24.3 Query Records, Retention and Evidence Preservation
Key Takeaways
The actual query may reside in the health record or a retrievable business record; the clinical answer must enter the permanent health record.
An administrative label alone does not decide HIPAA designated-record-set access or create legal privilege.
Hospital medical-record retention, HIPAA documentation retention, the overpayment lookback and FCA action limits have different scopes; none creates one nationwide 6–10 year rule for every query.
Preserve relevant materials under actual obligations and holds; do not conceal defects by purging query history.
Civil Rule 37(e) and 18 USC 1519 have distinct conditions and intent requirements; adverse inferences, fraud findings and criminal sentences are not automatic.
Query Records, Retention and Evidence Preservation
Query governance must answer several different questions: where the communication is stored, where the provider's clinical answer becomes permanent, what information is subject to access or disclosure, and how long each record category is retained. A single label such as “administrative” or “legal health record” does not answer all four.
HIM, CDI, privacy, security, compliance and counsel should define responsibilities in organizational policy. The 2026 AHIMA/ACDIS brief permits actual queries to be part of the permanent health record or retrievable in the business record, while the provider's clinical answer must be documented in the permanent health record. The storage arrangement should preserve traceability and support appropriate retrieval.
Define the record architecture
Map the original query, indicator sources, response, authentication, amendments, administrative disposition and relevant audit information. Determine which system is authoritative for each component, how it links to the encounter and what happens during migration or vendor termination. A report that displays only the latest template may fail to show the actual question delivered to a provider months earlier.
An authenticated response component within the permanent health record may carry the clinical clarification without a duplicate progress note. If the query is stored separately as a business record, the clinical answer still needs an approved permanent record location. Avoid leaving the only diagnosis in an administrative tracking field that is inaccessible to clinical and coding review.
Organizational legal-health-record policy also does not determine the full HIPAA designated record set. HHS explains that designated record sets include medical and billing records and other records used to make decisions about individuals. Some general quality-improvement or management records fall outside that scope. Evaluate actual function and applicable exceptions; do not assume every query is excluded from patient access merely because CDI calls it a business record.
| Request or use | Question to resolve | Responsible coordination |
|---|---|---|
| Clinical and coding review | Where is the authenticated answer and its supporting documentation? | Provider, HIM, CDI and coding |
| Patient access | Is the requested PHI in a designated record set, and does an applicable exception apply? | Privacy and HIM |
| Payer record request | What is the request's authority and scope, and which records must be supplied? | HIM, appeals/compliance and the relevant business owner |
| Subpoena, civil investigative demand or litigation | What must be preserved or produced, and what objections or protections apply? | Counsel with records, privacy and IT teams |
Distinguish retention rules from enforcement periods
Apply the rules governing the organization, jurisdiction and record category. The following authorities address different matters and cannot be collapsed into one nationwide query-retention period:
| Authority | Actual scope | Implication for the retention decision |
|---|---|---|
| 42 CFR 482.24(b)(1) | Hospital medical records retained in original or legally reproduced form for at least five years | Apply the hospital record requirement and any additional applicable obligations |
| 45 CFR 164.530(j) | Specified HIPAA Privacy Rule documentation retained six years from creation or last effective date, whichever is later | This is not a general six-year rule for every patient's medical record or every query log |
| 42 CFR 401.305(f) | Medicare Part A/B overpayments identified within six years of receipt must be reported and returned under the rule | Consider payment support and review needs, without calling the lookback a universal query-retention mandate |
| 31 USC 3731(b) | FCA civil-action limitation: the later of six years after violation or three years after responsible US official knowledge, subject to the ten-year outer limit | Inform legal risk assessment; the limitations provision does not itself command ten-year retention of all queries |
| State law, contracts and specific holds | Requirements vary with jurisdiction, record type and circumstances | Identify the actual applicable authority; do not invent a national pediatric or adult duration |
HHS states that the HIPAA Privacy Rule does not set medical-record retention periods. It does require appropriate protection while information is maintained and through disposal. Applicable federal hospital requirements and state rules still matter; the absence of a HIPAA duration does not mean an organization may destroy records at will.
