TMA and TMLT Resources
The Texas Medical Association (TMA) offers an excellent publication Managing Your Medical Records that covers the rules of consent, release and disclosure, how to maintain and store your medical records in a HIPAA-compliant manner, how to apply appropriate measures for retaining and destroying them, and more.
TMA also provides several whitepapers, articles and other TMA resources on medical records.
The Texas Medical Liability Trust (TMLT) provides answers to FAQs, as well as other medical records resources.
For additional guidance from TMA and TMLT:
If disaster strikes, will your patients have access to their medical records? (TMA)
Recovering damaged records (TMLT)
Moving patient charts from paper to electronic form (TMA)
Know your rights to your patients' PHI (TMA) Can your EHR vendor block or terminate your access to your patients' records?
Texas Medical Board Rules (TMB) Chapter 163 on Medical Records
For the TMB's complete and most up to date set of rules, refer to Chapter 163 Medical Records.
The Texas Medical Practice Act/Texas Occupations Code provides additional guidance regarding confidentiality and the information to be furnished by physicians under Title 3, Chapter 159: Physician-Patient Communication.
Amending Records and Late Entries
Amendments and corrections are covered under TMB Rule 163.1(b)(7): Clear identification of any amendment or correction to the medical record, including the date it was amended or corrected and the identity of the author of the amendment or correction, with the original text remaining legible.
Late entries are discussed in TMB Rule 163.1(b)(4): Late entries, if any, that indicate the time and date entered, as well as the identity of the person who made the late entry.
The Centers for Medicare and Medicaid Services (CMS) explains how to make amendments, corrections and delayed entries in medical documentation (refer to section 3/3.2.5).
Medical records are legal documents and can even become evidence in legal proceedings. Altered records can make it impossible to defend a medical liability case. Even additions and comments made by well-meaning physicians who are attempting to clarify or elaborate on previous notes can compromise the integrity of a medical record.
The reality is that everyone makes occasional mistakes when documenting medical records, but the methods used to correct those mistakes can make or break a physician in a legal challenge. Clearly identify late entries made in the EHR. Include the reason for the lateness of the entry and the date, time, and name of the person making the late entry.
Billing Records
The TX Occupations Code 159.001 defines a billing record: (1) "Billing record" means a record that describes charges for services provided to a patient by a physician; and (2) "Medical record" does not include a billing record.
Although billing codes, including CPT and ICD-CM codes, reported on health insurance claim forms or billing statements should be supported by the documentation in the medical record, the billing records themselves are not considered to be part of the medical record. Check your payer/plan contracts for any specific billing record retention requirements.
The Consent (request) for Release of Confidential Information is covered under Section 159.005: (a) Consent for the release of confidential information must be in writing and (b) the written consent must specify: (1) the billing records, medical records, or other information to be covered by the release; (2) the reasons or purposes for the release; and (3) the person to whom the information is to be released.
Contents of Records
TMB Rule 163.1 states: (a) The medical record must be a complete, contemporaneous, and legible documented account of each patient encounter by a physician or delegate; and (b) goes into detail as to what must be included in the record.
Also, refer to the TMB FAQs page and click on Laws and Rules, then Medical Records. It includes a link to the Position Statement by the Texas Medical Board on Electronic Medical Records.
From TMA, see Electronic medical records documentation pointers.
TMA also provides guidance on What not to include in a medical record.
TMLT, The Reporter, Volume 2 2015, provides guidance in the article EHR best practices: Complying with new TMB documentation rules. It discusses passwords, completing and locking notes, tracking and signing test results, the addendum process, the use of scribes, and more.
Deceased Patients' Records
Concerning the release of medical records when the patient is deceased, there is no exception to confidentiality, outside of a court or administrative proceeding. As such, a family member of a deceased patient does NOT necessarily have access to the patient's medical records. Instead, access is restricted by law to someone who is designated as a "personal representative" of the deceased.
Texas Occupations Code 159.005(a)(5) states (a) Consent for the release of confidential information must be in writing and signed by: (5) a personal representative of the patient if the patient is deceased.
