When a physician retires, closes a practice, or sells it to another provider, the medical records must remain secure and accessible. Choosing a medical records custodian after practice closure is one of the most important transition decisions because it determines who will maintain the records and respond to future requests.
The closing provider may retain the records, transfer them to the purchasing practice, or hire a professional medical records custodian. Each option carries different administrative, security, and compliance responsibilities.
What Does Medical Records Custodianship Involve?
A medical records custodian is responsible for protecting patient records and providing access to authorized individuals. Custodianship involves much more than storing paper charts or retaining access to an electronic medical record system.
The custodian must maintain secure storage, respond to patient and third-party requests, verify authorizations, follow applicable retention requirements, and arrange for proper destruction when the retention period ends. Patients must also receive clear instructions explaining where their records are located and how to request them.
HIPAA does not establish one universal medical record retention period. Retention requirements are generally determined by state laws, licensing boards, contracts, and other applicable regulations. However, HIPAA requires protected health information to remain appropriately secured for as long as it is maintained.
Option 1: The Closing Provider Retains the Records
A physician may decide to remain the custodian after retiring or closing the practice. This option can appear less expensive because it avoids the immediate cost of hiring a third party.
However, the provider remains responsible for the records long after the practice stops operating. Patients, attorneys, insurers, government agencies, and other healthcare providers may continue submitting requests for years.
The provider must maintain a reliable process for receiving requests, confirming authorization, finding the correct records, and delivering them securely. The provider may also need to respond to subpoenas, disability claims, insurance matters, and continuity-of-care requests during retirement.
Security is another major concern. Records stored on personal computers, external drives, old office servers, or in boxes may not have appropriate backups, access controls, disaster recovery systems, or technical support.
The main risks include ongoing liability, inadequate backups, and the burden of continuing to process requests after retirement.
Option 2: The New Practice Accepts Custodianship
When a practice is purchased, the selling provider may prefer to transfer all patient records to the buyer. This arrangement can simplify the closure and provide continuity for patients who plan to remain with the new practice.
However, not every former patient will become a patient of the acquiring organization. Some may choose another provider, move away, or no longer need care from the practice. The buyer can therefore inherit thousands of records belonging to individuals it may never treat.
Accepting custodianship also creates an ongoing administrative function. The new practice may need to:
- Maintain access to old electronic systems, exported files, scanned documents, and paper charts.
- Process requests from patients, attorneys, insurers, government agencies, and other providers.
- Review identities, signatures, authorizations, and legal documents before releasing information.
- Maintain secure storage, backups, request logs, and destruction procedures.
This work can take employees away from scheduling, billing, clinical support, and current patient care. In some cases, the additional workload may require new staff or outside assistance.
Acquiring a practice does not automatically mean accepting its legacy records is the best business decision. The buyer should first evaluate the number of records, their condition and format, applicable retention periods, expected request volume, and the cost of maintaining old systems.
When Should the New Practice Keep the Records?
Accepting custody may make sense when most patients are expected to transfer to the new practice. It may also be practical when the buyer will continue using the same electronic medical record system and the historical information is necessary for ongoing treatment.
The purchase agreement should clearly explain which records will transfer, who will process requests, how expenses will be handled, and what will happen when the retention period ends. The parties should also determine whether patient notice, consent, or other state-specific procedures are required.
Custodianship should be treated as a separate operational responsibility, not an automatic part of purchasing a practice.
Option 3: Use a Professional Medical Records Custodian
A professional medical records custodian takes responsibility for securing legacy records and managing future requests. This allows the retiring provider to complete the closure without personally administering records for years.
It also helps the acquiring practice focus on active patients and business operations. When a former patient establishes care with the new practice, the necessary records can be requested from the custodian through the appropriate authorization process.
New practices generally want their employees focused on caring for patients, not fulfilling requests for people who may never join the practice.
A professional custodian can provide:
- Secure storage for paper and electronic medical records.
- Electronic medical record extraction and document scanning.
- Patient notifications and a dedicated request process.
- Authorization review and secure record delivery.
- Retention tracking and appropriate record destruction.
This approach separates legacy record management from the daily operations of both the retired provider and the new practice.
What to Review Before Selecting a Custodian
Hiring a third party does not eliminate the need for due diligence. The organization must have appropriate safeguards, processes, technology, and experience handling protected health information.
The custodianship agreement should clearly address retention periods, security requirements, patient requests, permitted fees, breach procedures, record ownership, and final destruction. A business associate agreement may also be required when the custodian maintains protected health information on behalf of a HIPAA-covered entity.
Because requirements vary by state and profession, providers should review the rules of the applicable medical or licensing board and consult qualified legal counsel before transferring records.
Choose Custodianship Before Completing the Transition
The custodian determines how patient records will be protected, located, and released after a practice closes or changes ownership. A poorly planned transition can leave patients unsure where to request their information and create years of unexpected work for a retired provider or acquiring practice.
The parties should decide who will manage the records early in the sale or closure process. They should review record volume, file formats, retention requirements, expected patient transfers, security needs, and long-term costs.
Desert River Solutions provides nationwide medical records custodianship, electronic medical record extraction, document scanning, secure storage, and release-of-information support. By transferring legacy records to an experienced custodian, providers can meet their continuing responsibilities while allowing the new practice to remain focused on current patients and daily operations.
