Michael H. Cohen

No, you generally cannot take original patient records with you when leaving a medical practice. Patient records are considered the property of the practice or healthcare organization, not the individual physician. However, under HIPAA, you may request copies or access to relevant information for continuity of care, provided you follow proper legal and ethical procedures.

This post will cover HIPAA rules on transferring or copying records when a provider leaves. It will also let you know best practices for maintaining continuity of care without violating HIPAA.

Who Owns Patient Records?

Ownership of patient records is a complex issue that depends on the laws of the jurisdiction, as well as the agreements between healthcare providers and their organizations. In the United States, the general rule is that the medical practice or healthcare facility owns the physical or electronic patient records, not the individual physician. Even if a physician has treated a patient for years, the records typically remain the property of the practice, hospital, or clinic where the care was delivered.

Patients, however, do not “own” the records themselves, but they do have a legal right to access and obtain copies of their health information. Under HIPAA (Health Insurance Portability and Accountability Act) in the U.S., patients must be granted access to their records upon request, within specific timelines. HIPAA is primarily concerned with protecting the privacy and security of protected health information (PHI), rather than dictating record ownership.

Outside the U.S., different laws apply. For instance, in the European Union, the GDPR (General Data Protection Regulation) governs how patient data is collected, stored, and used. While healthcare providers still maintain control over the records, GDPR emphasizes the patient’s rights to access, correct, and request deletion of their personal health data in certain circumstances. Similarly, many countries have their own healthcare privacy and data protection regulations that define ownership, access rights, and provider responsibilities.

Am I Legally Allowed to Take Records When Leaving a Practice?

When a physician is departing a medical practice, one of the most common questions is whether they can take patient records with them. In nearly all circumstances, patient medical records belong to the medical practice or healthcare entity, not the individual physician. This principle applies whether records are maintained in electronic or paper form. While a departing physician may be able to obtain copies under certain conditions, they cannot remove or transfer such medical records without following strict state and federal laws.

The Health Insurance Portability and Accountability Act (HIPAA) is the key federal law governing the confidentiality and transfer of health information. It requires that health care providers and covered entities maintain control over the designated record set and protect medical record confidentiality. In addition to HIPAA, state law often governs how records are retained, how patients are notified, and the time frame for medical record retention. Violating these rules can result in disciplinary action, fines, or loss of a medical license.

Physicians and staff cannot generally take copies of patient records for their own personal reference or to use in a new practice. Any access to healthcare provider records must serve a legitimate purpose, such as continuing care or compliance with legal obligations. If a departing physician needs to access patient information, they must comply with both state and federal requirements, as well as any restrictions in their employment contract or group practice agreement.

There are limited circumstances where a physician may be allowed to obtain copies of records, but such access is often on a case-by-case basis and requires patient consent or authorization. Even then, the healthcare provider must ensure that proper documentation is maintained to demonstrate compliance with the HIPAA Privacy Rule and applicable state law.

Taking patients’ medical records without permission can lead to severe consequences. It can result in civil penalties, loss of the right to practice medicine, and reputational harm for both the individual and the physician practice. In addition, the federal government and state regulatory agencies may impose fines for improper handling of health information technology or electronic formats of records.

Most employment contracts and practice agreements also have clauses addressing ownership and handling of records. Violating these terms could lead to lawsuits, loss of privileges within a physician group, and other legal obligations. A departing physician must be extremely cautious to avoid jeopardizing their career when transitioning to a new provider or new practice.

What Does HIPAA or State Law Say About Patient Record Transfers?

Under HIPAA, patient records must remain with the original covered entity or healthcare provider, but patients themselves have the right to request easy access to their information within a reasonable period. Patients may request that their records be transferred to a new provider for continuing care, and the original practice is obligated to comply within the set period defined by law.

State and federal laws may vary on how records are handled, especially regarding medical record retention. For example, most states require that records be retained for a certain number of years, even if the physician is no longer practicing at that location. Some states require the practice to notify patients and provide a forwarding address if a physician leaves, ensuring patients can still request copies and maintain access to their health information.

Can You Make Copies of Patient Records for Personal Use?

Making copies of patient records for purely personal use is not permitted. A physician cannot simply download or photocopy records for their files, regardless of whether those records are in paper form or electronic formats. The difference between records for personal use and official practice records is crucial. Only the latter are recognized as legally valid and must remain with the practice or hospital that maintains them.

