• Ben Kanter, M.D. , CMIO, PPH
• Lisa Thakur, VP Operations, Scripps Health
• Chris Pryor, IT Director/Clinical Systems, Sharp Healthcare
• Ash Shehata, Director Cisco Systems
• Tim Vanderveen, VP Carefusion
• John Curing, VP Burwood Group

The Evolution of Record Retention: Best Practices for Healthcare and Life Science Firms
 By DeEtte Trubey, PMP (http://www.linkedin.com/in/deettetrubeypmp)

The financial world asked permission from the Securities and Exchange Commission (SEC) in the early 1990s to make electronic copies of the records that were traditionally kept on paper or microfiche.  This enabled them to service their clients in a much faster and more efficient manner.  In fact, it worked so well that the financial firms requested to store everything electronically, and get rid of the paper records.

After considering the request, the SEC issued a final rule that allowed financial firms to store records exclusively electronically, if they met very stringent criteria, including:  at least two copies of the data and two copies of the separate database indices, with one set of the data and indices stored offsite, and a trusted third party who knew how to access those records, should something happen to the firm (SEC Title 17 Section 240.17a-4(f)(1-3)).

Additionally, after it was discovered that changes had been made to many electronic records in order to avoid legal discovery, a requirement was added that specific categories of records be recorded on WORM (Write Once Read Many) (not re-writable) media.  This WORM requirement was expanded to include all email into, within, and leaving each firm for 3 years in the USA and 5 years in Canada.

When it was discovered that outside email (i.e. Yahoo, Gmail, Hotmail, AOL etc.) was being used to setup and place trades, the ruling added that all emails concerning trading had to be from the firm’s email domain, and safeguards must be put in place so the researchers could not talk with the traders, to avoid selective disclosure and any appearance of Insider Trading (SEC Title 17 CFR Parts 240, 243, and 249.)

With the advent of Instant Messaging (IM), the firms either had to capture it or lock out the capability. These requirements were put in place to stop illegal activities from occurring. The WORM requirement for email was added because the legal community needed to be able to discover what actually occurred during investigation of wrongdoing, without records being selectively changed.

Depending on the firm size and the amount of records processed, this requirement could be fulfilled inexpensively by using indexed Write-only DVDs, or at the other end of cost spectrum, with Compliance editions for EMC Centera and NetAPP.  For companies that had already invested in the enterprise systems following IT best practices, this created a major expense to switch to the Compliance editions. 

The Code of Federal Regulations also specified the length of time that different classes of records must be kept, including some which were to be kept for the life of the account plus ten years. (SEC) Title17 CFR Part 240 Sections 17a-3 and 17a-4 contain the Financial and Securities specifics.

What happened over the last 20 years with the regulation of the financial industry has a direct correlation with what is happening now within the Healthcare and Life Sciences Industry,including HIPAA, Sarbanes Oxley (SOX), FDA Title 21 CFR Part 11, DOD 5015.2, require companies to preserve increasing amounts of data, including information relating to financial statement accounting.

Best practices would suggest the use of WORM media to store critical information in a form that cannot be altered or erased. FDA Title 21 CFR Part 11 in particular contains specifics on Electronic Records and the requirement for the use of digital signatures with electronic records. CFR Title 21 Part 11 also requires a company to “employ procedures and controls designed to ensure the authenticity, integrity, and confidentiality of electronic records from the point of their creation to the point of their receipt.” This potentially includes using document encryption and digital signature standards to preserve a company’s intellectual property.

We must create Best Practices and follow them, or new regulations will be etched in stone without our input.  Healthcare records, medical test results and bio-implant device records may soon require specific times for records retention, in some cases, requiring the records to be kept for the life of the patient plus a number of years. The industry must work together to establish appropriate archiving and retention standards for each record type.

Email and Instant Messaging for collaboration among partners, to get a product to market or promises made about research, should be documented in a way that is consistent and discoverable. Additionally, if all records concerning development of a new product are stored on WORM media, the time stamp of the archived WORM storage media could prove in a court of law who was first to discover and who should own the rights to the product or process, without having to divulge company intellectual property to apply for a patent.

