TMA and TMLT Resources
The Texas Medical Association (TMA) offers an excellent publication Managing Your Medical Records that covers the rules of consent, release and disclosure, how to maintain and store your medical records in a HIPAA-compliant manner, how to apply appropriate measures for retaining and destroying them, and more.
TMA also provides several whitepapers, articles and other TMA resources on medical records.
The Texas Medical Liability Trust (TMLT) provides answers to FAQs, as well as other medical records resources.
For additional guidance from TMA and TMLT:
If disaster strikes, will your patients have access to their medical records? (TMA)
Recovering damaged records (TMLT)
Moving patient charts from paper to electronic form (TMA)
Know your rights to your patients' PHI (TMA) Can your EHR vendor block or terminate your access to your patients' records?
Texas Medical Board Rules (TMB) Chapter 165 on Medical Records
For the TMB's complete and most up to date set of rules, refer to Chapter 165, Medical Records.
The Texas Medical Practice Act/Texas Occupations Code provides additional guidance regarding confidentiality and the information to be furnished by physicians under Title 3, Chapter 159: Physician-Patient Communication.
Amending Records
TMB Rules 165.1(a)(11) Medical Records - Any amendment, supplementation, change, or correction in a medical record not made contemporaneously with the act or observation shall be noted by indicating the time and date of the amendment, supplementation, change, or correction, and clearly indicating that there has been an amendment, supplementation, change, or correction.
The Centers for Medicare and Medicaid Services (CMS) explains how to make amendments, corrections and delayed entries in medical documentation (refer to section 3/3.2.5).
Medical records are legal documents and can even become evidence in legal proceedings. Altered records can make it impossible to defend a medical liability case. Even additions and comments made by well-meaning physicians who are attempting to clarify or elaborate on previous notes can compromise the integrity of a medical record.
The reality is that everyone makes occasional mistakes when documenting medical records, but the methods used to correct those mistakes can make or break a physician in a legal challenge. Clearly identify late entries made in the EHR. Include the reason for the lateness of the entry and the date, time, and name of the person making the late entry.
Billing Records
TMB Rules 165.2(j) Billing Record Requests - In response to a proper request for release of medical records, a physician shall not be required to provide copies of billing records pertaining to medical treatment of a patient unless specifically requested pursuant to the request for release of medical records. TMB Rules 165.2(e)(4)(B) state a physician may charge separate fees for medical and billing records requested.
Although billing codes, including CPT and ICD-CM codes, reported on health insurance claim forms or billing statements should be supported by the documentation in the medical record TMB Rules 165.1(a)(9), the billing records themselves are not considered to be part of the medical record. Check your payer/plan contracts for any specific billing record retention requirements.
Contents of Records
TMB Rules 165.1(a) Contents of Medical Records - "Regardless of the medium utilized," each physician shall maintain an adequate medical record for each patient that is complete, contemporaneous and legible.
Also, refer to the TMB FAQs page and click on Laws and Rules, then Medical Records. It includes a link to the Position Statement by the Texas Medical Board on Electronic Medical Records.
From TMA, see Electronic medical records documentation pointers.
TMA also provides guidance on What not to include in a medical record.
TMLT, The Reporter, Volume 2 2015, provides guidance in the article EHR best practices: Complying with new TMB documentation rules. It discusses passwords, completing and locking notes, tracking and signing test results, the addendum process, the use of scribes, and more.
Deceased Patients' Records
Concerning the release of medical records, there is no exception to confidentiality, outside of a court or administrative proceeding, where a patient is deceased. As such, a family member of a deceased patient does NOT necessarily have access to the patient's medical records. Instead, access is restricted by law to someone who is designated as a "personal representative" of the deceased.
Texas Occupations Code 159.005 states consent for release of confidential information must be in writing and signed by a personal representative of the patient if the patient is deceased.
A "personal representative" is someone specifically named by the Texas Estates Code as having the authority, when appointed as such by the probate court, to transact business on the part of the estate. An authorized representative will have legal documents, called "Letters Testamentary" (when there is a will) or "Letters of Administration" (when no will is found to exist), describing his or her authority.
Before fulfilling a request for records, a physician should ask for evidence of the person's legal capacity to obtain the deceased patient's records.
The requester can find information about applying for letters in Texas Estates Code, Chapter 301. In Harris County, the Harris County Clerk's office Probate Courts Department has the responsibility for issuing these letters.
The medical records of a deceased patient should be retained for the same length of time as those of other patients.
Destruction of Records
TMB Rules 165.1(b)(8) Destruction of medical records shall be done in a manner that ensures continued confidentiality.
