What considerations will you consider in preparation for drafting your policy?
Identify 3 factors that could pose a disaster threat to health information along with suggestions for disaster recovery.
Explain how you will be guided by the AHIMA Code of Ethics by specifically identifying the relevant ethics principle(s) and interpreting it in your own words.
As a new HIM director of a large healthcare system composed of multiple sub-acute care facilities with locations in multiple states of the US. You could use the example of Atlantic Health System or other similar health care organization of your choice (the selected organization must extend health care operations in more than one state). The organization uses an EHR but has some paper records, as well. One of your tasks is to put together a health record retention policy for the entire organization.
Sample Answer
Health Record Retention Policy Preparation
In preparing to draft a health record retention policy for a multi-state healthcare system, I would first consider the following:
Legal and Regulatory Requirements: I'll research and compile all federal and state laws governing health record retention. This is crucial because retention periods vary significantly by state and type of record. For example, some states require a 10-year retention period for adult records, while others might require longer periods, especially for minor patients. I will also need to consider federal regulations like HIPAA, which mandates the retention of certain documentation for six years.
Organizational Needs: I'll assess the organization's specific needs, including the types of health records generated (e.g., inpatient, outpatient, behavioral health, imaging) and the mix of electronic health records (EHR) and paper records. The policy must provide clear guidance for both formats. I will also consider the operational impact, such as storage capacity and the cost of maintaining both digital and physical archives.
Stakeholder Input: I will consult with key stakeholders, including legal counsel, IT/IS security, clinical leadership, and finance. Their input is essential for creating a policy that is not only compliant but also practical and executable across all facilities and states.
Disaster Threats to Health Information and Recovery
Three factors that could pose a disaster threat to health information are natural disasters, cyberattacks, and human error.
Natural Disasters (e.g., floods, hurricanes, fires): These events can physically destroy servers and paper records, making data irretrievable.
Disaster Recovery Suggestion: Implement a robust off-site backup and data replication system. This includes regularly backing up EHR data to a secure, geographically distant data center. For paper records, a disaster plan should include a process for storing vital records in a secure, fireproof, and waterproof location, with a contingency plan for salvage and restoration.
Cyberattacks (e.g., ransomware, data breaches): Malicious actors can encrypt or steal health data, holding it for ransom or selling it on the dark web.
Disaster Recovery Suggestion: A comprehensive plan should include data backups that are isolated from the network to prevent them from being encrypted. The plan also needs an incident response team to contain the breach, investigate the attack, and begin the data recovery process. Regular security audits and employee training on phishing and security hygiene are also crucial preventative measures.
Human Error (e.g., accidental deletion, improper handling of records): An employee could inadvertently delete critical data or misplace paper charts, leading to a loss of information.
Disaster Recovery Suggestion: The best defense is a combination of strong access controls and a detailed audit trail. Data restoration protocols must be in place to recover files from backups. For paper records, a strict check-in/check-out system and a clear chain of custody are essential to prevent misplacement.
Guidance by the AHIMA Code of Ethics
I will be guided by the AHIMA Code of Ethics in drafting this policy, particularly the principles related to protecting patient privacy and security and stewardship of health information.
Principle: Protect health information and privacy and security.