Recommended Medical Record Practices for Student-Run Free Clinics

Although well-intentioned, free clinics may overlook details pertaining to the protection of patient information and maintenance of medical records. Providing students may not know about important regulations and practices which are currently in place to protect patients. For example, it is necessary for a business associate agreement to be signed with respective data managing providers prior to using an online cloud storage provider. This article is a summary of reasonable and prudent tips for free clinics to follow and includes: the proper handling of patient information, what to include in patient notes, who may write notes, and ensuring that notes are signed in a timely manner.


Introduction
This paper draws on the experiences obtained from the Robert R. Frank Student-Run Free Clinic (SRFC) affiliated with Wayne State University School of Medicine, which has serviced the most uninsured zip code in Detroit since 2011.Services are completely free of cost to patients who are underserved and uninsured in the Detroit area.Students provide oversight and perform several duties and responsibilities including overall administration, patient care, social work, laboratory testing, pharmaceuticals, and duties outside the clinic such as patient coordination, preceptor recruitment, and fundraising.We practice a continuous model of care with a focus on long-term management and consistent follow-up rather than screenings and urgent care.In addition to traditional health care, the clinic also emphasizes disease prevention by increasing health awareness and providing social support.Our student-led care teams, under the supervision of clinicians, are focused on spending time with each patient allowing for optimum patient education and disease management.To maintain continuity of care, we adhere to strict standards of record-keeping which we believe has enhanced the quality of care we can provide for all of our longstanding patients.Current and complete documentation is essential for quality medical care.A start-up free clinic may have questions about where their records will be kept, whether or not the records will be paper or electronic and who will be allowed access.More established clinics will use their medical records to conduct periodic reviews to assess if they are maintaining quality and improving outcomes, provide them to patients to facilitate transition into insured care, and use them for filing claims such as disability.Additionally, the Association of American Medical Colleges learning objectives call for students to be able to "document and share patient-specific information, demonstrating the ability to record in information systems specific findings about a patient and orders directing the further care of the patient," and many students benefit from learning their first medical record practices from SRFCs. 1 Regardless of the status of the clinic, there are fundamental practices that should be observed.Furthermore, guidelines and protocols become increasingly imperative as more free clinics transition to electronic medical records (EMR), and it has been reported that 44 percent of surveyed Student-Run Free Clinics now possess an EMR. 2 EMRs are used for a variety of reasons, and existing research suggests that EMRs' perceived benefits include improved patient care (particularly through transmitting important clinical information), improving office efficiency, and have mixed reviews on financial benefits (namely decreasing transcription costs, time spent maintaining and accessing paper charts, decreased physical space requirements).Although adoption of EMRs has been slower than anticipated, more EMR use is expected in the future. 3ollowing an internal audit of our own medical record system and recognizing areas for improvement, this paper reviews reasonable and prudent practices recommended for free clinics to follow including: proper handling of patient information, what to include in patient notes, who may write notes, and ensuring that notes are signed in a timely manner.

Ensure the Proper Storage and Maintenance of Protected Health Information
Under US Law, namely the Health Information Portability and Accountability Act (HIPAA), Protected health information (PHI) is (paraphrased) any information in any medium that is collected or created by a covered entity (for example a health care provider or its associates), that can be linked to an individual. 4A variety of tools have been used to store patient information.Some SRFCs and community care clinics have employed services such as Google Docs for managing patient flow. 5Clinics utilizing resources like Google Drive and Gmail should be aware that these are not outof-the-box HIPAA compliant. 6The casual versions of Google Services do comply with common security standards, but are not inherently HIPAA compliant. 7Health care providers that wish to include associated companies with their PHI enter into a business associate agreement (BAA) with the company.Consequently, it is worth noting that Google states on their site that, "Customers who have not entered into a BAA with Google must not use Google services in connection with PHI." 8 Compliance with HIPAA starts with entering into a BAA with the appropriate associate (in Google's case, a data provider), typically for a nominal fee.Similarly, Box states, "Box signs BAA addendums with its customers who have an Enterprise or Elite account and want to be HIPAA compliant.A signed BAA should be in place between Box and the customer prior to storing any PHI on Box." 9 Using a cloud storage service for PHI without a BAA may warrant a HIPAA violation.In the case PHI has already been uploaded without a signed BAA in place, removing any PHI hosted by these providers and storing them appropriately as soon as possible is advisable.However, this must be done in accordance with state law as many states have laws in place that protect medical records from destruction.Another example of a possible breech of HIPAA can occur with the use of a single shared account to log into patient records.Although a single shared account is convenient, there are no easily identifiable methods to track who is viewing and editing the record and, consequently, no respectable audit trail.Therefore, having a BAA in place and understanding the audit trail mechanism of your specific EMR is prudent to ensure proper storage and appropriate viewing of patient's PHI and to maintain HIPPA compliance.

