Medical Records Retention for Wound Care: Legal Guide

Medical Records Retention Requirements for Wound Care Practices

Medical records retention is a compliance obligation that wound care practices cannot afford to get wrong. Destroying records too early exposes the practice to audit liability, malpractice defense gaps, and regulatory penalties. Retaining records without proper security exposes the practice to HIPAA violations. Every wound care practice must establish a medical records retention policy that satisfies the most demanding applicable standard across federal law, state law, payer requirements, and malpractice statute of limitations.

The challenge for wound care specifically is that wound care records often span longer treatment periods, involve higher audit rates from Medicare, and contain imaging and measurements that create larger storage requirements than typical outpatient records.

Federal and State Retention Requirements

No single federal law mandates a universal medical records retention period for all providers. The retention obligation comes from multiple overlapping regulations, and the practice must comply with whichever imposes the longest requirement.

Federal Requirements

HIPAA. HIPAA does not specify a medical record retention period. However, HIPAA requires that policies, procedures, and documentation related to HIPAA compliance be retained for six years from the date of creation or the date the document was last in effect, whichever is later. This applies to your privacy and security policies, not to clinical records directly.
Medicare Conditions of Participation. Medicare requires providers to retain records for at least five years from the date of service for purposes of audit and review. For wound care practices that bill Medicare, this is the federal floor.
False Claims Act. The federal False Claims Act has a six-year statute of limitations, extendable to ten years in some circumstances. Records that might be relevant to a False Claims Act investigation should be retained for at least ten years to support the practice's defense.

State Requirements

State medical records retention laws vary from five to ten years for adult patients, with extended requirements for minors (often until the patient reaches age of majority plus the standard retention period). Some states specify different retention periods for different record types.

The practical approach is to identify the longest applicable retention period across all jurisdictions where the practice operates or has operated and apply that standard uniformly. For most wound care practices, a ten-year retention policy satisfies all federal and state requirements with a safety margin.

Medicare Audit Period and Wound Care Records

Wound care practices face higher Medicare audit rates than many other outpatient specialties. Debridement codes, skin substitute codes, and evaluation and management codes billed alongside wound care procedures are frequent audit targets.

Audit Timeline Considerations

Medicare RAC audits, ZPIC audits, and SMRC reviews can look back at claims within the standard three-year reopening window. However, cases involving suspected fraud have no time limitation. The practical implication is that wound care records supporting any Medicare claim should be retained for a minimum of seven years, and ten years is safer.

What Wound Care Records Must Include for Audit Purposes

Retention is not just about keeping files. The retained records must be complete enough to support the claims that were billed. For wound care, this means retaining:

Complete wound assessment documentation including measurements and photographs
Treatment plans with revision histories
Progress notes for every visit
Debridement documentation including tissue type, area, and method
Wound photographs with date stamps and patient identification
Orders for wound care supplies and DME
Lab results, vascular study results, and pathology reports
Referral documentation and consultation notes
Signed consent forms for procedures

For a broader view of how compliance programs protect wound care practices, see Wound Care Compliance Program Development.

Electronic Storage Requirements

Most wound care practices now maintain electronic health records, but electronic storage introduces its own compliance obligations.

HIPAA Security Rule Compliance

Electronic wound care records must be stored in systems that satisfy HIPAA Security Rule requirements:

Access controls. Role-based access limiting record access to authorized personnel
Audit trails. Logging of who accessed, modified, or exported records and when
Encryption. Data encryption at rest and in transit for all electronic protected health information
Backup and recovery. Regular backups with tested recovery procedures to prevent data loss
Business associate agreements. BAAs with any third-party vendors who store, transmit, or process electronic wound care records

Wound Care-Specific Storage Considerations

Wound care records present unique electronic storage challenges:

Photograph storage. Wound photographs generate significant storage volume over long treatment courses. The storage solution must maintain image quality sufficient for clinical and audit use throughout the retention period.
Measurement data. Wound measurements must be stored in a format that preserves the data integrity and allows for healing trajectory analysis during audits.
Format longevity. Records retained for ten years must be accessible at the end of that period. File formats, database structures, and software platforms may change. The retention policy must address format migration to prevent records from becoming inaccessible.

For guidance on securing wound care records in mobile practice settings, see HIPAA Compliance for Mobile Wound Care.

Destruction Protocols for Wound Care Records

When the retention period expires, records must be destroyed in a manner that prevents unauthorized access to protected health information. Improper destruction is a HIPAA violation regardless of how well the records were secured during their retention period.

Destruction Methods

Paper records. Cross-cut shredding or incineration. Standard strip-cut shredding is not sufficient for records containing PHI.
Electronic records. Secure deletion using methods that prevent data recovery. For hard drives and solid-state drives, this means using certified data destruction software or physical destruction of the storage media.
Photographic records. Digital photographs must be destroyed using the same electronic destruction standards. Physical photographs must be shredded or incinerated.

Documentation of Destruction

Maintain a destruction log that records:

What records were destroyed (patient identifiers, date ranges, record types)
When destruction occurred
How destruction was performed (method and standard)
Who performed or supervised the destruction
Certificate of destruction from any third-party destruction vendor

The destruction log itself must be retained. This log becomes the practice's proof that records were handled properly if a question arises after destruction.

Key Takeaways

Apply the longest applicable retention period across all jurisdictions; for most wound care practices, ten years from the date of service provides adequate coverage for Medicare audits, state requirements, and malpractice statutes.
Wound care records retained for audit defense must include complete clinical documentation, photographs with date stamps, measurement data, and all supporting orders and results.
Electronic wound care records must satisfy HIPAA Security Rule requirements including encryption, access controls, audit trails, and business associate agreements with storage vendors.
Records destruction requires documented protocols using certified methods, and the destruction log itself must be retained as proof of compliant disposal.