In this episode of Ask an Advisor, hosts Daniel Williams and Christie Good delve into the topic of transitioning from paper to digital employee records for practice administrators. They explore the absence of federal laws requiring paper copies, highlight state-specific regulations, and discuss best practices for securing digital files, ensuring legal validity, and maintaining HIPAA compliance. The conversation also covers the importance of having reliable document management systems and IT professional involvement, retention and destruction policies, and the transition process from paper to digital. Show notes and additional resources, including links to EEOC record-keeping requirements and the MGMA HIPAA essentials course, are provided.
00:00 Introduction and Today's Topic
00:24 The Digital Transition: Can Practices Go Fully Digital?
02:26 Compliance and Legal Considerations
03:57 Best Practices for Secure Digital Storage
06:50 Retention Periods for Employee Records
08:17 Ensuring Document Authenticity and Legal Validity
08:55 HIPAA Compliance in Digital Records
09:46 Managing the Transition to Digital
12:09 Conclusion and Additional Resources
Additional Resources:
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Daniel Williams (00:06):
Well, hi, everyone, and welcome to another
ask an adviser podcast. I'mDaniel Williams, a senior editor
at MGMA, We're always joined onask an adviser with cohost and
MGMA senior adviser, ChristieGood. We have got a really cool
topic today. We're gonna reallylook at a really big question
(00:26):
that many practiceadministrators are asking. Can
we go fully digital withemployee files, or do we need to
still hang on to those papercopies?
So this is an environmentalquestion, but, no, we're really
looking at it from the not fromthe climate, change perspective,
but we're really looking at thisfrom the perspective of the
(00:50):
practices and the practiceadministrators. So, Christy,
let's just kick this off. Firstof all, it's always good to see
you.
Cristy Good (00:59):
Nice to see you too.
Daniel Williams (01:01):
Alright. So let's look at this issue. I I
was so happy when you sent thisover because it is one of those
things that there is somethingabout having a physical file,
but when so much is stored in acloud or a drive of some type
and people can access it thatway, you know, it really gets
down to that short answer for aquestion. Can practices make the
(01:24):
switch to digital employeefiles?
Cristy Good (01:28):
Yeah. And the question came through our MGMA
community, which I love, that,more questions are coming
through our MGMA communityasking peers such questions just
for guidance. Like, what areother people doing? And so I
keep reminding people that ourMGMA community is a great place
where you can ask your peersquestions such as this.
Daniel Williams (01:49):
Alright. Well, thank you for sharing that the
origination of where these comefrom. And just as a reminder,
everyone, that that communityfor MGMA is has really picked
up. As Christie's saying, we'vegot community live, and we've
got other outlets for you toconnect with each other and to
reach out to, the MGMA expertswith that ask MGMA green button
(02:13):
anywhere you go on the MGMAwebsite. So let's look at this,
question just in a short wayhere.
Can practices make the switch todigital employee files?
Cristy Good (02:26):
And the short answer is, yes, you could go
fully digital, but you do haveto make sure that you take some
things into consideration. Thereare no federal laws requiring
paper copies of employee files,but some states do have specific
rules. And beyond compliances,practices just need to think
about security, accessibility,and retention policies when
(02:47):
making that transition.
Daniel Williams (02:49):
Okay. Perfect. Alright. So we've got a lot to
cover here in the next ten totwelve minutes or so, and we do
like to keep this ask, MGMAsegment pretty short. We wanna
get right to the point and giveyou some tools.
So let's start with compliance.If there are no federal law
(03:10):
requiring paper copies, whatlegal issues do practice leaders
need to keep in mind?
Cristy Good (03:17):
So at the federal level, there are key regulations
that dictate how long certainrecords can must be kept, but
not necessarily in what format.However, some states do require
certain employee documents liketermination records or signed
agreements to be stored as hardcopies. That's why it's crucial
to check state specific lawsbefore making the transition.
(03:37):
And regardless of format,practices must meet HIPAA, EEOC,
and OSHA compliance withhandling employee records,
especially when it comes tostoring protective protected
health information or injuryreports.