Maintain Core Elements in Patient Notes
Several organizations provide guidelines for medical record documentation.With the goal of recognizing commonly accepted standards, the National Committee for Quality Assurance (NCQA), a private 501(c)(3) not-for-profit organization, has published guidelines for medical record documentation.The NCQA guidelines note six core elements to a medical record (Table 1), and fifteen additional elements that represent a set of commonly accepted standards (Table 2). 10ith many student and faculty providers potentially contributing to the patient record at a free clinic, adhering to the established guidelines for medical record documentation can be difficult.For example, the authors' clinic functions on a continuity model with 160-200 patient visits per year.We adopted the free web-based EMR, Practice Fusion, a few years ago as we transitioned from paper records.Although this EMR contains an easily identifiable face sheet for each patient, in our experience, consistent updates and maintenance of a patient's biographical data have proved challenging.Ideally, face sheet information would be updated by providers at every encounter.Our patients are first seen by a pre-clinical and a clinical medical student, and then by a licensed clinician.This care team comprehensively documents the patient encounter in new patient visit notes, but may miss updating the patient's face sheet as this is not a focus of the patient encounter.We have instituted two stop-gap measures to remedy this shortcoming and to comply with the standards for medical record documentation set forth.Chart review sessions are held prior to each clinic where students are instructed to conduct and document a basic review of the scheduled patients' charts, formulate problem lists, and update face sheets.Additionally, we have a monthly year 4 medical student free clinic elective.It is also part of the fourth year student's responsibility to review and update patient charts with the clinic's medical director on an ongoing basis.

Table 1.
National Committee for Quality Assurance Guidelines for Medical Record Documentation: Core Elements 1) Significant illnesses and medical conditions are indicated on the problem list.
2) Medication allergies and adverse reactions are prominently noted in the record.If the patient has no known allergies or history of adverse reactions, this is appropriately noted in the record.
3) Past medical history (for patients seen three or more times) is easily identified and includes serious accidents, operations and illnesses.For children and adolescents (18 years and younger), past medical history relates to prenatal care, birth, operations and childhood illnesses.
4) Working diagnoses are consistent with findings.

5) Treatment plans are consistent with diagnoses.
6) There is no evidence that the patient is placed at inappropriate risk by a diagnostic or therapeutic procedure.
Table 2. National Committee for Quality Assurance Guidelines for Medical Record Documentation: Additional Elements 1) Each page in the record contains the patient's name or identification number.
2) Personal biographical data include the address, employer, home and work telephone numbers, and marital status.
3) All entries in the medical record contain the author's identification.Author identification may be a handwritten signature, unique electronic identifier, or initials.
4) All entries are dated.
5) The record is legible to someone other than the writer.
6) For patients 12 years and older, there is appropriate notation concerning the use of cigarettes, alcohol, and substances (for patients seen three or more times, query substance abuse history).
7) The history and physical examination identifies appropriate subjective and objective information pertinent to the patient's presenting complaints.8) Laboratory and other studies are ordered, as appropriate.9) Encounter forms or notes have a notation, regarding follow-up care, calls or visits, when indicated.The specific time of return is noted in weeks, months, or as needed.
10) Unresolved problems from previous office visits are addressed in subsequent visits.
11) There is review for under-or over-utilization of consultants.
12) If a consultation is requested, there is a note from the consultant in the record.
13) Consultation, laboratory, and imaging reports filed in the chart are initialed by the practitioner who ordered them, to signify review.(Review and signature by professionals other than the ordering practitioner do not meet this requirement).If the reports are presented electronically or by another method, there is also representation of review by the ordering practitioner.Consultation and abnormal laboratory and imaging study results have an explicit notation in the record of follow-up plans.
14) An immunization record (for children) is up to date or an appropriate history has been made in the medical record (for adults).
15) There is evidence that preventive screening and services are offered in accordance with the organization's practice guidelines.
Free clinics may also struggle with providing complete treatment plans that are consistent with the patients' diagnoses.For example, if a patient was discovered to have an abnormality on routine testing, it can be difficult to provide the patient with the appropriate follow-up tests due to potential out-of-pocket costs to the patient.In these cases, in order to maintain compliance with the standards of documentation, we document what the treatment would be if we had all the required resources, and then document why the treatment is not feasible for us to provide.Documentation should include that the treatment plan as well as available resources were discussed with the patient.