The TMA Board of Councilors Opinion concerning the confidentiality of patient records is: "Physicians face both an ethical and a legal responsibility to safeguard patient communications and information in patients' medical records..."
Note: Please refer to Retention of Medical Records to determine when records may be destroyed and what types of records should be retained beyond the normal retention period.
When medical records are eligible for destruction, they can be cross-cut shredded (and recycled) or burned. TMA provides the following guidance when destroying medical records:
- Maintain records scheduled for destruction in a secure location to guard against inappropriate access until the destruction is complete.
- Whether you shred the records yourself in your office or hire a record destruction company, create a permanent record destruction log, individually listing all medical records with the following information:
- Patient name and medical record number (or other identifiers);
- Date of destruction, combined with a notation that the record was destroyed in accordance with the retention policy; and
- Signature of staff person performing the destruction, or if you are using a record destruction company, the name of the company and signature(s) of individuals witnessing the destruction. (Add signatures after the destruction has been completed.)
If an outside company is used,
- First, obtain a current Business Associate Agreement with the destruction company.
- Make sure the destruction contract specifies the method of destruction and time to elapse between acquisition and destruction.
- Establish safeguards for confidentiality.
- Follow the record destruction company's protocol for carrying out the actual destruction.
- Obtain a certificate of destruction from the company and file it with your log.
- Obtain a statement that records were destroyed in the regular course of business.
- Indemnify your practice from loss due to unauthorized disclosure.
Refer to TMA's guidance How to Delete Data-for Real for advice on destroying electronic storage securely. Also, refer to the U.S. Department of Health and Human Services Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals consistent with NIST (National Institute of Technology and Standards) Special Publication 800-88 Guidelines for Media Sanitation such that the PHI cannot be retrieved.
Refer to the below section for document destruction resources.
Management, Storage, Retrieval, and Destruction Resources
For a list (pdf) of Records Management, Storage, Retrieval, and Destruction Resources in the Houston area. (This list is provided as reference only; it is not an endorsement of any of these companies.)
Also, refer to the HCMS Buyers Guide under the sections Custodian of Records, Document Destruction, and Document Scanning and Imaging.
Photos and Videos in the Records
In some fields of practice photographs are a common way to document a patient's condition and response to treatment. These records are no different from narrative records; the photo is meant to document what is necessary to achieve an adequate medical record and should be considered part of that record. TMA provides additional information.
For patient access information, see TMB Rules 165.3 Patient Access to Diagnostic Imaging Studies in Physician's Office.
Records Request - Release Requirements
TMB Rules 165.2(a) Medical Record Release and Charges - As required by the Medical Practice Act/Texas Occupations Code 159.006, a physician shall furnish copies of medical and/or billing records requested or, if the patient prefers, a summary or narrative of the records pursuant to a written release of the information as provided by the Medical Practice Act 159.005.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) provides extensive guidance in areas such as:
- Information blocking and the 21st Century Cures Act
- Medium by which information is provided
- Grounds for refusing release
- Exceptions to information blocking
- Mental health records
- Records of workers' compensation patients
- Release without consent
- Insurer access, and more.
Both HIPAA and Texas code do provide some limitations if, in the physician's judgment, access to that information would be reasonably likely to endanger the life or physical safety of the patient or another person (see TMA whitepaper above). Also, the physician may delete (from the copy only, not from the original record) confidential information about another patient or family member of the patient who has not consented to the release.
HIPAA permits physicians to disclose PHI to another health care provider for treatment purposes via fax or other means, as long as reasonable and appropriate technical, administrative, and physical safeguards are in place.
In addition, HIPAA provides guidance concerning individuals' right to access health information.
TMA has a brief Sample Letter Authorization to Release Medical Records (members only). See also TMA's Medical Records page for a more detailed sample letter "Authorization to Release Medical Records."
When receiving a request for records of a deceased patient, first determine whether the requestor has the proper authorization to access the information.
Regarding the rights of parents, including divorced parents, to access their minor child's chart, see our page on Treatment of a Minor (Rights of the Parents).
TMA provides guidance on release exceptions to health plan requests for PHI.
The Texas Office of Inspector General (OIG) relies on record reviews as a primary tool to identify potential fraud, waste, and abuse in Medicaid-supported services. Refer to Records Requests in an OIG Investigation for information.
Records Request - Records Created By Other Physicians
TMB Rules 165.2(d) Contents of Records - For purposes of this section, "medical records" shall include those records as defined in 165.1(a) and shall include copies of medical records of other health care practitioners contained in the records of the physician to whom a request for release of records has been made.
