HIM 540 Module 6 Information Life Cycle Short Paper Example

Keeping What We Must, Destroying What We May: Retention and Legal Holds at Tidewater Crossing Health

[Student Name]

Southern New Hampshire University

HIM 540: Health Information Governance

Module Six Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Keeping What We Must, Destroying What We May: Retention and Legal Holds at Tidewater Crossing Health

Tidewater Crossing Health pays about $96,000 a year to store 22,000 boxes of paper records at an offsite vendor. One former hospital has not destroyed a record since 1998, another follows a ten-year schedule and the third a seven-year schedule for adults. Electronic data are kept indefinitely because no one has decided otherwise. Meanwhile, a malpractice lawsuit filed last spring concerns a 2019 admission, and no one is sure whether all relevant records were preserved. This paper examines the information life cycle and proposes how the system should retain, preserve and destroy information.

The Information Life Cycle

Information passes through stages: it is created or received, used, stored, shared, retained for as long as required and finally disposed of. Governance applies at every stage, but the last two are the most neglected, because keeping information feels safe and destroying it feels risky. In practice, the reverse is often true. Information kept beyond its required period still has to be protected, searched in litigation and secured against breaches. Liu et al. (2015) found that breaches of protected health information involved many kinds of media, including paper records, which means boxes in a warehouse carry risk as long as they exist.

Building One Retention Schedule

A defensible retention schedule starts from legal requirements and adds business needs. Counsel and compliance have already compiled a register that pairs every category of record with the federal and state rules governing it. Hospitals participating in Medicare must retain medical records for at least five years under the federal conditions of participation, some payer contracts and programs require longer periods, records of minors must be kept for a period tied to the age of majority, and certain records, such as mammography images, have their own federal rules. Business needs, such as research or continuity of care, may justify longer retention for some records. The schedule sets one period for each record type across all four hospitals, choosing the longest applicable legal period plus any documented business need, and applies equally to paper and electronic records.

Legal Holds

A legal hold suspends destruction of information relevant to litigation, an investigation or an audit. The duty to preserve arises when litigation is reasonably anticipated, not only when a lawsuit is filed, and under the federal rules of civil procedure a court may impose remedies, up to instructing a jury about the missing evidence, when digital records a party should have kept are lost. At Tidewater Crossing, the new process works as follows: counsel issues a written hold notice identifying the patients, dates and record types involved; the health information director confirms that the retention system blocks destruction of those records; custodians, including departments that keep their own files, acknowledge the hold in writing; and counsel releases the hold in writing when the matter ends. The lawsuit over the 2019 admission is the first matter placed under the new process, and a search confirmed that its records remained intact.

Defensible Destruction

Destruction is defensible when it follows an approved schedule, is applied consistently, excludes records under hold and is documented. For paper, the system will use a contracted shredding vendor that provides a certificate of destruction listing the boxes destroyed. For electronic media, federal guidance on media sanitization describes methods matched to the sensitivity of the data and the type of media, from clearing and purging to physical destruction, with verification that data cannot be recovered (Kissel et al., 2014). The health information department will keep a destruction log recording what was destroyed, when, by what method, under which schedule rule and with whose approval. Destroying data inside active systems is harder, since records are linked, so the first phase will focus on paper and retired systems.

Departmental Records Outside the Record System

Retention and holds must reach beyond the health information department. Clinical departments keep their own files: research offices keep study records, quality departments keep peer review files, pharmacies keep controlled substance logs and imaging keeps images in its own archive. Some of these follow different laws, such as peer review protections under Virginia law, and some have been kept indefinitely by habit. The inventory in the second quarter will include these departmental records, each department will name a records coordinator and the retention schedule will cover them explicitly. Legal hold notices will go to these coordinators as well, since a hold that reaches only the medical record may miss relevant evidence.

Communicating the Change

Staff who have kept records for decades may resist destruction, fearing that something needed will be lost. The health information director will explain the schedule at each hospital's leadership meeting, show the legal basis for each period and describe the hold process that protects anything under litigation. Staff will see that destruction is a governed decision, not a cleanup.

What Keeping Too Much Costs

Over-retention has direct and indirect costs. Storage fees for the 22,000 boxes are the obvious one. Less obvious are the costs of searching old records during litigation, of protecting them from breaches and of honoring patient requests for information the system no longer needs. Price and Cohen (2019) describe how large accumulations of health data create privacy risks that grow as data are combined and reused, a caution that applies to electronic data kept indefinitely because no one decided otherwise. A schedule that destroys what the law no longer requires reduces all of these costs.

A Phased Plan

Table 1 summarizes the first year of the retention program.

Table 1. First-Year Retention Program

Note. Plan prepared by the author with counsel and the compliance officer.

Conclusion

Keeping everything forever is neither safe nor cheap. Tidewater Crossing's single retention schedule, legal hold process and documented destruction methods let it keep what law and business require, preserve what litigation demands and securely remove the rest. The information life cycle then ends by design rather than by neglect.

References

Kissel, R., Regenscheid, A., Scholl, M., & Stine, K. (2014). Guidelines for media sanitization (NIST Special Publication 800-88, Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-88r1

Liu, V., Musen, M. A., & Chou, T. (2015). Data breaches of protected health information in the United States. JAMA, 313(14), 1471-1473. https://doi.org/10.1001/jama.2015.2252

Price, W. N., & Cohen, I. G. (2019). Privacy in the age of medical big data. Nature Medicine, 25(1), 37-43. https://doi.org/10.1038/s41591-018-0272-7