A "personal representative" is someone specifically named by the Texas Estates Code as having the authority, when appointed as such by the probate court, to transact business on the part of the estate. An authorized representative will have legal documents, called "Letters Testamentary" (when there is a will) or "Letters of Administration" (when no will is found to exist), describing his or her authority.
Before fulfilling a request for records, a physician should ask for evidence of the person's legal capacity to obtain the deceased patient's records.
The requester can find information about applying for letters in Texas Estates Code, Chapter 301. In Harris County, the Harris County Clerk's office Probate Courts Department has the responsibility for issuing these letters.
The medical records of a deceased patient should be retained for the same length of time as those of other patients.
Destruction of Records
Destruction of medical records must be done in a manner that ensures continued confidentiality.
The TMA Board of Councilors Opinion concerning the confidentiality of patient records is: "Physicians face both an ethical and a legal responsibility to safeguard patient communications and information in patients' medical records..."
Please refer to Retention of Medical Records to determine when records may be destroyed and what types of records should be retained beyond the normal retention period.
When medical records are eligible for destruction, they can be cross-cut shredded (and recycled) or burned. TMA provides the following guidance when destroying medical records:
- Maintain records scheduled for destruction in a secure location to guard against inappropriate access until the destruction is complete.
- Whether you shred the records yourself in your office or hire a record destruction company, create a permanent record destruction log, individually listing all medical records with the following information:
- Patient name and medical record number (or other identifiers);
- Date of destruction, combined with a notation that the record was destroyed in accordance with the retention policy; and
- Signature of staff person performing the destruction, or if you are using a record destruction company, the name of the company and signature(s) of individuals witnessing the destruction. (Add signatures after the destruction has been completed.)
If an outside company is used,
- First, obtain a current Business Associate Agreement with the destruction company.
- Make sure the destruction contract specifies the method of destruction and time to elapse between acquisition and destruction.
- Establish safeguards for confidentiality.
- Follow the record destruction company's protocol for carrying out the actual destruction.
- Obtain a certificate of destruction from the company and file it with your log.
- Obtain a statement that records were destroyed in the regular course of business.
- Indemnify your practice from loss due to unauthorized disclosure.
Refer to TMA's guidance How to Delete Data-for Real for advice on destroying electronic storage securely. Also, refer to the U.S. Department of Health and Human Services Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals consistent with NIST (National Institute of Technology and Standards) Special Publication 800-88 Guidelines for Media Sanitation such that the PHI cannot be retrieved.
Refer to the below section for document destruction resources.
Management, Storage, Retrieval, and Destruction Resources
For a list (pdf) of Records Management, Storage, Retrieval, and Destruction Resources in the Houston area. (This list is provided as reference only; it is not an endorsement of any of these companies.)
Also, refer to the HCMS Buyers Guide under the sections Document Management Solutions and Document Scanning and Imaging.
Photos and Videos in the Records
In some fields of practice photographs are a common way to document a patient's condition and response to treatment. These records are no different from narrative records; the photo is meant to document what is necessary to achieve an adequate medical record and should be considered part of that record. TMA provides additional information.
Regarding patient requests, TMB Rule 163.3 includes (b) Requests for diagnostic imaging, including static films, non-static films, and imaging studies, must specify whether a copy or the original of the study is sought.
Records Request - Release Requirements
Requests for medical records are covered under TMB Rule 163.3, which states (a) Upon receipt of a request for medical records that complies with §159.005 of the Act, a physician must provide the information within 15 days of the request and in accordance with Chapter 159 of the Act. This references TX Occupations Code 159 involving Physician-Patient Communication.
TX Occupations Code 159.005 explains that the request for confidential information must be in writing, defines who is authorized to make the request, and what the written request must specify.
Regarding exceptions to confidentiality, refer to TX Occupations Code 159.003 and 159.004.
As required by TX Occupations Code 159.006, a) Unless the physician determines that access to the information would be harmful to the physical, mental, or emotional health of the patient, a physician who receives a written consent for release of information as provided by Section 159.005 shall furnish copies of the requested billing or medical records, or a summary or narrative of the records, including records received from a physician or other health care provider involved in the care or treatment of the patient. (b) The physician may delete confidential information about another patient or a family member of the patient who has not consented to the release.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) provides extensive guidance in areas such as:
- Information blocking and the 21st Century Cures Act
- Medium by which information is provided
- Grounds for refusing release
- Exceptions to information blocking
- Mental health records
- Records of workers' compensation patients
- Release without consent
- Insurer access, and more.
