The Specialist Forum Volume 13 No 11 November 2013 | Page 36

ETHICS

Retention of medical records

M

any doctors are unaware of how to manage medical records
and do not know when it is permissible to dispose of them.
Good records management is essential for the continuity of
care of your patients, and can reduce the risk of adverse incidents through
misplaced or untraceable records. Problems with medical records - lack
of accessibility, poor-quality information, misinformation, poorly organised
notes, misfiling and many others - are known to lie at the root of a high
proportion of adverse incidents.

‘

Keeping good medical records is a
prerequisite of delivering high-quality,
evidence-based healthcare. Equally
important is ensuring that records are stored
appropriately - it is a doctor’s professional duty
to keep sensitive personal data secure
It is good practice for every healthcare organisation to have a records
management policy in place. A nominated individual should be responsible
for reviewing the policy on a regular basis and ensuring it is up to date with
legislative requirements. Familiarise yourself with the following two record
management standards:
• ISO standard ISO/IEC 27002 (2005): which contains information on
security issues such as staff responsibilities and training, premises,
business continuity, protocols and procedures, email and internet usage
policies, and remote access. This standard has been approved for use
in SA as SANS 27002:2008.
• ISO 27799 (2008): Health Informatics: Information Security Management
in Health, which contains all the relevant guidance in ISO/IEC 27002 as
it relates to the healthcare sector.
The HPCSA offers the following guidance on the retention of medical
records:
• Records should be kept for at least six years after they become dormant.
• The records of minors should be kept until their 21st birthday.
• The records of patients who are mentally impaired should be kept until
the patient’s death.
• Records pertaining to illness or accident arising from a person’s

occupation should be kept for 20 years after treatment has ended.
• Records kept in provincial hospitals and clinics should only be
destroyed with the authorisation of the Deputy Director-General
concerned.
• Retention periods should be extended if there are specific reasons for
doing so, such as when a patient has been exposed to conditions that
might manifest in a slow-developing disease, such as asbestosis. In
these circumstances, the HPCSA recommends keeping the records
for at least 25 years.
• The cost and space implications of keeping records indefinitely must
be balanced against the possibility that records will be found useful in
the defence of litigation or for academic or research purposes.
• Statutory obligations to keep certain types of records for specific periods must be complied with.

Disposal of medical records
An efficient records management system should include arrangements
for archiving or destroying dormant records in order to make space available for new records, particularly in the case of paper records. Records
held electronically are covered by the Electronic Communications and
Transactions Act, which specifies that personal information must be deleted or destroyed when it becomes obsolete.
A policy for disposal of records should include clear guidelines on record
retention and procedures for identifying records due for disposal. Records
should be examined first to ensure that they are suitable for disposal and
an authority to dispose should be signed by a designated member of staff.
Records must be destroyed in a safe, secure manner. Paper records
should be shredded or incinerated. CDs, DVDs, hard disks and other
forms of electronic storage should be overwritten with random data or
physically destroyed. Be wary of selling or donating second-hand computers – ‘deleted’ information can often be recovered from a computer’s
hard drive.
If you use an outside contractor to dispose of patient-identifiable infor mation, it is crucial that you have a confidentiality agreement in place and
that the contractor provides you with certification that the files have been
destroyed.
You should keep a register of all healthcare records that have been destroyed or otherwise disposed of. The register should include the reference
number (if any), the patient’s name, address and date of birth, the start and
end dates of the record’s contents, the date of disposal and the name and
signature of the person carrying out or arranging for the disposal.

Protecting paper records
Paper records can be easily damaged by moisture, water, fire and insects.
It’s a good idea to carry out a risk assessment to identify ways in which
to safeguard them. You must ensure there are systems in place to protect
paper records in case of fire, flood, or other circumstances that could
damage the records.
You must ensure you install smoke and fire alarms to allow you to act
quickly in the event of a fire breaking out. Water sprinkler systems can
damage electronic equipment, so install chemical fire extinguishers to
protect your paperwork. Avoid storing archives of paper records in a basement as they are prone to flooding, and conduct regular inspections of
your premises and have control measures carried out by experts to keep
damaging insects and rodents at bay.
Page 36

November 2013 | The Specialist Forum