Reprinted with permission from the Birmingham Medical News. This article was published in the December 2021 issue. Since this article’s publication, the Proposed Rule was adopted, effective January 14, 2022.

The Alabama State Board of Medical Examiners and the Alabama Licensure Commission have proposed a complete overhaul of the rules affecting medical record management by Alabama physicians (the “Proposed Rule”). Currently, there are few state guidelines with respect to medical record access, copying and patient notification, which often leads to disputes when a physician leaves a medical practice. The Proposed Rule establishes for the first time detailed requirements for accessing, retaining and disposing of patient medical records, as well as patient notification of a change in physician status. Following notice and a public comment period, the Proposed Rule is expected to become final in January of 2022. Once finalized, a physician risks licensure disciplinary action for violating any of the new provisions.

Medical Record Access

The Proposed Rule requires that following receipt of a “legally compliant request” from a patient or a patient’s legal representative, a physician or his or her practice “shall provide a copy of the medical record to the patient or to another physician, attorney, or other person designated by the patient or the patient’s legal representative.” While the term “legally compliant request” is not defined in the Proposed Rule, it likely means a request for medical record access that complies with HIPAA. Copying costs for medical records must not exceed what is authorized under state and federal law.

The Proposed Rule also specifically addresses Alabama physicians who practice telemedicine, stating that such physicians must retain access to medical records in order to document the delivery of health care services via telemedicine. Also, when a physician goes on vacation, takes a sabbatical or leave of absence, leaves the United States, or is otherwise unavailable to his or her patients, the physician must arrange to provide his or her patients access to their medical records. This requirement could be challenging for physicians in solo practice. Finally, the Proposed Rule continues the existing requirement that “physicians charging for the cost of reproduction of medical records should give primary consideration to the ethical and professional duties owed to other physicians and their patients, and waive copying charges when appropriate.”

Medical Record Retention

The Proposed Rule states that medical records shall be retained for a period of not less than seven years from the physician’s (and/or other providers within his or her practice) last professional contact with the patient, with a few exceptions discussed below. Currently, there are no state laws generally addressing the retention period for medical records and some medical practices may currently retain records for less than the proposed seven-year period based on the shorter Alabama statute of limitations time-frame for filing a medical malpractice lawsuit.

The Proposed Rule sets out four specific exceptions to the seven-year retention requirement. First, immunization records which have not been transmitted to the immunization registry maintained by the Alabama State Board of Health must be retained for a period of not less than two years after the patient reaches the age of majority (age 19 in Alabama) or seven years from the date of the physician’s (and/or other providers within his or her practice) last professional contact with the patient, whichever is longer. Second, X-rays, radiographs and other imaging studies must be retained for at least five years from the date of the study, after which if there exist separate interpretive records thereof, the imaging studies may be destroyed. However, mammography imaging and reports must be maintained for 10 years. Third, medical records of minors must be retained for a period of not less than two years after the minor reaches the age of majority or seven years from the date of the physician’s (and/or other providers within his or her practice) last professional contact with the patient, whichever is longer. Finally, no medical record involving services which are under dispute shall be destroyed until the dispute is resolved, so long as the physician has formal notice of the dispute prior to the expiration of the applicable retention period. The Proposed Rule does not define the term “dispute”, but a reasonable interpretation is any legal action involving the applicable medical record or any related government or third-party investigation.

Destruction of Medical Records

The Proposed Rule requires that a physician have an established policy for destruction of medical records and that medical records should only be destroyed in the ordinary course in accordance with such policy and applicable state and federal laws. Records may be destroyed by burning, shredding, permanently deleting, or other effective methods in keeping with the confidential nature of the records. When medical records are destroyed, the physician or the physician’s practice must keep written documentation of the time, date, and circumstances of the destruction and such documentation must be maintained for not less than four years. The record of destruction need not list the individual patient medical records that were destroyed but must sufficiently identify which “group of destroyed records contained a particular patient’s medical records.” The intent of this last requirement is subject to interpretation, and it is recommended that a list of destroyed records by patient name (or by last date of service) be maintained, if possible.