Both HIPAA and Texas code provide some limitations if, in the physician's judgment, access to that information would be reasonably likely to endanger the life or physical safety of the patient or another person (see TMA whitepaper above). Also, the physician may delete (from the copy only, not from the original record) confidential information about another patient or family member of the patient who has not consented to the release.
HIPAA permits physicians to disclose PHI to another health care provider for treatment purposes via fax or other means, as long as reasonable and appropriate technical, administrative, and physical safeguards are in place.
In addition, HIPAA provides guidance concerning individuals' right to access health information.
TMA has a brief Sample Letter Authorization to Release Medical Records (members only). See also TMA's Medical Records page for a more detailed sample letter "Authorization to Release Medical Records."
When receiving a request for records of a deceased patient, first determine whether the requestor has the proper authorization to access the information. Refer to the Deceased Patients' Records section above.
Regarding the rights of parents, including divorced parents, to access their minor child's chart, see our page on Treatment of a Minor (Rights of the Parents).
TMA provides guidance on release exceptions to health plan requests for PHI.
The Texas Office of Inspector General (OIG) relies on record reviews as a primary tool to identify potential fraud, waste, and abuse in Medicaid-supported services. Refer to Records Requests in an OIG Investigation for information.
Records Request - Records Created by Other Physicians
TX Occupations Code 159.006 states (a) Unless the physician determines that access to the information would be harmful to the physical, mental, or emotional health of the patient, a physician who receives a written consent for release of information as provided by Section 159.005 shall furnish copies of the requested billing or medical records, or a summary or narrative of the records, including records received from a physician or other health care provider involved in the care or treatment of the patient. (b) The physician may delete confidential information about another patient or a family member of the patient who has not consented to the release. Also, refer to HIPAA guidance, under General Right.
There is no exception in the act for documents that may be stamped "do not copy or forward" or "not for release."
Problem: While seeing a patient, a physician notices the patient's history is inconsistent with the previous medical record and is concerned about the care the patient received from a colleague.
Recommendation: TMA recommends the following: Simply note in the patient's chart, "Patient's history is inconsistent with prior medical records." Focus the conversation on the situation at hand and what treatment you can offer; and if appropriate, a physician can report to the TMB any quality or regulatory concerns.
Records Request - Processing Time Allowed
The time allowed to process a request for records is covered under TMB Rule 163.3: (a) Upon receipt of a request for medical records that complies with §159.005 of the Act, a physician must provide the information within 15 days of the request and in accordance with Chapter 159 of the Act. This references TX Occupations Code 159 involving Physician-Patient Communication.
TX Occupations Code 159.008 under Physician Fees for Information states (a) Except as provided by Subsection (b), a physician: (1) may charge a reasonable fee, as prescribed by board rule, for copying billing or medical records; and (2) is not required to permit examination or copying of the records until the fee is paid unless there is a medical emergency. (b) A physician may not charge a fee for copying billing or medical records under Subsection (a) to the extent the fee is prohibited under Subchapter M, Chapter 161, Health and Safety Code.
If the copy fee is not included with the request, the physician should notify the requesting party in writing of the need for payment and the letter should be made part of the patient's medical and/or billing record as appropriate.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) discusses the time limit to respond in connection with information blocking and the 21st Century Cures Act. Under the Cures Act, the acceptable time frame to release electronic health information (EHI) may be shorter than the 15 days, depending on the circumstances. Particularly, suppose a physician who could more promptly fulfill EHI requests chooses instead to engage in a practice that delays fulfilling those requests. In that case, that practice may constitute an interference under the information blocking provision of the Cures Act, even if requests are fulfilled within the 15-day timeline under Texas Law.
