Medical Records

Question: Because of a particularly busy day, you started but could not complete charting for a patient whom you saw at 4 p.m. The patient had complained of chest pain, but the EKG was normal. You had to leave for a hospital emergency and were further delayed by a traffic accident. You later discovered that your 4 p.m. patient had collapsed from a myocardial infarct after he left your office. It is now 11 p.m., you have not had dinner, and you are very tired and mildly disoriented. Which of the following is best?

A. You must complete the record at 11 p.m. before going home.

B. Wait until the next day and continue writing as though you were not interrupted.

C. Write "incomplete" and leave the note as is.

D. Complete the note the next day with an explanation of the interruptions, date and time both notes, and document the normal EKG.

E. Medical records are kept for the convenience of the doctor. One should spend more time taking care of the patient and less time taking care of the records.

Answer: D. All medical entries should be made contemporaneously and it is a bad idea to put off charting to another day, as clinical impressions may be forgotten or inaccurately recalled, and new events have a habit of overtaking the busy doctor. However, fatigue can lead to errors, so it may be better to defer writing anything if circumstances so dictate.

The hypothetical case above appears to fit this picture. A late or separate entry should bear the actual date and time it was written, and not any other. Charting is particularly critical when there is any hint of a potential malpractice complaint. Note that this case concerns a patient who may have developed a myocardial infarct that was "missed" in the doctor’s clinic. In his defense, the doctor did obtain a normal EKG that may or may not be enough, depending on the clinical presentation and the patient’s risk for a coronary event. If a suit is filed at a later date, the documentation of a normal EKG can serve as exculpatory evidence.

Anything arising out of the doctor-patient encounter can constitute part of the patient’s medical record. This includes items like handwritten, typed, or electronic clinical notes; notes recorded from telephone conversations; all correspondence including letters to and from other health care professionals, insurers, patients, family, and others; laboratory reports; radiographs and other imaging records; electrocardiograms and printouts from monitoring equipment; audiovisuals; and other computerized/electronic records, including e-mail messages. This last category is assuming increasing importance as a favored mode of communication, and carries with it special medicolegal risks.

The medical record is of extreme importance in litigation, which typically takes place many months or years after the incident when memories regarding what was said or done may have faded. Furthermore, what was not documented can be legally construed to mean that it was not done. There are statutory requirements in each state that stipulate how long medical records are to be kept, for example, at least 7 years in Hawaii.

A subpoena is nothing more than a legal request. A subpoena to produce documents including medical records is termed a subpoena duces tecum. A court order (sometimes incorrectly called a court-ordered subpoena), that is, one signed by a judge, to produce clinical records must be complied with or the practitioner risks being found in contempt of court. However, not all subpoenas are the same. One that originates from a lawyer’s office, even if it appears official and is signed by the clerk of the court, does not have the same force of law.

A doctor may challenge a subpoena that lacks a patient’s authorization, but the doctor should not simply ignore it. Refusal to produce may force the attorney to obtain a court order, at which time the practitioner is legally obligated to produce the records. Indiscriminate release of records can lead to violation of patient confidentiality, and a New Jersey appellate court has ruled against a physician for disclosing medical records in response to an improper subpoena without prior patient authorization. A good rule of thumb is to always insist on obtaining a patient’s signed consent before releasing any information to anyone.

How HIPAA Affects Medical Records

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), which went into effect in April 2003, is a set of comprehensive federal laws that governs all aspects of a patient’s protected health information (PHI). The Act, a weighty document, attempts to strike a balance between the rights of patients to privacy to their health information and the smooth and efficient delivery of health care. HIPAA overrides state statutes that are less protective of patient access and privacy, but stricter state requirements continue to have priority. States have enacted their own statutes relating to medical records, and it is therefore necessary for physicians to consult their state statutes to ensure full compliance with the law.

The intent of HIPAA is to inform consumers how their health information is being used as we embrace the electronic computer age. The emphasis is on preserving privacy of PHI and ensuring security of electronic transmission of such data. In practice, this means informing all patients, via postings in the office or hospital, direct mailings, brochures, etc., of the conditions under which the contents of their records will be shared with others, and the procedures in place to safeguard improper disclosures.

