Kentucky Privacy Laws Checklist for Archived Paper Medical Records

Confirm Applicable Kentucky Record Retention Periods

Archived paper charts remain subject to applicable retention and privacy rules. HIPAA does not set a medical-record retention period; the required period depends on the provider’s license, facility type, and other applicable requirements.

• Hospitals: Kentucky’s hospital regulation generally requires retaining records for at least six years from discharge. For a minor, retain the record until three years after the patient reaches the age of majority, if that is longer.
• Licensed clinics: The applicable rule generally requires retaining a complete record for six years after the patient’s death or discharge, or, for a minor, until three years after the age of majority, whichever is longer.
• Physicians’ offices: A Kentucky regulation requires physicians to maintain patient records for a minimum of seven years. It also provides that requests for office records are to be honored within ten business days.

Check the rules for your specific provider category rather than applying one period to every Kentucky practice. Also account for payer or program requirements, audits, pending claims, litigation holds, and any other applicable legal duty that may require longer retention.

KRS 311.377 addresses confidentiality and privilege for certain professional-review materials; it is not a general retention rule for patient charts. The supplied citation KRS 311.6235 should be verified before relying on it as a medical-record privacy or retention requirement.

Secure Archived Paper Charts Against Unauthorized Access

HIPAA’s Privacy Rule requires appropriate safeguards for protected health information (PHI) while it is maintained, including in paper files. Keep archived charts in a locked, access-controlled area and limit access to staff whose job duties require it.

Use a sign-out or tracking process when staff retrieve or return a chart. Protect records from loss, theft, water, fire, and tampering, and ensure off-site storage vendors have appropriate safeguards and written obligations for handling PHI.

The HIPAA Security Rule focuses on electronic protected health information. Do not treat 45 CFR 164.310(d)(2)(i), which concerns the final disposition of electronic PHI and electronic media, as a paper-chart storage rule.

Limit Disclosure Under HIPAA and Kentucky Law

Archived status does not make a chart less confidential or create permission to disclose it. Under the HIPAA Privacy Rule, providers may use or disclose PHI for permitted purposes such as treatment, payment, and health care operations, and in other circumstances allowed or required by law. When authorization is required, obtain a valid authorization before releasing the information.

Apply role-based access and disclose only what is appropriate for the purpose when the minimum-necessary standard applies. That standard has exceptions, including certain disclosures for treatment and disclosures to the individual. Treat subpoenas, attorney requests, and other legal demands carefully: confirm the applicable legal conditions before releasing records.

Do not confuse peer-review materials protected under KRS 311.377 with an ordinary patient chart. Handle any potentially specially protected information under the rules that apply to that information.

Apply Record Destruction and Disposal Requirements

Do not destroy a chart merely because it has been moved to storage. First confirm that the applicable retention period has ended, check for audits, investigations, litigation holds, or other preservation duties, and ensure the record is eligible for destruction under your retention policy.

When paper PHI is eligible for disposal, use a method that makes it unreadable, indecipherable, and difficult to reconstruct, such as shredding, pulping, burning, or pulverizing. Secure records during collection and transport, and use a written agreement and documented chain of custody when a destruction vendor handles them.

45 CFR 164.530(c) requires appropriate safeguards for PHI, including through disposal. By contrast, 45 CFR 164.310(d)(2)(i) specifically addresses disposal of electronic PHI and the hardware or electronic media on which it is stored; it is not the paper-record destruction standard.

Document Access and Disclosure Decisions

Maintain practical records of who retrieved archived charts, when they were accessed, and whether records were returned. A tracking log helps you identify missing files and review unusual access. It is a sound safeguard, but do not describe every internal access as a disclosure that must appear on a patient’s accounting.

HIPAA’s accounting of disclosures applies to certain disclosures and has exceptions, including many disclosures for treatment, payment, and health care operations and disclosures made under an individual’s authorization. When a disclosure is subject to accounting, record the information needed to prepare an accurate response to a patient’s request.

Keep required privacy policies, authorizations, and disclosure documentation for the periods applicable under HIPAA and other laws. Train staff to record the purpose and recipient of a release and to report misdirected, lost, or otherwise improper disclosures promptly.

Respond to Patient Requests for Archived Records

Under HIPAA, patients generally have a right to access PHI about themselves in a designated record set, which can include a paper chart kept in an archive or by a storage vendor. Archived location alone is not a reason to deny access. Identify the records covered by the request, retrieve them, and review them for any applicable access exception.

HIPAA generally requires action on an access request within 30 calendar days. If you need more time, you may use one extension of up to 30 additional days by giving the patient written notice within the initial period that explains the reason for delay and states when you will respond. Follow any shorter deadline that applies to your provider type; Kentucky’s physician-office regulation, for example, calls for office-record requests to be honored within ten business days.

KRS 422.317 provides for a patient’s written request for a copy of the patient’s medical record and generally requires the first copy to be provided to the patient without charge. Confirm the rule that applies to the requester and request, including when a representative is involved. Document the request, identity and authority checks, retrieval effort, response date, and any permitted denial or extension.

A dependable archive process combines the correct retention period, controlled storage, lawful disclosure, secure destruction, and a timely response to access requests.

FAQs

How long must Kentucky providers retain paper medical records?

There is no single period for every provider. Kentucky regulations generally require hospitals to retain records for at least six years from discharge, with a longer rule for minors when applicable; licensed clinics generally follow a six-year period with a longer rule for minors; and physicians’ offices generally must retain records for at least seven years. Confirm the rule for the specific facility and check for other requirements that call for longer retention.

Are archived paper charts protected by HIPAA?

Yes. If the records contain PHI held by a HIPAA-covered entity or its business associate, HIPAA safeguards continue to apply while the information is maintained, including when it is archived and during disposal.

Who may access archived medical records in Kentucky?

Access should be limited to authorized workforce members who need the information for their duties. Patients generally have a right to access their own records in a designated record set, and personal representatives may have access when authorized under applicable law. Disclosures to other people or entities must be permitted or required by HIPAA and applicable Kentucky law, or supported by a valid authorization when required.

How should paper medical records be destroyed?

After confirming that the records are eligible for destruction and are not subject to a hold, use a method such as shredding, pulping, burning, or pulverizing that renders the PHI unreadable and not reasonably reconstructable. Secure the records during handling and transport, and document destruction performed by a vendor.