Beth Israel Deaconess Medical Center - Download Now DOC

Document Sample
Beth Israel Deaconess Medical Center - Download Now DOC Powered By Docstoc
					                             Beth Israel Deaconess Medical Center
                                 Records Management Policy


                        Attachment A
             Record Retention & Disposition Manual
                                      Table of Contents
A. Definitions: ......................................................................................... 1
B. Procedures:......................................................................................... 4
  1. Records. .............................................................................................. 4
  2. Record Integrity ................................................................................... 4
  3. Appropriate Retention Period ................................................................. 4
  4. Historical Archives ................................................................................ 5
  5. Permanent Records .............................................................................. 5
  6. Vital Records ........................................................................................ 5
  7. Confidential/Proprietary Records ............................................................ 6
  8. Electronic Records ................................................................................ 6
  9. E-mail .................................................................................................. 7
  10. Off-site Storage of Inactive Records ....................................................... 8
  11. Off-site Storage of Protected Health Information .................................... 9
  12. Record Substitution .............................................................................. 9
  13. Ownership ........................................................................................... 9
C. Destruction of Records: .................................................................... 10
  1. Timing for Destruction ........................................................................ 10
  2. Unauthorized Destruction / Disclosure.................................................. 10
  3. Method of Destruction ........................................................................ 11
  4. Investigations, Audits, and Legal or Administrative Proceedings ............. 11
  5. Use of Outside Contractors .................................................................. 12
  6. Destruction of Protected Health Information ......................................... 13
D. Policy Implementation and Monitoring: .......................................... 13
  1. BIDMC Records Management Coordinator ............................................ 13
  2. Records Management Sub-Committee .................................................. 14
  2. Training and Education ....................................................................... 15
  3. Questions and Comments ................................................................... 15
  4. Reporting Requirement ....................................................................... 15
A. Definitions:

As used in this Manual, certain terms are defined as follows (listed alphabetically):

       “BIDMC Workforce” means any individual who performs work on behalf of
        BIDMC, either directly or indirectly. A person can be a member of the BIDMC
        Workforce regardless of whether they are paid by the Medical Center for their
        efforts. Some common examples of Workforce members would include:

        o Employees

        o Volunteers

        o Trainees

        o Consultants and other agents

        o Members of the Medical and Professional Staff
        ― and ―
        o Members of the Board of Directors, the Board of Trustees, and the Board
          of Overseers, along with the officers and / or members of any related
          committees.

       “Confidential/Proprietary Records” has the same meaning as defined
        and described by BIDMC Policy #ADM-04 “Technology Resource Utilization.”
        Confidential / Proprietary Records include material, in any form, related to the
        operation of BIDMC, including, but not limited to health information, financial
        information, employee information, and information related to proprietary
        products and product development, marketing and general business
        strategies, along with any other information marked “Confidential.”

       “Electronic Memory” means non-volatile or persistent storage devices.

       “Electronic Records” means any Records maintained via electronic storage
        media. For example, electronic storage media will include all non-volatile or
        persistent storage devices, including hard drives in desktop, laptop, or
        handheld computers, as well as data network servers. Electronic storage
        media also includes removable and/or transportable digital media, such as
        personal data assistants (“PDAs”) and other electronic organizers, personal
        micro-drives, magnetic tapes or disks, optical disks (CD-ROM, DVD, et
        cetera), and digital cards or “memory sticks.”




Records Management Policy (Attachment A)                                       Page 1 of 15
Record Retention and Disposition Manual                                  (Revised 08/2007)
        This definition of “Electronic Records” is similar in functional scope to the
        regulatory definition of “Electronic Media” appearing at 45 CFR § 160.103,
        which is a subsection of the Federal security standards for electronic health
        information, as authorized by the Health Insurance Portability and
        Accountability Act (“HIPAA”). However, other than the BIDMC standards
        expressly set forth by this Manual, any such similarity is not intended to
        extend additional regulatory requirements to Records that are not otherwise
        subject to the HIPAA standards (e.g. Records that contain protected health
        information in electronic form).

