Medical Records Custody Agreement Template for the United States

A Medical Records Custody Agreement is a critical legal document that governs the transfer and management of patient medical records when healthcare providers need to change custody arrangements. You'll need this agreement to ensure compliance with federal healthcare privacy laws while protecting sensitive patient information during transitions.

When do you need this document?

You need a Medical Records Custody Agreement when your medical practice is closing permanently, when you're retiring and transferring patient records to another provider, or during practice mergers and acquisitions. The agreement is also essential when outsourcing record storage to third-party medical records management companies or business associates. Healthcare facilities undergoing ownership changes, converting from paper to electronic records systems, or establishing partnerships with other healthcare entities also require this documentation. Emergency situations where a practice must suddenly cease operations due to unforeseen circumstances make this agreement crucial for ensuring continuity of patient care and legal compliance.

Key legal considerations

The agreement must clearly define the roles and responsibilities of both the transferring healthcare provider and the receiving custodian. Critical clauses include specific security measures for protecting Protected Health Information (PHI), procedures for patient access to their records, and protocols for handling record requests from other healthcare providers. You must address liability allocation, indemnification provisions, and breach notification procedures. The document should specify retention periods, destruction protocols for records that have exceeded legal requirements, and compliance monitoring procedures. Insurance requirements, termination clauses, and dispute resolution mechanisms are equally important to prevent future legal complications.

Legal requirements in the United States

Under federal law, your Medical Records Custody Agreement must comply with HIPAA Privacy and Security Rules, which mandate specific safeguards for PHI handling and transmission. The HITECH Act expands these requirements, particularly for electronic health records, and increases penalties for violations. If your records include substance abuse treatment information, you must also comply with 42 CFR Part 2 regulations, which impose stricter confidentiality requirements than HIPAA. The agreement must ensure ADA compliance for accessibility of medical records and accommodate patients with disabilities. State laws may impose additional requirements regarding record retention periods, patient notification procedures, and specific licensing requirements for records custodians. Your agreement should include provisions for ongoing compliance monitoring and regular security assessments to meet evolving regulatory standards.