HIPAA creates criminal and civil penalties for the improper use or disclosure of PHI by covered entities. Business associates, like covered entities, are now also subject to HIPAA rules under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which is a part of the American Recovery and Reinvestment Act of 2009. Fines start at $100 for each violation. Criminal penalties are severe for knowing and wrongful disclosures, with fines up to $50,000 and up to a year in prison.

If the violation is committed under false pretenses, the penalty can reach $100,000 and 5 years in prison. Where the disclosure is coupled with the intent to sell or to use for commercial advantage or personal gain, the punishment reaches $250,000 and up to 10 years in prison. Recent changes in HIPAA rules include an increase of the maximum civil penalty to $1.5 million.

HIPAA does not create a private right of action, that is, only the government, not private individuals, can prosecute a violation. However, HIPAA can serve to set the standard governing privacy of health information, and it has been used as evidence to support a case of emotional distress that allegedly resulted from the improper disclosure of records.

Dr. Tan is a former professor of medicine and adjunct professor of law at the University of Hawaii. This article is meant to be educational and does not constitute medical, ethical or legal advice. It is adapted from the author’s book, "Medical Malpractice: Understanding the Law, Managing the Risk" (2006). For additional information, readers may contact the author at [email protected].

This column, “Law & Medicine,” appears regularly in Internal Medicine News, a publication of Elsevier.

Question: Because of a particularly busy day, you started but could not complete charting for a patient whom you saw at 4 p.m. The patient had complained of chest pain, but the EKG was normal. You had to leave for a hospital emergency and were further delayed by a traffic accident. You later discovered that your 4 p.m. patient had collapsed from a myocardial infarct after he left your office. It is now 11 p.m., you have not had dinner, and you are very tired and mildly disoriented. Which of the following is best?

A. You must complete the record at 11 p.m. before going home.

B. Wait until the next day and continue writing as though you were not interrupted.

C. Write "incomplete" and leave the note as is.

D. Complete the note the next day with an explanation of the interruptions, date and time both notes, and document the normal EKG.

E. Medical records are kept for the convenience of the doctor. One should spend more time taking care of the patient and less time taking care of the records.

Answer: D. All medical entries should be made contemporaneously and it is a bad idea to put off charting to another day, as clinical impressions may be forgotten or inaccurately recalled, and new events have a habit of overtaking the busy doctor. However, fatigue can lead to errors, so it may be better to defer writing anything if circumstances so dictate.

The hypothetical case above appears to fit this picture. A late or separate entry should bear the actual date and time it was written, and not any other. Charting is particularly critical when there is any hint of a potential malpractice complaint. Note that this case concerns a patient who may have developed a myocardial infarct that was "missed" in the doctor’s clinic. In his defense, the doctor did obtain a normal EKG that may or may not be enough, depending on the clinical presentation and the patient’s risk for a coronary event. If a suit is filed at a later date, the documentation of a normal EKG can serve as exculpatory evidence.

Anything arising out of the doctor-patient encounter can constitute part of the patient’s medical record. This includes items like handwritten, typed, or electronic clinical notes; notes recorded from telephone conversations; all correspondence including letters to and from other health care professionals, insurers, patients, family, and others; laboratory reports; radiographs and other imaging records; electrocardiograms and printouts from monitoring equipment; audiovisuals; and other computerized/electronic records, including e-mail messages. This last category is assuming increasing importance as a favored mode of communication, and carries with it special medicolegal risks.

The medical record is of extreme importance in litigation, which typically takes place many months or years after the incident when memories regarding what was said or done may have faded. Furthermore, what was not documented can be legally construed to mean that it was not done. There are statutory requirements in each state that stipulate how long medical records are to be kept, for example, at least 7 years in Hawaii.

A subpoena is nothing more than a legal request. A subpoena to produce documents including medical records is termed a subpoena duces tecum. A court order (sometimes incorrectly called a court-ordered subpoena), that is, one signed by a judge, to produce clinical records must be complied with or the practitioner risks being found in contempt of court. However, not all subpoenas are the same. One that originates from a lawyer’s office, even if it appears official and is signed by the clerk of the court, does not have the same force of law.

