Medical Record Policy and Procedures - Document security, release, storage, consent, and documentation requirements

Sep 4, 2026

Medical Record Policy and Procedures outlines requirements to keep patient records secure, confidential, and accessible only to authorized parties. It specifies lawful conditions for releasing medical information, including authorized consent, court orders, and regulated disclosure for research without identifying patients. The policy defines secure central storage, retention periods (including minors), organization and retrieval standards, and rules preventing records from being accessible to patients. It also details consent for treatment and medical record documentation practices.

LanguageEnglish

CategoryForms

FormatPDF

Pages4

Reading Time2 min

AccessFree to download

Security of Medical Records

Release of Medical Records and Distribution

Storage and Maintenance

Consent for Treatment

Medical Record Documentation

MEDICAL RECORD POLICY AND PROCEDURES Security of Medical Records 1. The medical record will be secure and inaccessible to unauthorized persons in order to prevent loss, tampering, disclosure of information, alteration or destruction of the record. 2. Information must be accessible only to authorized staff within the physician’s office, contracted health plans, DHS or to persons authorized through a legal instrument (i.e., subpoena) . 3. As per the Provider Agreement/Contract, provisions must be made for the contracted health plan to have appropriate access to the member’s medical records for purpose of quality review. Release of Medical Records and Distribution 1. Patient information and records shall be protected for confidentiality according to the Confidentiality of Medical Information Act which prohibits a provider of health care from disclosing any individually identifiable information regarding a patient’s written consent or specific legal authority. 2. Patient information in a medical record may only be released under the following conditions: a. The attorney or representative of the patient may receive a copy of the medical record after presenting a signed authorization from the patient or his/her representative. The patient must present identification when requesting a copy of his/her medical record. Outside health care providers: Federal, State, County or City agencies; employers; and insurance companies may also receive a copy of the patient record, with the patient’s authorization. b. Any release in response to a court order or to authorized persons will be reported to the patient in a timely manner. c. Member records may be disclosed, with or without patient authorization, to qualified personnel for the purpose of conducting scientific research, but these records must not identify, directly or indirectly, an individual patient in any report of the research or otherwise disclose participant identity in any manner to prevent divulging confidential information. d. In accordance with individual Provider Agreements/Contracts, health plan representatives are provided appropriate access to members’medical records for the purpose of quality review. 3. Only the Medical Record Department or assigned personnel responsible for the maintenance of medical records may provider written documents or copies of patient records. 4. Authorization forms permitting release of medical records must specify whom the information is requested by, the type of information requested and the dated signature of the patient or patient representative. The patient’s name, medical record number, name and organization of the requester, date of the request and date the record was released must be documented and filed in the medical record. 5. Minors have the right to access confidential services without parental consent, therefore those medical records and/or information regarding medical treatment specific to those confidential services are not to be released to parent(s) without the minor’s consent. Storage and Maintenance 1. Medical records will be stored in one central medical record area and must be inaccessible to unauthorized persons. The medical record area need not be locked if staff is present. 2. Medical records are to be maintained in a manner that is current, detailed, organized; permits effective patient care and quality review and maintain confidentiality. 3. All medical records will be maintained for a minimum of ten (10) years following patient discharge, except minors. Records of minors must be maintained for at least (1) year after a minor has reached age 18, but in no event for less than ten (10) years. 4. Printed chart contents will securely fastened, attached or bound to prevent medical record loss. 5. The records must be filed alphabetically, numerically and/or color coded for easy retrieval. 6. Each patient must have his own medical record. No“family”charts are allowed. 7. Medical re

FAQs

Who is allowed to access medical records under the policy?

Access is limited to authorized staff within the physician’s office, contracted health plans, DHS, or persons authorized through a legal instrument such as a subpoena. Provider agreement provisions may also grant contracted health plan access for quality review.

Under what conditions can patient information be released?

Patient information may be released with signed authorization by the patient or representative, in response to court orders with timely notice to the patient, or for qualified scientific research without identifying the individual. Releases may also occur under specific provider agreement/contract arrangements for quality review.

How long are medical records required to be stored?

Medical records must be maintained for at least ten years following patient discharge, except minors. Records for minors must be kept for at least one year after the minor reaches age 18, but never for less than ten years.

Sep 4, 2026

Upload by Ethan Miller