Medical Record Custody & Compliance Checklist for Healthcare Attorneys

The Problem

Myth vs. Fact

Myth: “The acquiring practice takes full responsibility.”
Fact: Unless explicitly transferred in writing, you remain the legal custodian

Myth: “I can store records in my garage or a portable hard drive at home.”
Fact: HIPAA security requirements continue, and you’re liable for any breach

Myth: “After I retire, I’m immune from liability.”
Fact: Legal challenges such as malpractice or liability allegations don’t start until the issue is discovered, and could arise years later. You’ll need to be able to respond with evidence that challenges any allegations.

Know Your Risks | The Real Cost of Non-Compliance:

Audit recoupment demands

Retiring Physician

The reality of DIY record management:

• Physicians receive an average of 15-30 records requests per month post-retirement
• Each request takes 20-45 minutes to process manually
• You’ll need to maintain EMR access ($500-2,000/month), remember login credentials, and navigate legacy EHR platforms you haven’t touched in years
• Hiring a part-time medical records coordinator costs $25,000-40,000 annually
• One missed request or HIPAA violation can result in fines up to $50,000 per incident

Practice Bankruptcy

The costs of non-compliance:

• Federal HIPAA violations: $100-$50,000 per record, per violation
• State medical board sanctions and license implications
• Personal liability that survives corporate bankruptcy protection
• Trustees and courts will require proof of compliant records retention

Without staff, systems, or operating funds, how will you respond to records requests? You need an outsourced solution now—before your EMR access terminates, before your staff leaves, and before you lose the ability to extract and secure your data.

Mergers & Acquisitions

Your remaining obligations:

• Even though your healthcare entity is dissolved, you’re still legally required to:
• Maintain secure custody of all patient records for 7-21+ years depending on patient age and state law
• Respond to patient requests, legal subpoenas, and continuity of care requests
• Ensure HIPAA-compliant storage and access controls
• Provide audit trails and breach notification capabilities

The problem: Once your TSA ends, your EMR access terminates, but the records requests keep coming. Maintaining legacy EMR access costs $15,000-50,000+ annually, and you no longer have staff to manage it.
You need an outsourced archiving solution now—before your systems shut down, before your data becomes inaccessible, and before you’re personally liable for non-compliance.

Patient Health Record Audits

Internal vs. External Audits

• Internal Audits: Conducted in-house to proactively identify inefficiencies, verify compliance with OIG and HIPAA, and ensure proper documentation.
• External Audits: Performed by outside entities like Medicare/Medicaid, commercial payers, or legal investigators to verify claims, billing accuracy, and medical necessity. 

2. Functional & Compliance Audits

• HIPAA/Privacy & Security Audits: Focus on how Protected Health Information (PHI) is accessed and protected, including review of audit logs, user access, and breach policies.
• Coding and Documentation Audits: Review medical records to ensure that documentation supports the ICD-10 and CPT codes billed, maximizing legitimate revenue and preventing overcoding.
• Medical Necessity Audits: Evaluate whether the services provided were medically necessary and appropriate based on the documentation.
• Pharmacy/Medication Audits: Specifically check for compliance in medication administration, documentation, and safety protocols. 

3. Timing-Based Audits

• Prospective (Pre-billing) Audits: Conducted before submitting claims to prevent errors and ensure accurate billing initially.
• Retrospective (Post-billing) Audits: Conducted after services are rendered and billed to identify, correct, or refute improper claims. 

4. Other Specialized Audits

• Random Audits: An audit of a random sample of records to evaluate overall compliance and quality.
• Targeted Audits: Focused reviews on high-risk areas, such as high-dollar claims, specific providers, or frequently audited codes.
• Quality Assurance/Clinical Audits: Review patient care quality, such as compliance with clinical guidelines or infection control protocols.
• Medicare Comprehensive Error Rate Testing (CERT) Audits: Mandatory audits to ensure Medicare claims are paid correctly.
• Hybrid Audit: A combination of random and comprehensive checks for a more thorough overview of claims. 

