By GRACE CORDOVANO, DEVEN McGRAW, and AARON MIRI

The HIPAA Privacy Rule gives patients the right to copies of their medical records, with rare exceptions. When patients need a copy of their medical records, most start the process by calling their doctor’s office and asking for how to get access. The receptionist or office staff point them in the right direction, whether it’s instructing them to write down their request and sending it to the office, pointing them to contact the medical records or radiology department (if the practice is large enough), or assisting them in setting up their patient portal, if the practice is using an electronic health record (EHR). Being able to connect with a person inside the four walls of medicine is often crucial for many patients and their carepartners who may be unsure of exactly how to request their records.

But what happens to those records when a doctor closes or leaves the practice?

Independent practices close for a variety of reasons. Physicians may merge with a large practice or health system, retire, they may sell or close their practice for personal reasons, they may file for bankruptcy, or they may get sick and die. The COVID19 pandemic has had devastating financial consequences on many small, independent, and rural practices, leading to their consequent closure, acquisition, or merger.

What should patients do when their doctor’s office closes, and they need a copy of their medical records? This is especially challenging when a doctor may not have had an EHR, as is the case with many independent practices as well as more rural settings. On September 26, 2020, a tweet from Cait DesRoches, Executive Director of OpenNotes, inquired about how a family member may get access to medical records from her physican’s practice that closed, triggering a robust conversation that led to the realization that patients and families are not well informed in these circumstances.

Prevention is Worth a Pound of Cure

It can be much more difficult to get copies of records after a practice has closed. Patients should get copies of their medical records as they are generated instead of waiting until they’re needed. HIPAA Privacy Rule guidance states that individuals can get digital copies of digital information (or even digital copies of records kept on paper, as long as the practice has a scanner). Companies are developing tools and services that enable individuals and their care partners to collect, use, and store health records. Request digital (or paper, if that is preferred) copies of blood work, imaging, discharge instructions, and corresponding reports before you leave the practice.

What Happens to Medical Records When Offices Close? The Law

The Health Insurance Portability and Accountability Act (HIPAA) does not require a physician to retain medical records for any particular period of time. (HIPAA covered entities – which include physicians who bill health insurers for care – are required to keep records demonstrating compliance with HIPAA for at least six years – but those records are distinct from medical records.) However, if the physician still has those medical records – or has placed them in storage for safekeeping – the HIPAA requirements to produce them when a patient requests still apply.

State laws typically set medical record retention requirements for physicians and may also require the physician to take particular steps (such as notifying a patient) prior to or upon closure of a practice. 

An example of some of these state laws:

• In California, physicians must notify patients in advance of closure of the practice, and are still responsible for safeguarding records and making sure they are available to patients. The California Medical Association recommends physicians keep records for at least ten years from the last date the patient was seen.
• New York requires that medical records be retained for six years from the date of the most recent entry in the record, and patients are required to informed when a practice closes.
• Virginia prohibits the transfer of medical records as part of the closure or sale of a practice until the provider has first attempted to notify by the patient by mail or by publishing notice in a newspaper of general circulation in the area.
• Texas law requires physicians to keep records for a minimum of seven years after the date of last treatment, and physicians leaving a practice are required to notify patients.

During the record retention period, these records are considered to be still “available” and subject to the HIPAA right of access. Consult the medical board or the state medical society in the state where the physician has practiced for further information about physician requirements in the event of closure of a practice. The Medical Board should also have information about how to file a complaint if the physician’s practice has closed without any notice or information about how to obtain records. 

Irrespective of legal requirements, the American Academy of Family Physicians recommend that patients be notified by a letter that the office is closing, giving them the opportunity to obtain a copy of their medical records or have records forwarded to a physician of their choosing. The office may post an update on their website or social media page(s), if ones exist or run an ad in the local newspaper. Patients should be notified who will be the custodian of the medical records and their contact information.

Sorry! The Office Is Closed

Unfortunately, the reality is that most individuals do not get copies of their medical records throughout their care journey. This leaves patients and carepartners in need of records facing significant uncertainty, stress, and frustration when they unexpectedly find out that their doctor’s office has closed. Here are a number of critical tips to assist patients in gathering their medical records, directly and indirectly, in the event their doctor’s office has closed.

1. It is helpful to know when the office may have closed: was it recently or many years ago? As noted above, state laws govern how long records must be retained as well as how they must be handled with respect to confidentiality, privacy, and how they may be destroyed, when and if needed. Typically, records that are about 10 years from the last documented encounter, may be candidates to be destroyed and may be more difficult to obtain as a copy.  (As noted above, state laws may allow for them to be destroyed even sooner than 10 years.)

