Retention and Release When a Clinic Closes
A 12-physician independent practice will close its only clinic in 90 days and uses a cloud-based EHR vendor. State law requires adult records be kept seven years from the last encounter and minors until age 21 or seven years, whichever is longer. The malpractice carrier contract requires 10 years, and one payer contract requires 10 years after the last claim. The practice is a defendant in a pending malpractice suit involving a 2019 surgery. A former patient's attorney has served a subpoena for the complete record of a different patient. The managing partner proposes deleting all records older than seven years before closing to reduce storage fees. The office manager asks the HIM consultant to approve the deletion list and to release the subpoenaed record immediately, saying 'the subpoena is a court order.'
1. Should the HIM consultant approve deletion of records older than seven years? Explain.
Read the worked answer
No. The consultant should not approve destruction based on the shortest retention period. The practice must apply the longest applicable requirement: state law, payer contracts, malpractice carrier requirements, and any legal hold. The pending malpractice suit triggers a litigation hold that overrides routine destruction, and the hold may extend to records beyond the specific patient in the suit if they are potentially relevant. Destroying records after a duty to preserve has attached can be spoliation and can create sanctions, regardless of the state's seven-year minimum. The payer contract's 10-year requirement also applies to claims data. The consultant should recommend that counsel issue a written hold, suspend destruction, inventory records by category and retention trigger, and document the legal basis for any later destruction. If storage cost is the concern, the practice can migrate to a lower-cost archive or negotiate with the vendor, but it should not destroy records to save fees before the retention periods and legal hold are resolved.
2. What must be verified before responding to the subpoena?
Read the worked answer
The office manager's statement that 'the subpoena is a court order' is incorrect. A subpoena is a discovery request, not necessarily a court order, and the response depends on jurisdiction and applicable rules. The consultant should verify that the subpoena was properly issued and served, identify the court and case, confirm the patient identity, and determine whether the patient has authorized release or whether the legal process itself compels production. Many jurisdictions require notice to the patient or an opportunity to object, and some records, such as psychotherapy notes or certain substance-use records, require a court order or specific authorization. The practice should release only the records requested, redact information about other patients, and apply minimum-necessary principles where appropriate. Counsel should review before production. The disclosure should be logged for the accounting of disclosures, and the practice should not release the 'complete record' of a different patient merely because the subpoena says so without confirming scope and authority.
3. Outline the record custody and notification plan for closure.
Read the worked answer
The plan should designate a records custodian and a successor custodian, such as another provider, a records storage vendor, or the EHR vendor under a business associate agreement. Patients must receive advance notice of the closure, how to obtain copies, where records will be maintained, and the deadline for transfer requests. The practice should post the notice publicly and send it to active patients. The plan should map retention triggers, including last encounter, minor status, claims, and legal holds, and should preserve records in a readable format. The vendor contract must address ownership, access, return or destruction of data, and breach responsibilities. Destruction later must be secure and documented with certificates. The practice should also address payer contracts, state reporting, and malpractice carrier requirements. The HIM consultant should not approve deletion until counsel confirms no hold applies and the longest retention period has run.