Medical records serve important patient interests for present health care and future needs, as well as for insurance, employment, and other purposes. Medical records management encompasses not only managing the records of current patients, but also retaining old records against possible future need, and providing copies or transferring records to a third party as requested by the patient or the patient’s authorized representative.

• Access
• Retention
• Destruction
• Disposition
• Minimum Standards for Medical Records
• FAQ

Joint Rules of the Board and Commission for Medical Records Management

Access

Requirements and procedure for patient access to medical records:

• Patient or patient’s legal representative submits legally compliant request

• Physician or practice provides copy of medical record to:
  • Patient
  • Another physician
  • Attorney
  • Other person designated by patient or patient’s legal representative
• Patient/representative may authorize the physician to provide a specific portion or summary (when record is in paper form and patient waives right to a full copy)
• The cost of reproduction shall not exceed what is authorized under state and federal law. (Ala. Code § 12-21-6.1  provides for not be more than one dollar ($1) for each page of the first 25 pages, not more than 50 cents ($.50) for each page in excess of 25 pages. If the medical records mailed to the person making the request, reasonable costs shall include the actual costs of mailing the medical records. A person may charge in addition to the fees allowed the actual cost of reproducing X-rays and other special medical records.) 
• Physicians charging for the cost of reproduction of medical records should give primary consideration to the ethical and professional duties owed to other physicians and their patients and waive copying charges when appropriate.

Retention

Records must be retained for at least seven years from the physician’s (and/or other providers within the practice) last professional contact with the patient. 

Exceptions:

• Immunization records not transmitted to the state board of health immunization registry:  retain for at least two years after the minor reaches the age of majority or seven years from the date of the physician’s (and/or other providers within the practice) last professional contact with the patient, whichever is longer
• X-rays, radiographs, and other imaging products shall be retained for at least five (5) years after which if there exist separate interpretive records thereof, they may be destroyed.  However, mammography imaging and reports shall be maintained for ten (10) years.
• Medical records of minors shall be retained for a period of not less than two (2) years after the minor reaches the age of majority or seven (7) years from the date of the physician’s (and/or other providers within his or her practice) last professional contact with the patient, whichever is longer.

No medical record involving services which are under dispute shall be destroyed until the dispute is resolved, as long as the physician has formal notice of the dispute prior to the expiration of the retention requirement.

Destruction

• No medical record may be singled out for destruction other than in the ordinary course of established office procedures
• Records may be destroyed by burning, shredding, permanently deleting, or other effective methods in keeping with their confidential nature
• When records are destroyed, the time, date, and circumstances of the destruction must be recorded and maintained for at least four years.  The record does not need to list the individual records but should be detailed enough to identify which group of destroyed records contained a particular patient’s records.

Disposition

• Minimum Requirements for Patient Notification
• Disposition upon Physician's Death
• Disposition upon Physician's Retirement
• Disposition upon Physician's License Suspension or Revocation
• Disposition upon Physician's Departure from a Group
• Sale of a Medical Practice
• Disposition when Physician is Unavailable
• Telemedicine Records

Minimum Requirements for Patient Notification

Active patients must be notified at their last known addresss or via a HIPAA compliant EHR system upon a physician’s retirement, death, license suspension or revocation, or departure from a practice group. 

The minimum required notification must:

• Identify the physician who treated the patient
• Provide a general reason for the patient to be notified
• Provide an explanation how to obtain medical records
• Provide a HIPAA authorization for the patient to complete
• State how long the records will be made available to the patient
• State the intended disposition of the records if no instructions are received within the time provided.

Disposition upon Physician’s Death

• Notification to all active patients must be sent by the practice (if in a group) within 30 days following the physician’s death.
• If not in a group the notice should be sent by the personal representative of the physician’s estate within 30 days of appointment.
• Notification should contain a HIPAA compliant form to authorize transfer and clear directions for submission of the form.
• The party sending the notice bears the costs of notifying the physician’s patients.
• Physicians in solo practice should include compliance with these rules as part of his or her estate planning.
• The personal representative should take steps for all medical records to be transferred either to another physician or to a HIPAA-compliant entity to act as custodian and for records to be maintained for the required retention periods and made available for transfer to active patients, and finally to dispose of or destroy the records.