Build a schedule that identifies record categories, start events, periods, owners, approved disposal methods and exceptions. Consider the ability to retrieve supporting information over relevant review periods. Counsel may recommend a longer schedule for specific records, but describe that as an organizational decision grounded in the actual obligations, not an AHIMA mandate to retain all query materials for 6–10 years.
Preserve relevant evidence when required
When a dispute, investigation or reasonably anticipated litigation raises preservation needs, notify counsel and the responsible record owners promptly. Follow a hold defining relevant people, encounters, dates, systems and record categories. Suspend affected deletion routines, including vendor or mailbox processes, as directed. A hold may require preserving records that would otherwise be eligible for routine disposal.
Do not destroy embarrassing queries, rewrite their histories or remove originals to make an audit appear clean. Preserve appropriate versions while correcting the underlying clinical or operational problem. Conversely, do not assume every routine audit freezes all organizational data forever; preservation scope and duration require an actual assessment and documented direction.
Federal Civil Rule 37(e) addresses electronically stored information that should have been preserved for anticipated or ongoing litigation, was lost because reasonable preservation steps were not taken, and cannot be restored or replaced through additional discovery. With prejudice, the court may order measures limited to curing it. The rule's adverse presumptions, adverse-inference instructions, dismissal or default require a finding of intent to deprive another party of the information's use in litigation. Negligence does not automatically produce an instruction that a query proved fraud.
Separately, 18 USC 1519 covers specified knowing destruction, alteration or falsification with intent to impede, obstruct or influence a matter within federal agency jurisdiction or bankruptcy, including contemplated matters. It permits a fine, imprisonment up to 20 years, or both when its elements are met. That is a potential statutory consequence, not an automatic sentence for every missing document.
Respond through an authorized release process
A business-record designation alone does not create privilege. Under 31 USC 3733, a qualifying civil investigative demand can seek relevant documentary information for a false-claims investigation; that statute also recognizes protected material. Federal Civil Rule 26(b)(1) addresses relevant, proportional, nonprivileged discovery. Counsel assesses scope, protection, objections and production duties. Do not promise a court's ruling from a hypothetical label or release every file indiscriminately.
For retrieval, test that the team can locate the actual delivered query, permanent answer, source references and correction history for the specified encounter. Use authorized access and a documented production process. Resume routine disposal only when the applicable schedule and any preservation direction allow it; record the authorized action under policy. Reliable retention protects the integrity of both correct work and candid remediation.
Sources: 2026 AHIMA/ACDIS query brief, HHS patient access guidance, HHS medical-record retention FAQ, 42 CFR 482.24, 45 CFR 164.530, 42 CFR 401.305, 31 USC 3731, 31 USC 3733, Federal Civil Rules 26 and 37, and 18 USC 1519.
A hospital calls query forms administrative business records outside its legal-health-record export. Which access and production conclusion is sound?
The label automatically excludes every form from patient access and every legal demand.
Assess the designated-record-set function, request scope and applicable protections; the label alone neither decides HIPAA access nor creates privilege.
Release every form to any requester because business records have no confidentiality protection.
A court must always reject any privilege claim involving a query, regardless of the actual facts or governing law.
Which statement correctly distinguishes retention-related authorities?
The hospital medical-record minimum, specified HIPAA documentation period, Part A/B overpayment lookback and FCA limitation period address different subjects; identify actual applicable requirements before setting the query schedule.
The FCA limitation period directly mandates ten-year retention of every CDI email and draft.
HIPAA requires every medical record and every query to be retained six years from discharge.
The six-year overpayment lookback eliminates the need to examine state rules, contracts or preservation holds.
Electronic query records that should have been preserved for litigation are lost despite no finding of intent to deprive another party of their use. Which statement accurately describes Civil Rule 37(e)?
Any negligence automatically requires the jury to presume the missing queries proved fraud.
The rule has no relevance unless a criminal conviction already exists.
Assess the preservation, reasonable-steps, loss and restoration conditions; prejudice may support limited curative measures, while the rule’s adverse presumptions or dismissal/default require intent to deprive.
Every missing file automatically results in a 20-year sentence under the civil rule.
Sections you finish are checked off in the contents.
You've completed this section
Continue exploring other exams