Maine Ambulance EMS Run Report Privacy Laws: Compliance Checklist

Patient Care Report Timelines

You must complete a Patient Care Report (PCR) for every request for service and submit it within 24 hours of the incident’s completion. For transported patients, the PCR must also be submitted within 24 hours of arrival at the destination facility; if a full ePCR cannot be left at the hospital, you must leave a Maine EMS–approved handwritten short form. ([law.cornell.edu](https://www.law.cornell.edu/regulations/maine/16-163-C-M-R-ch-22-SS-3))

Checklist

• Start the PCR during or immediately after care; verify the incident completion and destination arrival times.
• For transports, leave an approved short form if the full PCR cannot be left before departure. ([law.cornell.edu](https://www.law.cornell.edu/regulations/maine/16-163-C-M-R-ch-22-SS-4))
• Ensure all required Maine EMS Data Dictionary fields are complete to avoid validation delays. ([law.cornell.edu](https://www.law.cornell.edu/regulations/maine/16-163-C-M-R-ch-22-SS-4))

Usage of MEFIRS System

Maine EMS requires electronic PCR reporting through the Maine EMS & Fire Incident Reporting System (MEFIRS), the statewide system used with the Office of the State Fire Marshal. Maine EMS provides non‑mobile access to the ePCR system at no cost to each EMS agency. ([www11.maine.gov](https://www11.maine.gov/ems/mefirs))

Setup and workflow checklist

• Confirm your software is NEMSIS-compliant and mapped to the Maine EMS Data Dictionary. ([law.cornell.edu](https://www.law.cornell.edu/regulations/maine/16-163-C-M-R-ch-22-SS-4))
• Validate uploads and clear error queues daily; correct rejected elements promptly.
• Limit MEFIRS access to trained staff; request data-access logs from Maine EMS when needed (available within 14 days). ([maine.gov](https://www.maine.gov/ems/sites/maine.gov.ems/files/inline-files/Maine-EMS-Rules-Effective-December-13-2023.pdf))

HIPAA Confidentiality Rules

The Health Insurance Portability and Accountability Act (HIPAA) sets the baseline for protecting EMS PCRs as protected health information (PHI). You may use and disclose PHI without authorization for treatment, payment, and health care operations, and for other narrowly tailored purposes recognized by HIPAA. Maintain the “minimum necessary” standard and document compliance. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

HIPAA does not impose a medical record retention period, but it requires you to retain HIPAA compliance documentation (policies, notices, training records, and related evidence) for at least six years from creation or last effective date. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html?utm_source=openai))

Action steps

• Train all personnel on PHI privacy/security and limit ePCR access to job-related need. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.530?utm_source=openai))
• Honor patient access requests to their PCRs per HIPAA’s access rules. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))
• Maintain HIPAA documentation for six years; this is separate from clinical record retention. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.530?utm_source=openai))

Law Enforcement Disclosure Procedures

Under Maine’s Freedom of Access Act (FOAA), medical records and reports of municipal ambulance/rescue and other EMS units are not public—but they must be made available upon request to law enforcement officers investigating criminal conduct. Any disclosure must still align with HIPAA’s permitted law‑enforcement disclosures and the minimum‑necessary rule. ([mainelegislature.org](https://www.mainelegislature.org/legis/statutes/1/title1sec402.html))

Step‑by‑step protocol

• Verify the requester’s identity and confirm the request is tied to a criminal investigation under FOAA’s EMS provision. ([mainelegislature.org](https://www.mainelegislature.org/legis/statutes/1/title1sec402.html))
• Disclose only what HIPAA allows for law enforcement (e.g., to locate a suspect, respond to a court order/subpoena, or report certain crimes at an emergency scene). Log the disclosure. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.512?utm_source=openai))
• When in doubt, seek a valid legal process (court order, warrant, or administrative subpoena) before releasing PHI. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.512?utm_source=openai))

EMS Record Retention Policies

Record retention is governed by state records schedules (and organizational policy), not HIPAA. For municipally operated ambulance services, local government schedules require EMS “Run Sheets” be retained for six years. State Department of Public Safety schedules list “EMS Run Reports” retained four years at the agency level. Keep controlled‑drug/medication logs at least five years. ([maine.gov](https://www.maine.gov/sos/arc/records/local/localschedules2018.v2.pdf?utm_source=openai))

