation, a comprehensive legacy data management strategy is essential. For those practices that are being acquired, the best practice is to work through a legacy data management plan to determine which records may be migrated into the new organization’s EHR and which records should be stored in an active archive to meet long term record retention requirements.
Key Steps to Take
We have compiled a general list of steps for hospitals and health systems facing a facility closure, service-line shutdown, consolidation, or acquisition. While every organization’s circumstances are unique, these actions can help ensure patient records remain accessible, secure, and compliant with regulatory requirements throughout the transition.
- Understand applicable regulatory requirements.
Before making decisions about records, organizations should review applicable federal and state regulations to ensure compliance. - Obtain legal and compliance guidance.
Consult legal counsel and compliance leaders early in the process to ensure the organization meets its obligations related to medical retention and destruction laws. - Create a legacy data management plan.
Creating or updating a long-term plan for historical records will look different for practices that are closing vs. being acquired, but each must include provisions to comply with HIPAA, state and federal laws. Key steps will include a documented system inventory and system prioritization for possibly converting and migrating some records to a new EHR (for those being acquired), with plans to decommission legacy servers and archive historical records. - Contact any third parties that store the records. It can take several months’ notice to extract the records and allow for the decommissioning of the EHR system which stops the costly licensing or other fees.
- Transfer legacy clinical and business records into an active archive. A smart and economical option for retaining EHR and ERP data is to utilize a solution like HealthData Archiver® that supports the long-term data management strategy for your healthcare organization. An active archive meets retention requirements, cuts costs and supports cybersecurity efforts by consolidating information silos. It is important to compare apples to apples when reviewing archive vendor capabilities.
- Choose a trusted agent to manage future Release of Information requests. Keeping in mind all of the regulatory requirements, including the 21st Century Cures Act, patient records must remain accessible for the duration of application retention periods after a closure or M&A. A records custodian can take over the responsibility to process future release of information requests. It is important to trust this important role to an organization that offers assurances and proof that they will fully comply with HIPAA laws.
- Shred paper records that qualify for destruction. After confirming record retention requirements, use a professional to destroy the records that meet the criteria to be destroyed. Ensure there is a certificate of destruction.
Ensuring ongoing access to historical health information is one of the most important responsibilities facing organizations during a closure, acquisition, or consolidation. Patient records may be needed years after a facility has ceased operations. By developing a comprehensive legacy data management strategy, healthcare organizations can ensure legacy patient, employee, and business records remain secure, accessible, and compliant well into the future.
