CMS Record Retention & Privacy Guidelines
State laws generally govern how long medical records are to be retained.
However, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 administrative simplification rules require a covered entity, such as a physician billing Medicare, to retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. HIPAA requirements preempt State laws if they require shorter periods. Your State may require a longer retention period.
The Centers for Medicare & Medicaid Services (CMS) requires records of providers submitting cost reports to be retained in their original or legally reproduced form for a period of at least 5 years after the closure of the cost report. This requirement applies to hospitals and not physician practices.
CMS requires Medicare managed care program providers to retain records for 10 years.
Privacy must be maintained even after record retention timelines have expired. While the HIPAA Privacy Rule does not include medical record retention requirements, it does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal.
Additional information:
- Providers/suppliers should maintain a medical record for each Medicare beneficiary that is their patient.
- Medical records must be accurately written, promptly completed, accessible, properly filed and retained.
- Using a system of author identification and record maintenance that ensures the integrity of the authentication and protects the security of all record entries is a good practice.
- The Medicare program does not have requirements for the media formats for medical records. However, the medical record needs to be in its original form or in a legally reproduced form, which may be electronic, so that medical records may be reviewed and audited by authorized entities.
- Providers must have a medical record system that ensures that the record may be accessed and retrieved promptly.
Providers may want to obtain legal advice concerning record retention after CMS-required time periodshave been met.
CMS Issues Fact Sheets on Meaningful Use Provisions for EHR
The Centers for Medicare & Medicaid Services has issued three fact sheets related to the final rule to implement provisions of the American Recovery and Reinvestment Act of 2009 that provide incentive payments for the meaningful use of certified electronic health records (EHR) technology. The Medicare EHR incentive program will provide incentive payments to:
- Eligible professionals, eligible hospitals, and critical access hospitals that are meaningful users of certified EHR technology
- Eligible professionals and hospitals for efforts to adopt, implement, upgrade, or demonstrate meaningful use the technology
The fact sheets summarize:
- CMS’s final definition of meaningful use
- Requirements for the Medicare EHR incentive program
- Provisions in the final rule that affect state Medicaid programs and Medicaid providers
Medically Directed Anesthesia Guidelines Changed
Keep a close eye on your anesthesiologists’ documentation if they are medically directing a CRNA or AA (anesthesiologist assistant). CMS has once again adjusted the rules for medical direction – this time to allow your anesthesiologists a little more leeway to move around the hospital while they are involved in anesthesia cases.
New changes to the Interpretive Guidelines for the Anesthesia Services Condition of Participation (CoP) were released in a May 21 transmittal from CMS that provide further clarifications in two areas of concern. The latest changes refine the changes made earlier this year (see APCPS, 3/10).
Immediately available. In its latest tweak to the definition of when an anesthesiologist is considered “immediately available,” CMS now defines the term as “physically located within the same area as the CRNA, e.g., in the same operative/procedural suite, or in the same labor and delivery unit, and not otherwise occupied in a way that prevents him/her from immediately conducting hands-on intervention, if needed.” Previous language restricted the anesthesiologist to the same procedural room rather than suite. This small wording change allows the anesthesiologist a bit more freedom of movement while medically directing multiple cases.
Post-anesthesia evaluations. Previous language in the CoP required the anesthesia provider’s documentation be completed before the patient is discharged from the hospital. CMS deleted the requirement that “for outpatients, the post-anesthesia evaluation must be completed prior to discharge.” The deletion means that, while the post-anesthesia evaluation still has to be performed within 48 hours of the completion of surgery, there is no requirement that the anesthesiologist complete the evaluation form before the patient is discharged.
Comments and assistance from ASA
The American Society of Anesthesiologists (ASA) notes that CMS should be issuing further clarifications to the Interpretive Guidelines in the future. The recent changes were minor clarifications and ASA states it is working with CMS to further clarify responsibilities and guidelines for anesthesiologists in a hospital setting. In response to the ongoing changes from CMS, the ASA has created documentation checklists to help practices ensure they are complying with the new clarifications, including:
A pre-anesthesia evaluation policy and note provides information detailing what must be included in the pre-anesthesia evaluation, such as:
- review of the medical history, including anesthesia, drug and allergy history;
- interview and examination of the patient;
- notation of anesthesia risk according to established standards of practice (e.g., ASA classification of risk);
- identification of potential anesthesia problems, particularly those that may suggest potential complications or contraindications to the planned procedure; and
- the timing of a qualified pre-anesthesia evaluation.
A post-anesthesia evaluation policy and note provides assessment of stability or satisfactory control of:
- respiratory function (respiratory rate, airway patency, oxygen saturation);
- cardiovascular function (pulse rate, blood pressure, hydration status);
- temperature;
- mental status – patient participates in the evaluation;
- pain; and
- nausea and vomiting.
An intra-operative anesthesia record policy includes a checklist of information that must be included on the anesthesia record, such as:
- name and hospital identification number of the patient;
- name(s) of practitioner who administered anesthesia, and as applicable, the name and profession of the supervising anesthesiologist or operating practitioner;
- name, dosage, route and time of administration of drugs and anesthesia agents;
- technique(s) used and patient position(s), including the insertion/use of any intravascular or airway devices;
- name and amounts of IV fluids, including blood or blood products if applicable;
- timed-based documentation of vital signs as well as oxygenation and ventilation parameters;
- any complications, adverse reactions or problems occurring during anesthesia (including time and description of symptoms, vital signs, treatments rendered); and
- patient’s response to treatment.


