In the aftermath of Hurricane Sandy, many physicians are left facing the question of what to do with paper medical records that were destroyed by fire or flood. It is essential to look at what should be done in the future to try and prevent this from happening again, but more importantly, what to do now.
According to the administrative requirements of the HIPAA Privacy law, physicians and other health care “covered entities” must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information (“PHI”). These safeguards may include securing medical records with lock and key or placing them in a water or fire proof room. While the goal of the safeguards is to avoid disclosure of protected health information, health care providers may now want to look at other options that serve a dual purpose so that the records are protected from the elements of a natural disaster while ensuring that protected health information is not found floating down a street or outside the confines of the covered entity’s secured location.
Although recovery of PHI is not addressed in the HIPAA Privacy Law, it is imperative to understand that patient access to medical records for personal use and for disclosure of other uses, is vital to the continuity of patient care and the right to access medical records, amend medical records and receive an accounting of disclosures. PHI must be quickly and efficiently restored to a usable format with communication available to those that request it with information related to the length of time for restoration and/or recovery of information.
The American Health Information Management Association (AHIMA) has posted guidance on what to do if medical records are destroyed. First, try to salvage any records that you can. If a damage restoration company is used, ensure that you enter into a business associates agreement with that company to ensure that any and all services are performed in accordance with the HIPAA privacy and security rules for third party contractors.
If the records are totally unsalvageable, and cannot be reconstructed by either electronic data recovery or through a damage restoration company, reconstruction of the records must be attempted. This can be done by reprinting documents from computer systems, pharmacy records with physician orders, laboratory and radiology databases and other data backup services. If possible, re-transcribe documents from a dictation system if available and check with consultants or other physicians for copies of dictated progress notes or consultative reports. In addition, obtain copies from recipients of previously distributed reports, documents, discharge summaries, and emergency room reports from other physician offices, hospitals, or other healthcare facilities.
If reconstruction is impossible, the health care provider must document the date, the information lost, and the event that caused the loss of patient information. In addition to documentation of loss in the individual patient record, a detailed record must be prepared that includes at a minimum, a list of patient records lost, recovery efforts undertaken and the outcome of such efforts. If any of the affected charts are requested for disclosure for any reason, the documentation of recovery efforts and loss must be sent with that disclosure. Accurate and comprehensive documentation is key to assist with billing and patient care issues.
It should be noted that Medicaid and Medicare providers who are subject to a Payment Error Rate Measurement (PERM) or a Comprehensive Error Rate Testing (CERT) review, may obtain administrative relief from the Department of Health and Human Services Centers for Medicare and Medicaid Services (DHHS) if records are completely or partially destroyed due to a natural disaster. This means that providers that are subject to a review may be entitled to a shift in the time period of the claims being reviewed to a later time period and a suspension of the review for a t least thirty (30) days with appropriate documentation of the disaster as required by DHHS. It is possible that in the case of complete destruction of medical records where no backup records exist, DHHS would accept an attestation that no medical records exist and consider the services covered and correctly coded. In the case of partial destruction, providers should reconstruct the records as best as they can. In either case, providers must note on the face sheet of the medical records that “This record was reconstructed because of disaster.” In addition, during a natural disaster, DHHS is required to do all it can do to make sure that Medicare and Medicaid beneficiaries receive the emergency or urgent services that they need and that providers receive payment for all covered services.
Abrams Fensterman is dedicated to assist you in your disaster recovery efforts after Hurricane Sandy. Please contact us for assistance.