Records Request - Denial of Requests
Regarding denial of a request for records, TMB Rule163.3 states: (d) A provider cannot deny a request for medical records due to a delinquent account or amounts owed to the provider; (e) A provider cannot require a subpoena for the records if a proper request is made in accordance with §159.005 of the Act; and (f) A denial of a request for records must be in accordance with §159.006(e) of the Act (see below). This references TX Occupations Code 159 involving Physician-Patient Communication.
TX Occupations Code 159.006 states:
(a) Unless the physician determines that access to the information would be harmful to the physical, mental, or emotional health of the patient, a physician who receives a written consent for release of information as provided by Section 159.005 shall furnish copies of the requested billing or medical records, or a summary or narrative of the records, including records received from a physician or other health care provider involved in the care or treatment of the patient.
(b) The physician may delete confidential information about another patient or a family member of the patient who has not consented to the release.
(c) In accordance with Section 159.005, on receipt of a written request by a subsequent or consulting physician of a patient of the requested physician, the requested physician shall furnish a copy of the complete billing or medical records of the patient to the subsequent or consulting physician. The duty to provide billing or medical records to a subsequent or consulting physician may not be nullified by contract.
(d) A physician shall provide the information requested under this section not later than the 15th business day after the date of receipt of the written consent for release under Subsection (a) or the written request under Subsection (c).
(e) If the physician denies the request, in whole or in part, the physician shall: (1) furnish the patient with a written statement, signed and dated, providing the reason for the denial; and (2) place a copy of the statement denying the request in the patient's: (A) billing records, if the request was for billing records; or (B) medical records, if the request was for medical records.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) provides extensive guidance on grounds for refusing release under Texas Law, under HIPAA, and exceptions to information blocking that involve not fulfilling requests.
Records Request - Fees and Exceptions
TMA's whitepaper Fees for Copies of Medical Records (members only) provides a great deal of guidance regarding fees and exceptions, including a discussion of copy fees under the Information Blocking Provision of the 21st Century Cures Act and those involving subpoenas.
TMLT discusses the differences between federal and state rules Charging for copies of medical records. Please note some Exceptions to the rules (below).
Under
HIPAA allowable charges rules, a physician is not obligated, but may choose to use one of the following fee methods to provide a patient with a copy of the patient's medical records:
- Actual Cost - May calculate and charge the actual allowable cost, but only up to the allowable amount determined by the TMB (see below).
- Average Cost - May develop a schedule of costs based on average, allowable labor costs to fulfill standard requests.
- Flat Rate of $6.50 - May decide to charge the HIPAA flat rate of no more than $6.50 for requests of electronic copies, if he/she does not wish to calculate the actual costs up to the TMB maximum for electronic PHI. However, this flat rate is only an option and is not a cap on fees.
The Texas guidelines are different than federal rules in that the TMB allows physicians to charge patients a reasonable, cost-based fee for copies of their records based on the type of records requested – paper, electronic, or a combination. The charges should reflect the actual cost to produce the copies and practices should understand that the TMB charges are maximum allowable charges. The TMB has set the following rules:
TMB Rule 163.3(c) under Allowable charges for records states:
(1) paper records - the maximum fee may be $25.00 for the first twenty pages and $.50 per page thereafter
(2) electronic records - the maximum fee may be $25.00 for 500 pages or less and $50.00 for more than 500 pages;
(3) hybrid records (part paper and electronic) - the fee for each different format may be utilized, including diagnostic studies;
(4) if an affidavit is requested for the records, the maximum fee may be $15.00;
(5) if a narrative is provided in lieu of records, the maximum fee may be $20.00;
(6) requests that all records be in paper format even though available as electronic records - the paper record fee may be charged; and
(7) if records are mailed to the requestor - actual postage cost may be charged.
A reasonable fee for records provided in a paper, electronic or hybrid format may NOT include costs associated with searching for and retrieving the requested information, and shall include only the cost of: (A) copying and labor, including, compiling, extracting, scanning, burning onto media, and distributing media; (B) cost of supplies for creating the paper copy or electronic media (if the individual requests portable media) that are not prohibited by federal law; (C) postage, when the individual has requested the copy or summary be mailed; and (D) preparing a summary of the records when appropriate.
