Even after you retire from medical practice, you’re still responsible for your patients’ protected health information (PHI) as long as you or your practice hold their records. HIPAA doesn’t retire when you do.

Planning ahead protects your patients, preserves their access to records and reduces your compliance risk. Here’s what still applies and how to hand records off the right way.

Why HIPAA Still Applies After Retirement

Closing your practice doesn’t end your HIPAA obligations for records you still hold. You remain responsible for:

• Safeguarding records. You must protect PHI from unauthorized access, loss or improper disposal, whether it’s paper or electronic.
• Patient access. Patients have a right to copies of their records. HIPAA generally requires a response within 30 days, with one 30-day extension allowed.
• Retention under state law. HIPAA doesn’t set a retention period for medical records; your state does. (HIPAA’s six-year rule applies to compliance documentation such as policies and authorizations, not patient charts.)
• Proper disposal. When records reach the end of their retention period, they must be destroyed so they can’t be read or reconstructed.

Losing records, letting them sit unsecured in storage or failing to respond to patient requests can lead to HIPAA penalties and licensing complaints, even after your doors close. For the full list of steps before closing, see our medical records checklist for retiring physicians.

Who Can Take Custody of Your Records?

Most retiring physicians choose one of two paths:

• Transfer records to another practice. If a colleague or buyer is taking over your patients, their practice can take custody of the records and become responsible for them.
• Appoint a medical records custodian. A custodian holds your records for the rest of the retention period and handles requests from patients and other authorized parties. A colleague, an attorney or a company that specializes in custodial services can fill this role.

If a third party will store or handle PHI on your behalf, HIPAA requires a business associate agreement (BAA) that spells out how they’ll protect it. Many state medical boards also expect a written agreement that guarantees both you and your patients can get to the records.

What to Look for in a Medical Records Custodian

Before you sign with a custodian, confirm they offer:

• A signed business associate agreement covering storage, access and disposal of PHI
• Secure storage, with access-controlled facilities, monitoring and a clear chain of custody for paper and electronic records
• A defined request process, including how patients, attorneys and other authorized parties request records, how identities are verified and how fast requests are filled
• Transparent fees, so you know who pays for storage and copies and that patient fees comply with HIPAA and state law
• A retention schedule that meets your state’s rules, plus documented, secure destruction when it ends
• A plan if the custodian closes or is sold, covering what happens to your records in that case

How Record Storage Systems Can Help

Record Storage Systems works with healthcare organizations in the Charlotte area that are still operating, including practices taking over records from a retiring colleague. We provide:

• Secure offsite storage in a HIPAA-compliant facility
• Document scanning and indexing to bring incoming charts into your system
• Certified document shredding when records reach the end of their retention period

If your practice is absorbing patient records, contact us to plan secure storage and access.