Custodian of Medical Records

What is a Custodian of Medical Records?

A custodian of medical records is an individual or company who has been designated the responsibility of the care, custody, and control of patient medical records. This often becomes necessary after a medical practice closes or needs to delegate storage of medical records. In addition, custodians of medical records handle requests for records, ensure compliance with HIPAA, and manage the retention and destruction of records according to state laws. 

Key Takeaways:

Who can be a Custodian of Medical Records? 

A custodian of medical records can be an individual or a company that is delegated legal custody of the records and can make decisions regarding who can access them.   

In many cases, a physician in charge of the records during the practice's operating years or the executor of the physician's will serves as the custodian.  

Alternatively, companies specializing in records custodianship can be employed prior to a medical practice closing. 

Hospitals can have a health information manager or a designated representative serve as the custodian.  

In general, a physician who creates and maintains the medical record is the initial custodian. It can also extend to a practice, especially if a physician is part of a larger medical group.  

There are some companies that specialize in medical records custodianship that can be paid to manage records on behalf of physicians or practices, often when a practice closes.  

For Example: 

A physician in your local city decides to retire and close their practice. The physician could hire a medical records custodian service to manage all the medical records for their patients. This would ensure compliance with the State's medical record retention laws and patient access rights.  

Benefits of a Custodian of Medical Records 

Hiring a medical records custodian can free the practice from the burden of managing records, especially when closing or retiring.  This allows the practice to focus on more critical matters like patient care. When a medical practice closes, it is critical to have someone take on the duty for the management of records to protect the practice from legal liabilities and to ensure patients are still able to access their records.  

Each state/country/province has its own guidelines for how long a practice will need to store its patient records. Patients need to be able to easily contact a custodian of medical records and obtain their health information, get physical copies of their medical records, or have electronic copies mailed to them.   

Thus, the most important benefit of a custodian of medical records is that they free up medical practice staff from having to perform time-consuming and costly records searches.  

When it comes to the end of retention periods, custodians can also provide efficient and secure destruction of medical records. 

‍

What Are the Duties of a Custodian of Medical Records?

A medical records custodian manages a variety of aspects of record keeping, including: 

• Storing and scanning records.  
• Secure transport safely moves medical records to separate medical records centers and provides packaging services. 
• Handling requests for medical records from patients, legal professionals, and other healthcare entities.  
• Ensuring medical facilities are in compliance with HIPAA regulations and state-specific laws regarding retention and destruction of records.  
• Providing records to authorized individuals or organizations in a timely manner on receipt of valid requests. 
• Full release of information requests and the handling of medical record requests according to HIPAA standards. 
• Closing Practice Notification including: 
• Mailing records.  
• Emailing notifications to patients with updates on their medical records. 
• State Medical Board/Agency notices. 
• Web services to provide the closing practice's messages and instructions for record requests. 

Who has a Duty to safeguard medical records?  

The duty to safeguard medical records lies with health care providers (e.g., doctors and hospitals), health plans, and their business associates. Under the Health Insurance Portability and Accountability Act (HIPAA), they are required to maintain protected health information (PHI) securely and confidentially and protect it from unauthorized access, use, or disclosure.  

Specifically, HIPAA defines "covered entities" (those responsible for protecting health information) as health plans, healthcare clearinghouses, and most healthcare providers that conduct certain healthcare transactions electronically.  

HIPAA also applies to business associates that perform services for or on behalf of covered entities. These other entities may include billing, IT, and record storage companies. These entities are also responsible for protecting PHI.  

Beyond legal obligations, healthcare professionals also have an ethical duty to safeguard patient confidentiality. Covered entities and other associates must employ appropriate administrative, technical, and physical safeguards to protect PHI.  

‍