Proper handling of patient records is one of the most complex aspects of closing a practice. According to APA Ethics Code Standard 6.021 (Maintenance, Dissemination, and Disposal of Confidential Records of Professional and Scientific Work), psychologists maintain responsibility for protecting confidentiality when transferring records from their control to another psychologist or professional. It is essential to make arrangements for the secure storage of patient records consistent with your state’s requirements. Be sure to obtain written patient consent if your patient has requested that their records be transferred to another psychologist or mental health provider. If you are transferring your patient files to a records custodian, such as a records retention company, you do not have to obtain individual patient consent, if you have executed a Business Associate Agreement (BAA) with the custodian.
If you are not transferring records to another party and are keeping custody of those files consistent with state requirements, it is important that the files are stored in a secure location that is not accessible by unauthorized third parties. For example, storing patient files in your attic or garage is not considered secure storage.
For records that have exceeded the retention period, develop a plan to dispose of them securely to ensure they are no longer readable or reconstructable. Consider using a professional shredding company, but first ensure the company is HIPAA-compliant, willing to sign a Business Associate Agreement, and provides a certificate of destruction.
For digital records, clear any electronic protected health information from electronic devices. Simply deleting files from your devices may not be sufficient. The HIPAA Security Ruleopens in new window establishes requirements for the storage and destruction of electronic protected health information (EPHI). Records are not limited to electronic devices like computers, laptops, or tablets; records may also be stored on office equipment. For example, photocopiers sometimes have memory storage of recently copied documents, which should be deleted.
To plan for the unexpected, APA Ethics Code Standard 3.121 advises that psychologists make reasonable efforts to facilitate the continuation of services in the event of the psychologist’s illness, death, unavailability, relocation, or retirement. This requirement applies throughout your career, including when closing your practice.