Also, Medical Practice Act/Texas Occupations Code 159.006(a) and HIPAA guidance - Information furnished by a physician: Unless the physician determines that access to the information is reasonably likely to endanger the life or physical safety of the patient or another person, a physician who receives a written consent for release of information as provided by Section 159.005 shall furnish copies of the requested billing or medical records, or a summary or narrative of the records, including records received from another physician or other health care provider involved in the care or treatment of the
patient.
There is no exception in the act for documents that may be stamped "do not copy or forward" or "not for release."
Problem: While seeing a patient, a physician notices the patient's history is inconsistent with the previous medical record and is concerned about the care the patient received from a colleague.
Recommendation: TMA recommends the following: Simply note in the patient's chart, "Patient's history is inconsistent with prior medical records." Focus the conversation on the situation at hand and what treatment you can offer; and if appropriate, a physician can report to the TMB any quality or regulatory concerns.
Records Request - Processing Time Allowed
TMB Rules 165.2(b) Deadline for Release of Records - The requested copies of medical and/or billing records or a summary or a narrative of the records shall be furnished by the physician within 15 business days after the date of receipt of the request and reasonable fees for furnishing the information.
If the copy fee is not included with the request, then, within ten calendar days from receiving the request, the physician shall notify the requesting party in writing of the need for payment. See withholding until request fee is received for information.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) discusses the time limit to respond in connection with information blocking and the 21st Century Cures Act. Under the Cures Act, the acceptable time frame to release electronic health information (EHI) may be shorter than the 15 days, depending on the circumstances. Particularly, suppose a physician who could more promptly fulfill EHI requests chooses instead to engage in a practice that delays fulfilling those requests. In that case, that practice may constitute an interference under the information blocking provision of the Cures Act, even if requests are fulfilled within the 15-day timeline under Texas Law.
Records Request - Denial of Requests
TMB Rules 165.2(c) Denial of Requests for Records - If the physician denies the request for copies of medical and/or billing records or a summary or narrative of the records, either in whole or in part, the physician shall furnish the patient a written statement, signed and dated, within 15 business days of receipt of the request stating the reason for the denial and how the patient can file a complaint with the federal Department of Health and Human Services (if the physician is subject to HIPAA) and the TMB.
A copy of the statement denying the request shall be placed in the patient's medical and/or billing records as appropriate.
TMA's whitepaper Patient Access and Consent to the Release of Medical Records (members only) provides extensive guidance on grounds for refusing release under Texas Law, under HIPAA, and exceptions to information blocking that involve not fulfilling requests.
Records Request - Fees and Exceptions
TMA's whitepaper Fees for Copies of Medical Records (members only) provides a great deal of guidance regarding fees and exceptions, including a discussion of copy fees under the Information Blocking Provision of the 21st Century Cures Act and those involving subpoenas.
TMLT explains the differences between federal and state rules in Clearing up the Confusion: Charging Your Patients for Medical Record Copies. Please note some Exceptions to the rules (below).
Under
HIPAA allowable charges rules, a physician is not obligated, but may choose to use one of the following fee methods to provide a patient with a copy of the patient's medical records:
- Actual Cost - May calculate and charge the actual allowable cost, but only up to the allowable amount determined by the TMB (see below).
- Average Cost - May develop a schedule of costs based on average, allowable labor costs to fulfill standard requests.
- Flat Rate of $6.50 - May decide to charge the HIPAA flat rate of no more than $6.50 for requests of electronic copies, if he/she does not wish to calculate the actual costs up to the TMB maximum for electronic PHI. However, this flat rate is only an option and is not a cap on fees.
The Texas guidelines are different than federal rules in that the TMB allows physicians to charge patients a reasonable, cost-based fee for copies of their records based on the type of records requested – paper, electronic, or a combination. The charges should reflect the actual cost to produce the copies and practices should understand that the TMB charges are maximum allowable charges. The TMB has set the following rules:
TMB Rules 165.2(e) Allowable Charges (Also, note some Exceptions to the fee allowance listed below.)
- Paper Format (A) The physician responding to a request for such information in paper format shall be entitled to receive a reasonable, cost-based fee for providing the requested information. (B) A reasonable fee for providing the requested records in paper format shall be a charge of no more than $25 for the first twenty pages, and $.50 per page for every copy thereafter.
- Electronic Format (A) The physician responding to a request for such information to be provided in electronic format shall be entitled to receive a reasonable, cost-based fee for providing the requested information in electronic format. (B) A reasonable fee for providing the requested records in electronic format shall be a charge of no more than: $25 for 500 pages or less; $50 for more than 500 pages.
