2.3 Confidentiality, HIPAA & Patient Record Retention

Confidentiality, HIPAA, and Record Retention

Safeguarding patient information is a dual responsibility governed by both federal law (HIPAA) and Florida state statutes. Physical therapists are entrusted with highly sensitive personal and medical information, and the failure to protect this data can result in devastating consequences for the patient and severe penalties for the practitioner. This section covers the strict rules for confidentiality, as well as the specific timelines Florida dictates for keeping and destroying medical records.

Confidentiality and HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) sets the national standard for protecting sensitive patient data, known as Protected Health Information (PHI). PHI includes any information that can identify a patient, such as names, dates of birth, medical diagnoses, treatment notes, and billing records.

The Privacy Rule

The HIPAA Privacy Rule dictates how and when PHI can be used or disclosed. Physical therapists may share PHI for the purposes of Treatment, Payment, and Healthcare Operations (TPO) without specific patient authorization. For example, sending an evaluation to the referring physician or a claim to an insurance company is permissible. However, sharing a patient's progress on social media, even without using their name (if they can be identified by the context), is a blatant HIPAA violation.

The Security Rule

The HIPAA Security Rule requires practitioners to implement safeguards to protect electronic PHI (ePHI):

• Administrative Safeguards: Training staff on privacy policies and conducting risk assessments.
• Physical Safeguards: Locking file cabinets, restricting access to areas where records are kept, and ensuring computer screens are not visible to unauthorized individuals.
• Technical Safeguards: Using encrypted software, secure passwords, and audit controls for EMR systems.

Under F.S. Chapter 456, Florida echoes these federal mandates, stating that patient records are confidential and must not be disclosed without the patient's written authorization, except where specifically compelled by law (e.g., a court order or mandatory reporting of abuse).

Florida Record Retention Requirements

Florida law imposes very specific timeframes for how long medical records must be kept. These timelines frequently appear on the jurisprudence exam.

The Standard 5-Year Rule

According to F.A.C. Rule 64B17-6, a physical therapist must retain patient medical records for a minimum of 5 years from the date of the last patient contact with that specific physical therapist or the therapy practice.

• Note: While the state minimum is 5 years, some federal programs (like Medicare) or specific malpractice insurance policies may require retaining records for longer periods (e.g., 7 or 10 years). However, for the Florida Jurisprudence exam, the state standard of 5 years is the critical number to remember.

Relocation or Termination of Practice

If a physical therapist terminates their practice or relocates and is no longer available to patients, they must ensure continuity of care and record access. The PT must publish a notice in a newspaper of greatest general circulation in each county where they practiced. This notice must contain the date of termination/relocation and an address where patients can obtain their medical records.

Death of a Physical Therapist

When a physical therapist dies, the responsibility for their records falls to their executor, administrator, or a designated survivor. The specific Florida timeline is rigid:

1. Within 1 month from the date of death, the executor must publish a notice in a local newspaper of general circulation indicating to patients where their records can be obtained.
2. The executor must retain the records for a period of 22 months following the 1-month publication period (totaling 2 years of retention from the date of death).
3. At the end of this 2-year period, the executor must publish another notice in the newspaper once a week for four consecutive weeks, warning that any unclaimed records will be destroyed.

Proper Disposal of Medical Records

When the required retention period expires, records cannot simply be thrown in the trash. They must be destroyed in a manner that completely obliterates the PHI and renders it unreadable and reconstructable.

• Paper Records: Must be cross-cut shredded, burned, or pulverized.
• Electronic Records: Hard drives must be physically destroyed, wiped using secure software that permanently overwrites the data, or demagnetized. Leaving old patient charts in a dumpster is a massive HIPAA violation and a breach of Florida law.

Exam Traps and Clinical Scenarios

Exam Trap: Be highly alert to questions asking about the timeline for deceased practitioners. The exam often tries to confuse the general 5-year retention rule with the 2-year retention rule following the death of a PT. Remember: Living PT = 5 years from last contact. Deceased PT = 2 years retained by the executor.

Clinical Scenario: A PT is retiring and closing their private practice. They box up all patient records from the last 10 years and store them in their damp residential garage without notifying anyone. This violates multiple statutes. The PT failed to publish the required newspaper notice regarding the practice closure and where records can be accessed. Furthermore, storing unencrypted, unsecured records in a residential garage violates HIPAA physical safeguards.

Summary Table: Retention Timelines