TMA provides additional guidance on Charging a Fee to Complete Forms. Also, refer to Exceptions below.
Exceptions to the fee allowance:
- Disability Claims
A physician may not charge a fee for a medical or mental health record requested by a patient, former patient or authorized representative for use in supporting an application for disability benefits or other benefits of assistance. Refer to Subchapter M, Chapter 161, 202 of the Health and Safety Code for specifics.
- Emergency Requests
A physician should not delay or withhold providing copies of a medical record when the information is requested by a licensed health care provider or a physician for purposes of emergency or acute medical care. TX Occupations Code 159.008 states: (a) Except as provided by Subsection (b), a physician: (1) may charge a reasonable fee, as prescribed by board rule, for copying billing or medical records; and (2) is not required to permit examination or copying of the records until the fee is paid unless there is a medical emergency.
- Past Due Accounts
TMB Rule 163.3(d) A provider cannot deny a request for medical records due to a delinquent account or amounts owed to the provider.
Records Request - Withholding Until Request Fee Received
TMB Rule 163.3: (a) Upon receipt of a request for medical records that complies with §159.005 of the Act, a physician must provide the information within 15 days of the request and in accordance with Chapter 159 of the Act. This references TX Occupations Code 159 involving Physician-Patient Communication.
TX Occupations Code 159.008 under Physician Fees for Information states (a) Except as provided by Subsection (b), a physician: (1) may charge a reasonable fee, as prescribed by board rule, for copying billing or medical records; and (2) is not required to permit examination or copying of the records until the fee is paid unless there is a medical emergency. (b) A physician may not charge a fee for copying billing or medical records under Subsection (a) to the extent the fee is prohibited under Subchapter M, Chapter 161, Health and Safety Code.
If payment is not routed with such a request, the physician should notify the requesting party in writing of the need for payment and may withhold the information (other than for a medical emergency) until payment of a reasonable fee is received. A copy of the letter regarding the need for payment should be made part of the patient's medical and/or billing record as appropriate. If, however, the records are requested by a physician or health care provider for the purposes of providing emergency or acute medical care to the patient, then the records cannot be withheld.
Note that TMB Rule 163.3 (d) states: A provider cannot deny a request for medical records due to a delinquent account or amounts owed to the provider.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) discusses the time limit to respond in connection with information blocking and the 21st Century Cures Act. Under the Cures Act, the acceptable time frame to release electronic health information (EHI) may be shorter than the 15 days, depending on the circumstances. Particularly, suppose a physician who could more promptly fulfill EHI requests chooses instead to engage in a practice that delays fulfilling those requests. In that case, that practice may constitute an interference under the information blocking provision of the Cures Act, even if requests are fulfilled within the 15-day timeline under Texas Law.
For more extensive information, see TMA's whitepaper on Patient Access and Consent to the Release of Medical Records (members only).
See above for information on allowable fees and exceptions.
Retention Requirements and Exceptions
TMB Rules 165.1(b) Maintenance of Medical Records - (1.) A physician shall maintain adequate medical records of a patient for a minimum of seven years from the anniversary date of the date of last treatment by the physician. However, there are Exceptions:
- Exception for minors: (2.) If a patient was younger than 18 years of age when last treated, the medical records shall be maintained until the patient reaches age 21 or for seven years from the date of last treatment, whichever is longer.
- Exception for sexual assault victims: (3.) A licensed physician who conducts a forensic medical examination of a sexual assault victim shall maintain the medical records for 20 years from the date of the examination.
- Exception for records related to legal proceedings: (4.) A physician may destroy medical records that relate to any civil, criminal or administrative proceeding only if the physician knows the proceeding has been finally resolved. (If in doubt, the physician may wish to place a note on the file that the records should be retained.)
- Exception if mandated by other federal or state regulation: (5.) Physicians shall retain medical records for such longer length of time than that imposed herein when mandated by other federal or state statute or regulation. (Refer to the below exception if health plan contract requirements differ.)
- Exception if health plan contract requirements differ: It has been noted that some health plans, such as Medicare Advantage plans, sometimes include a requirement in their contracts that physicians retain their members' records for up to ten years. Refer to each payer's contract language for any specific requirements.