       “Inactive Records” means Records that are no longer required for current
        operations.

       “Medical Records” has the same meaning as defined and described by the
        following BIDMC policies:

        o BIDMC Policy #ADM-05 “Medical Record Content, Unit Numbering,
          Retention & Destruction, Correction of Errors, and General Release of
          Information”
        ― and ―
        o BIDMC Policy #PV-13 “Patient Medical Record and Designated Record Set”

       “Non-Records” means documentation and other materials outside the
        scope of this Policy. The BIDMC Records Management Policy does not apply
        to any Non-Records. Unless otherwise specified, for example, the retention
        requirements of this Manual do not apply to the following types of Non-
        Records created or received by BIDMC:

        o Duplicate Copies of Documents. Official Records will include only a single
          copy of each document. Duplicate copies of Records created for short-
          term reference will be discarded after they are of no further use.

        o User-Deleted E-mails. Nothing in this Policy will be interpreted to create
          additional obligations with respect to the temporary retention or recovery
          of user-deleted e-mails. Absent special instructions to the contrary, any
          user-deleted e-mail messages and attachments will be deemed for the
          purposes of this Policy to be Non-Records. For more information, please
          refer to Section 7.8 of BIDMC Policy #ADM-04 “Technology Resources
          Utilization.”

        o Documents That Are Temporary in Nature. These documents include
          those that have no value or whose value is short-lived, such as informal

Records Management Policy (Attachment A)                                      Page 2 of 15
Record Retention and Disposition Manual                                 (Revised 08/2007)
           personal notes, telephone messages (either written or sound recordings),
           preliminary working papers, or superseded drafts.

           Unless otherwise determined to be necessary, drafts will not be retained
           after (i) completion of the final work product; or (ii) upon notification that
           the work product is not going to be completed, assuming the material is
           not needed for future reference. In any case, drafts will not be retained
           for a period longer that the retention period prescribed for the category of
           document to which the draft relates.

        o Publications. Non-Records will also include any stocks of non-BIDMC
          publications, magazines, newspapers, newsletters, public telephone
          directories, et cetera not published and distributed by BIDMC.

        For any materials deemed to be Non-Records, administrative discretion will be
        used in determining whether to generate or retain such documents and
        materials. If generated, they will be maintained only for as long as
        administratively needed, and will be routinely discarded when their use has
        terminated.

       “Obsolete Records” means any Records that are no longer needed for
        patient care, business, regulatory, or other purposes. Records generally do
        not become obsolete until they exceed the mandatory minimum retention
        period, as set forth by this Manual.

        Records may also become obsolete following a successful conversion into
        substitute images, as described by Section B.12 of this Manual.

       “Original Records” means the original version of a Record. Original Records
        are to have priority when it comes to preserving Records. The purpose of this
        Policy is to ensure that appropriate procedures are used for retaining and
        locating Original Records. The policy of BIDMC is to make every effort to
        retain Original Records (or properly substituted images, as described by
        Section B.12 of this Manual).

       “Permanent Records” means any Records that are not subject to
        destruction ― i.e. will be retained for an indefinite period ― as identified by
        this Manual.

       “Records” means recorded, retrievable information created or received in
        connection with the operations and activities of BIDMC, or related to BIDMC’s
        legal obligations. Records include materials that serve business, legal, or
        other functions, as well as any Records maintained for patient care or medical
        research purposes. This definition applies to such relevant information,

Records Management Policy (Attachment A)                                         Page 3 of 15
Record Retention and Disposition Manual                                    (Revised 08/2007)
        regardless of physical form or medium (including “substituted images” as
        described by Section B.12 below).