Copies may be made if the patient or their personal representative signs a proper authorization, allowing their information to be shared with a new practice or new provider. In such circumstances, the physician must document consent and maintain proof of authorization in compliance with the HIPAA Privacy Rule and any other law that applies. This ensures that both the patient’s right to access is honored and that the healthcare provider remains in full compliance with the Portability and Accountability Act and relevant state law.

What Are Your Ethical Duties With Patient Records?

Physicians and healthcare providers have a fundamental ethical duty to maintain patient confidentiality at all times. This obligation extends beyond the requirements of state and federal laws like HIPAA and reflects the trust patients place in their providers. Whether records are kept in electronic or paper form, safeguarding the privacy of health information is central to the physician–patient relationship.

Another key duty is ensuring continuity of care when a physician leaves a medical practice or joins a new provider. Patients must not be left without access to their records or a way to continue treatment. This means that records should be transferred in compliance with the HIPAA Privacy Rule, with proper authorization and within the legally mandated period, so that patient care is not disrupted.

Physicians must also avoid conflicts of interest or any misuse of patient medical records. Records cannot be taken for competitive purposes, used for marketing, or retained for personal gain. Instead, they must be managed with integrity, respecting medical record confidentiality and the patient’s rights.

At all times, the physician has an ethical obligation to act in the patient’s best interest when handling such medical records. This includes providing access when requested, cooperating with personal representatives, and respecting the patient’s autonomy over their health information.

Finally, ethical practice requires strict adherence to professional guidelines on record management. Organizations such as the American Medical Association (AMA) and specialty boards emphasize that physicians must comply with legal obligations while upholding professional standards. This means following proper procedures for medical record retention, transfer, and patient notification, ensuring compliance not only with the portability and accountability act but also with the broader principles of medical ethics.

How Can You Transition Patient Medical Records Safely?

When a physician leaves a medical practice, one of the most important responsibilities is ensuring that patients’ medical records are transferred safely and in compliance with both state and federal laws. This process must protect medical record confidentiality, honor patient rights, and ensure continuity of care.

By taking the proper steps, a departing physician can transition patients’ records smoothly without risking HIPAA violations or patient trust. Here’s what to do:

• Notify the Practice and Patients: The first step is to inform your current employer and patients about your departure. Practices are often required to provide notice to active patients, along with instructions on how they can access or transfer their records. Transparency helps patients feel secure that their care will continue uninterrupted.
• Obtain Written Consent: Patients must provide written authorization before their patient records can be transferred to a new provider. This ensures compliance with the HIPAA Privacy Rule, which requires proper documentation before any health information can be shared.
• Secure the Records: Whether in electronic or paper form, all health information technology transfers must be handled with strict security. Encrypted digital transfers and locked physical methods help prevent breaches and maintain accountability under the Health Insurance Portability and Accountability Act.
• Create a Record Inventory: A complete inventory of the records being transferred should be prepared. This log ensures that no files are lost in the process and demonstrates compliance with both federal laws and state requirements for medical record retention.
• Coordinate with Receiving Provider: Communication with the new practice or receiving provider is essential. Physicians must confirm that the receiving office has secure systems in place to accept and store the records in accordance with applicable laws.
• Retain Copies if Allowed: In some circumstances, physicians may retain copies of certain healthcare provider records, but only if explicitly permitted by law or their employment contract. This is typically limited to supporting continuing care or meeting other legal obligations.
• Document the Process: Every step of the transfer, from patient notifications and consents to the actual transfer actions, should be documented. This documentation protects both the physician’s practice and the departing physician against future disputes.
•  Follow State and Federal Regulations: Finally, compliance with the Portability and Accountability Act and relevant state and federal laws is non-negotiable. Each jurisdiction may impose different timelines and requirements, so it is crucial to follow both HIPAA and any local regulations to ensure a legally sound transfer.

What Are the Legal Risks of Taking Patient Records?

One major risk is being accused of theft or misappropriation of records. Even if the intention is to continue caring for active patients in a new practice, the unauthorized removal of records violates medical record confidentiality and can result in disciplinary action.

A physician who takes records without authorization may also be charged with breaching federal laws such as the Health Insurance Portability and Accountability Act (also referred to as the Portability and Accountability Act). HIPAA requires that covered entities and health care providers maintain a designated record set securely, whether in electronic or paper form, and protect all health information.

