10 AHLA Connections March 2018
Medical Record Issues in the Transfer or Closing of a Medical
Practice: Address Them Upfront to Avoid Problems Later
By Gerard M. Nussbaum, Zarach Associates LLC, and Rick L. Hindmand, McDonald Hopkins LLC
Details regarding how medical records will be handled in the
sale or closing of a medical practice are sometimes relegated to
general boilerplate provisions and viewed as side issues during
the negotiation process. Yet, how the rights and responsibilities
of the parties regarding the transfer, retention, maintenance,
and accessibility of medical records are (or are not) addressed
in the underlying agreement(s) can have far-reaching and long-
lasting implications.
Transactions involving the transfer of medical records can
be triggered by various circumstances, such as the sale or lease
of a medical practice, consolidation into a larger group practice,
departure of one or more physician owners to a dierent prac-
tice, or the death or retirement of a physician. ese transac-
tions are oen asset sales, but may also be structured as sales of
ownership interests in a medical entity or other arrangements
involving health systems or private equity rms. Transfers may
occur when a retiring physician refers her patients to another
physician to assure the patients have continuity of care. ese
referral arrangements may or may not be associated with the
sale of other assets.
For simplicity, this article uses the terms “seller” to include
the physician who departs the practice or the medical practice
entity selling the practice, even if there is not a formal sale (e.g.,
retirement), and “acquirer” to denote the physician or entity
that assumes the practice, even if there is not a formal purchase
(e.g., a retiring physician’s recommendation to patients on a
successor physician).
As of 2015, over 78% of United States oce-based physi-
cians had adopted a certied electronic health record (EHR)
system.
1
Given the prevalence of EHR systems, the article
healthlawyers.org 11
focuses primarily on electronic records, though many of the
issues discussed can also apply to paper records. In either
case—paper or electronic—a multitude of potential issues
may arise regarding the handling and accessibility of medical
records when a practice is sold, leased or shut down, or when a
physician departs, retires, or passes away. Assuring compliance
with legal and professional standards requires careful attention,
and how the parties divide the responsibilities for the aected
medical records may impact the ultimate price paid in the sale
of a practice. e division (or absence) of such responsibilities
also may impose ongoing costs on one or both parties.
Medical records typically warrant a more customized
approach than most other medical practice assets due to the long
term implications as well as legal, professional, strategic, and
operational issues involved. It is therefore crucial for parties and
attorneys involved in the sale or closing of a medical practice to
plan ahead for medical record issues, including how the records
will be transferred and integrated, how they can be accessed
by the parties and by patients, who will be responsible for
responding to patient requests, and how the parties will allocate
the costs of these arrangements. How these and other relevant
issues are addressed will vary depending on a number of factors,
including the parties involved, the circumstances, and attention
devoted to each issue.
Medical records typically warrant
a more customized approach than
most other medical practice assets
due to the long term implications as
well as legal, professional, strategic,
and operational issues involved.
Benet or Burden?
In many states, medical records are owned by the provider
(such as an individual physician or medical practice). Physician
employment agreements oen include provisions granting
ownership to the practice entity for which the physician works.
While patients may not have an actual ownership stake in the
records, they do have a number of rights, including, the right
to review, obtain copies, submit corrections, and restrict access
to the records, as well as obtain an accounting of disclosures.
In the event of a transfer of medical records, the parties should
agree on how to notify patients, who will be responsible for
maintaining the records (custodianship), and who will respond
to requests from patients (including personal representatives).
e laws of some states establish minimum record reten-
tion periods, such as seven years from the last date of service.
In some states, the period can stretch to 10 years, or longer for
specic types of records for minors.
2
While federal law is gener-
ally silent on general retention periods for medical records of
a physician practice, regulations require retention of records
(six years)
3
to support an accounting of disclosures under the
Health Insurance Portability and Accountability Act (HIPAA),
4
and 10 years for Medicare Advantage.
5
A seller may also have an interest in assuring that it retains
the right to access medical records if it needs to defend itself
in the event of a medical malpractice suit or other action (e.g.,
governmental investigation, disciplinary action, or payer audit).
In many states, the statute of repose for professional liability
actions is four years from the time at which the act, error, or
omission giving rise to the injury occurred. Some states may
have longer statute of repose periods,
6
or they may impose
tolling if the physician knew but did not disclose relevant infor-
mation
7
or if the act, error, or omission involved a specic type
of injury, such as foreign objects being le in the patient.
8
In
some cases, a state’s statute of limitations in written contracts—
which can be as long as 10 years—also may inuence the
retention decision.