Daniel Williams (03:50):
Okay. So let's say a practice decides to go
digital. They are committed toit. What are the best practices
then for storing employee filessecurely in at that level?
Cristy Good (04:03):
So security is key. Practices need to use a reliable
document management system andmake sure that the the data is
encrypted. So protected filesmust be protected from
unauthorized access, backupsystems to make sure that
records aren't lost due to,like, a system failure or an
emergency, and then have accesscontrols to limit file access to
(04:28):
only authorized personnel. It'sreally important to have IT
professionals involved insetting this up and maintaining
these systems. And just likepaper records, digital files
should be organized and easilyretrievable, whether for an
internal audit or an employeerequest.
So, make sure also to keep aneye on any updates to those
(04:49):
systems.
Daniel Williams (04:51):
Okay. Yeah. That's the part that freaks me
out. I mean, there is that fearthat, you know, you have
everything stored up into somesystem, whether it's a drive or
wherever that's being kept, thatwhat if that just goes away and
you don't have the paper copyand it just totally freaks you
out? I don't know.
(05:12):
In your practice experience, Iknow you've been at MGMA now for
seven to eight years. So backwhen you were at a practice
last, did what did y'all do tomake sure you had it?
Cristy Good (05:24):
For employee files, we had paper, but but, you know,
I was part of that whole EHRtransition, and we're we're
trusting that everything in ourEHR is gonna be backed up and
stored and protected becausethose are patient records.
Right? So you're still doingthat same thing. These are
employee records. These arepatient records.
(05:44):
The key is to make sure you'rebacked up. And and often, you
know, having that some placeshave a hard drive that they
backed up back up to at night aswell as the cloud, so they have
a double backup, which is good,especially with just cyber as
we've just had a recent, youknow, certificate program on.
(06:06):
It's very important withcybersecurity to to have backup,
and maybe it's two ways tobackup. One's an internal hard
drive or one on your practiceand the other one's the cloud. I
mean, I have pictures right nowin the cloud, and it I'm still
gonna put those on the thumbdrive for myself because I don't
wanna lose my picture.
So I know we all that angst ofwhat if we lose it? So having a
(06:28):
you know, maybe out back up intwo places, is a great way to
just ensure that you have youwill have it.
Daniel Williams (06:36):
Yeah. Yeah. Well, thanks for sharing that
personal experience with it. AndI guess those pictures are like
your son's doing hockey andthings like that. You know?
Cristy Good (06:46):
But you don't want those pictures.
Daniel Williams (06:48):
You do not. Absolutely not. Okay. So let's
talk about retention periods.They're always a big question.
Can you walk us through how longdifferent types of employee
records need to be kept?
Cristy Good (07:02):
Yes. And we'll have this also in the podcast kinda
article because I know somepeople wanna refer back to it,
but I'll go over the main ones.The performance review should be
kept at least two years aftertermination. Payroll records
should be kept to four years tocomply with IRS rules. Health
and benefits records are usuallygeneral three generally three
(07:24):
years after termination.
Drug test rules are results, Imean, retained usually for three
years after termination. Jobrelated injuries and illnesses
are kept for five years underOSHA. The form I nine, you
either keep that for three yearsafter hire or one year after
termination, whichever whicheveris longer. And then EEO data
(07:49):
forms are permanent. So theseare federal guidelines, but,
again, practices should alwayscheck with their state laws for
any additional requirements.
Daniel Williams (07:57):
That's a really good point. Yeah. Because there
is that the the Fed rules andthe state rules don't always
match up. They often don't. Andso, yeah, it is really important
to keep track of both of thoseas well.
So let's move on to the nextaspect of this, and that's
really getting down to documentauthenticity and legal validity.
(08:18):
So if a practice scans andstores files digitally, are they
considered legally valid?