Another risk involves penalties for HIPAA Privacy Rule violations. Improper handling of records in electronic formats, paper form, or any other method can result in large fines from the federal government, along with potential restrictions on the ability to continue practicing medicine. In addition, state law may impose stricter rules regarding medical record retention and patient access. Failing to notify patients and provide a forwarding address when leaving a practice may result in further liability.

Civil lawsuits are another potential consequence. Patients have the right to request copies of their records and expect easy access within a reasonable period. If a physician removes records without consent, patients may sue for damages arising from lack of access, interruption of treatment, or breach of privacy. Similarly, if an employment contract or group practice agreement violates contractual obligations, the original physician group or hospital may file claims.

How Healthcare Lawyers Can Help You Avoid Legal Issues

Given the complex intersection of state and federal requirements, any departing physician needs to consult a qualified healthcare attorney before attempting to move patient medical records. A lawyer can review the specific rules that apply in your jurisdiction, explain how the Accountability Act and other laws apply, and ensure compliance with both HIPAA and state law for retaining records.

Legal advice is also critical to protect against HIPAA Privacy Rule violations or disputes with a former physician’s practice. For example, an attorney can advise whether it is legally permissible to obtain copies for continuing care, how to obtain authorization from a personal representative, or how to document patient consent when transferring records to a new practice or provider. Lawyers also help explain when certain rules apply, like situations where state or federal laws create two types of records: those that must stay with the practice and those that can be shared if the patient agrees.

By consulting with experienced healthcare counsel, such as our team at Cohen Healthcare Law Group, physicians and healthcare providers gain confidence that they will comply with all applicable rules, avoid conflicts with patients or former employers, and transition into their new practice without unnecessary risk. With over 25 years of experience, Cohen Healthcare Law Group helps physicians navigate issues of medical record confidentiality, retention, and lawful patient transfers, ensuring they can continue to provide high-quality patient care while honoring their legal obligations.

Need Help With Patient Records? Consult a Healthcare Lawyer

When leaving a medical practice, ensuring that patient records are managed properly is both a legal and ethical responsibility. Physicians, staff, and patients all have rights and obligations under state and federal laws, including the Health Insurance Portability and Accountability Act (HIPAA).

In summary, records belong to the practice, and patients have the right to request copies and easy access to their information, and providers must comply with strict rules regarding medical record confidentiality and medical record retention. Mishandling such medical records, whether in electronic or paper form, can result in serious legal risks for a departing physician or any healthcare provider.

To transition safely, it is essential to follow the HIPAA Privacy Rule, honor patient consent requirements, and consult a knowledgeable healthcare attorney.

FAQ

Below are some answers based on state and federal laws, the HIPAA Privacy Rule, and professional standards of medical record confidentiality:

What Happens to Patients’ Files When a Practice Is Closing?

When a practice closes, the physicians must arrange for secure retention of medical records and notify patients about how to obtain copies or transfer their records to a new provider. Laws vary by state, but records are typically kept for a set period defined by federal laws and state law.

Can a Doctor Take Patient Records When Leaving a Practice?

A doctor cannot take original patient medical records when leaving a medical practice, since those records belong to the practice or facility. They may only obtain copies under certain conditions with proper patient consent and legal authorization.

Do Patients Have the Right to Copies of Their Records?

Yes, under HIPAA and most state laws, patients have the right to request copies of their medical records in either electronic or paper form within a reasonable period. Practices must provide access but may charge a small administrative fee.

What Happens if Records Are Taken Without Permission?

Taking such medical records without authorization can lead to accusations of theft, HIPAA violations, civil lawsuits, and disciplinary action against the healthcare provider. It also breaches both federal laws and professional ethical duties regarding medical record confidentiality.

How Long Does the Process of Taking Patient Records When Leaving a Medical Practice Usually Take?

Transferring patient records to a new practice usually takes a few days to several weeks, depending on the number of records, format, and state and federal requirements. HIPAA requires easy access within a specific timeframe, typically 30 days.

What Costs Are Involved in Transferring Patient Records When Leaving a Medical Practice?

Costs vary by state, but health care providers may charge reasonable fees for copying, mailing, or preparing electronic formats of health information. These costs are usually passed to the patient requesting the transfer, not the departing physician.