In some cases, the angry departure of a physician from a
group practice may raise issues as to the appropriate handling
of medical records for patients who were being treated by the
departing physician. e group practice may try to have the
aected patients seen by one of the group’s remaining physi-
cians. Depending on the terms of the departing physician’s
contract, issues may arise concerning his or her ability to make
and take copies of patients’ medical records; post-departure
access to records; the medical group’s need to retain copies
12 AHLA Connections March 2018
of the aected records; and potential data breach and unau-
thorized access to records. A medical group may be able to
address these issues early on by carefully craing its notice of
privacy practices and patient consent forms to make it clear
that the group, its physicians, and sta may access the patient’s
protected health information (PHI).
A little extra attention early on can
avoid signicant problems down
the road, such as failing to satisfy
record retention responsibilities,
being unprepared to respond to
patient requests or lawsuits, and
disagreements over storage costs
and administrative burdens.
Clean Up Your Storage Room (Virtual or Otherwise)!
One of the challenges that an acquirer faces is that medical
records typically contain records for both active and inactive
patients, i.e., those who have not been under the care of the
seller for some time. In the case of paper records, it may not
be practical or economical to separate records between active
and inactive patients. An EHR, on the other hand, can easily
identify active patients by sorting records by date of last service.
is quick and simple assessment can help an acquirer assess
the burden of assuming the responsibility for maintaining the
acquired records.
While a physician practice might purge paper records that
have sat in storage for many years, the low cost of storage, inertia,
and challenges of using purge functions in an EHR system may
prevent the same level of housekeeping for electronic records. As
a result, the acquirer may be faced with the substantial burden of
maintaining records that are unlikely to correspond to patients
who will continue to seek care from the acquirer. e burden
can be magnied when the acquirer has its own EHR system and
wishes to convert records from the seller’s EHR into the acquir-
er’s EHR, especially because conversion costs are oen driven in
part by the number of records to be converted. Added costs also
may be incurred by the acquirer if part of the ongoing EHR-re-
lated costs takes into account the number of patient records that
must be maintained in the EHR system.
Another factor that oen mitigates against conversion of
records is concern about the quality of those records. Many
providers experienced a signicant learning curve when they
adopted EHRs, which inevitably impacted the quality and
completeness of the records. In many cases, for example, physi-
cians treated the dictated note—which is a free text eld—as
the primary documentation, leaving discrete elds incomplete
or in conict with the dictated note. us, the acquirer may
not wish to convert records that do not meet current standards
for data quality.
If only records for active patients are transferred, the seller
may be faced with the responsibility of providing appropriate
custodial services for the records that the acquirer refused to
accept. In many cases, identifying and purging records from an
EHR system may require more work than either party is willing
to undertake or fund, especially when sucient records must
be retained to meet requirements under state and federal laws.
If the parties decide to purge records, the deletion should be
carried out in a manner that complies with HIPAA’s require-
ments regarding the destruction of PHI.
9
is will require
physical destruction by a vendor or personnel with appropriate
training in information disposal in accordance with industry
best practices.
10
e parties should also assure that appropriate
records regarding the disposal activities are maintained and
that the disposal process addresses backup media or services
that may contain copies of PHI within purged records.
The Tip of the Iceberg
Medical record discussions oen focus on the chart itself, but
there may be adjuncts to the chart that also must be considered.
For example, if the physician practice had a laboratory or other
diagnostic testing facility, the parties may need to address the
transfer and handling of specimens, computer or paper les
associated with any laboratory information and lab automation
systems, and their underlying soware, contracts, and support
agreements. Similar issues with other systems and data reposi-
tories may arise if the seller provided imaging services and had
other standalone systems, such as PACS.
11
Unless the acquirer continues to use and maintain the
existing systems in the acquired practice, issues with meta-
data need to be addressed. Metadata, which includes audit
logs, may be needed to respond to medical malpractice claims
(e.g., to show when a record was created, accessed, reviewed,
or updated and by whom); provide a means for review and
audit of the complete record in the event of a Medicare claims
audit;
12
or respond to requests for an accounting of disclosure
under HIPAA.
13
Metadata is oen not converted when the main
clinical and billing records are moved into the acquirer’s EHR
system, so provisions may need to be made to maintain access
to the old EHR platform—which may have signicant ongoing
costs—or export the les to searchable media so that the seller
can access the metadata when necessary.