- Hybrid Records Format. (A) The physician responding to a request for such information that is contained partially in electronic format and partially in paper format ("hybrid"), may provide the requested information in a hybrid format and shall be entitled to receive a reasonable, cost based fee for providing the requested information. (B) A reasonable fee for providing the requested records in a hybrid format may be a combination of the fees as set forth in the above paragraphs.
- Other Charges. (A) If an affidavit is requested, certifying that the information is a true and correct copy of the records, whether in paper, electronic or hybrid format, a reasonable fee of up to $15 may be charged for executing the affidavit. (B) A physician may charge separate fees for medical and billing records requested. (C) Allowable charges for copies of diagnostic imaging studies are set forth in §165.3 of this title (relating to Patient Access to Diagnostic Imaging Studies in Physician's Office) and are separate from the charges set forth in this section.
- A reasonable fee for records provided in a paper, electronic or hybrid format may NOT include costs associated with searching for and retrieving the requested information, and shall include only the cost of: (A) copying and labor, including, compiling, extracting, scanning, burning onto media, and distributing media; (B) cost of supplies for creating the paper copy or electronic media (if the individual requests portable media) that are not prohibited by federal law; (C) postage, when the individual has requested the copy or summary be mailed; and (D) preparing a summary of the records when appropriate.
TMA provides additional guidance on Charging a Fee to Complete Forms. Also, refer to Exceptions below.
Practices that do not have EHRs do not have to provide patients with their medical records in electronic format. TMB rules say physicians should provide the records in electronic format if requested as such if they are "readily producible," or if not, in a format agreed upon by the physician and requester 165.2(a)
Exceptions to the fee allowance:
- Disability Claims
TMB Rules 165.2(k) Prohibited Fees for Records Released Related to Disability Claims - The allowable charges as set forth in this chapter shall be maximum amounts, and this chapter shall be construed and applied so as to be consistent with lower fees or the prohibition or absence of such fees as required by state statute or prevailing federal law. In particular, under §161.202 of the Texas Health and Safety Code, a physician may not charge a fee for a medical or mental health record requested by a patient, former patient or authorized representative of the patient if the request is related to a benefits or assistance claim based on the patient's disability.
- Emergency Requests
TMB Rules 165.2(f) Emergency Requests - The physician providing copies shall be entitled to payment of a reasonable fee prior to release of the information unless the information is requested by a licensed health care provider or a physician for purposes of emergency or acute medical care.
- Past Due Accounts
TMB Rules 165.2(h) Improper Withholding for Past Due Accounts - Medical and/or billing records requested pursuant to a proper request for release may not be withheld from the patient, the patient's authorized agent, or the patient's designated recipient for such records based on a past due account for medical care or treatment previously rendered to the patient.
- Search Fee Not Allowed
A physician may not charge a search fee when a practice must go into off-site storage to fulfill a records request. TMB Rules 165.2(e)(5) specifically prohibits charging a fee for searching for and retrieving the requested information, as does HIPAA.
Records Request - Withholding Until Request Fee Received
TMB Rules 165.2(g) Non-emergent Requests - In the event the physician receives a proper request for copies of medical and/or billing records or a summary or narrative of the records for purposes other than for emergency or acute medical care, the physician may retain the requested information until payment is received.
If payment is not routed with such a request, within ten calendar days from receiving a request for the release of such records, the physician shall notify the requesting party in writing of the need for payment and may withhold the information until payment of a reasonable fee is received. A copy of the letter regarding the need for payment shall be made part of the patient's medical and/or billing record as appropriate.
If, however, the records are requested by a physician or health care provider for the purposes of providing emergency or acute medical care to the patient, then the records cannot be withheld. See 165.2(f).
Also, a physician may not withhold requested medical records based on a past due account.
TMA e-tip: See Withholding Copies of Records for Failure to Pay Copy Fee, as well as more extensive information in TMA's whitepaper on Patient Access and Consent to the Release of Medical Records (members only).
See above for information on allowable fees and exceptions.
Retention Requirements and Exceptions
TMB Rules 165.1(b) Maintenance of Medical Records - (1.) A physician shall maintain adequate medical records of a patient for a minimum of seven years from the anniversary date of the date of last treatment by the physician. However, there are Exceptions:
- Exception for minors: (2.) If a patient was younger than 18 years of age when last treated, the medical records shall be maintained until the patient reaches age 21 or for seven years from the date of last treatment, whichever is longer.
- Exception for sexual assault victims: (3.) A licensed physician who conducts a forensic medical examination of a sexual assault victim shall maintain the medical records for 20 years from the date of the examination.
- Exception for records related to legal proceedings: (4.) A physician may destroy medical records that relate to any civil, criminal or administrative proceeding only if the physician knows the proceeding has been finally resolved. (If in doubt, the physician may wish to place a note on the file that the records should be retained.)
