Submit your HIPAA questions to Editor Jaclyn Fitzgerald at firstname.lastname@example.org , and we will work with our experts to provide the information you need.
Q: Within the pharmacy dispensing system at the facility where I am employed, we can enter free-form notes for certain records such as a patient record, prescription records, and physician records. The notes entered in the patient record are customer-service focused and not related to treatment or payment. Would these notes be considered PHI? Would there be a retention requirement concerning these notes?
A: If these notes contain patient-identifiable information, they would be considered PHI and must be protected from unauthorized use or disclosure under the HIPAA Privacy Rule. However, the Privacy Rule does not establish record retention requirements. Instead, state law/regulation establishes retention requirements for medical records and some other records.
Check your state law to see if there are any retention requirements for information in pharmacy dispensing systems. Your state board of pharmacy may be a good resource. Search “(state name) State Board of Pharmacy” into your web browser for more information (i.e., Texas State Board of Pharmacy).
Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, vice president of health information for Baylor Scott & White Health in Temple, Texas, answered this question for HCPro’s Briefings on HIPAA . This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions.