The Closing Practice, the Missing Vitals, and the Attorney's Request
Dr. Nguyen is closing her Meridian practice after 19 years and moving out of state. She has 4,100 patient files, some dating to 2005. A 34-year-old former patient, treated for 14 visits over 6 months after a rear-end collision, has an attorney who sends a signed authorization requesting "the complete file." Reviewing the file before copying, Dr. Nguyen finds three problems: the initial examination note has no mechanism-of-injury description and no vital signs; one progress note is dated March 3, a day the patient was documented in a hospital in Sun Valley; and the final note says "released, MMI" with no outcome measures or functional status. She considers retyping the initial note to add the missing information and removing the March 3 note, believing the corrected version is "more accurate and better for the patient." Her office is cash-only and has never submitted an insurance claim, so her office manager says HIPAA does not apply.
1. Can Dr. Nguyen rewrite the initial note and delete the March 3 note? Explain what she may do instead.
Read the worked answer
She cannot rewrite the initial note and she cannot delete the March 3 note. A patient record is a contemporaneous document; its value - to the next treating provider, to a court, to the Board - depends on it being what was actually written at the time. Retyping an old note to insert facts learned later manufactures evidence and destroys the record's credibility, and it can be treated as unprofessional conduct or fraud independent of whatever the underlying care looked like. Deleting a note is worse: it is spoliation, and in litigation it invites an adverse inference and sanctions.
The correct mechanism is an addendum. For the initial note, she writes a dated, signed late entry: "Addendum, [date]: Initial examination note of [date] did not record mechanism of injury or vital signs. Patient recalls [mechanism]. Records reviewed [date]." She does not alter the original text. For March 3, she verifies the true date from the appointment schedule, bank deposits, or EHR audit log, then adds a dated correction explaining the discrepancy and how it was resolved - for example, that the visit occurred March 4 and the note was misdated. If the visit never happened and was billed, that is a separate refund problem.
The reasoning: corrections are legitimate and expected; concealment is not. The distinction is transparency and traceability, not the final appearance of the chart.
2. What must she release to the attorney, on what authority, and does the cash-only status change anything?
Read the worked answer
The patient, not the attorney, controls the record. A signed authorization from the patient that identifies the records, the recipient, and the purpose is sufficient authority to release; a bare attorney request is not. If a subpoena arrives instead, she should follow its terms and the applicable rules for notice to the patient or a protective order rather than simply mailing records to whoever asks.
She must release the complete record - the original entries, the addenda, imaging reports, intake forms, and billing records - not a curated version. Withholding the March 3 note or the addenda while producing the rest is exactly the selective production that turns a records dispute into a credibility problem. She should keep a copy of the authorization and a log of what was sent, when, and to whom.
The office manager's HIPAA point is half right and mostly irrelevant. A cash-only practice that conducts no electronic standard transactions may not be a HIPAA covered entity. But Idaho law and the Board's rules impose their own confidentiality, access, and recordkeeping duties on licensees regardless of payer mix, and the patient's common-law right of access does not depend on HIPAA. State law also governs reasonable copying fees. So the practical answer is: release in full and in a defensible way, and do not treat "we're cash-only" as a permission slip.
3. Before she closes, what must happen to the 4,100 files?
Read the worked answer
Closing a practice is a records project, not a dumpster project. She must plan for custody, notice, retention, and destruction.
Custody: identify who will hold the records after closure - a successor practice, a records custodian, or a commercial storage vendor - and put it in writing with a business associate or custody agreement that includes confidentiality and security terms.
Notice: tell patients in advance, through signage, a letter to active patients, website notice, and, where the practice is large enough, newspaper publication, stating the closure date, where records are going, how to request copies, and the deadline. Notice must reach patients she has not seen in years, which is why publication matters.
Retention: keep records for at least the period the Board's rule requires, measured from the last date of service; for minors, the clock generally runs until the patient reaches majority plus the retention period, so a 2005 pediatric file may still be within retention. She must also preserve any record subject to a pending request, subpoena, or known claim, regardless of the retention clock.
Destruction: only after retention expires and no hold applies, and only by a method that renders the records unreadable and unrecoverable, documented by a certificate of destruction. Abandoning records, leaving them in a vacated office, or destroying them while a request is pending are all Board problems.