What Virginia’s New Record Retention Regulations Mean for Practices

A new Virginia law, effective July 1, requires health care practitioners licensed by the Board of Medicine to maintain health records for a minimum of six years following the last encounter with the patient. The law (HB 1524) also indicates that providers are not required to maintain health records for longer than 12 years from the date of creation, with a few exceptions. The 12-year limit for record retention marks a shift from previous parameters provided by the state.

Curi’s Risk Management team recommends that medical records from all sources be kept in their original form forever. However, the team also recognizes this isn’t always practical, especially for practices that maintain paper records.

Here’s what medical practices need to know to ensure they’re in compliance with the new law, plus additional guidance for mitigating potential risk around medical record retention:

Exceptions to the Law

According to the new law, physicians must keep records for a minimum of six years from the last patient encounter but not more than 12 years from date the record was created, with the following exceptions:

1. Minors’ records, including immunizations, must be maintained until the child reaches the age of 18 or becomes emancipated, with a minimum time for record retention of six years from the last patient encounter regardless of the age of the child.
2. Records that have previously been transferred to another physician or healthcare provider or provided to the patient or his or her personal representative do not need to be kept. This refers mainly to records transferred as part of selling or closing a practice.
3. Records required by contractual obligation or federal law to be maintained for a longer period of time must be preserved, including mammography films and OSHA blood-borne pathogen employee records.

Guidelines for Records

• Deceased patients: Records should be kept for six years after the date of the patient’s death, subject to the above exceptions.
• Immunization records: Immunization records must be kept forever. Every state has an immunization database; however, practices should also maintain their own immunization records as a back-up.
• X-rays: X-rays are not legally different from other forms of patient records, so the same retention advice applies to them as it does to other records.
• Employee injury records: These records must be kept for five years.
• Employee blood-borne pathogen exposure records: These records must be kept for the duration of employment plus 30 years.
• Mammograms and interpretations: These records must be kept for 10 years from the last encounter.

The above guidelines indicate the minimum amount of time that Virginia practices need to keep various patient records. It’s also important to note that records of patients who experience unexpected bad outcomes should be kept indefinitely, especially if there’s a concern about a future lawsuit.

In addition, rules for record retention are the same whether the records are kept in paper form or stored electronically. Physicians must also inform all patients of the timeframe for record retention and destruction.

Curi members seeking more information or advice on this topic, including record retention regulations for practices in other states, may contact our Risk Management team at 800-328-5532.