Disposition upon Physician’s Retirement

• It is the solo practitioner’s or the group practice’s responsibility to send notifications to active patients at least 30 days prior to retirement. 
• Reasonable steps must be taken to transfer records to active patients, another physician, or a HIPAA- compliant entity.
• Patient notification must contain a HIPAA-compliant form to authorize records to be sent to a new physician, the patient, or the  patient’s representative, and directions for submission of the form.

Disposition upon Physician’s License Suspension or Revocation

• The physician or his or her practice must send notification of the suspension or revocation within 30 days to all active patients.
• The cost of notification is borne by the physician whose license is suspended or revoked.
• The physician must take all reasonable steps to transfer records to active patients, another physician or physician practice group, or to a HIPAA-compliant entity that agrees to act as custodian.
• The notification must contain a HIPAA-compliant form for the patient’s use to authorize the transfer of records and clear directions.

Disposition upon Physician’s Departure from a Group

• The physician’s employment contract dictates the responsibility for patient notification, records reproduction/transfer, and the associated costs; if there is no contractual provision pertaining to medical records upon departure, and the group does not elect to notify the patients, then the departing physician is responsible.
• When the departing physician is responsible for the notification, the practice must provide the physician a list of the active patients and their last known mailing address and contact information.
• The departing physician’s active patients must be notified of the physician’s new address and offered the opportunity to have their records transferred to the new practice.
• A group may not withhold the medical records of a patient who has authorized their transfer; the patient’s freedom of choice of physicians may not be interfered with and must be left to the patient.

Sale of a Medical Practice

• The selling physician or group must take steps to transfer all medical records to another physician, covered entity, or business associate where they will be retained in compliance with Board and Commission rules.
• When patient records are included in the sale, the selling physician or group must notify all active patients within 30 days of the transfer that the practice is transferring and will retain custody of their records but will transfer them at the patient’s request.

Disposition when Physician is Unavailable

When a physician goes on vacation, takes a sabbatical, takes a leave of absence, leaves the United States, or is otherwise voluntarily unavailable to patients, the physician must arrange to provide patients with access to their medical records.

Telemedicine Records

• Physicians who practice medicine via telemedicine have the same duty as all other physicians to adhere to these rules.
• Physicians practicing telemedicine must retain access to the medical records which document their delivery of health care services via telemedicine.
• It is a violation of Board and Commission rules if a physician is unable to access and produce medical records documenting the practice of medicine via telemedicine.

Minimum Standards for Medical Records

Every physician licensed to practice medicine in Alabama must maintain for each patient a record which, in order to meet the minimum standards for medical records, shall:

• Be legible and written in the English language.
• Contain only those terms and abbreviations that are or should be comprehenible to other medical professionals.
• Contain adequate identification of the patient.
• Indicate the date any professional service was provided.
• Contain pertinent information concerning the patient’s condition.
• Reflect examinations, vital signs, and tests obtained, performed, or ordered and the findings or results of each. 
• Indicate the initial diagnosis and the patient’s initial reason for seeking the physician’s services. 
• Indicate the medications prescribed, dispensed, or administered and the quantity and strength of each
• Reflect the treatment performed or recommended; document the patient’s progress during the course of treatment. 
• Include all patient records received from other health care providers, if those records formed the basis for a treatment decision by the physician.

FAQ - Medical Records

What if my practice uses EHRs (electronic health records)?  

---

Do I include copies of records from prior treatment providers?  

---

What obligation does a third-party, such as a landlord, building owner, decedent’s estate, or business entity, have to retain patients’ medical records if the physician dies or is no longer licensed to practice medicine or osteopathy?   

---