Two of my co-workers attended a training session this week, "Records Retention and Destruction", held by Fred Pryor training. In the session they learned a few things which puzzled me:

1. If someone calls in sick, you must tell others that person is "out" or "not in". Saying "She's out sick" is a HIPAA violation.

2. Medical files held by an organization (such as any claim forms we might receive, but also enrollment forms, etc), must be kept in a locked filing cabinet, behind two locked doors.

Can anyone verify if these are correct? #1 especially doesn't make sense to me. I plan on doing some research on my own, but thought I'd start here to see if anyone could give me a shortcut! :)

Here's a link to the class, if anyone is interested: Records Retention and Destruction — Fred Pryor Seminars

HIPPA laws have become most stringent as keeping records for clients of any institution have become in doubt recently. I am writing from Canada.

I work for Canadian Red Cross in Ontario and I can tell you that our confidentiality issues are numerous and far reaching. Record destruction is tantamount; any records kept by workers in the field must be hand delivered back to branch office for disposal by CRC in conjunction with directives from the Canadian Government, Access Centre, Health Unit and I hope this is followed by any corresponding unit in the United States.

There have been many infractions in both countries including records of clients being compromised and I hope you will follow any directives from training session, that you receive.

I have to keep medical insurance enrollment applications in a separate file outside of the employee's personnel file. I haven't been given any information on the 2 locked doors part.

If I have a question, I usually check out the Department of Labor website. U.S. Department of Labor - Find It By Topic - Health Plans - Portability of Health Coverage

That's the thing, we want to be in compliance, which is why we went to the training, but given that no one in our company has heard these regulations, we are questioning the accuracy of the training. We also haven't seen notification come through from the professional organizations we are members of, which update us on employment law changes (like the recent ADA changes). We want to comply, but we don't want to go overboard in the event this training was wrong.

We don't really have medical records on file; we aren't a medical office. We have enrollment forms, STD claims, LTD claims, worker's disability claims, that sort of thing. Most things have no actual medical information on them, as far as I know. For example, I have no way of looking in my office mate's file to see if she's on birth control. All I can see is which carrier she signed up with.

Thanks, Emland. I know the files must be kept apart, which isn't a problem. We're just wondering about the double locked doors part! Thanks for the link, I'll check it out.

Normally a locked file and in a locked room meet the requirements, but for 20 years all medcial records have had to be in a separate file and restricted access.

20 years? Are you sure? It's my understanding it's 6 years from date of creation or last use. Maybe this is a Georgia state requirement?