Medical Records

Section 3007 of the Business and Professions code sets forth a requirement that you must maintain records for seven years. However, that does not necessarily mean that you should not keep the records longer, it depends on the individual patient and circumstance. For instance, federal, state, and local law enforcement can investigate Medi-Cal or Medicare fraud beyond seven years, and part of their investigation would include looking at medical records.

If the patient is a minor, the records must be retained for a minimum of seven years from the date he or she completes treatment and until the patient reaches 19 years of age.

Also, you are strongly encouraged to look at your contracts with various health plans as they also have their own requirements for medical record storage. For example, CMS requires Medicare managed care program providers to retain records for 10 years.

Medical records can be in either electronic (see Electronic Health Records) or paper formats. It is of importance that whichever format used, the records are kept safe and secure so as to prevent loss, destruction, and tampering. Additionally, the HIPAA Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.

Yes, patients or a patient’s personal representative must be granted access to their medical records. According to sections 123100 - 123149.5 of the Health and Safety Code, copies of the medical records must be made available during business hours within 15 working days after receiving a request. If the patient only requests to inspect their medical records, this must be made available to them within 5 working days after receiving the request. A health care provider may impose a reasonable, cost-based fee for providing a paper or electronic copy or summary of patient records, provided the fee includes only the cost of the following:

• 1. Labor for copying the patient records requested by the patient or patient’s personal representative, whether in paper or electronic form.

  2. Supplies for creating the paper copy or electronic media if the patient or patient’s personal representative requests that the electronic copy be provided on portable media.

  3. Postage, if the patient or patient’s personal representative has requested the copy, or the summary or explanation, be mailed.

  4. Preparing an explanation or summary of the patient record, if agreed to by the patient or patient’s personal representative.

  5. The fee from a health care provider shall not exceed twenty-five cents ($0.25) per page for paper copies or fifty cents ($0.50) per page for records that are copied from microfilm.

If you choose to prepare a summary of the patient’s medical records in lieu of granting access to the entire record, it must be made available within 10 working days from the time of the request. If more time is necessary, the patient must be notified of the date that the summary will be completed, not to exceed 30 days between the request and the delivery of the summary. No fee can be collected for medical records requested to support a claim or appeal regarding eligibility for a public benefit program (e.g. Medi-Cal, CalWORKs).

…even if they have not paid for services received?

Section 123110 of the Health & Safety Code states that you cannot deny a patient or a patient’s representative a copy of their records because they have not paid for the services they have received.

No, there is no set law that requires you to transfer patient records as prescribed by California Health & Safety Code Section 123100. It is considered a “common courtesy” to transfer records between providers. You may charge a copying or transfer fee since there is no law forbidding you to do so. There is no time limit set for the transference of these documents. The patient will need to sign a records release form to transfer records.