        Records can include, but are not limited to, original documents, papers,
        correspondence, meeting minutes, memos, reports, contracts, receipts,
        requisitions, invoices, books, general ledgers, financial statements, blueprints,
        charts, maps, drawings, presentation slides, x-rays, photographs, website
        pages, audio or video recordings, microfilm, magnetic tape, electronic media,
        or other forms of information.

       “Vital Records” means any Records that are essential to the continued
        operation of BIDMC during and/or after a natural, human, or technological
        emergency or disaster. This includes any Records that are necessary to
        safeguard the legal and financial rights and interests of BIDMC, or our
        patients and their families.


B. Procedures:

    1. Records. Records subject to the Records Management Policy will be clearly
       labeled, properly organized, and available for retrieval.

        Records will be stored or maintained in a manner that facilitates distinction
        from (and avoids intermingling with) Non-Record materials. With respect to
        electronic storage media in particular, the distinction of Record from Non-
        Record material will be implemented to the extent feasible within the
        limitations of available, affordable technologies. (Please refer to the
        definitions in Section A for a description and some common examples of Non-
        Record materials.)

        To supplement the requirements described in this Manual, individual
        departments or divisions may establish additional standards for the content,
        format, and organization of specific categories of Records, provided that no
        changes may be made to shorten the mandatory minimum timeframes for
        retention set forth in the BIDMC Record Retention and Disposition Schedule
        (Attachment B to the Records Management Policy).

    2. Record Integrity. No one may falsify or inappropriately alter information in
       any Record or document. Members of the BIDMC Workforce may be subject
       to the Corrective Action Policy (#PM-04), the Medical Staff By-Laws, and
       possible further legal process.

    3. Appropriate Retention Period. Records will be maintained in accordance with
       applicable laws and regulations, accreditation standards, and other

Records Management Policy (Attachment A)                                        Page 4 of 15
Record Retention and Disposition Manual                                   (Revised 08/2007)
        requirements governing Record retention. Records will not be disposed before
        the appropriate retention period has expired. For information concerning the
        mandatory minimum retention period for specific categories of Records,
        please refer to the BIDMC Record Retention and Disposition Schedule
        (Attachment B).

    4. Historical Archives. The BIDMC Records Management Policy does not apply to
       any Records maintained or preserved by the Archivist of BIDMC. Individuals
       who possess or discover any Records or other items of potential historical
       significance will contact the BIDMC Archives at (617) 667-7313. Such items
       may include institutional reports, manuscripts, scrap books, photographs,
       portraits, memorabilia, or other archival material relating to important events
       of BIDMC.

    5. Permanent Records. Records for which the appropriate retention period is
       described as “Permanent” in this Manual will be retained for an indefinite
       period. Whenever possible, Permanent Records will be created in (or
       transferred to) an immutable and durable medium, to safeguard against
       inappropriate alteration or deterioration.

       Permanent Records have been determined to hold unique legal or corporate
       value to BIDMC. Permanent Record status is assigned by the Records
       Management Sub-Committee. An inventory of Permanent Records will be
       made from time to time by the Sub-Committee, listing the location and
       content of Permanent Records, as well as the individual(s) responsible for
       safekeeping.

    6. Vital Records. The management of Vital Records is an essential component of
       emergency preparedness for BIDMC. Vital Records will be secured to an
       extent that ensures continued operations in the event of a natural, human, or
       technological emergency or disaster.

       Common examples of Vital Records would include, but are not necessarily
       limited to the following:

       o Emergency / Disaster Response Plans, including orders of succession,
         delegations of authority, emergency staffing assignments, security codes,
         and relevant contact information;

       o Building Plans or Blueprints;

       o Medical Records;

       o Insurance Records;

Records Management Policy (Attachment A)                                     Page 5 of 15
Record Retention and Disposition Manual                                (Revised 08/2007)
       o Payroll Records;

       o Patient Accounts Receivables;

       o Inventories of Vital Records;
        ― and ―
       o Any other Records relating to contracts, deeds, leases, or obligations
         whose loss would pose a significant detriment to the legal and financial
         rights of the BIDMC.