- Exception if mandated by other federal or state regulation: (5.) Physicians shall retain medical records for such longer length of time than that imposed herein when mandated by other federal or state statute or regulation. (Refer to the below exception if health plan contract requirements differ.)
- Exception if health plan contract requirements differ: It has been noted that some health plans, such as Medicare Advantage plans, sometimes include a requirement in their contracts that physicians retain their members' records for up to ten years. Refer to each payer's contract language for any specific requirements.
- Special consideration for Obstetric Patient's medical records: Per TMA, physicians who treat women during pregnancy may want to keep those patients' medical records longer than the seven years from date of last treatment, in case any issues arise regarding the prenatal care of the child (regardless if the physician did not actually deliver the baby, or participate in its care once it was born.) Most liability carriers suggest keeping the medical records until the baby the patient was carrying is 21 years of age; however, physicians should check with their liability carrier for recommendations specific to their situation.
These same retention guidelines apply to the medical records of deceased patients.
TMA recommends that practices design a retention schedule for each location where they maintain medical records. The plan should include provisions for the automatic transfer of eligible records to inactive storage, and later, destruction of the medical record itself. The policy should specify what to keep, how long to keep it, and what storage medium to use.
The TMA whitepaper Retention of Medical Records (members only) provides guidance in areas such as drug records, lost medical records, pathology-CLIA regulations, tax records, potential medical professional liability claims, and more.
Subpoenas
TMA provides assistance on How to Respond to a Subpoena.
For extensive guidance, see the TMA whitepaper Subpoenas for Medical Records (members only).
TMA also provides help on What to Do When You're Caught in the Middle of a personal injury suit.
Transfer Ownership / Discontinue Practice
TMB Rules 165.1(b)(6) Maintenance of Medical Records - Physicians may transfer ownership of records to another licensed physician or group of physicians only if the physician provides notice consistent with 165.5 of this chapter and the physician who assumes ownership of the records maintains the records consistent with this chapter.
TMB Rules 165.5 Transfer and Disposal of Medical Records - When a physician retires, terminates employment, or otherwise leaves a medical practice, he or she is responsible for:
(a) Required Notification of Discontinuance of Practice
(1) Ensuring that patients receive reasonable notification and are given the opportunity to obtain copies of their medical records or arrange for the transfer of their medical records to another physician; and
(2) Notifying the Texas Medical Board when they are terminating practice, retiring, or relocating, and therefore no longer available to patients, specifying who has custodianship of the records, and how the medical records may be obtained.
(3) Employers of the departing physician...are not required to provide notification...the departing physician remains responsible for providing notification...
(b) Method of Notification
(1) When a physician retires, terminates employment, or otherwise leaves a medical practice, he or she shall provide notice to patients of when the physician intends to terminate the practice, retire or relocate, and will no longer be available to patients, and offer patients the opportunity to obtain a copy of their medical records or have their records transferred.
(2) Notification shall be accomplished by:
(A) EITHER:
(i) Posting such notice on the physician's or practice website; OR
(ii) Publishing notice in the newspaper of greatest general circulation in each county in which the physician practices or practiced and in a local newspaper that serves the immediate practice area; AND
(B) Placing written notice in the physician's office; AND
(C) Notifying patients seen in the last two years of the physician's discontinuance of practice BY EITHER:
(i) Sending a letter to each patient; OR
(ii) Sending an email to each patient, in a manner that is compliant with state and federal law.
(3) A copy of the posted notices shall be submitted to the Texas Medical Board within 30 days from the date of termination, sale, or relocation of the practice.
(4) Notices placed in the physician's office shall be placed in a conspicuous location in or on the façade of the physician's office as a sign announcing the termination, sale, or relocation of the practice. The sign shall be placed at least thirty days prior to the termination, sale or relocation of the practice and shall remain until the date of termination, sale or relocation.
Note: As HCMS frequently receives calls from former patients who are looking for their medical records, please also notify our office so we may advise these patients who/where to contact to request a copy of their medical records. Call 713-524-4267, ext. 219, or send a letter to Harris County Medical Society, John P. McGovern Building, 1515 Hermann Dr, Houston, TX 77004-7126.
(c) Prohibition Against Interference (when a physician is leaving a group practice)
(1) Other physicians remaining in the practice may not prevent the departing physician from posting notice and the sign.
(2) A physician, physician group, or organization may not withhold information from a departing physician that is necessary for notification of patients.
For additional information, refer to our pages on Closing or Selling Your Medical Practice and Leaving a Group Practice.