• Individuals should refer to the letter they may have received notifying them of the office closing and contact the designated records custodian. Updates may also have been posted to the physician or practice’s website or social media page, if available. The local librarian may assist with researching for the office closure notice in archived newspapers or posts in the public domain.

• Insurance companies, current and previous, should be contacted to request any claims that may have been received from the specific physician or provider’s practice. A supervisor should be requested and relayed specific information about the health information needed and why is it critical for one’s care. In the event individuals are encountering difficulty getting traction over the phone, individuals may turn to social media for help.  If the respective insurance company has a Twitter account, individuals may tweet their request while including the insurance company’s Twitter handle. Social media managers are often very responsive and may be an additional avenue for connecting individuals to the information they need if it is perceived that delays in response may be detrimental to their company’s reputation.

• Is there another doctor or professional now at the same physical office/facility location? Individuals should address the request in-person or via a call. The new office staff often receive many of the same questions from other previous patients and may have contact information for a point person on hand. They may also have the records in question if the practice was acquired (where applicable).

• Individuals should contact their local chamber of commerce, borough hall, or local Department of Health. If the office closure was recent, someone may know a way to connect with the doctor or a former staff member for more information.

• Did the doctor have other doctors on staff? If so, individuals may search for the other doctors who may still be in practice at another location to see if they may have a contact for where records have been retained.

• Individuals may quickly determine if their doctor is on social media, such as LinkedIn, Twitter, and Facebook, and respectfully direct message them with their request for more information.

• Individuals may search the internet for any recent press releases that may feature the doctor’s work, activism, or research and contact the respective article’s author or journalist. At minimum, they may be willing to forward the request for records to the doctor.

• If individuals need specific information on medications, they may contact the pharmacy that was used to fill respective prescriptions so as to request copies of prescription records.

1. Individuals should contact their primary care doctor, and other members of their  care team, to see if records were forwarded to them for continuity of care purposes.

1. If an individual’s doctor is deceased, the state medical licensing board may be contacted to determine the care provider’s county of residence. Consequently, the specific state’s county probate court may be contacted to confirm if there is a designated executor of estate that has authority over records retention processes. Alternatively, an obituary may list surviving next of kin which may also be contacted for more information on records retention.

1. If medical records were available digitally, individuals may look up their state and “health information exchange (HIE)”.  An HIE is a secure network that supports the electronic exchange of patient health information among trusted data entities typically across an entire state. Individuals should research if there is an HIE that may serve their local area. An HIE’s website will have a phone number and email to contact directly with your request.

1. If imaging was performed, individuals may reach out to the respective imaging center or the location where imaging was done to request copies of images on CDs and the corresponding reports.

1. If bloodwork was performed, individuals may contact the lab, such as Quest or LabCorp, that processed the tests directly for copies of final lab reports. Individuals may contact their insurance company, current or previous, if they are unsure of the names of the labs that may have been in-network via their plan; individuals can also use their right of access to get copies of claims from their health plan, which may identify the lab that processed the tests.

1.  If individuals are in need of immunization records they may contact their state Department of Health as they may have an immunization registry. The Immunization Action Coalition also has information on locating immunization records.

1. If individuals are working within the framework of a specific diagnosis or condition, they may research non-profits that support patients within that specific disease state and reach out for peer health support, where other individuals diagnosed with the same condition may also be able to assist in navigating these barriers to patient access based on their own lived experiences.

1. A state’s medical board, Office of the Attorney General (AG) and state’s Department of Health are all resources for additional support.

Individuals may also file a complaint with the Office of Civil Rights (OCR) at the Department of Health and Human Services (HHS) if all efforts have been exhausted and the needed medical records have not been obtained.

A closed practice does not need to be a dead end for patient access. Proactively requesting copies of medical records throughout one’s care journey can prevent encountering such patient access barriers. Continuing to share best practices for navigating patient access barriers, from legal, regulatory, and practical standpoints, is in the best interest of all patients.

Grace Cordovano, PhD, BCPA is a board-certified patient advocate specializing in the oncology space, a patient experience enhancer, and information unblocker.

Deven McGraw , JD, MPH, LLM (@healthprivacy) is the Chief Regulatory Officer at Ciitizen (and former official at OCR and ONC). She blogs at ciitizen.com.

Aaron Miri is the Chief Information Officer for The University of Texas at Austin comprising of the Dell Medical School, UT Health Austin clinical enterprise, research, and community impact missions.