March 25, 2019
By: Susan E. Ziel and Stacy Walton Long
The Indiana Administrative Code, specifically 844 IAC, Article 5, establishes certain professional standards for physicians licensed in the State of Indiana. One particular section, 844 IAC 5-2-16, sets forth requirements governing the discontinuation of a physician’s practice due to retirement or upon moving from a community. Although these events may often cause a physician to enter into a business transaction to transfer the ownership of the practice assets to another healthcare entity, the physician may otherwise decide to discontinue the practice altogether, for which these Article 5 requirements would apply.
An essential part of any closing of a physician’s practice is to notify all active patients of the pending events and to offer these patients the opportunity to transfer their medical records to another physician or another healthcare entity of the patient’s choice. In many cases, the physician may still be required to retain certain patient records after the practice has been closed, for which the physician remains responsible and must make reasonable arrangements. These reasonable arrangements typically involve the transfer of records to another physician or other qualified entity. 844 IAC 5-2-6 (a)-(d). In all cases, any such transfer must be conducted in accordance with all applicable requirements that govern these medical records.
First and foremost, HIPAA1 requires the physician to identify a qualified HIPAA covered entity or business associate that is capable of managing the medical records on behalf of the physician under the terms of a written “record custodian agreement.” The typical terms of these agreements include the following:
- Compliance with applicable laws and regulations that govern, including HIPAA, and other applicable state laws governing the privacy and security of other “personal information”2 included in the medical records;
- An accurate and complete list of all medical records that are transferred to the record custodian and which remain the subject of the arrangement for the term of the agreement;
- A detailed description of the specific services to be performed by the record custodian in order to safeguard the privacy and security of the medical records and in responding to patient and other third party requests for records that may arise during the agreement’s term;
- A compensation schedule that sets out payment arrangements and up-to-date contact information for the parties;
- The defined term of the agreement, which must comply, at a minimum, with the records retention requirements governing the physician under applicable state laws. In the case of the medical records themselves, Indiana’s health record laws apply and require retention for a minimum of seven years;3 and
- A HIPAA-compliant Business Associate Agreement that is executed by the physician and the record custodian and attached as an essential part of the agreement.
As evidenced by these requirements, any Indiana physician who decides to discontinue his or her practice and to transfer medical records to another physician or another qualified healthcare entity must do so in accordance with these requirements. To do otherwise leaves the physician at risk of a possible complaint or investigation that could result in an enforcement action under HIPAA4, or a possible “abandoned records” action brought by Indiana’s Office of the Attorney General.5
Please contact Susan E. Ziel at sziel@ihsconsultinggroup.com or Stacy Walton Long at slong@kdlegal.com for guidance regarding these matters or assistance in the drafting of a record custodian arrangement to cover these medical record arrangements.
[1] Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act and related Privacy and Security regulations (collectively, HIPAA”).
[2] Ind. Code § 24-4-14-1, et seq.; Ind. Code § 24-4.9-1, et seq.
[3] Ind. Code § 16-39-7-1(a)(b).
[4] 45 CFR part 160.
[5] https://www.in.gov/attorneygeneral/2808.htm.
Industries
March 25, 2019
By: Susan E. Ziel and Stacy Walton Long
The Indiana Administrative Code, specifically 844 IAC, Article 5, establishes certain professional standards for physicians licensed in the State of Indiana. One particular section, 844 IAC 5-2-16, sets forth requirements governing the discontinuation of a physician’s practice due to retirement or upon moving from a community. Although these events may often cause a physician to enter into a business transaction to transfer the ownership of the practice assets to another healthcare entity, the physician may otherwise decide to discontinue the practice altogether, for which these Article 5 requirements would apply.
An essential part of any closing of a physician’s practice is to notify all active patients of the pending events and to offer these patients the opportunity to transfer their medical records to another physician or another healthcare entity of the patient’s choice. In many cases, the physician may still be required to retain certain patient records after the practice has been closed, for which the physician remains responsible and must make reasonable arrangements. These reasonable arrangements typically involve the transfer of records to another physician or other qualified entity. 844 IAC 5-2-6 (a)-(d). In all cases, any such transfer must be conducted in accordance with all applicable requirements that govern these medical records.
First and foremost, HIPAA1 requires the physician to identify a qualified HIPAA covered entity or business associate that is capable of managing the medical records on behalf of the physician under the terms of a written “record custodian agreement.” The typical terms of these agreements include the following:
- Compliance with applicable laws and regulations that govern, including HIPAA, and other applicable state laws governing the privacy and security of other “personal information”2 included in the medical records;
- An accurate and complete list of all medical records that are transferred to the record custodian and which remain the subject of the arrangement for the term of the agreement;
- A detailed description of the specific services to be performed by the record custodian in order to safeguard the privacy and security of the medical records and in responding to patient and other third party requests for records that may arise during the agreement’s term;
- A compensation schedule that sets out payment arrangements and up-to-date contact information for the parties;
- The defined term of the agreement, which must comply, at a minimum, with the records retention requirements governing the physician under applicable state laws. In the case of the medical records themselves, Indiana’s health record laws apply and require retention for a minimum of seven years;3 and
- A HIPAA-compliant Business Associate Agreement that is executed by the physician and the record custodian and attached as an essential part of the agreement.
As evidenced by these requirements, any Indiana physician who decides to discontinue his or her practice and to transfer medical records to another physician or another qualified healthcare entity must do so in accordance with these requirements. To do otherwise leaves the physician at risk of a possible complaint or investigation that could result in an enforcement action under HIPAA4, or a possible “abandoned records” action brought by Indiana’s Office of the Attorney General.5
Please contact Susan E. Ziel at sziel@ihsconsultinggroup.com or Stacy Walton Long at slong@kdlegal.com for guidance regarding these matters or assistance in the drafting of a record custodian arrangement to cover these medical record arrangements.
[1] Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act and related Privacy and Security regulations (collectively, HIPAA”).
[2] Ind. Code § 24-4-14-1, et seq.; Ind. Code § 24-4.9-1, et seq.