
It amazes us how many healthcare facilities don’t always store records appropriately. Check that. People don’t store records properly.
Just this week, I was in a colleague’s office. Literally, it looked like Staples puked up aisle 3. I asked her what everything was, because you couldn’t make heads or tails of any of it. She explained that it was patient records that she didn’t know what to do with.
I asked her, “Well, what does the process say to do?”
“Process?” she said. Nice girl, means well, greener than a pepper tree.
After helping her re-organize everything, I was motivated to put together some ideas to help others in her situation. Here are some record retention best practices in the event you have hoarded up some claptrap and now have to figure out what to do with it.
What Records Do You Have? Archival or Data?
First step, take an assessment of everything you have. Samples? Materials? Records?
Archival storage should be for all original records, including source data and metadata, which are generated, recorded, calculated or transcribed at the time of an activity. This data allows full and complete reconstruction and evaluation of the activity.
Data storage may be written, printed electronically, scanned image, photographic, or other form for later reference. Raw data obtained from measurement, testing, processing, direct observation or computer, and instrument printouts should be represented exactly as captured at its source without transformation, aggregation or calculation.
Responsible Parties and Retention Periods
All personnel should be responsible for handling, submitting or returning records to the archive in the same conditions in which they were found.
Keep in mind that different items are governed by different regulations, so you need to check retention periods. The retention period begins when all work with samples or records is complete. Specified retention periods supersede any other retention requirements unless explicitly noted.

Factors Influencing Retention Period Requirements
- State and federal laws: State laws are the primary source for retention periods, which can range from three to over ten years. Federal laws, like those from CMS for Medicare, may also have specific requirements.
- Patient age: Records for minors often require longer retention periods, usually extending past the age of majority.
- Type of record: Different types of records can have different retention requirements. For instance, some states require longer retention for certain records like mammography images.
- Legal and regulatory changes: Laws and regulations can change, so it’s important to stay updated on current requirements.
Scope of Work in Healthcare Records Retention Process
Generally, quality or project management takes the lead on records retention. The scope of work involves:
- Archiving, filing, retaining, organizing and retrieving records
- Maintaining security and integrity of records in archives if stored on-site
- Collecting and cataloging records, including:
- Assigning archival numbers
- Preparing archive labels, updates to archival forms
- Making copies of any supporting electronic data
- Handling off-site storage as applicable.
On-Site and Off-Site Record Storage Locations
For healthcare records, you have two storage choices: on-site or off-site.
If you store records on-site, storage must be access-controlled, and all records must be stored appropriately to ensure integrity and preservation, minimize deterioration and facilitate timely retrieval. All original paper records should be stored in secure, fireproof filing cabinets or appropriate containers, like folders, binders, weather-proof envelopes, cases or boxes.
If you decide to store records off-site, make sure to use a qualified contractor specializing in off-site medical records storage. Quality should be involved in sending records off-site. All records should be assigned a unique number or other appropriate identifiers which your site must maintain.
Records should be sent off-site appropriately grouped by record type. This is important because at some point, you might need to retrieve them. And you generally don’t have much notice to retrieve something. It’s generally an immediate need or within 24-48 hours, so if you don’t know where the records are or how they are organized, you won’t be able to produce them as you need to. That’s a problem.
General Guidelines to Reduce Risk in Records Retention
Healthcare record retention is governed by federal and state laws, requiring that records be kept for a specific period for patient access, legal protection, and compliance.
Your organization should operate under the basic requirements for retaining records unless otherwise specified. Use these general guidelines to ensure your processes are set up for retention compliance:
- Without a specified retention period, a minimum period of 10 years should be used.
- Once the defined retention period is reached, samples and records may continue to be maintained, returned, transferred to the appropriate owner, or destroyed.
- Do not destroy anything without appropriate approval from the functional owner.
- Record destruction must be appropriately documented to denote the end of the life cycle.
What’s Your Next Step?
When you have these processes and practices in place, records retention will be a lot more efficient and a lot less stressful.
Want more ideas for optimizing compliance and quality? You’ll find guidance in these popular articles.
- Four Ways to Integrate Compliance with Safety/Quality Efforts
- Best Practices for Better Training in Healthcare Compliance
- Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips

Andrea has taught first grade in Willoughby, Ohio for 27 years in the same classroom that she attended school as a child. She earned a Bachelor of Science in elementary education with a minor in language arts from John Carroll University and a Master’s Degree in the Art of Teaching and Education from Marygrove College.

John builds and fixes quality departments, while currently thriving as the Administrator & Director of Quality, Risk Management and Compliance at River Vista, a behavioral hospital in Columbus, Ohio.
The Q-Kids – John R Nocero and Andrea L Bordonaro – are experts at everything quality, regulatory, education training and compliance and love sharing their knowledge on YouCompli.
Follow them on LinkedIn – for more quality content or send them a message – they’d love to hear from you.

