Enabling Information Governance:

Transcription

1 Enabling Information Governance: The Importance of Retention Policy & Management Haven t worn it in the last year? Then it s time to reduce the clutter and get that article of clothing out of your closet. That s the common wisdom professional organizers often give to those trying to bring some order to their homes. Healthcare organizations face a similar challenge as they struggle to achieve some order by managing what records stay and what records go. The problem: There s no simple rule to live by as retention management in healthcare is much more complicated than the one year axiom. Unfortunately, healthcare professionals often struggle with their records retention schedule and that s why organizations tend to have a keep everything culture, exposing themselves to increased cost and legal risk. In addition, they maintain policies and retention schedules with manual time-intensive processes and piecemeal spreadsheets, which put them at risk of non-compliance, said Greg Slabodkin, managing editor of Health Data Management magazine. Slabodkin recently served as the host of Enabling Information Governance: The Importance of Retention Policy & Management, a webinar sponsored by Iron Mountain and hosted by Source Media. During the online presentation, industry experts Linda Kloss, president of Kloss Strategic Advisors and formerly the CEO of the American Health Information Management Association (AHIMA), Dan McKnight, program manager at Iron Mountain, and David Murphy, health information management operations manager and records management administrator at Lahey Health, a Burlington, Mass.-based

2 "Lifecycle management, including retention practices, is a very key dimension of effective information governance." - Linda Kloss, President Kloss Strategic Advisors healthcare provider, offered their expert perspectives on information governance, the importance of effective records retention initiatives as well as the best practices associated with planning and implementing these programs. Information Governance To start, leaders need to consider the importance of information governance as it is used to guide the creation, storage, archiving, management and deletion of both electronic and paper information. Think of information governance as kind of the rules of the road, the ground rules for how information will be managed to enhance its value as an asset while ensuring proper stewardship and compliance, Kloss said. Lifecycle management, including retention practices, then, is a very key dimension of effective information governance. Retention practices typically emanate from a variety of applicable laws and standards. As such, healthcare leaders need to understand the operable laws. For example, a state law [might dictate] how long records are to be retained, Kloss said. At the same time, standards such as the HL7 standard on records management and evidentiary support could introduce additional requirements. These laws and regulations only provide a starting point, though. Healthcare organizations also need to examine other principles that will govern their own unique retention policies. For example, a research and teaching facility may be committed to more longterm retention of electronically stored clinical information, well beyond the legal and regulatory requirements. But another organization, their guiding principle might be to adhere to the legal and regulatory floor or [minimum], Kloss said. The laws, standards and principles provide direction, but organizations also need to ensure that they have the people, procedures and technology that make it possible to implement and support information governance and records retention policies. It s a tall task, as most healthcare organizations appear to be struggling with data retention policies, according to the 2014 and 2015 Cohasset AHIMA Information Governance surveys. 1 In fact, according to the survey results, only 34% of respondents said that they would describe their records retention practices as mature; just 26% reported that electronically stored information that is eligible for deletion is actually being deleted; and only 37% reported that they have mature, standardized practices for paper records that are eligible for deletion. The fact that electronic information is growing is making the data retention challenge even greater. 2

3 "With all this new electronic data in the mix, there's great uncertainty about retention." - Linda Kloss, President, Kloss Strategic Advisors We ve seen an exponential growth of information and data including new and challenging forms such as exchanges between patients and clinicians and patient-generated information, Kloss said. Unfortunately, with all this new electronic data in the mix, there s great uncertainty about retention, she added. One thing is certain, though: keeping it all is simply not a viable long-term strategy, according to Kloss. Improving records retention at Lahey Indeed, leaders at Lahey Hospital and Medical Center realized that to better manage their information, they needed to develop a more comprehensive and integrated records retention program. As it had been operating, each area of the hospital was responsible for its own storage and associated retention - with no central oversight. Storage costs continued to grow due to concerns of destruction as well as the fact that many areas were maintaining material longer than needed in relation to litigation. As a result, Lahey worked with Iron Mountain to design and implement an information lifecycle management program that would include a records retention initiative designed to improve cost control, enhance access to information, and support recordkeeping consistency while also reducing litigation risk. Through the implementation period, which required a good deal of organizational collaboration across various departments, the provider organization was able to: produce defined record classes, retention schedules and functional classifications; update policies and procedures; and publish a retention schedule on the hospital s intranet site. In fact, the initiative has enabled the hospital to make the following improvements to its records retention initiative: Single authority. The records retention schedule is now the only authority for the retention and destruction of media, regardless of format. Defined roles. Expectations for who is responsible for maintaining compliance to policy is now clearly delineated. Accountability. Records managers, records coordinators and business partners are now ensuring records are classified appropriately and reviewed for destruction opportunity. Enterprise support. Business partners such as human resources, legal, IT and others routinely reference the retention policy to support issues/concerns. 3