In some cases, the angry departure
of a physician from a group
practice may raise issues as to
the appropriate handling of medical
records for patients who were
being treated by the departing
physician.
healthlawyers.org 13
Custodial Arrangements
As discussed above, both the acquirer and the seller have an
ongoing interest in the medical records. e acquirer will likely
need access to the records of patients who continue to seek
care in the acquired practice, but may have less interest in the
records of inactive patients. On the ip side, the seller needs to
maintain access to records to defend against medical malprac-
tice, overpayment, disciplinary or other claims and actions,
and to respond to patient requests. In addition, some states may
prohibit or severely restrict the sale of medical records. In that
case, it may be a good idea to address the transfer of medical
records through a custodial agreement rather than having them
transferred with the other assets.
While electronic records could be held by both the seller
and the acquirer, this may not be a realistic option for the seller,
especially if he or she is retiring from the practice of medicine
or taking on a new role that does not involve maintaining a
medical practice. Whether the medical records are paper or
electronic, maintaining them is a substantial burden; the holder
must, under HIPAA and state laws, act to assure the condenti-
ality, integrity, and accessibility of those records.
In addition, increase in cybercrime means that risks to
electronic records are mounting daily. If the seller retains
possession of the records, the seller would need to provide
appropriate security for the records, assure ongoing cyber
liability insurance coverage as needed, and provide for the tech-
nical environment in which the records would be maintained
in an accessible manner. e seller may also need to make
arrangements for a license from the EHR vendor, pay the costs
of conversion to a more generally accessible format, or arrange
for the acquirer to assume these costs.
Alternatively, the seller could enter into a custodial agree-
ment with the buyer wherein the buyer would maintain custody
over the records and perhaps assume responsibility for the
duties the seller has to release information to patients, as well
as provide the seller with access to the records to support
a seller’s response to suits and claims. Even if the acquirer
assumes responsibility for managing the release of informa-
tion, the underlying duty to the patient remains with the seller,
who may potentially be held responsible if the acquirer fails to
fully perform its agreed upon duties. us, a seller may seek to
include indemnication from the acquirer for any such failures
in the sale or transfer agreement.
If, on the other hand, the acquirer assumes custody for all of
the records from the practice, there will inevitably be a subset
of patients who choose to use a dierent provider, as well as a
number of records that belong to inactive patients. e acquirer
eectively may not have a treatment relationship with these
patients who have found dierent providers or are now consid-
ered inactive. As such, depending on the nature of the trans-
action, the acquirer may lack patient consent to access these
records. e seller may therefore want to assure that a business
associate agreement is in place, with the acquirer being identi-
ed as the business associate.
You Are Not Good Enough for Me
A dierent type of challenge may arise when a health
system acquires independent physician practices or enters
into management or practice lease arrangements. In many
instances, the health system may be unwilling to assume
responsibility for the existing medical records.
A health system usually seeks to incorporate the acquired
practice’s medical records into its own EHR platform. As part
of this process, patient records are usually only abstracted when
an appointment is scheduled, with only clinical data relevant
to the ongoing care of the patient being entered into the health
system’s EHR. Such abstraction of patient records oen results
in the original records remaining the property of the seller,
with some or all of the seller’s physicians becoming employees
of the health system.
Some major considerations or factors driving this approach
may be that the records of the acquired practice were created
under less rigorous standards than those maintained by the
health system’s health information management (HIM) and
quality control departments; the records may not conform
to the health system’s risk management protocols; and/or the
health system may not have the bandwidth to handle a wide
variety of medical record types, systems, and formats. e
cost of maintaining the records could then fall to the seller,
which can be an unanticipated cost. Further, when continuing
patients request copies of their records, the request can create
a bifurcated process, with release of information for records
aer the date of sale going through the health system’s HIM
department, but pre-sale records being handled by the seller. In
some cases, health system protocols may limit the ability of the
practice sta—who are now employees of the health system—to
support this process on behalf of the seller.
A different type of challenge
may arise when a health
system acquires independent
physician practices or enters into
management or practice lease
arrangements.
Where Danger Lives
In some situations, the transfer of the practice, or a part
thereof, is precipitated by factors that make it dicult to plan
for the orderly handling of records. For example, when a prac-
tice experiences bankruptcy, Section 351 of the Bankruptcy
Code provides that the trustee may destroy medical records
if adequate funds are not available to pay for their storage.
14
While the Bankruptcy Code provides a year-long process,
including notice to patients to provide them with the oppor-
tunity to request a copy of their records, those records may be
destroyed at the end of the notice period.
15
is bankruptcy
14 AHLA Connections March 2018
provision not only takes precedence over state law record
retention requirements, but it also overrides any requirements
under HIPAA to maintain the records that would otherwise be
necessary to support an accounting of disclosures. While the
destruction requirements under Section 351 are not as compre-
hensive as those under HIPAA, the trustee would be well
advised to adhere to the requirements set forth in the HIPAA
regulations
16
to assure that records are destroyed so that they
cannot be retrieved at a later time.
