Back to Chapter 3 Privacy, Confidentiality & Medical Records
Opinion 3.3.1
Medical records serve important patient interests for present health care and future needs, as well as insurance, employment, and other purposes.
In keeping with the professional responsibility to safeguard the confidentiality of patients’ personal information, physicians have an ethical obligation to manage medical records appropriately.
This obligation encompasses not only managing the records of current patients, but also retaining old records against possible future need, and providing copies or transferring records to a third party as requested by the patient or the patient’s authorized representative when the physician leaves a practice, sells his or her practice, retires, or dies.
To manage medical records responsibly, physicians (or the individual responsible for the practice’s medical records) should:
- Ensure that the practice or institution has and enforces clear policy prohibiting access to patients’ medical records by unauthorized staff.
- Use medical considerations to determine how long to keep records, retaining information that another physician seeing the patient for the first time could reasonably be expected to need or want to know unless otherwise required by law, including:
- immunization records, which should be kept indefinitely;
- records of significant health events or conditions and interventions that could be expected to have a bearing on the patient’s future health care needs, such as records of chemotherapy.
- Make the medical record available:
- as requested or authorized by the patient (or the patient’s authorized representative);
- to the succeeding physician or other authorized person when the physician discontinues his or her practice (whether through departure, sale of the practice, retirement, or death);
- as otherwise required by law.
- Never refuse to transfer the record on request by the patient or the patient’s authorized representative, for any reason.
- Charge a reasonable fee (if any) for the cost of transferring the record.
- Appropriately store records not transferred to the patient’s current physician.
- Notify the patient about how to access the stored record and for how long the record will be available.
- Ensure that records that are to be discarded are destroyed to protect confidentiality.
AMA Principles of Medical Ethics: IV, V
Council Reports
Related Opinions
See All OpinionsPatient-Physician Relationships
At the heart of medicine lie relationships founded in a “covenant of trust” between patient and physician in which physicians commit themselves to responding to the needs and promoting the welfare of patients.
Patient Rights
The health and well-being of patients depends on a collaborative effort between patient and physician in a mutually respectful alliance.
Terminating a Patient-Physician Relationship
Physicians’ fiduciary responsibility to patients entails an obligation to support continuity of care for their patients.
Confidentiality
Physicians have an ethical obligation to preserve the confidentiality of information gathered in association with the care of the patient. With rare exceptions, patients are entitled to decide whether and to whom their personal health information is disclosed.
Access to Medical Records by Data Collection Companies
Information gathered and recorded in association with the care of a patient is confidential. Disclosing information to third parties for commercial purposes without consent undermines trust, violates principles of informed consent and confidentiality, and may harm the integrity of the patient-physician relationship.
Confidentiality & Electronic Medical Records
Information gathered and recorded in association with the care of a patient is confidential, regardless of the form in which it is collected or stored.
Breach of Security in Electronic Medical Records
When there is reason to believe that patients’ confidentiality has been compromised by a breach of the EMR, physicians have a responsibility to follow ethically appropriate procedures for disclosure. The degree to which an individual physician has an ethical responsibility to address inappropriate disclosure depends in part on his or her awareness of the breach, relationship to the patient(s) affected, administrative authority with respect to the records, and authority to act on behalf of the practice or institution.