A doctor may challenge a subpoena that lacks a patient’s authorization, but the doctor should not simply ignore it. Refusal to produce may force the attorney to obtain a court order, at which time the practitioner is legally obligated to produce the records. Indiscriminate release of records can lead to violation of patient confidentiality, and a New Jersey appellate court has ruled against a physician for disclosing medical records in response to an improper subpoena without prior patient authorization. A good rule of thumb is to always insist on obtaining a patient’s signed consent before releasing any information to anyone.

How HIPAA Affects Medical Records

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), which went into effect in April 2003, is a set of comprehensive federal laws that governs all aspects of a patient’s protected health information (PHI). The Act, a weighty document, attempts to strike a balance between the rights of patients to privacy to their health information and the smooth and efficient delivery of health care. HIPAA overrides state statutes that are less protective of patient access and privacy, but stricter state requirements continue to have priority. States have enacted their own statutes relating to medical records, and it is therefore necessary for physicians to consult their state statutes to ensure full compliance with the law.

The intent of HIPAA is to inform consumers how their health information is being used as we embrace the electronic computer age. The emphasis is on preserving privacy of PHI and ensuring security of electronic transmission of such data. In practice, this means informing all patients, via postings in the office or hospital, direct mailings, brochures, etc., of the conditions under which the contents of their records will be shared with others, and the procedures in place to safeguard improper disclosures.

HIPAA creates criminal and civil penalties for the improper use or disclosure of PHI by covered entities. Business associates, like covered entities, are now also subject to HIPAA rules under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which is a part of the American Recovery and Reinvestment Act of 2009. Fines start at $100 for each violation. Criminal penalties are severe for knowing and wrongful disclosures, with fines up to $50,000 and up to a year in prison.

If the violation is committed under false pretenses, the penalty can reach $100,000 and 5 years in prison. Where the disclosure is coupled with the intent to sell or to use for commercial advantage or personal gain, the punishment reaches $250,000 and up to 10 years in prison. Recent changes in HIPAA rules include an increase of the maximum civil penalty to $1.5 million.

HIPAA does not create a private right of action, that is, only the government, not private individuals, can prosecute a violation. However, HIPAA can serve to set the standard governing privacy of health information, and it has been used as evidence to support a case of emotional distress that allegedly resulted from the improper disclosure of records.

Dr. Tan is a former professor of medicine and adjunct professor of law at the University of Hawaii. This article is meant to be educational and does not constitute medical, ethical or legal advice. It is adapted from the author’s book, "Medical Malpractice: Understanding the Law, Managing the Risk" (2006). For additional information, readers may contact the author at [email protected].

This column, “Law & Medicine,” appears regularly in Internal Medicine News, a publication of Elsevier.

Question: Because of a particularly busy day, you started but could not complete charting for a patient whom you saw at 4 p.m. The patient had complained of chest pain, but the EKG was normal. You had to leave for a hospital emergency and were further delayed by a traffic accident. You later discovered that your 4 p.m. patient had collapsed from a myocardial infarct after he left your office. It is now 11 p.m., you have not had dinner, and you are very tired and mildly disoriented. Which of the following is best?

A. You must complete the record at 11 p.m. before going home.

B. Wait until the next day and continue writing as though you were not interrupted.

C. Write "incomplete" and leave the note as is.

D. Complete the note the next day with an explanation of the interruptions, date and time both notes, and document the normal EKG.

E. Medical records are kept for the convenience of the doctor. One should spend more time taking care of the patient and less time taking care of the records.

Answer: D. All medical entries should be made contemporaneously and it is a bad idea to put off charting to another day, as clinical impressions may be forgotten or inaccurately recalled, and new events have a habit of overtaking the busy doctor. However, fatigue can lead to errors, so it may be better to defer writing anything if circumstances so dictate.

The hypothetical case above appears to fit this picture. A late or separate entry should bear the actual date and time it was written, and not any other. Charting is particularly critical when there is any hint of a potential malpractice complaint. Note that this case concerns a patient who may have developed a myocardial infarct that was "missed" in the doctor’s clinic. In his defense, the doctor did obtain a normal EKG that may or may not be enough, depending on the clinical presentation and the patient’s risk for a coronary event. If a suit is filed at a later date, the documentation of a normal EKG can serve as exculpatory evidence.