4 "Your organization can reduce storage costs by having better control of both your physical and your electronic records." - Dan McKnight, Program Manager Iron Mountain Expanded reach. The ability to expand policy reach and maintain policy relevance is easier to achieve. Space savings. The hospital has been able to reduce the storage footprint required for records. By implementing more sophisticated records retention programs such as Lahey s, healthcare organizations can expect to achieve a variety of benefits, according to McKnight. Perhaps most importantly, organizations can significantly cut expenses through these initiatives. Your organization can reduce storage costs by having better control of both your physical and your electronic records. And, when you have more control of your records, knowing that you have those records that are required, and knowing where they are, you can reduce the costs of litigation and discovery, McKnight said. In addition, improved records management can directly translate to reduced data security risks. By limiting your stored records to only those that are required to retain and having the right security controls, your organization will be less vulnerable to data breaches, McKnight pointed out. Doing records retention right To successfully implement an enterprise-wide records retention program, however, healthcare organizations should consider a variety of best practices: Apply retention requirements to all data formats. It's not just about paper, many records are retained electronically. You want to make sure that you have a retention schedule that works, regardless of the format, McKnight said. Consider all types of records. It s important to realize that there are specific requirements for certain types of medical records. The retention periods for minors, for example, are different than for other patients. Remember that your retention schedule should include all of your records not just medical records. For example, general accounting records, employee training, tax reporting, all of those types of records have to be included in the retention schedule, McKnight said. Take your organization s unique history into account. When determining a retention schedule, it s important to consider your organization s litigation history as well as other risk and cost considerations. Some organizations choose to dispose of records as soon as they are legally able to do so. Many others might want to hold onto some records for a longer period to help with litigation and other operational issues, McKnight said. 4

5 Healthcare organizations can create the records retention programs that they need by promoting the importance of such initiatives as an organizational imperative that enables better information governance. Cast a wide net. The retention schedule should address all records regardless of their format. The retention schedule should encompass both legal and regulatory requirements and, in some cases, operational requirements as well, McKnight said. Involve a variety of staff members. A records retention program requires the participation of a variety of staff including executives, legal, compliance, health information management, information systems, IT governance and security. It s important to get the key players invested in this right at the start, McKnight said. For example, IT needs to think about applying the retention schedule to electronic records. So, you ve got to have the right people at the table. Train the staff to take action. Staff need to not only understand the records retention policies and procedures, they must be trained in how to implement them. It s got to be a combination of Records Management 101 training for all staff and then perhaps more detailed training for those who have roles that are more specific with regard to records and information management, McKnight said. Consider your geographic reach. Many organizations operate facilities in a number of states. You want to make sure that the policy and the retention schedule includes those state requirements, all of them, and that it is complied with, again, regardless of the location. McKnight said. Spell out who is responsible for what. Your records retention policy should state which senior position has overall accountability for the program... and which position has day-to-day responsibility for managing the program. At a high level, the policy should address how the organization manages records across the entire lifecycle of those records. That includes the litigation holds, security, storage and access as well as records disposition. Responsibility for training and compliance review should also be addressed in the policy, McKnight said. Keep it current. Laws and standards are subject to change. As such, organizations need to keep the policy and retention schedule fresh and up-to-date, and build in regular compliance reviews, McKnight said. In summary, healthcare organizations can create the records retention programs that they need by promoting the importance of such initiatives as an organizational imperative that enables better information governance. By engaging various stakeholders across the organization, training staff, implementing technology that will support records retention goals and adopting a variety of best practices, organizations can achieve cost savings, reduce legal risks and realize the advantages associated with focusing on high value data. Reference 1 Source: Cohasset AHIMA Information Governance in Healthcare: Professional Readiness and Opportunity, underwritten in part by Iron Mountain and Nuance 5