[T]he legal storage requirements for various components of the medical record such as clinical lab data or radiology images vary considerably. It is thus easier for hospitals to store all of their data forever rather than researching and complying with the individual patchwork of storage requirements. This makes total sense to me, given the relative ease and cost-effectiveness of computer storage of data and particularly cloud storage.
I came across what seems to be a very authoritative and lengthy article about the storage of radiology studies (see: Storage management: What radiologists need to know ) Suffice it to say that this is a very complicated topic. Below is what I consider a key paragraph from it pertaining to the retention of ePHI (electronic protected health information):
Many of the retention and destruction requirements of ePHI are
federally mandated by the FDA, HIPAA and others. In addition, state and
local entities impose their own requirements, which in many cases are
more restrictive than those federally mandated. To further complicate
the matter, retention requirements are typically 5 to 7 years, but they
vary by type of healthcare entity, by type of ePHI, and even by
subcategories within radiology such as mammography and pediatrics....Resulting from the complex
rules governing retention of ePHI, automation of its destruction is not
currently possible. The most cost-effective solution to manage outdated
ePHI may be permanent retention. Any study that is deleted must be
documented, and the study typically will only be deleted from the
demographic database and not from the storage media.
In this same context, I have come across a new and useful phrase -- born-digital. It refers to a document (or diagnostic image, I presume) that was created and exists only in a digital format (see: Word Spy ). Once destroyed, born-digital data or images cannot be reconstructed. This contrasts with a whole-slide-image in pathology which represents the information in a histology slide. As I ponder this issue and putting aside federal and state mandates regarding retention of ePHI, I am having trouble justifying the destruction at any time of a born-digital medical document or image.
I suspect that patients, if given a vote, would opt for retaining their own born-digital files on the off-chance that they may be relevant ten or twenty years hence. However, the retention of ePHI is radically different than the relatively simple task of storing paper records. We have such documents from ancient Egypt that can be interpreted to this day. Stored ePHI on the other hand, whether medical records or radiology images, needs to be both accessible and viewable. Given the radical IT changes that take place over time including key standards, what guarantees can be made that ePHI stored for twenty years will be of any value at the end of that time span?