It’s hard to miss updating your practice on Supreme Court landmark decisions (like the Affordable Care Act). But you can easily overlook prepping your practice for court rules stemming from smaller cases. While they may not make it to the nightly news — still affect our daily lives. One of those is the May 2019 decision on Cochise Consultancy Inc. v. United States, ex rel. Hunt that affects medical record retention law and changes how long your office will need to keep medical records — so listen up.

Not only is keeping medical records on file an essential part of patient care, those records also protect you and your practice. Well-documented records — whether paper or EHR — can provide essential evidence when defending against claims of malpractice or violations of statutes like the False Claims Act (FCA).

The recent decision in the Cochise case set a new medical record retention law for how long you should hold onto patient medical records. The verdict? 10 years. For providers, the Cochise medical record retention law means that you may be vulnerable to FCA claims for up to ten years after an alleged violation.

FCA Basics: Fraud Definition and Filing Limitations

In case you need a reminder of what the FCA entails, here are the basics:

The Federal False Claims Act makes it illegal to — you guessed it — knowingly file false claims to any federal healthcare program (like Medicare or Medicaid). “Knowingly” means that you:

Have actual knowledge of fraud occurring. Example: You knowingly double-billed a claim.
Act with deliberate ignorance or reckless disregard. Example: You code all E/M visits level 4 or above without verifying the visits meet those requirements.

The FCA is particularly scary to healthcare providers for three reasons:

No specific intent to commit fraud is required. You must have only known or should-have-known that fraud occurred.
It addition to significant financial penalties, there are criminal penalties, including jail time.
It includes a “whistleblower” provision: an individual (patient, staff member, etc.) can file a qui tam suit and receive a percentage of any monetary penalties.

The False claims act has two statutes of limitations. A claim may only be brought:

Within six years of the date when the violation was committed. Or;
Within three years of the date when material fact become known (or reasonably should have become known) by a U.S. official but not more than 10 years of the date the violation was committed.

A claim alleging an FCA violation can be brought by a private citizen (qui tam) or by the Federal Government. If the claim is qui tam, the government can choose to either intervene or let the private citizen handle the case. In the majority of cases, the government stays out of it.

How FCA Limitations Affected Cochise

The result of Cochise’s medical record retention law hinges on FCA statutes of limitations. Here’s how:

The private citizen in the case (Hunt) filed a qui tam complaint against Cochise Consultancy. He filed the claim more than six years after the incident in question allegedly occurred, but less than three years after he notified a government official.
The government opted not to intervene in the case, leaving the litigation to Hunt.
Because of that, Cochise argued that only the 6-year statute of limitations applied. Hunt’s claim exceeded that 6-year statute of limitations, so if the court ruled in favor of Cochise, it would mean that the FCA violation claim was no longer valid.
The court disagreed with Cochise. They ruled that Hunt filed within three years of notifying a government official—even though the government didn’t intervene—and within 10 years of the alleged violation.
They also clarified that knowledge of a violation by a private citizen does not trigger the three-year statute of limitations. Therefore, Hunt’s claim against Cochise was valid.

Updated Medical Record Retention and Destruction Policy 2019

Since you are now vulnerable to a FCA claim for up to 10 years after the alleged violation, keep patient medical records for ten years. They can help form a basis for your defense.

This is longer than the previous HIPAA-compliant guideline of six years, and longer than current state guidelines that may be more strict that the HIPAA guideline. Keep in mind that if records are involved in litigation, an investigation, or an audit of any kind, you must keep them until the case is closed.