Patient Notification

The death, retirement, license suspension or revocation, departure of a physician from a medical practice, or sale of a medical practice all require that the applicable physician’s “active patients” be notified of the triggering event. Active patients are defined in the Proposed Rule as any patient treated by the physician “one or more times during the immediately preceding thirty-six (36) months” prior to the event that necessitates patient notification. The Proposed Rule states that patient notification shall at a minimum identify: (1) the physician who treated the patient, (2) the general reason for the patient being notified, (3) an explanation of how the patient may obtain a copy of his or her medical records, (4) a HIPAA authorization for the patient to complete and return, (5) how long the medical records will be made available to the patient, and (6) the intended disposition of the medical records if no instructions are received from the patient within the time provided. Notification may be sent by U.S. Mail to active patients at their last known address. Further, notification can be through an electronic message sent in compliance with HIPAA or HIPAA-compliant electronic health record system that provides a means of electronic communication to the patient and is capable of sending the patient a notification that a message is in the patient’s portal.

Death of a Physician. If notification is due to the death of a physician, the Proposed Rule provides that notification shall be sent by the physician’s practice, if applicable, within 30 days following the death of the physician. If the physician is in solo practice, the notice must be sent by the personal representative of the physician’s estate within 30 days of appointment of an executor or administrator by the Probate Court. The party sending the notice shall bear the cost of notifying the physician’s active patients. Of note, for physicians who are in solo practice, the physician must include compliance with the Proposed Rule (once finalized) as part of his or her estate planning.

Physician Retirement. If notification is due to a physician’s retirement, the physician, if in solo practice, or the physician’s group practice, as applicable, is responsible for sending a notification to the physician’s active patients not less than 30 days prior to retirement. The retiring physician must take reasonable steps for all medical records to be transferred to the custody of his or her active patients, to another physician, or to a HIPAA-compliant entity that agrees in writing to act as custodian of the records. If a custodian is used, it is recommended that the parties enter into a written medical records custodian agreement to specifically delineate the custodian’s responsibilities under HIPAA and state law.

Licensure Action. Under the Proposed Rule, a physician’s active patients must be notified of a suspension or revocation of the physician’s license. The notice must be sent by the affected physician or his or her medical practice within thirty days following imposition of the suspension or revocation. The cost of sending the notification is the responsibility of the physician whose license is suspended or revoked and the notification must contain a copy of the Medical Licensure Commission’s Order of Suspension or Revocation. Further, the affected physician must take reasonable steps for all medical records to be maintained or transferred either to the custody of the physician’s active patients, to another physician, the physician’s medical practice, or to a HIPAA-compliant entity that agrees in writing to act as custodian of the records.

Leaving a Medical Practice. If a physician leaves a medical practice (other than for retirement), the Proposed Rule states that the responsibility for notifying active patients and paying for the cost of the notification is governed by the physician’s employment or other agreement with the medical practice. Absent a contractual provision to the contrary, when the medical practice undertakes to notify patients of the physician’s departure, the practice shall bear the cost of notification and reproducing or transferring medical records. If, however, no contractual provision exists and the medical practice elects not to notify active patients, then the departing physician shall be responsible for the cost of notification and reproducing or transmitting medical records. When the departing physician is responsible for notifying patients, the practice must provide the physician a list of his or her active patients and their last known mailing address and contact information. In general, absent a contractual provision to the contrary, the party who notifies the active patients of a physician’s departure is responsible for the costs of notification and reproducing or transferring medical records.

Sale of a Medical Practice. The Proposed Rule recognizes that medical records may be part of the assets sold to a buyer of a medical practice. In that situation, the selling physician, his or her estate, or medical practice, as applicable, must take reasonable steps to transfer all medical records to another physician or HIPAA “covered entity” or HIPAA “business associate” operating on the buyer’s behalf. All active patients must be notified within 30 days of the transfer and given the opportunity to have their records sent to another physician, the patient, or the patient’s representative. Notwithstanding the above, the purchase of equity in a medical practice (i.e., stock in a P.C. or Inc. or membership units in an LLC) that continues to operate, and which does not constitute the sale of the entire practice, is not considered a “sale” for purposes of the Proposed Rule. This exception would apply when a physician is admitted as a new owner of a medical practice.

Howard Bogard is a Partner at Burr & Forman LLP and chairs the firm’s Health Care Practice Group. He can be reached by email or (205) 458-5416.