- Special consideration for Obstetric Patient's medical records: Per TMA, physicians who treat women during pregnancy may want to keep those patients' medical records longer than the seven years from date of last treatment, in case any issues arise regarding the prenatal care of the child (regardless if the physician did not actually deliver the baby, or participate in its care once it was born.) Most liability carriers suggest keeping the medical records until the baby the patient was carrying is 21 years of age; however, physicians should check with their liability carrier for recommendations specific to their situation.
These same retention guidelines apply to the medical records of deceased patients.
TMA recommends that practices design a retention schedule for each location where they maintain medical records. The plan should include provisions for the automatic transfer of eligible records to inactive storage, and later, destruction of the medical record itself. The policy should specify what to keep, how long to keep it, and what storage medium to use.
The TMA whitepaper Retention of Medical Records (members only) provides guidance in areas such as drug records, lost medical records, pathology-CLIA regulations, tax records, potential medical professional liability claims, and more.
Subpoenas
TMA provides assistance on How to Respond to a Subpoena.
For extensive guidance, see the TMA whitepaper Subpoenas for Medical Records (members only).
TMA also provides help on What to Do When You're Caught in the Middle of a personal injury suit.
Transfer Ownership / Discontinue Practice
TMB Rules 165.1(b)(6) Maintenance of Medical Records - Physicians may transfer ownership of records to another licensed physician or group of physicians only if the physician provides notice consistent with 165.5 of this chapter and the physician who assumes ownership of the records maintains the records consistent with this chapter.
TMB Rules 165.5 Transfer and Disposal of Medical Records - When a physician retires, terminates employment, or otherwise leaves a medical practice, he or she is responsible for:
(a) Required Notification of Discontinuance of Practice
(1) Ensuring that patients receive reasonable notification and are given the opportunity to obtain copies of their medical records or arrange for the transfer of their medical records to another physician; and
(2) Notifying the Texas Medical Board when they are terminating practice, retiring, or relocating, and therefore no longer available to patients, specifying who has custodianship of the records, and how the medical records may be obtained.
(3) Employers of the departing physician...are not required to provide notification...the departing physician remains responsible for providing notification...
(b) Method of Notification
(1) When a physician retires, terminates employment, or otherwise leaves a medical practice, he or she shall provide notice to patients of when the physician intends to terminate the practice, retire or relocate, and will no longer be available to patients, and offer patients the opportunity to obtain a copy of their medical records or have their records transferred.
(2) Notification shall be accomplished by:
(A) EITHER:
(i) Posting such notice on the physician's or practice website; OR
(ii) Publishing notice in the newspaper of greatest general circulation in each county in which the physician practices or practiced and in a local newspaper that serves the immediate practice area; AND
(B) Placing written notice in the physician's office; AND
(C) Notifying patients seen in the last two years of the physician's discontinuance of practice BY EITHER:
(i) Sending a letter to each patient; OR
(ii) Sending an email to each patient, in a manner that is compliant with state and federal law.
(3) A copy of the posted notices shall be submitted to the Texas Medical Board within 30 days from the date of termination, sale, or relocation of the practice.
(4) Notices placed in the physician's office shall be placed in a conspicuous location in or on the façade of the physician's office as a sign announcing the termination, sale, or relocation of the practice. The sign shall be placed at least thirty days prior to the termination, sale or relocation of the practice and shall remain until the date of termination, sale or relocation.
Note: As HCMS frequently receives calls from former patients who are looking for their medical records, please also notify our office so we may advise these patients who/where to contact to request a copy of their medical records. Call 713-524-4267, ext. 219, or send a letter to Harris County Medical Society, John P. McGovern Building, 1515 Hermann Dr, Houston, TX 77004-7126.
(c) Prohibition Against Interference (when a physician is leaving a group practice)
(1) Other physicians remaining in the practice may not prevent the departing physician from posting notice and the sign.
(2) A physician, physician group, or organization may not withhold information from a departing physician that is necessary for notification of patients.
For additional information, refer to our pages on Closing or Selling Your Medical Practice and Leaving a Group Practice.