HIPAA compliance documentation (not the clinical PCR itself) must be retained for at least six years. Align your agency’s retention policy with these schedules and any payer, hospital, or risk‑management requirements that may warrant longer retention. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.530?utm_source=openai))

Retention checklist

• Municipal services: retain PCR/run sheets ≥6 years; state‑level EMS program records: follow the four‑year schedule (agencies may keep longer). ([maine.gov](https://www.maine.gov/sos/arc/records/local/localschedules2018.v2.pdf?utm_source=openai))
• Maintain drug/med logs for a minimum of five years. ([maine.gov](https://www.maine.gov/ems/sites/maine.gov.ems/files/inline-files/Maine-EMS-Rules-Effective-20260406.pdf))
• Retain HIPAA compliance documentation for six years. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.530?utm_source=openai))

Peer Review Committee Protections

Quality assurance (QA)/peer review materials of an EMS quality assurance committee approved by the Maine EMS Board are confidential and generally not discoverable. Patient‑identifying information provided to the Board for investigations is confidential. Participants and assisting entities receive statutory protections. ([mainelegislature.org](https://www.mainelegislature.org/legis/statutes/32/title32sec91-B.html))

Practical safeguards

• Form a Board‑approved QA committee; label materials “Confidential QA/Peer Review.” ([mainelegislature.org](https://www.mainelegislature.org/legis/statutes/32/title32sec91-B.html))
• Segregate QA files from patient medical records; share only as permitted by statute or Board‑approved processes. ([mainelegislature.org](https://www.mainelegislature.org/legis/statutes/32/title32sec91-B.html))

Controlled Substance Reporting

Report any instance of missing controlled drugs or medications to Maine EMS within 24 hours of discovery and send a full investigative report when complete. Secure storage with numbered seals is required; maintain a drug/medication log for each vehicle or drug box and retain these logs for at least five years. ([maine.gov](https://www.maine.gov/ems/sites/maine.gov.ems/files/inline-files/Maine-EMS-Rules-Effective-20260406.pdf))

If your service dispenses controlled substances (rare in field EMS), comply with Maine’s Prescription Monitoring Program reporting rules; note that controlled substances dispensed by a hospital emergency department for ≤48 hours are exempt from routine PMP submission. ([legis.maine.gov](https://www.legis.maine.gov/statutes/22/title22sec7249.html?utm_source=openai))

Chain‑of‑custody checklist

• Use sealed, labeled storage; perform daily seal/expiry checks and record them in the log. ([maine.gov](https://www.maine.gov/ems/sites/maine.gov.ems/files/inline-files/Maine-EMS-Rules-Effective-20260406.pdf))
• Reconcile usage to PCR numbers; investigate discrepancies immediately and report losses within 24 hours. ([maine.gov](https://www.maine.gov/ems/sites/maine.gov.ems/files/inline-files/Maine-EMS-Rules-Effective-20260406.pdf))

FAQs.

What is the required timeframe for submitting EMS run reports?

Submit an electronic PCR within 24 hours for every request for service; for transports, it must be submitted within 24 hours after arrival at the destination. If you can’t leave a full PCR at the receiving facility, leave an approved handwritten short form. ([law.cornell.edu](https://www.law.cornell.edu/regulations/maine/16-163-C-M-R-ch-22-SS-3))

How does HIPAA protect EMS run report confidentiality?

HIPAA treats PCRs as PHI and permits use/disclosure without authorization only for defined purposes (e.g., treatment, payment, operations) and specific public‑interest exceptions. You must apply the minimum‑necessary standard and maintain required privacy/security documentation for six years. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

When can EMS reports be disclosed to law enforcement?

FOAA requires municipal EMS records be available to law enforcement investigating criminal conduct, but disclosures must also meet HIPAA’s law‑enforcement provisions (e.g., court order, limited identifying information, emergencies). Disclose only what is permitted and document the disclosure. ([mainelegislature.org](https://www.mainelegislature.org/legis/statutes/1/title1sec402.html))

What is the minimum retention period for EMS records in Maine?

For municipal ambulance services, retain run sheets at least six years; the Department of Public Safety’s schedule retains EMS run reports for four years at the state‑agency level. Keep controlled‑substance logs at least five years and HIPAA compliance documentation for six years. Your agency may adopt longer periods based on risk or payer requirements. ([maine.gov](https://www.maine.gov/sos/arc/records/local/localschedules2018.v2.pdf?utm_source=openai))