Anything arising out of the doctor-patient encounter can constitute part of the patient’s medical record. This includes items like handwritten, typed, or electronic clinical notes; notes recorded from telephone conversations; all correspondence including letters to and from other health care professionals, insurers, patients, family, and others; laboratory reports; radiographs and other imaging records; electrocardiograms and printouts from monitoring equipment; audiovisuals; and other computerized/electronic records, including e-mail messages. This last category is assuming increasing importance as a favored mode of communication, and carries with it special medicolegal risks.

The medical record is of extreme importance in litigation, which typically takes place many months or years after the incident when memories regarding what was said or done may have faded. Furthermore, what was not documented can be legally construed to mean that it was not done. There are statutory requirements in each state that stipulate how long medical records are to be kept, for example, at least 7 years in Hawaii.

A subpoena is nothing more than a legal request. A subpoena to produce documents including medical records is termed a subpoena duces tecum. A court order (sometimes incorrectly called a court-ordered subpoena), that is, one signed by a judge, to produce clinical records must be complied with or the practitioner risks being found in contempt of court. However, not all subpoenas are the same. One that originates from a lawyer’s office, even if it appears official and is signed by the clerk of the court, does not have the same force of law.

A doctor may challenge a subpoena that lacks a patient’s authorization, but the doctor should not simply ignore it. Refusal to produce may force the attorney to obtain a court order, at which time the practitioner is legally obligated to produce the records. Indiscriminate release of records can lead to violation of patient confidentiality, and a New Jersey appellate court has ruled against a physician for disclosing medical records in response to an improper subpoena without prior patient authorization. A good rule of thumb is to always insist on obtaining a patient’s signed consent before releasing any information to anyone.

How HIPAA Affects Medical Records

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), which went into effect in April 2003, is a set of comprehensive federal laws that governs all aspects of a patient’s protected health information (PHI). The Act, a weighty document, attempts to strike a balance between the rights of patients to privacy to their health information and the smooth and efficient delivery of health care. HIPAA overrides state statutes that are less protective of patient access and privacy, but stricter state requirements continue to have priority. States have enacted their own statutes relating to medical records, and it is therefore necessary for physicians to consult their state statutes to ensure full compliance with the law.

The intent of HIPAA is to inform consumers how their health information is being used as we embrace the electronic computer age. The emphasis is on preserving privacy of PHI and ensuring security of electronic transmission of such data. In practice, this means informing all patients, via postings in the office or hospital, direct mailings, brochures, etc., of the conditions under which the contents of their records will be shared with others, and the procedures in place to safeguard improper disclosures.

HIPAA creates criminal and civil penalties for the improper use or disclosure of PHI by covered entities. Business associates, like covered entities, are now also subject to HIPAA rules under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which is a part of the American Recovery and Reinvestment Act of 2009. Fines start at $100 for each violation. Criminal penalties are severe for knowing and wrongful disclosures, with fines up to $50,000 and up to a year in prison.

If the violation is committed under false pretenses, the penalty can reach $100,000 and 5 years in prison. Where the disclosure is coupled with the intent to sell or to use for commercial advantage or personal gain, the punishment reaches $250,000 and up to 10 years in prison. Recent changes in HIPAA rules include an increase of the maximum civil penalty to $1.5 million.

HIPAA does not create a private right of action, that is, only the government, not private individuals, can prosecute a violation. However, HIPAA can serve to set the standard governing privacy of health information, and it has been used as evidence to support a case of emotional distress that allegedly resulted from the improper disclosure of records.

Dr. Tan is a former professor of medicine and adjunct professor of law at the University of Hawaii. This article is meant to be educational and does not constitute medical, ethical or legal advice. It is adapted from the author’s book, "Medical Malpractice: Understanding the Law, Managing the Risk" (2006). For additional information, readers may contact the author at [email protected].

This column, “Law & Medicine,” appears regularly in Internal Medicine News, a publication of Elsevier.