On August 14, 1997, the Wall Street Journal reported that federal prosecutors claimed to have evidence that Columbia/HCA Healthcare Corporation may have destroyed documents relating to a criminal investigation. The evidence consisted of documents that Columbia had allegedly discarded, in contravention of law. A citizen in El Paso, Texas heard about the federal probe concerning Colombia's Medicare reimbursement practices and alerted law enforcement officials to Columbia documents found in a garbage container.
The accusation against Columbia puts the spotlight on questions that can apply to virtually all health care organizations:
- What should health care organizations do with their documents:
- What documents are organizations required to keep? For how long?
- What are organizations required to do with their documents if they learn or a law suit or government investigation?
- What should health care consultants do with their own records and the records of their clients?
Unclear Obligations
Federal and state laws require businesses to retain certain documents, but the extent of this obligation is not always clear. Numerous statutory requirements and regulations apply to health care institutions in particular. For example, as a condition of participation in Medicare, hospitals and home health agencies must retain certain medical and financial records for at least five years. However, state law may impose additional or conflicting requirements.
No business has an incentive to retain and organize documents that could be used to support a lawsuit against it. Once a document has outlived its business purpose, most businesses would be happy to be rid of it. However, businesses should be aware that they can be held criminally and/or civilly liable for negligent or intentional destruction of documents. While not a guarantee against liability, the best defense against claims of improper destruction of documents is to establish and maintain a records management program.
Records management programs are an important element of any corporate compliance program. A comprehensive program should address the retention and destruction of medical and financial documents, and should include a monitoring system to assure the program's ongoing effectiveness.
Program Administration
No document management program is self-implementing. One particular individual in the organization must be responsible for making sure that the program is up-to-date, and that documents are being retained and destroyed according to program terms. This program manager should periodically provide each department head with a listing of the specific types of records that should be destroyed. However, there must be a mechanism for stopping the destruction of documents in the case of actual or foreseeable litigation, or governmental investigation.
Health care providers should also address how records will be stored. Convenience and accessibility are important considerations, but must be weighed against the need to restrict access when records are subject to heightened confidentiality requirements. In short, a comprehensive records management program is a significant undertaking for any health car provider or consultant.
However, such a program is a necessary expenditure in today's heavily regulated health care market. When one considers that civil and criminal penalties are at stake, it is clear that this is a project well worth the investment.