Develop Systems for Appropriate and Timely Documentation
Prudent practices for free clinics also include being aware of any potential conflict with income that may be received from their patient notes for filling out paperwork.By not billing, a free clinic protects healthcare volunteers from payment concerns.However, there are situations where free clinics may receive some compensation.While the Robert R. Frank Student-Run Free clinic is completely free of charge, other free clinics may be compensated by the state government for completing disability paperwork for their patients.In these cases, it may be prudent to follow guidelines set by Medicare regarding notes that can be used for billing.Medicare does not pay for any services provided by a medical student. 11Fortunately, no student ought to be providing medical care for patients without working with an attending physician or other licensed professional who could create a billable note.Unfortunately, per Medicare and Medicaid, the teaching physician may only refer to a student's documentation for the review of systems and past family and social histories when creating their notes.For all other aspects of the note, the teaching physician must complete their own documentation.Intentionally using a medical student's notes in support of a bill submitted to Medicare or other funding sources may be considered fraud and abuse. 12,13lthough these standards exist for Medicare and are well established, each insurance agency may have differing guidelines.The simplest approach may be to have students write their own separate notes and keep these in a non-billable part of the patient's chart.It is difficult to predict what questions may arise in the audit of patient records, including student notes, which adds an element of uncertainty that could be easily avoided by distinguishing between medical student and medical professional notes. 14Additionally, students and physicians should only sign notes and orders personally generated as the author identification of each entry in the medical record is an essential element of the standards of medical record documentation.
All entered notes should be signed in a timely manner.Common hospital policies require notes to be signed within 7-14 days of the notes postdate.We would encourage a similar policy for free clinics, and suggest that the policy each free clinic develops should reflect the policies at local hospitals.Information gaps in patient records have been associated with increased lengths of stay, particularly in acute settings. 15,16Having a policy to have all notes signed the day they are posted could also be considered.It may be helpful to assign a medical student as project manager to oversee the electronic or paper medical records in order to make sure that all notes are signed in a timely manner.A project manager could also be responsible for ongoing training and educating other medical student volunteers and physicians new to the clinic on how to use the EMR and sign their notes ensuring consistent use of the EMR. 17,18In any case, a periodic review of the EMR for the status of unsigned records should be conducted to ensure compliance with note completion.

Discussion
Striving for excellence in patient care at our free clinics includes the appropriate management of patients' PHI and adhering to the established standards of documentation.Patient records should follow established quality guidelines, avoid fraud, and be stored safely.Quality guidelines have been published by national organizations and are freely available online.Proper systems and agreements should be in place to manage storage of PHI.Necessary distinctions between student and physician notes should be clear.The creation and use of a single anonymous user for accounts at free clinics, while convenient, should be avoided.Pitfalls also include using electronic software to store records without the proper agreements in place, inappropriate use of electronic user accounts to access the notes, and failing to complete timely notes.Student run clinics should exercise due diligence in researching the HIPAA compliance of their records and work towards systems that improve patient care.Clinics should regularly review their state and federal requirements regarding medical record practices.Free clinics also need to be aware of any potential conflict with income generated from their patient notes for filling out paperwork.With a large percentage of free clinics already using or transitioning to an electronic medical record system, awareness of and adherence to proper storage and maintenance of patient's PHI is essential.This coupled with appropriate and timely documentation will enhance patient care and ensure the integrity of the free clinic system going forward.