17
It’s Complicated
How to best handle medical records is one of the many issues
that must be addressed when selling or closing a medical prac-
tice. How the parties agree to address those issues may impact
the sale price of the practice and costs incurred by the parties in
eectuating the transfer and transition of the records, including
ongoing costs, liabilities, and exposures. By considering the
rights and responsibilities of each party regarding medical
record retention, transfer, maintenance, and access—as well as
related nuances and potential complications—the parties and
their attorneys will be better positioned to proactively address
these issues when negotiating the transaction. A little extra
attention early on can avoid signicant problems down the
road, such as failing to satisfy record retention responsibilities,
being unprepared to respond to patient requests or lawsuits,
and disagreements over storage costs and administrative
burdens.
Gerard Nussbaum is a principal at Zarach
Associates LLC. He focuses his practice on
digital health, health information technology,
privacy, cybersecurity, strategic planning,
regulatory compliance, and mergers and acqui-
sition planning, due diligence, and execution.
Rick Hindmand is a member at McDonald
Hopkins LLC in Chicago, IL, where he focuses
his practice on health care regulatory, reim-
bursement, data privacy and cybersecurity,
corporate and transactional matters.
Endnotes
1 The Ofce of the National Coordinator for Health Information Technology,
Percent of U.S. Physicians that Adopted Any, Basic, and Certied EHRs:
2015, Health IT Dashboard, available at https://dashboard.healthit.gov/
apps/health-information-technology-data-summaries.php?state=
National&cat9=all+data&cat1=ehr+adoption#summary-data
(last accessed Nov. 1, 2017).
2 State Medical Record Laws: Minimum Medical Record Retention Periods
for Records Held by Medical Doctors and Hospitals, Table A-7, available at
https://www.healthit.gov/sites/default/les/appa7-1.pdf (last accessed Nov.
1, 2017).
3 45 C.F.R. § 164.528(a)(1).
4 The Privacy, Security and Breach Notication Rules under the Health
Insurance Portability and Accountability Act at 45 C.F.R. Parts 160 and 164.
5 42 C.F.R. § 422.504 (d)(2)(iii).
6 Hawaii has a six-year statute of repose, Hawaii Re v. Stat. § 657-7. 3.
7 Id.
8 Ten years in North Carolina, N.C. GeN Stat. § 1-15.
9 45 C.F.R. § 164.310(d)(2)(i), et seq.
10 See, e.g., National Institute of Standards and Technology Special
Publication 800-88, Guidelines for Media Sanitization (NIST SP 800-88).
11 PACS (picture archiving and communication system) is used to analyze,
store, and manage the images.
12 Centers for Medicare & Medicaid Services, Medical Record Retention and
Media Formats for Medical Records, MLN Matters® Number: SE1022
(Aug. 21, 2012) (“[T]he medical record needs to be in its original form or in a
legally reproduced form, which may be electronic, so that medical records
may be reviewed and audited by authorized entities. Providers must have a
medical record system that ensures that the record may be accessed and
retrieved promptly.”).
13 45 C.F.R. § 164.528(a)(1).
14 11 U.S.C.A. § 351.
15 Id. The statute sets forth additional requirements, including notice to
insurers and the appropriate federal agency.
16 See discussion supra, inclusive of notes 9 and 10.
17 11 U.S.C.A. § 351(3)(B).
Thanks go out to the leaders of the Physician
Organizations Practice Group for sponsoring this
feature article: David T. Lewis, Lewis Health Advisors,
Brentwood, TN (Chair); Kathryn E. Hickner, Ulmer &
Berne LLP, Cleveland, OH (Vice Chair—Publications);
Tami Reinglass Horton, Cancer Treatment Centers of
America, Zion, IL (Vice Chair—Membership); Alyson
M. Leone, Wilentz Goldman & Spitzer PA, Woodbridge,
NJ (Vice Chair—Strategic Planning and Special Projects);
Ethan E. Rii, Vedder Price Kaufman & Kammholz PC,
Chicago, IL (Vice Chair—Research & Website); Daniel F.
Shay, Alice G. Goseld & Associates PC, Philadelphia,
PA (Vice Chair—Educational Programs); and Patrick D.
Souter, Gray Reed & McGraw PC, Dallas, TX
(Social Media Coordinator). For more information
about the Physician Organizations Practice Group,
visit www.healthlawyers.org/PGs.
