DOHP 4-E-9 Health Record.pdf

Department of Health Policy Office of Information Technology Health Record

DOHP 4-E-9 Page 1 of 11

TABLE OF CONTENTS

Section Page

I. Policy Statements 2

II. Definitions 2

III. Procedures 4

IV. Training 7

V. Authority 7

VI. Supportive Data and References 8

VII. History Notes 8

VIII. Signature and Effective Date 9

IX. Appendices 9

Appendix A – Sample Legal Health Record Matrix 10

DOHP 4-E-9 Page 2 of 11

I. Policy Statements

A. The Florida Department of Health (Department) strives to create and maintain health records that, in addition to their primary intended purpose of clinical and patient care use, will also serve the business and legal needs of the Department.

B. This policy defines the legal health record for client information stored within the Department’s Health Management System (HMS). The HMS legal health record will consist of the paper medical record and electronic health documentation. The legal health record is the repository for information of the patient’s health history, past and present illnesses, and documentation of the continuum of care and treatment provided by the Department. The same standards of documentation, authentication, and access apply to paper and electronic health records (EHRs).

Medical records, whether in electronic or paper format, should be stored in a manner to allow for lawful access and maintain confidentiality.

C. County health departments (CHDs) should direct questions or concerns about health record management or release of information to their local legal counsel.

D. In accordance with rule 60L-36.005(3)(e) of the Florida Administrative Code (F.A.C.), all Department employees must abide by Department policies and procedures in performing their duties.

II. Definitions

Access: To approach, view, instruct, or communicate with stored data, to retrieve data from, or otherwise make use of, any information or system resource.

Authentication: The process of recording the responsible individual for the entry with full name, title, date, and time.

Authorization: A detailed document that gives covered entities permission to use protected health information (PHI) for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose PHI to a third party specified by the individual. An authorization must specify: a description of the PHI to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization.

Consent: Granting permission to health care providers to examine or treat clients or release health or other personal identifiable information for payment, treatment, or health care operational purposes. The Health Insurance Portability and Accountability Act (HIPAA) permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of PHI for treatment, payment, and health care operations.

DOHP 4-E-9 Page 3 of 11

Designated Record Set: Includes medical records, billing records, payment and claims records, health plan enrollment records, case management records, as well as other records used, in whole or in part, by or for a covered entity to make decisions about individuals. (45 C.F.R. 164.501).

Electronic Health Record (EHR): A health record created, maintained, and stored in electronic format. The health record may be longitudinal, containing information beyond the scope of the actual treatment facility. Patient demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, and ancillary reports should all be included in the EHR. The EHR automates and streamlines the clinicians’ workflow. The EHR can generate a complete record of patient encounters as well as support other care-related activities.

Imaging: Computerized tomography, magnetic resonance imaging, ultrasound, and nuclear medicine reports.

Legal Health Matrix: Tool to track where and how the health record documentation resides.

Minimum Necessary Standard (Need to Know): A standard for staff, which requires that PHI should not be used or disclosed when it is not necessary to satisfy a particular purpose or to carry out a function.

Patient Health Record: A systematic documentation of a patient’s medical history and care. This record serves as a method of communication among health care providers caring for a patient and provides supporting documentation for reimbursement of services provided to a patient.

Protected Health Information (PHI): Individually identifiable health information relating to the past, present, or future health status of an individual that is created, collected, or transmitted, or maintained by a HIPAA covered entity in relation to the provision of health care, payment for health care services, or use in health care operations. This definition excludes individually identifiable health information in education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. 1232g, records described as 20 U.S.C. 1232g(a)(4)(B)(iv), and employment records held by a covered entity in its role as employer.

Radiology: X-ray exams and reports.

Super Confidential Information: A subset of PHI that includes, but is not limited to, information relating to substance abuse and related treatment; human immunodeficiency virus (HIV) and acquired immunodeficiency syndrome (AIDS); psychotherapy notes documenting or analyzing conversations with individuals during any mental health evaluation and/or counseling session.