       Originals of Vital Records will be maintained in locations with adequate
       security and/or environmental protections. If not otherwise cost-prohibitive or
       infeasible, appropriate safeguards may include off-site duplication or image
       scanning for Records.

       Appropriate safeguards will be sufficient for reasonable continuity should
       normal operations be disrupted. Safeguards may also include the design of
       contingency operating plans in the event of sudden or unexpected Record
       unavailability.

       An inventory of Vital Records will be made from time to time by the Records
       Management Sub-Committee, listing the location and content of Vital Records,
       as well as the individual(s) responsible for safekeeping.

    7. Confidential/Proprietary Records. Confidential/Proprietary Records will be
       securely maintained, controlled, and protected to prevent unauthorized
       access or disclosure. For guidance on Records that contain Protected Health
       Information, please refer to BIDMC Policy #PV-07 “Safeguarding Protected
       Health Information.”

    8. Electronic Records. All members of the BIDMC Workforce are responsible for
       ensuring that Electronic Records are created, used, maintained, preserved,
       and disposed in accordance with the Records Management policy. Individuals
       will utilize appropriate media and systems for storing and maintaining
       Electronic Records. Electronic media and systems will permit the retrieval of
       stored Electronic Records in a timely fashion (including back-up mechanisms
       in the case of system failure).

       The selection of appropriate storage media or systems may vary based on the
       subject matter or content of an Electronic Record, as well as the length of the
       mandatory minimum timeframe for retention. Electronic media and systems
       will allow for the retention of Electronic Records in a usable format until the

Records Management Policy (Attachment A)                                     Page 6 of 15
Record Retention and Disposition Manual                                (Revised 08/2007)
       authorized disposition date. When it is cost-effective or feasible given
       available technologies, the retention of Electronic Records in a useable format
       may be accomplished by the transfer or “upgrading” of Electronic Records
       into newer formats (i.e. to keep pace with advances in technology). In certain
       circumstances however, the retention of Electronic Records in a useable
       format may necessitate the provisional maintenance of “legacy” electronic
       storage systems ─ as well as superseded or otherwise outmoded electronic
       hardware (e.g. drives, readers, or players) ─ until the expiration of the
       applicable retention period.

       Electronic Records will not be stored or managed via an individual’s home
       directory (“H:\”); desktop hard drive (“C:\”); PDA; or other technology
       resources that are not intended to support the long-term retention and
       retrieval of Records.

       The appropriate storage and access of Electronic Records via BIDMC’s
       computer and telecommunication resources is governed by BIDMC Policy
       #ADM-04 “Technology Resources Utilization.”

    9. E-mail. Electronic mail represents a means of communication, and should not
       be viewed as a Records Management system in its own right.
       Communications, messages, and materials transmitted by e-mail are similar
       to paper documents. Most e-mail messages are not Records. However,
       depending on their purpose and content, e-mails (and relevant attachments)
       may be considered Records subject to the BIDMC Records Management
       Policy.

       BIDMC does not adhere to a strict “Print and Retain” requirement for e-mails,
       although certain important messages of significant business, legal, or medical
       value may warrant retention in either paper form or an appropriate electronic
       storage medium (e.g. shared network directory (“S:\”), CD-ROM, et cetera). A
       general rule is that if an e-mail in paper form would meet the definition of a
       Record, then it will be retained, either electronically or in paper form.

       Generally, when the sender of an e-mail is a member of the BIDMC
       Workforce, that individual will be responsible for determining whether the e-
       mail and/or any attachments qualify as a Record. When the sender of an e-
       mail is not a member of the BIDMC Workforce, the responsibility will pass to
       the individual recipient(s), if a member of the BIDMC Workforce.

