Policy needed to manage electronic, paper documents
■ A column examining the ins and outs of contract issues
By Steven M. Harris — is a partner at McDonald Hopkins in Chicago concentrating on health care law and co-author of Medical Practice Divorce. He writes the "Contract Language" column. Posted Feb. 5, 2007.
- WITH THIS STORY:
- » Related content
Don't delete your e-mails so quickly: New electronic discovery provisions of the Federal Rules of Civil Procedure descended on physicians and others who run businesses on Dec. 1, 2006.
These new rules impose a duty on physicians who find themselves as litigants to produce "electronically stored information." That includes everything from e-mail and voice mail to computer networks and databases. Essentially, the new rules -- which technically govern rules in federal cases but are often quickly adopted by state courts -- elevate electronic information to the same status and importance as paper.
However, the rules leave a lot of questions unanswered when it comes to what should be held, for how long, and how accessible old information should be. So in order to avoid sanctions for failure to comply with these discovery requests, physicians have no choice but to develop a document retention policy.
With a document retention policy in place, covering both digital and paper information, physicians can continue to destroy unneeded or certain older information without having to worry about getting in trouble.
A document retention policy requires physicians and their medical practices to systematically review, retain, and destroy records and information received or created in the ordinary course of business.
A document retention policy should identify documents and their sources that need to be maintained and outline guidelines for how long specific categories of those documents should be retained. The policy also should state how documents should be destroyed (the "retention and destruction schedule").
The policy should include presumptive limits, based on time or quantity, on the retention of e-mail and other communications and also communications policies that promote the appropriate use of company systems.
Specifically, the policy should discourage the creation of inappropriate e-mails and instant messages. The policy should also incorporate practices and customs tailored to the needs of the medical practice.
While physicians are not required to retain original documents, copies of the following documents should be included in the document retention policy and set forth in the retention and destruction schedule:
Employment records. Employee files, including job applications, payroll records, employee timesheets, performance reviews and any complaints, should be maintained for the length of the employee's tenure with the medical practice, plus at least another three years after the employee leaves.
Accounting and tax records. Tax documents include tax returns, payroll expenses, proof of deductions, business costs, accounting procedures, gross receipts and expense receipts. Whether personal or business, the general rule is keeping records for at least six years from the date of filing the applicable return. Excluding the numerous exceptions for fraud and willful failure to file a tax return, the Internal Revenue Service has three years to audit the medical practice or individual physician, starting from the date the return is filed.
Medical records. Physicians are obligated to keep medical records that are of reasonable value to patients -- including charts, x-rays and medical correspondence. Each state has regulations requiring physicians to retain medical records for a certain number of years, typically seven years, or two years after a minor reaches adulthood.
HIPAA requires physicians to retain patient records and documents related to use and disclosure of protected health information for a minimum of six years. Records covered by government programs should be kept for 10 years.
Physicians might also consider keeping medical records as long as their state's statute of limitations for medical liability suits.
Legal records. Legal documents include annual financial reports, underlying schedules, contracts, leases, insurance policies, land records, deeds, mortgages, promissory notes, intellectual property documents and warranty documents. These generally should be retained for 10 years. However, any document with an expiration date should be kept for the life of the document, plus three additional years.
Electronic records. Electronic documents include databases, networks, computer systems (including legacy systems -- that is, systems you don't use anymore), servers, archives, backup or disaster recovery systems, tapes, disks, drives, cartridges, other storage media, laptops, cell phones, personal computers, Internet data (including e-mails and Web pages), and personal digital assistants. Electronic documents also require medical practices to determine the recycle time applicable for backup tapes based on disaster recovery needs.
A reasonable time period, such as two years, should be chosen for deleting electronic records. Additionally, the document retention policy should specify precisely how, when, and by whom, data is to be deleted.
Medical groups should also consider limiting or mapping dissemination of electronic documents by creating policies regarding forwarding e-mail, copying information onto disks, printing information, and saving to hard drives.
Publishing the policy
The medical practice should publish and distribute the document retention policy, and any retention and destruction schedule, to all of the physicians and employees. At the time of distribution and explanation regarding the policy, employees should be required to sign forms acknowledging the policy and certifying compliance.
Each of the physicians and employees should then receive annual training on the document retention policy, as well as training on how to manage and retain business records created or received in the ordinary course of business.
This training should emphasize the importance of preserving electronic and other records in the case of anticipated or threatened litigation, and when and how employees should carry out their responsibilities.
It is critical that in the event the medical practice has knowledge of a pending or probable lawsuit or investigation, the medical practice immediately and quickly identify any related documents and information, mark the documents as such, and exclude them from the time frame set forth in the document retention plan until the investigation or lawsuit ceases.
This "litigation hold" must be implemented to retain documents the physician reasonably believes are discoverable in anticipated litigation. The hold should override automatic destruction systems, such as routine elimination of e-mail and rotation of backup tapes, if necessary.
Whatever steps are taken, the medical practice should document these efforts in case it has to explain its actions later to the court.
Records activities should be routinely audited, and the document retention policy should be periodically reviewed to ensure that it addresses current changes in the law or necessities of the medical practice.
At a minimum, the document retention policy should be consistently practiced, actively enforced, documented and audited.
If a medical practice's policy is comprehensive and routinely audited, it will provide the court with assurance that the medical practice has all of the documents it is required to keep and that the medical practice knows how to find them. Physicians might be surprised how far this can go in protecting them and their practice.
Steven M. Harris is a partner at McDonald Hopkins in Chicago concentrating on health care law and co-author of Medical Practice Divorce. He writes the "Contract Language" column.