DOHP 4-E-9 Page 4 of 11

III. Procedures

A. The health record may include both paper and electronically generated documents for patients who receive health care services at the CHDs and through children’s medical services (CMS).

B. Access to the health record will be limited to employees and contractors with a “need to know” and the authority to access PHI.

C. Documentation in the health record must be either authenticated electronically or by signature, as required for legal documentation.

D. Documentation should be individualized to the patient and encounter. The user is cautioned to minimize the use of “copy/paste” or carry forward features of the EHR without carefully reviewing and updating all information. Documentation of clinical findings for each patient encounter must accurately reflect the actual care provided. The use of “copy/paste” should only be employed in circumstances when the totality of copied material from prior interactions is pertinent to the current situation.

1. Avoid insufficient documentation such as:

a. Incomplete progress notes (e.g., unsigned, undated, insufficient detail).

b. Unauthenticated medical records (e.g., no provider signature, no supervising signature, illegible signatures without a signature log or attestation to identify the signer, and an electronic signature without the electronic record protocol or policy that documents the process for electronic signatures).

c. No documentation of intent to order services and procedures (e.g., incomplete or missing signed order or progress note describing intent for services to be provided).

2. Clinic visit notes should be generated at the time of service or shortly thereafter. Delayed entries within a reasonable time frame (24-48 hours) are acceptable for purposes of clarification, error correction, the addition of information not initially available, and if certain unusual circumstances prevented the generation of the note at the time of service.

3. Core health-related data that is found in the electronic or paper-based records include the following items:

a. Demographic, including eligibility and third-party information

b. Consents and administrative management documents

c. History

DOHP 4-E-9 Page 5 of 11

d. Immunizations

e. Medications

f. Physical findings

g. Diagnostic testing (lab, imaging, etc.) and service orders

h. Diagnostic results

i. Consultation requests and reports

j. Procedure notes

k. Psychological/social evaluations

l. Progress notes

m. Discharge summaries

n. Referrals

o. Programmatic health assessments

p. Case management and care coordination

4. Photographs may be included as part of the health record to aid in patient identification and medical care. Client consent should be obtained and documented prior to photographic images being taken. Photographic images should be retained in the medical record consistent with proper recordkeeping procedures. Any release of printed photographs should be consistent with standard procedures for release of HIPAA-protected materials.

5. The same standards of documentation, signature, and access apply to both paper and EHRs.

6. The CHDs shall maintain an internal document that defines the type of clinical data and its location, either on paper or electronic, during the ongoing transition process from paper to EHR. See Appendix A – Sample Legal Health Record Matrix.

7. The CHDs shall complete a quarterly review of 10 clinical health records from the previous three months. The review should focus on accurate and complete clinical documentation that supports the continuity and quality of patient care. A clinician (mid-level or above) should review the clinical portions of the records. Business office staff should review records for

DOHP 4-E-9 Page 6 of 11 completion of client demographics, accurate medical records disclosure documentation, program eligibility, and coding/billing.

8. Designated Record Sets:

a. General medical record set for clients who initiate services at a

CHD. Includes medical records, billing and payment records, insurance information, clinical laboratory test reports, x-rays, wellness and disease management program information, and notes (such as clinical case notes or “SOAP” notes, but not including psychotherapy notes).

b. Separate record sets for Women, Infants, and Children, and dental health records may be maintained if approved by the State Surgeon General or the local CHD health officer.

c. Healthy Start records maintained under contractual agreement, with an entity outside the purview of the Department, may maintain a separate data set.

d. Health records maintained for the purposes of epidemiological investigation and research study are not part of the patient’s personal health records and should be maintained in a separate record set.

e. Super Confidential Information

(1) Criminal or forensic evaluation and treatment records must be maintained separately, including those of Florida’s Child Protection Team. CHDs that maintain forensic sexual assault or sexual battery records must ensure that those records are maintained in a separate record set from other CHD health care records.