       Decisions regarding whether to save or delete e-mails reside with individual
       users. This decision should not be dictated solely by the Electronic Memory
       capacity of electronic media or systems, or by the operation of pre-
       programmed, time-based auto-delete functions.

Records Management Policy (Attachment A)                                     Page 7 of 15
Record Retention and Disposition Manual                                (Revised 08/2007)
       If an e-mail message qualifies as a Record, that Record will be managed in
       accordance with the BIDMC Records Management Policy. E-mails that qualify
       as Records will be maintained in a retrievable format for the full duration of
       the applicable retention period. In order to alleviate constraints related to
       Electronic Memory capacity, or to prevent automated deletion, individual
       users will print and retain a paper copy of the e-mail (and relevant
       attachments), or in the alternative, will transfer these materials to an
       appropriate electronic storage medium. E-mail Records will not be stored or
       managed via an individual’s Outlook mailbox, personal folders, remote access
       device (e.g. Blackberry, Treo, et cetera), or other technology resources that
       are not intended to support the long-term retention and retrieval of Records.

       Except as otherwise noted, nothing in the BIDMC Records Management Policy
       will be interpreted to prohibit the regularly scheduled back-up and/or purging
       procedures that may take place as part of the standard operating procedures.

    10. Off-site Storage of Inactive Records. Records will be reviewed periodically to
        determine if they are active, inactive (i.e. no longer required for current
        operations), or obsolete (i.e. eligible for immediate disposition). Any Records
        that are no longer required for active use may be considered for off-site
        storage. The immediate usefulness of Records will be weighed against
        existing physical space limitations.

       Off-site storage vendors will be pre-approved by the BIDMC Records
       Management Sub-Committee. Inactive Records may not be stored in an off-
       site facility that has not been approved by the Records Management Sub-
       Committee. Off-site storage facilities will be secure locations with the
       capability to reasonably safeguard Records against unauthorized access, use,
       disclosure, or disposition (by any cause).

       Records will be maintained and organized in a way that facilitates compliance
       with the BIDMC Records Management Policy. For example, the designated
       individual who is responsible for the management of a Record will ensure that
       an accurate and complete inventory exists, e.g. to locate and retrieve Records
       in off-site storage. The inventory must be maintained until the Record is
       destroyed in accordance with the Records Management Policy.

       On-site physical space limitations are an appropriate consideration when
       evaluating the need for off-site storage. However, space limitations are not
       an appropriate justification for the premature disposition of Records before
       the expiration of the mandatory minimum retention period.



Records Management Policy (Attachment A)                                       Page 8 of 15
Record Retention and Disposition Manual                                  (Revised 08/2007)
       The designated individual responsible for the management of a Record
       remains responsible for the appropriate disposition of Obsolete Records in off-
       site storage. Off-site storage is not an appropriate method to dispose of
       Obsolete Records.

    11. Off-site Storage of Protected Health Information. A written and signed
        Business Associate Agreement approved by the Records Management Sub-
        Committee is required for the engagement of any outside entities to assist in
        the off-site storage of any Records that include “protected health information”
        or patient-specific “identifiers,” as those terms are defined by BIDMC Policy
        #PV-04 “Confidentiality.”

       For further guidance, please refer to BIDMC Policy #PV-17 “Business
       Associates and Business Associate Agreements within the BIDMC Organized
       Health Care Arrangement.”

    12. Record Substitution. It is the goal of BIDMC to utilize effective and cost-
        efficient Records Management techniques. Unless expressly prohibited by
        statute or regulation, the substitution of digitally scanned, microfilmed,
        microfiched, or other similar imaging technologies for an original paper
        document is permitted for purposes of more efficient or cost-effective
        Records Management.

       The process through which Records are converted into substitute images will
       be performed under conditions that are supervised or approved by the BIDMC
       Records Management Coordinator. In addition, the process will provide
       certification that the substituted image is an exact and legible replication of
       the original document.

