Failure to Keep Medical Records Secure Can Cost You

By Jennifer M. Wang
OB/GYN News, December 1, 2000

LANCASTER, PA. -- Storing your medical records in an unsecured area can have unexpected consequences, said Dr. Robert F. Pendrak, vice president and medical director of PHICO Group, a medical malpractice insurance carrier in Mechanicsburg, Pa.

One of his colleagues, after moving his office to a building shared with two attorneys, put his inactive patient records in unsecured paper-clasp folders down in the shared basement. Two months later he started receiving malpractice lawsuits--but only from those patients whose files were kept in the common storage area.

The lawsuits stopped as soon as the physician moved the files to a more secure location, Dr. Pendrak said at a meeting on family practice management sponsored by Pennsylvania State University and the Family Health Foundation of Pennsylvania.

Keeping good track of your medical records is important for you and your patients, he noted, offering the following suggestions:

Protect patient access
Patients have access rights to their own files only, so a husband should not be able to obtain his wife's files, noted Dr. Pendrak, who is a general internist.

The only exception is parents' rights to their children's records: Generally both parents have access rights, even if they are divorced and only one parent has custody. If a court order withholds these rights or mandates that a parent cannot have access to the records, the parent who is holding custody must notify the child's doctor accordingly.

Transfer files securely
Faxing files is not recommended, but if it is done, the receiving party should be called before and after the file transmittal, and an attached disclaimer should provide a phone number to call in case the fax is received in error.

Practice computer security
The same laws that apply to hard copies of medical records also apply to computerized records. Consider who is able to see records displayed on a computer screen. How visible is the monitor to other people in the office? And for how long is the computer display visible? Password or encryption filters for accessing records can provide more peace of mind, Dr. Pendrak said.

When entering data into electronic files, make sure that the system will allow date stamps for late additions to entries. Otherwise, undated revisions may leave you or your staff exposed to accusations of fraudulently entering information or changing the patient's medical record.

Anticipate emergencies
The city of Harrisburg experienced two major floods one year, and both times water damage claimed many of the records stored in the sub-basement of a local hospital. And after one of his colleagues lost 22 years of patient records to fire, every patient seen by that physician was like a new patient because he no longer had records of their care.

To prevent such disasters in your practice, don't keep records below ground level, replace old cabinets with fireproof ones, and store inactive files off-site, Dr. Pendrak advised.