7.1 Medical Records Management
Key Takeaways
- Medical records can be paper-based, electronic (EHR/EMR), or hybrid systems combining both formats
- An EMR is the digital version of a patient's chart within a single practice; an EHR is a broader system that shares data across multiple providers and settings
- Filing systems include alphabetical (most common for small practices), numerical (common for larger practices), and terminal-digit filing
- Medical record retention varies by state and federal law — generally 7-10 years for adults and until age 21 (or longer) for minors
- Record destruction must follow HIPAA guidelines: shredding for paper, degaussing or wiping for electronic media, with destruction documented
- Record release requires a valid authorization, and the office must follow minimum necessary standards and document the disclosure
Last updated: March 2026
Medical Records Management
Medical records are the foundation of patient care and a core administrative responsibility for CMAAs. Proper records management ensures continuity of care, legal compliance, and protection of patient information.
EMR vs. EHR
While often used interchangeably, there is a distinction:
| Feature | EMR (Electronic Medical Record) | EHR (Electronic Health Record) |
|---|---|---|
| Scope | Single practice or organization | Shared across multiple providers and settings |
| Interoperability | Limited — data stays within the practice | Designed to share data across the healthcare continuum |
| Content | Patient's chart within one practice | Comprehensive health history from all providers |
| Portability | Not easily transferred | Can follow the patient across care settings |
| Example | Chart at your family doctor's office | Health information shared between your PCP, specialist, hospital, and pharmacy |
Key EHR Functions
| Function | Description |
|---|---|
| Scheduling | Integrated appointment scheduling and reminders |
| Registration | Patient demographics and insurance entry |
| Clinical documentation | SOAP notes, progress notes, orders |
| Order entry | Lab orders, imaging orders, prescriptions (CPOE) |
| Results management | Lab and imaging results with provider review tracking |
| Messaging | Secure messaging between staff, providers, and patients |
| Billing integration | Encounter forms, coding, and claim generation |
| Reporting | Quality measures, population health, financial reports |
| Patient portal | Patient access to records, messaging, scheduling |
Filing Systems
Alphabetical Filing
| Feature | Description |
|---|---|
| Method | Files are organized by patient last name, first name, middle initial |
| Advantages | Simple, intuitive, no cross-reference needed |
| Disadvantages | Difficult with common names; misfiling risk increases with volume |
| Best for | Small practices with fewer than 5,000 patients |
| Filing rules | Nothing comes before something (Smith files before Smithson); surnames before given names |
Numerical Filing
| Feature | Description |
|---|---|
| Method | Files are organized by an assigned number (medical record number) |
| Advantages | Greater confidentiality, easier expansion, fewer misfiling errors |
| Disadvantages | Requires a cross-reference index (alphabetical list linking names to numbers) |
| Best for | Larger practices and hospitals |
Terminal-Digit Filing
| Feature | Description |
|---|---|
| Method | Filing by the last digits of the medical record number (read right to left) |
| Advantages | Even distribution of files across the filing system; reduced congestion; fewer misfiling errors |
| Disadvantages | More complex; requires training |
| Best for | Large healthcare facilities with high volume |
Example: Medical record number 123456 is filed as 56 (primary) → 34 (secondary) → 12 (tertiary)
Medical Record Content
Every patient's medical record should contain:
| Category | Documents |
|---|---|
| Administrative | Registration form, insurance information, consent forms, NPP acknowledgment, advance directives |
| Clinical | History and physical, progress notes, consultation reports, surgical reports, anesthesia records |
| Diagnostic | Lab results, pathology reports, radiology reports, EKG results |
| Therapeutic | Medication lists, treatment plans, immunization records, physical therapy notes |
| Correspondence | Referral letters, insurance correspondence, patient letters |
| Legal | Informed consent forms, authorization for release of records, subpoena responses |
Record Retention
General Guidelines
| Record Type | Minimum Retention Period |
|---|---|
| Adult patient records | 7-10 years from last encounter (varies by state) |
| Minor patient records | Until the patient reaches age of majority (18 or 21) plus the state's retention period |
| Medicare/Medicaid records | Minimum 10 years (CMS requirement) |
| OSHA records | Duration of employment plus 30 years |
| Financial records | 7 years (IRS requirement) |
| Vital statistics | Permanently |
Important: Always follow your state's specific retention laws AND any applicable federal requirements, whichever is longer.
Record Destruction
When retention periods have been met, records must be destroyed properly:
Paper Record Destruction
| Method | Description |
|---|---|
| Shredding | Cross-cut shredding is preferred over strip shredding |
| Incineration | Burning — most secure but least practical |
| Pulping | Chemical dissolution of paper |
Electronic Record Destruction
| Method | Description |
|---|---|
| Degaussing | Exposing magnetic media to a strong magnetic field to erase data |
| Overwriting (wiping) | Writing over data multiple times to make it unrecoverable |
| Physical destruction | Shredding or crushing hard drives, CDs, flash drives |
Destruction Documentation
All record destruction must be documented:
- Date of destruction
- Method of destruction
- Description of records destroyed (patient names are NOT listed — use date ranges and volume)
- Person responsible for or overseeing destruction
- Witness signature (if applicable)
Handling Records Requests
| Request Type | Required Documentation | Timeline |
|---|---|---|
| Patient request | Written request; photo ID verification | 30 days (per HIPAA) |
| Provider-to-provider (treatment) | Verbal or written request (TPO — no authorization needed) | Promptly |
| Attorney/legal request | Valid subpoena or court order, or signed patient authorization | Per court order/office policy |
| Insurance request (payment) | Written request with claim reference (TPO) | Per contract terms |
| Research request | IRB approval or signed patient authorization | Per office policy |
Test Your Knowledge
What is the key difference between an EMR and an EHR?
A
B
C
D
Test Your Knowledge
In terminal-digit filing, the medical record number 789012 would be filed under which primary number?
A
B
C
D
Test Your Knowledge
When destroying paper medical records that have met the retention period, which method is considered most appropriate?
A
B
C
D