       When a properly substituted image of a Record is created, the applicable
       retention period for the Record does not change. A Record’s mandatory
       minimum retention period is counted from the creation or receipt of the
       Original Record, not the date on which the substitute image was created.

    13. Ownership. Records created or received by the BIDMC Workforce are the
        property of Beth Israel Deaconess. No member of the BIDMC Workforce, by
        virtue of his or her position, has any personal or property right to such
        Records, even though he or she may have developed or compiled them.

       In certain instances, the law may not make a distinction between “personal
       files” and BIDMC’s “business files” or “medical records.” For example, such
       files may be subject to subpoena just like other “official records.” Therefore,
       personal calendars, schedule diaries, and correspondence files are typically

Records Management Policy (Attachment A)                                       Page 9 of 15
Record Retention and Disposition Manual                                  (Revised 08/2007)
       considered Records subject to the BIDMC Records Management Policy.
       Personnel will, on at least an annual basis, review his or her “personal” files
       and destroy any documents or Records not falling within one of the
       categories requiring continued retention.

       Any individual departing the BIDMC Workforce is required to leave all Records
       (including copies) for any successor(s) and / or supervisor(s). The individual
       is not permitted to depart with or destroy any Records without the express
       written authorization of the individual’s direct supervisor, specifically
       identifying the Records in question. Such written authorizations will be
       forwarded to the Records Management Coordinator, for retention in
       accordance with the minimum retention period set forth by the BIDMC Record
       Retention and Disposition Schedule (Attachment B).

       BIDMC may maintain or otherwise “share” certain technology resources or
       technical support services with a number of affiliated organizations, including
       but not limited to New England Baptist Hospital, Mount Auburn Hospital,
       Dimock Community Health Center, and others. Nothing in the BIDMC Records
       Management Policy is meant to assume ownership, liability, or responsibility
       for the retention and disposition of any materials belonging to institutions
       other than BIDMC. The scope of the BIDMC Records Management Policy
       applies only to the Workforce, Records, and Non-Records of BIDMC.


C. Destruction of Records:

    1. Timing for Destruction. Records may be destroyed only in accordance with
       the BIDMC Records Management Policy. Records will not be destroyed before
       the termination of the mandatory minimum retention period set forth in this
       Manual.

       In the absence of any special instructions or unique circumstances, Records
       generally will be destroyed promptly at the end of their retention period. One
       purpose of the BIDMC Records Management Policy is to promote the
       responsible management of Records, by avoiding the unnecessary
       accumulation of Obsolete Records. The continued retention of any Records
       past the mandatory minimum retention period will occur on an exceptions-
       only basis, taking into account the potential usefulness of the Record,
       weighed against any cost, space, or other resource limitations.

    2. Unauthorized Destruction / Disclosure. The unauthorized destruction,
       removal, use, or disclosure of BIDMC Records is prohibited.




Records Management Policy (Attachment A)                                     Page 10 of 15
Record Retention and Disposition Manual                                  (Revised 08/2007)
    3. Method of Destruction. The appropriate method of destruction for Records
       will depend on the physical form or medium of the Records, as well as the
       subject matter or content.

       Records should not be placed in unsecured trash or recycling receptacles,
       unless the Records are first rendered unrecognizable as a Record.

       Special restrictions apply to the destruction of all Records that include any of
       the following types of protected or personal information:

           a. “Protected Health Information” or patient-specific “Identifiers,” as those
              terms are defined by BIDMC Policy #PV-04 “Confidentiality”

              - or -

           b. “Personal information,” defined as any individual’s first name and last
              name or first initial and last name in combination with any 1 or more of
              the following data elements:

                       °   Social Security number;

                       °   Driver’s license number or identification card number;

                       °   Financial account number, or credit or debit card number, with
                           or without any required security code, access code, personal
                           identification number or password that would permit access to
                           a financial account;

                           - or -

                       °   Biometric indicator.

       Paper documents containing any of the above will be either redacted, burned,
       pulverized, or shredded so that personal data cannot practicably be read or
       reconstructed.