(2) Mental/behavioral health and substance use disorder counseling notes must be maintained in a separate record set from the client’s treatment and medical records and require specific authorization for disclosure. All other mental/behavioral and substance use disorder records are maintained as part of the general health record.

(3) Sexually transmitted disease (STD) epidemiological case investigation documentation, including HIV case investigation information contained in the disease report, is not a part of patient personal health records and therefore is not to be included in either the paper or electronic health or legal medical record and should be maintained in a separate record set (e.g., STARs or Merlin). Do not include

DOHP 4-E-9 Page 7 of 11 the actual name of any partner(s) in the index patient HMS record even if the name is known.

f. Record Retention and Destruction

(1) In the absence of investigation, litigation, or legal hold, records that have satisfied their legal, fiscal, administrative, and archival requirements may be destroyed in accordance with retention schedules as outlined by the Division of Administration, Support Services Records Schedules and Dispositions. Retention schedules pertinent to the EHR include:

(a) Financial transaction records (GS1-SL, Item #435)

– five (5) years after transaction is completed.

(b) Patient medical records (GS4, Item #80) – seven

(7) anniversary years after last entry.

(c) Patient medical records: children under one year of age (GS4, Item #130) – retain until the patient’s 8th birthday.

(d) Pharmacy patient and prescription records (GS4, Item #140) – two (2) anniversary years after last entry date.

(e) X-ray/imaging records (GS4, Item #78) – seven (7) anniversary years after last entry date.

(2) Additionally, each division, office, and CHD have a designated records management liaison officer and legal counsel who provide guidance regarding record retention and destruction.

(3) Paper records scanned into the EHR are considered duplicates. These paper duplicates can be shredded after verifying the scans are complete and legible.

IV. Training

HMS Training is available at HMS Training & Instructional Design or by request by emailing DLHMSSupport@flhealth.gov.

V. Authority

A. 45 C.F.R. 160, General Administrative Requirements

B. 45 C.F.R. 164, Security and Privacy https://floridahealth.sharepoint.com/sites/DIVOFADMINISTRATION/GenServices/supportservices/SitePages/Records%20Schedules%20and%20Dispositions.aspx https://floridahealth.sharepoint.com/sites/DIVOFADMINISTRATION/GenServices/supportservices/SitePages/Records%20Schedules%20and%20Dispositions.aspx https://floridahealth.sharepoint.com/sites/OIT-CLINIC/HMSTraining/ mailto:DLHMSSupport@flhealth.gov https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164

DOHP 4-E-9 Page 8 of 11

C. 42 C.F.R. 2, Confidentiality of Substance Use Disorder Patient Records

D. 5 U.S.C. § 552a, Privacy Act of 1974

E. 20 U.S.C. §1232g, Family Educational Rights and Privacy Act

F. Chapter 154, F.S.

G. Section 456.057, F.S.

H. Section 668.50, F.S.

I. Rule 1B-26.003, F.A.C.

J. Rule 60L-36.005(3)(e), F.A.C.

VI. Supportive Data and References

A. DOHP 4-E-3, Information Security and Privacy

B. IOP 4-E-1, Health Record Clinical Change

C. DOHP 4-A2-9, Records Management

D. HMS HIM Guidelines 2024

E. MLN909160 - Complying with Medical Record Documentation Requirements

F. Requirements for the Payment of Medicare Claims (3rd Quarter 2006 Medicare

Part B, page 3)

