Retaining and securing your notes
Most Allied Health regulatory organisations require that all notes you record are retained in a secure manner for significant periods. Access to notes must be controlled so that only those authorised to view notes do so.
Losing notes for your patient or allowing unauthorised access is usually a breach of your compliance requirements.
Of course it could also have much greater impact, including the loss of continuity of care or breaking a patients trust by allowing their personal information to be viewed by those who shouldn’t see it.
In the extreme case where all records are lost it may damage the viability of your practice.
Protect your practice
Regardless of how you record your notes you need to protect the health of your patients, and your practice, by ensuring that all the notes you record are retained in a secure manner for the required time.
This means thinking through and adding processes and tasks to your daily practice operation to keep your notes safe.
The actions you take will depend largely on whether you record notes on paper or electronically. We will run through each in turn.
A note on storing clinical notes online
A number of the recommendations below will discuss either storing or backing up the clinical notes you record online.
When you are making a decision to store any data online it is important that you trust the organisation you are dealing with. This is even more important when you are storing potentially sensitive clinical information about your patients. There may be industry regulations that you must follow when dealing with information of a medical nature and there will certainly be privacy legislation which may impact some of your choices.
We can’t provide specific advice on how to meet all these industry and privacy requirements but there are some features of online storage which will provide stronger protection if you confirm and utilise them. So, please do some homework before you decide to store patient clinical data online.
In particular you should prioritise or require the following if possible:
Have data stored in your country, or a nearby country with a similar approach to privacy
Ensure the physical location where data is stored is secured, with access controlled to international standards
Have your data encrypted, both when transmitted and at rest, so that unauthorised access will not be possible
Have backup and redundancy options are in place to minimise the likelihood of a service losing your data
Check if there is any sharing of data with third parties, in what circumstances and if there are any limitations
What controls are in place to limit access to data to those authorised
These simple checks will go a long way to ensuring that the clinical notes you store online will be private and secure to meet many of the standard regulations and laws.
Electronic note retention actions
Due to their nature electronic notes have strong retention qualities. There are some risks involved so it is worth reviewing how notes are stored to minimise the risk of loss.
Self managed notes
If you write your notes using your own templates, and store them on your own computers then you will want to have an easy to understand filing and naming system so that it’s easy to store and then find any notes you have recorded.
Secondly, and more importantly, a backup of all your files will be required so that fire, theft or hardware failure wont result in lost notes. Even better you should have a backup system which includes multiple different types of backups to give you the redundancy you need for your important patient files.
Syncing your files to an online storage service like iCloud, DropBox, Google Drive (or one of the many others) id your first line of defence. Next is a weekly (or more often) backup of files to a physical disk which is rotated off-site. If you want to understand more about the backup options available this guide from Backblaze is a great place to start.
Once you have a backup in place you need to check that it’s working properly, that the files on the backup are accessible if the computer is no longer available. You should also have a restore plan in place so that in the event a computer becomes unavailable so you can get quick access to your note history and the ability to record new notes.
It’s for this reason we would recommend taking a daily bootable backup. Where time is short, these backup drives can be attached to a new machine and effectively turn that computer into the original computer without having to do a restore. It can be a little slow, but if you need extra time before you are able to set up a new computer it is the fastest way to get up and running. The best App we know of to create bootable backups on a Mac is SuperDuper! which is worth checking out. Windows machines will likely have similar software options.
With all these backup options remember to do your homework on the service you choose in terms of privacy and security.
Online clinical notes
If you use an online system to record your clinical notes, in particular one that is attached to your practice management system, then you will have strong retention qualities.
Most online services provide encryption, redundancy and regular backups to all the data stored with them. They are a great retention option.
You still need to do the homework to confirm that they meet the baseline requirements for online storage that we discuss above. In particular is it worth confirming where your data will be held as many services will consolidate some or all of there data into global or regional hubs for performance and cost considerations. This may still be acceptable from a privacy and regulatory perspective but you must know that it’s the case rather than assuming it is.
Sending clinical notes
Be careful when sending digital copies of clinical notes outside your practice. If you attach an unencrypted copy to an email and hit send then you are likely to be breaching the privacy laws in your country. Email is not a secure method of sending private medical data.
To send files privately either encrypt the documents before they are emailed, or use an encrypted file transfer service to send them.
Paper note retention actions
Unfortunately, with paper notes, there are a number of situation which could lead to lost notes. All of these would result in either misplacing a note and having the note destroyed. This does mean that paper, without some form of backup process, is a poor long term choice for recording your clinical notes.
For paper notes we recommend the following actions to improve retention:
Take and file a digital backup every time a note is recorded
Have a process for preparing and filing notes each day, potentially with a fail safe check
Decide on long term storage
Limit the locations notes can be stored
Digital copies
By far the best retention action you can take is to record a digital copy every time a note is recorded. This could be as simple as having your reception staff snap a photo of the updated note, or scanning the note, and placing the copy on a PC in your practice.
In order for this to be completely effective you will need to take a few more steps.
You should make sure that the digital copy itself is backed up by using online backup or a shared file service like Dropbox
You must take a digital copy every time a change is made to a note, even if it results in multiple copies for a single piece of paper
The filing of the digital copy itself must be structured to easily find the notes you have saved
You must have a process in place for your reception staff to take the copy, file it and ensure that no copies are missed
It is difficult to see how paper notes can meet regulatory compliance requirements without digital copies in place.
Preparing and filing notes
The physical nature of paper notes requires special daily processes to ensure that the notes are available when required and then stored once they are finished with. They are relatively simple to understand and if you are using paper notes you will already have these processes in place.
There are a few important considerations that you should review as part of whatever process you have:
Do you have a fail safe double check and the end of each shift to ensure that the notes have been placed back into the filing system in the correct place
Do you have the storage required to store all the notes on site or will you need longer term storage in the future
Limitations should be placed on access to notes and the number of locations they can be stored, both will be discussed later in the series but as a minimum ensure that notes are not taken outside of the office, unless it is to place them in long term storage
If practitioners are allowed to take notes home to complete them at the end of the shift, processes must be in place to keep the notes safe and ensure they are not misplaced, destroyed or accidentally revealed to people who shouldn’t see them
Long term storage
Physical notes can eventually take up significant filing space in your practice and as you grow you may need to consider long term storage.
If you are at the point of considering long term storage then keep in mind the following:
There will be a trade off between the cost of the storage and access to notes. You will want the storage to be close to your practice so you can access notes as required, but the closer the storage the higher cost it may be.
Deciding what qualifies for long term storage isn’t necessarily a simple process. You could send all notes where a patient hasn’t been seen in some period of time, but they may return necessitating collecting their notes. Alternatively you could only send completed note pages which are older than some period of time, but that will mean splitting a patients record in two parts which is not ideal from a regulatory perspective.
Take your time
There are a number of recommendations here, and this is only one of the five tenets of effective clinical note taking that we are covering. Take your time as you add these and other changes to your practice. You may find that just collating confirming the access controls over your clinical notes can immediately improve your retention and security practices.
Want to learn more
This article is part of the series “Effective clinical note taking for Allied Health practitioners”. Please see the other emails in the series for further details and recommendations. If you were sent this link directly and want to subscribe to the whole series, please sign up.