Among the specifics (which can also be applied to wireless records):
 

• Authentic and reliable records must be captured promptly and accurately and preserved according to industry specific retention standards
• Attachments must be stored with the master document Viewing, saving, and printing of specific record categories must be possible
• Mishandling of data should not be possible
• Screens blocking the side viewing of records should be in place where ever it is possible for others to see data records that do not belong to them
• Screens set up for the patient to potentially see should contain only their information
• Changing key fields (like BirthDate) on a relational database should require a special change management process, with high-level supervisor approval, so as not to completely overwrite health records of another person by accident
• Specific records (based on industry) should be written to WORM media
• Records should be written to media, with records of a similar retention cycle, to ensure that records which must be kept for long term are not mixed in with records that must be kept for a short term
• Companies that purchase assets, which are under regulatory compliance rules, to maintain electronic records on WORM media for specific numbers of years, become themselves required to maintain those records
• Records should be written to WORM media, based on company division, which would make the regulatory compliance for electronic records much easier when company assets are sold
• System backup must occur at regular intervals, complete with audit trail
• Company IT Procedures must require comparing the size and amount of data between original data and data indices with the size of the new backup data and data indices at the end of each backup procedure and sizes must match
• Companies that are encrypting records should make sure that they have their Public keys and their Private keys available to a limited number of trusted employees
• Additionally, the encryption Public and Private keys should be backed up, and stored off-site in more than one storage facility so that a common disaster will not cause a company’s entire set of encrypted records to become unreadable
• Data and indices must be backed-up separately and stored offsite, preferably in a secure site that is far enough away so a single disaster will not take out the main system and the backup
• Data should be stored in a form that is easily read by generic software (e.g., PDF) or there should be a Service Level Agreement (SLA) with a trusted third party who has access to the software and knows how to read the data records
• Complete system recovery from the backups should be verified at least yearly, if not more often
• An approved corporate destruction policy, that takes into account all current regulations, should be in place and followed
• Appropriate access controls must be maintained and access recorded
• Audit information must be preserved
• Records, computer systems, and controls must be available for audit and/or discovery by the appropriate authorities

In addition, even if a company believes that they have found an efficient way to comply with the requirements that files be stored for long periods of time and remain unchanged to protect data integrity, there currently is no electronic media that can hold these records for an extended period of time.

As the capabilities of the system media change, the records must be migrated without loss of integrity. This responsibility cannot be generically “tossed to the cloud”, especially with records on public servers currently considered public domain after 6 months.

Please see the Electronic Communications Privacy Act (ECPA) reform discussion: (http://judiciary.house.gov/hearings/pdf/Hintze100923.pdf)

 

• How do I deliver value to people, clients or my company?
  Is it knowledge, your contacts, dependability, or unique skillset?
• Who is your client? Who are the ultimate beneficiaries of my work? What is important to them?
• What is unique about me?
• What can I do to showcase my personal brand of talent? 
   
• How can I contribute more perceived value? What contribution to I offer?

1. Tailor your Resume and Cover Letter. Use the job description to your advantage.  The average time that an employer looks at a resume is 10-20 seconds, which emphasizes the importance of the relevance and clarity of your resume content. Use the same language in the job description when modifying your resume and cover letter and be ready to provide specific examples for your interview (see below). 
    
2. Be Prepared. Study the job description and identify personal examples of how you have or how you can apply your skills to the job responsibilities and tasks.  Do your research on the organization to identify how you align yourself with their mission and goals, and to research any programs or initiatives that you may be part of if you are offered an opportunity. Prepare questions to ask the employer after they have completed asking their interview questions. Having questions ready at the end shows that you have done your research and have strong interest in the opportunity at hand. 
    
3. Be Specific. Think about how all of your experiences can be grouped into categories “Examples of Organizational Skills, Examples of implementation of a project, Examples of Leadership.” When answering a question during an interview, make your experience sound like a brief story, with a beginning, middle, and end with emphasis on the skills you used, the critical thinking you performed, and the outcome of your efforts.  When answering a generic question about your organizational skills, explain how you organized a project and the impact it had, i.e. “I utilize shared calendar deadlines and flow charts to track project outcomes while providing weekly updates and task lists to the entire project team to ensure that the team is moving forward efficiently.” 
    
4. Present Yourself Professionally.  Looking well-groomed helps your image as you look clean and ready to work.   Be careful about displaying distractions that may hinder the employer from seeing you who are and what you want to do, such as earrings, un-combed hair, bright make-up, and revealing, inappropriate clothing. 
    
5. Utilize Your Networks. With social networking sites like Facebook and professional networking sites like LinkedIn, your network can drastically improve your awareness of opportunities that you might be not able to find posted publicly.  Determine if any of your current relationships with people can lead to connections with people who you want relationships with.  Your network can be your most valuable resource in your career, especially when working in the health field where resources seem to be harder to find.