CMS SOM App. G, Tag J-0151

(1) The clinic . . . maintains a clinical record system in accordance with written

policies and procedures.

(2) A designated member of the professional staff is responsible for maintaining the

records and for insuring that they are completely and accurately documented,

readily accessible, and systematically organized

Interpretative Guidelines § 491.10(a)(1)-(2)

The RHC must maintain a complete, comprehensive and accurate clinical record (also

referred to as a medical record) for each RHC patient. The RHC must use the

information contained in each clinical record in order to ensure the delivery of

appropriate care to each RHC patient.

The RHC must have a designated member of its professional staff (which may be an

administrative professional rather than a clinical professional) who is responsible for the

RHC’s clinical record system. That individual is responsible for developing and

implementing, with approval of the RHC’s professional staff and leadership, written

clinical record policies and procedures.

A RHC that has an electronic health record (EHR) system may be part of a larger EHR

system or may participate in a systematic exchange of patient health care information to

promote good patient care. In either insistence, only the appropriate RHC staff may have

access to the medical records of RHC patients. The RHC’s written clinical records

policies and procedures reflect that it is part of a larger system or exchange, when

applicable. Further, even when the RHC participates in a larger EHR system, the clinical

records for all RHC visits must still meet the requirements of the RHC Patient Health

Records Condition and must be readily retrievable and distinguishable from other

information in the shared EHR system.

The RHC must also comply with the Health Insurance Portability and Accountability Act

(HIPAA) privacy and security rules at 45 CFR Parts 160 and 164 when sharing clinical

record information that is Protected Health Information. However, CMS does not

interpret or assess compliance with HIPAA requirements, and thus surveyors also are not

authorized to assess HIPAA compliance. If surveyors suspect a serious breach of

HIPAA, they should refer their concerns to the regional U.S. Department of Health &

Human Services Office of Civil Rights.

Complete and accurate

All clinical records entries must be legible, i.e., able to be read clearly and

unambiguously. Any entries or information contained in the clinical record that are not

legible may be misread or misinterpreted and may lead to medical errors or other adverse

patient events.

The clinical record must also be complete, i.e., it must contain for each patient at least the

information required at § 491.10(a)(3). Implicit in the requirement for the record to be

complete is an expectation that all entries of required information are made into the

clinical record promptly, so that it is available to subsequent caregivers. The clinical

record must be complete.

The RHC must ensure that all clinical records are accurately written. All clinical records

must contain the correct information for the correct patient. The identity of the patient

must be clear through use of identifiers such as name, date of birth, etc. The RHC may

have a system in place that assigns a unique patient identifier to each patient, such as a

medical record number or financial identification number. If the RHC has such a system

in place, its clinical records policies and procedures must address the manner in which

the unique identifiers are generated and assigned to each individual patient. The RHC

must also take steps to ensure the accurate identity of the patients if using unique

identifiers.

Entries in the clinical record may be made only by individuals authorized by the RHC in

accordance with its written policies and procedures to do so, and must be dated, timed,

and authenticated by the individual making the entry. When authenticating the entry, the

author indicates by his/her signature/authentication that the entry is accurate. Entries

made on behalf of a practitioner by authorized individuals must also be promptly dated,

timed, and authenticated by the practitioner. A clinic policy stating that a practitioner

must disapprove an entry within a specific time period or the entry is by “default”

authenticated is not acceptable; the practitioner must affirmatively authenticate each

entry.

The RHC must have in place a method to identify the author of each entry and to ensure

that entries are not made by any individual using another individual’s identity. For

example, if the RHC uses an EHR system that requires individuals to use passwords or

card keys to access the system, individuals may not share their passwords or card keys

with other individuals. Likewise, if the RHC uses a paper clinical record system and

authorizes the use of rubber stamps for signatures, the individual whose signature the

stamp represents must not allow any other individual to use it.

Readily accessible

The clinical record must be readily accessible to RHC staff. The RHC must have a

clinical record system that allows clinical staff timely access when needed to all open

records, i.e., records of all RHC patients who, per clinical record policy, are considered to

still be active RHC patients. The clinical records policies and procedures must also

address how long closed clinical records will be readily accessible to staff (This is

distinguishable from the 6 year retention of closed records requirement at §491.10(c)).

The RHC’s clinical record system must be systematically organized to facilitate

completion, storage, and retrieval of records in a manner that supports timely provision of

evaluation or treatment services to RHC patients.

Survey Procedures §491.10(a)(1)-(2)

• Verify that the RHC has written policies and procedures governing its clinical record

system.

• Do not review the policies and procedures unless observations, interviews or

record reviews indicate noncompliance with the requirements of the Clinical

Records Condition. At that time, ask to review the pertinent policies and

procedures to determine whether the noncompliance is based on deficient policies

or based upon failure to implement compliance policies.

• Verify a professional staff member has been designated responsible for the RHC’s

clinical record system.

• Ask the responsible individual whether there have been changes in the system, e.g.,

adoption of a partial or full EHR system, and, if so, for evidence that the RHC’s

policies and procedures were updated to reflect the clinical record system currently in

use.

• If the RHC has an EHR system, immediately after the entrance conference interview,

ask the person who is responsible for the RHC’s clinical record system to give an

overview of the EHR system, including:

• Whether there is one system that is fully integrated throughout the RHC or a

hybrid EHR-paper record system. In the case of a hybrid system, have the RHC

identify which parts of the RHC use which systems. Ask how the RHC ensures

that the clinical record is complete, accurate, and accessible in this hybrid

environment;

• What the arrangements are in the event of an EHR system failure, to ensure that

complete and accurate medical records are accessible;

• Observe how staff members use the EHR system to determine whether they are

able to access complete clinical record information when needed. When

applicable, observe whether or not staff members make entries promptly?

• If the RHC shares an EHR system with other providers, is the RHC able to

demonstrate that the RHC’s clinical records are readily identifiable,

distinguishable from other information in the shared system and accessible by

appropriate RHC staff members only?

• If the RHC uses a partial or whole paper clinical record system, are records

legible?

• When reviewing sampled clinical records is there evidence that any of the records are

inaccurate or incomplete?

• Is each entry dated, timed, and authenticated?

• If RHC policy permits authorized individuals to make entries on behalf of a

practitioner, has the practitioner promptly authenticated the entry?

• Is each clinical record systematically organized?

• Are the medical records organized in a systematic manner allowing easy retrieval?