Patient Health Record Custodianship

When a healthcare organization closes, transitions systems, or no longer maintains access to legacy records, a designated custodian assumes legal responsibility for those records.

As a records custodian, Aesto Health securely manages, maintains, and stores patient medical records on behalf of the original provider or organization. This includes:

• Safeguarding the confidentiality, integrity, and availability of records

• Maintaining secure, compliant storage environments

• Managing authorized record requests and releases

• Ensuring regulatory compliance (HIPAA and applicable state requirements)

• Providing long-term access to patient data as required by law

Custodianship ensures that patient records remain protected, accessible, and compliant — even when the original practice or system is no longer operational.

Patient Health Record Legal Obligations

Healthcare organizations face numerous legal inquiries and obligations regarding patient health records, primarily centered on patient privacy, regulatory compliance, and litigation support. These inquiries often involve balancing the legal requirement to protect patient confidentiality (under HIPAA and state laws) with the need to disclose information for care, legal action, or investigations.

Here are the primary types of legal inquiries a healthcare organization may have:

1. Patient Rights and Access

• Right to Access: Patients have a legal right to inspect and obtain copies of their medical records. Inquiries arise regarding reasonable, cost-based fees, deadlines for production (often 30 days under HIPAA, but state laws may be stricter), and the format of the records.
• Amendments to Records: Patients may legally request that inaccurate information in their record be amended.
• Restrictions on Disclosures: Patients may request restrictions on how their information is used or shared.
• Accounting of Disclosures: Patients may ask for a report of when and why their information was shared for non-routine purposes.

2. Legal Processes and Litigation

• Subpoena Duces Tecum: This is a command for the record custodian to produce specific medical records (or appear in court). Legal inquiries focus on whether the subpoena is valid, if it was issued by a court or just an attorney, and what, if any, patient notification is required.
• Court Orders: Unlike subpoenas, valid court orders usually require compliance, but the organization must still ensure they only release the specific information authorized.
• Discovery Requests: In lawsuits (medical malpractice, personal injury, worker’s compensation), lawyers may request large, relevant portions of the Electronic Health Record (EHR).
• Admissibility: Inquiries into whether the record is complete, properly authenticated, and compliant with privacy laws for use in court.

3. Regulatory Compliance and Privacy

• HIPAA Violations: Inquiries into breaches of confidentiality, such as unauthorized disclosure of Protected Health Information (PHI).
• Information Blocking: Federal law prohibits providers from standing in the way of patients accessing their own information, particularly via APIs (Application Programming Interfaces).
• Identity Verification: Ensuring the person requesting records is authorized to do so (e.g., verifying a personal representative’s legal authority).
• Retention and Destruction: Legal inquiries regarding how long records must be kept and how to securely destroy them.

4. Third-Party Requests

• Law Enforcement: Requests from police investigating crimes, which may require warrants, subpoenas, or court orders, though some exceptions apply.
• Insurance Companies/Audits: Requests for records to justify billing, verify medical necessity, or process claims.
• Child/Elder Abuse Reporting: Mandatory disclosures of records required by state laws.
• Coroners/Medical Examiners: Requests to investigate patient deaths.

5. Sensitive Information and Specialized Laws

• Substance Use/Mental Health Records: Strict, specialized confidentiality laws (e.g., “Part 2” regulations) apply to these records, often requiring more than a standard HIPAA release.
• HIV/Genetic Information: Subject to extra layers of protection.
• Reproductive Health: Specific privacy protections regarding reproductive health records.

6. Subpoena vs. Authorization Inquiries

• Validity of Authorization: Ensuring a release form is signed, dated, and not expired.
• Minimum Necessary Rule: The requirement to disclose only the minimum amount of information necessary for the purpose of the request.

When faced with these inquiries, a healthcare organization typically consults its “custodian of records” or legal counsel to determine the appropriate response, ensuring compliance with both federal (HIPAA) and state regulations.