       Electronic media and other non-paper media containing any of the above will
       be destroyed or erased so that personal information cannot practicably be
       read or reconstructed.

    4. Investigations, Audits, and Legal or Administrative Proceedings. In the event
       of an investigation or audit (conducted by either BIDMC or an external
       entity), lawsuit, administrative proceeding, or some other form of legal
       process for which particular Records would be relevant, those Records will
       not be destroyed. The relevant Records should not be maintained with other

Records Management Policy (Attachment A)                                       Page 11 of 15
Record Retention and Disposition Manual                                    (Revised 08/2007)
        Records that are subject to destruction, but segregated to insure proper
        handling.

       Any member of the BIDMC Workforce who becomes aware of an actual or
       reasonably foreseeable investigation, audit, lawsuit, administrative
       proceeding, or other form of legal proceeding will promptly notify the Office
       of General Counsel. The Office of General Counsel will provide instructions to
       the appropriate individual(s) ─ including the BIDMC Records Management
       Coordinator ─ to immediately suspend specified Record destruction
       procedures (if necessary), along with any additional instructions that may be
       required.

       At the direction of the Office of General Counsel, destruction procedures
       involving relevant Records, if any, will be suspended immediately (including
       any documents maintained at off-site storage facilities). In certain
       circumstances, this may necessitate the temporary suspension of certain
       routine operations, such as the regular auto-erasing or recycling of back-up
       copies for electronic information systems (i.e. until it can be verified that such
       operations would not result in the unintentional or inadvertent destruction of
       relevant Records).

       Upon the conclusion of the investigation, audit, lawsuit, or other proceeding,
       normal retention and destruction procedures will again apply (absent
       instructions to the contrary). The Office of General Counsel will provide
       instructions to the appropriate individual(s) ─ including the BIDMC Records
       Management Coordinator ─ at the conclusion of any proceedings.

       It is extremely important that you carefully follow the instructions of the
       Office of General Counsel, to avoid the possibility of impeding an investigation
       or the defense / prosecution of legal proceedings.

       If there are any questions about Records relating to a proceeding, you should
       contact the Office of the General Counsel before taking any action.

    5. Use of Outside Contractors. The use of any outside contractors or vendors for
       the destruction of Obsolete Records will first be pre-approved by the BIDMC
       Records Management Sub-Committee. Obsolete Records may not be
       destroyed by an outside contractor that has not been approved by the
       Records Management Sub-Committee.

       Any outside contractors or vendors hired to dispose of Records containing
       protected or personal information as described in Section C.3(a)-(b) above
       will implement and monitor compliance with policies and procedures that
       prohibit unauthorized access to or acquisition of or use of the information

Records Management Policy (Attachment A)                                      Page 12 of 15
Record Retention and Disposition Manual                                   (Revised 08/2007)
       during the collection, transportation, and disposal of the Records.

    6. Destruction of Protected Health Information. A written and signed Business
       Associate Agreement approved by the Records Management Sub-Committee
       is required for the engagement of any outside contractors to assist in the
       destruction of any Records that include “Protected Health Information” or
       patient-specific “Identifiers,” as those terms are defined by BIDMC Policy
       #PV-04 “Confidentiality.”

       For further guidance, please refer to BIDMC Policy #PV-17 “Business
       Associates and Business Associate Agreements within the BIDMC Organized
       Health Care Arrangement.”


D. Policy Implementation and Monitoring:

    1. BIDMC Records Management Coordinator. The Director of Health Information
       Management will designate an individual under his/her management and
       supervision to serve as BIDMC Records Management Coordinator. This
       responsibility will be assigned to a staff person with some existing Records
       Management skills, or the ability to learn the skills necessary to oversee the
       BIDMC Records Management Policy.