G. HIPAA - Landing

H. Records Schedules and Dispositions

VII. History Notes

Created: 10/1/1990 Previously Amended: 8/2009, 11/06/2013, 7/24/2019 Formerly: DOHP 50-24, DOHP 380-1, “Integrated Client Records” Internal Operating Policy: General 2 and Technical Assistance Guideline 2 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 http://www.gpo.gov/fdsys/pkg/USCODE-2009-title5/pdf/USCODE-2009-title5-partI-chap5-subchapII-sec552a.pdf https://www.govinfo.gov/content/pkg/USCODE-2010-title20/pdf/USCODE-2010-title20-chap31-subchapIII-part4-sec1232g.pdf https://floridahealth.sharepoint.com/sites/OIT-CLINIC/ClinicInformatics/HIM/HIM%20SIG/Forms/AllItems.aspx?id=%2Fsites%2FOIT%2DCLINIC%2FClinicInformatics%2FHIM%2FHIM%20SIG%2FHMS%20HIM%20Guidelines%2FHMS%20HIM%5FTRNG%5FGUIDE%20DRAFT%5FDecember%202024%2Epdf&parent=%2Fsites%2FOIT%2DCLINIC%2FClinicInformatics%2FHIM%2FHIM%20SIG%2FHMS%20HIM%20Guidelines https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/CERTMedRecDoc-FactSheet-ICN909160.pdf https://medicare.fcso.com/Publications_B/2006/141067.pdf https://medicare.fcso.com/Publications_B/2006/141067.pdf https://floridahealth.sharepoint.com/sites/OGC/HIPAA https://floridahealth.sharepoint.com/sites/DIVOFADMINISTRATION/GenServices/supportservices/SitePages/Records%20Schedules%20and%20Dispositions.aspx

DOHP 4-E-9 Page 9 of 11

VIII. Signature and Effective Date

IX. Appendices

Appendix A – Sample Legal Health Record Matrix

DOHP 4-E-9 Page 10 of 11

Appendix A – Sample Legal Health Record Matrix

This sample appendix could be modified and utilized by CHDs or CMS to track the source of health information documentation.

Document Type

Media Type Paper: “P”

Electronic: “E”

Source of Document

Location of the in the Legal Health Record

Date

Modified

Demographic Data

E E HMS and FL SHOTS

Supportive Identification Data

E/P

Scanned paper in HMS/paper documents in record

HMS and paper record

Financial/ Eligibility

E E HMS

Supportive Financial Data

E/P

Scanned paper in HMS/paper documents in record

HMS and paper record

Third Party E E HMS

Supportive Third-Party Data

E/P

Scanned paper in HMS/paper documents in record

HMS and paper record

Consents E/P Paper record May be scanned in HMS

HMS and paper record

Problem List E E HMS

Domestic Violence Risk Assessment

E/P E/P HMS and paper record

Adult and Adolescent History past, family, women’s, social, immunizations, hospitalizations, surgeries

E/P E/P

HMS and paper forms.

Adult and adolescent history; STD history; family planning limited exam;

tuberculosis history; HIV history

Lead Risk Assessment

P P Paper record

Immunizations E/P FL SHOTS and

HMS

FL SHOTS or adult medical history

Infant and Child History and Check-up

P P Paper record forms

Infant and Child Growth Charts

E/P E/P HMS and paper record forms

DOHP 4-E-9 Page 11 of 11

Appendix A (Continued)

Document Type

Media Type Paper: “P” Electronic: “E”

Source of

Location of the in the Legal Health Record

Date Modified

Pregnancy

Testing and Counseling

E/P E/P HMS and paper record

Family Planning Flow Record

E/P E/P HMS and paper record

Maternity Record P P (scanned into

HMS)

Paper record forms

Progress Notes E/P E/P HMS and paper record Laboratory Test Orders

E/P E/P HMS or paper record, or lab order forms

Laboratory Reports

E/P E/P HMS and paper record

Radiology and Imaging Studies

E/P E/P HMS and paper record

Program Specific Assessments

E E HMS programs may print electronic assessment to combine with paper record

Skin Tests E/P E/P HMS and paper record Medication Plan E/P E/P HMS and paper record Medication List E/P E/P HMS and paper record Radiology E/P E/P HMS and paper record Healthy Start

Care Coordination

E / P E/P HMS and paper record

Electronic Pharmacy Prescriptions

E E

HMS and paper printout HMS direct communication with the Bureau of Public Health Pharmacy

Requests for Disclosure

P P May be scanned