       The Records Management Coordinator will be responsible for the
       administration of the BIDMC Records Management Policy, including:

           a. Serving as a liaison to individuals with responsibility for the retention
              and proper disposition of BIDMC Records;

           b. Serving as a member of the BIDMC Records Management Sub-
              Committee (as described by Section D.2 below);


           c. Reviewing and approving off-site storage vendors for Inactive Records
              (as described by Section B.10 above);

           d. Reviewing and approving outside contractors for the disposition of
              Records (as described by Section C.6 above);

           e. Supervising and approving the processes through which Records are
              converted into substitute images (as described by Section B.12 above);

           f. Verifying that Business Associate Agreements have been executed with
              any outside vendors who store or handle Records containing Protected

Records Management Policy (Attachment A)                                      Page 13 of 15
Record Retention and Disposition Manual                                   (Revised 08/2007)
               Health Information (as described by Sections B.11 and C.7 above);
        ― and ―
           g. Conducting inventories of Permanent Records and Vital Records (as
              described by Sections B.5 and B.6 above);


    2. Records Management Sub-Committee. The Records Management Sub-
       Committee will consist of the following individuals:

           c. Records Management Coordinator;

           d. A representative from Information Systems;

           e. A representative from Contracting/Purchasing;

           f. A representative from Human Resources;

           g. A representative from Research / Academic Affairs;

           h. A representative from the Office of Business Conduct;

           i. A representative from the Office of General Counsel;
        ― and ―
           j. Other representatives from the BIDMC Workforce (as appropriate).

       The Sub-Committee will meet at least once quarterly (or as otherwise
       deemed necessary). The Sub-Committee will be responsible for supporting
       the Records Management Coordinator in the implementation and on-going
       administration of the BIDMC Records Management Policy. This includes
       responsibility for applying the standards and requirements of the Record
       Retention and Disposition Manual within their own department or area.

       The Sub-Committee also will be responsible for periodically reviewing and
       approving any proposed or recommended changes to the BIDMC Record
       Retention and Disposition Manual and the BIDMC Record Retention and
       Disposition Schedule (Attachment B), as necessary to ensure compliance with
       applicable laws and regulations, and other requirements.

       From time to time, the Records Management Sub-Committee may designate
       responsibility for periodic internal audits to evaluate compliance with the
       Records Management Policy.


Records Management Policy (Attachment A)                                  Page 14 of 15
Record Retention and Disposition Manual                               (Revised 08/2007)
    2. Training and Education. The Records Management Sub-Committee will be
       responsible for providing training in the implementation of the BIDMC
       Records Management Policy. The goal of this education program will be to
       increase awareness of the Policy, and to bring about individual responsibility
       and accountability. This process will include the documentation of training for
       all participants.

    3. Questions and Comments. Questions or concerns regarding the appropriate
       retention period or disposition method for certain categories of Records
       should be directed to the BIDMC Records Management Coordinator. You can
       also seek assistance from a variety of other sources, including the Office of
       Business Conduct (617) 667-1897 or the Office of General Counsel (617)
       667-1894. You can also send your questions or concerns in an e-mail to
       conduct@bidmc.harvard.edu. For anonymous inquiries, you can reach the
       BIDMC Compliance Helpline at (888) 753-6533.

       At any time, a member of the BIDMC Workforce may propose a change,
       addition, or revision to the BIDMC Record Retention and Disposition Schedule.
       Proposals should be based upon the legal, fiscal, administrative, and historical
       value of the Records. Such proposals are subject to the review and approval
       of the Records Management Sub-Committee. Proposals can be made through
       any of the channels identified above.


    4. Reporting Requirement. Members of the BIDMC Workforce are obligated to
       report any information regarding the unauthorized disposition, falsification,
       alteration, removal, use, or disclosure of any Records. Reports can be made
       through any of the channels identified in Section D.3 above.




Records Management Policy (Attachment A)                                    Page 15 of 15
Record Retention and Disposition Manual                                 (Revised 08/2007)