Cristy Good (08:25):
Yes. But they need to be the true representations
of the original document. Thatmeans scanned copies should be
complete, legible, andunaltered. So for additional
security, some practices use adigital signature, which can
also help verify authenticity.And if a practice ever needs to
provide documentation in a legalsituation, courts typically
(08:47):
accept that digital record aslong as they were stored
properly and haven't beentampered with.
Daniel Williams (08:53):
Okay. Next question. How should practices
handle HIPAA compliance whendigitizing records?
Cristy Good (09:01):
Oh, HIPAA applies whenever you're dealing with
protective health information.And I think sometimes people
don't think about that, but it,you know, often is in employee
files, which includes medicalleave requests, disability
accommodations, and drug testresults. So to stay compliant
with HIPAA, you need to makesure that you store your PHI in
a secure encrypted system aswe've talked about. You restrict
(09:23):
access to only authorizedpersonnel, and then you train
staff on how to handle PHIsecurely. So it's just as
important as in patient records,as in employee records, to be
HIPAA compliant.
And, you know, that HIPAAviolations can be costly. So
Yeah. You definitely wanna makesure to review your policies
regularly and make sure that theright protections are in place.
Daniel Williams (09:44):
Yep. I love that. Okay. So switching from
paper to digital sounds great intheory, but what's the best way
to manage that transition?
Cristy Good (09:55):
Actually, I'm making a I'll have a checklist
here soon that'll be availableto members online. But in
general, kinda like five quicksteps is to assure current
records can be identified, yourdocuments that you need
digitizing. So make sure you'relooking at everything and
deciding which need to bedigitized. Choose a secure
(10:17):
storage system, which could becloud based or on premise, or as
I suggested, maybe both. Setclear retention and destruction
policies.
So many people already have aretention policy or a
destruction policy. That appliesalso then to these electronic
files, and you won't maybe haveto shred them, but you're still
(10:41):
trying to figure out how do Idestroy old ones, and then how
do I, going forward, decide howlong I'm keeping those
electronic files. You need totrain your staff to make sure
everyone knows how to manage andaccess digital files, and then
verify the transition, whichmeans keep paper files until
everything is confirmed asaccurate and accessible. So,
(11:04):
like, you should be testing. Youshould be making sure that
everything you just uploaded,just like when you did your EHR
and you went from paper patientpaper files to your EHR.
You kept for a short bit oftime. You tested. You made sure
you had it. So, that is that'sreally key to making sure so you
don't lose anything.
Daniel Williams (11:25):
That is so valid. And, hey, as a added
benefit, we may even save a treeor two. Who knows?
Cristy Good (11:31):
Exactly.
Daniel Williams (11:33):
We just had y'all, we just had in, Denver,
the Denver area, we just had asort of a mini blizzard for
about a day or two, and thesun's back out already. But it
actually snapped like two orthree pine trees in our
neighborhood, Christy. Aw. Iknow. I know.
Cristy Good (11:50):
It a heavy snow.
Daniel Williams (11:51):
It was a heavy, wet, heavy snow. So enough
enough of the climate, y'all.Y'all can see that my brain is
now just fixated on the weatheroutside. So with all that said,
Christy, I love thisconversation. It it makes
perfect sense.
So employee record keeping issomething every practice deals
(12:12):
with in transitioning to digitalfiles can make things more
efficient if done the right way,and really appreciate your
insights and wanted to leteverybody know that we are going
to put this information into theepisode show notes. We're also
gonna be creating an articlethat really hits the highlights
of all of this, own MGMA.com,and we'll also direct you to
(12:35):
some resources. Christie, youput together some really
interesting resources. Any ofthose you just wanna just share
where they came from withanybody here that are of import?
Cristy Good (12:46):
Sure. The EEOC has a recordkeeping requirements,
and then SHRM, has we have alink to that, and they have a
more detailed list of some ofthose specifics on what
different types of records andhow long. And then we have our
HIPAA essentials course thatpeople may just wanna get a
(13:08):
refresher on HIPAA. And, youknow, it's free to members, So I
just recommend any of those.And, again, make sure you're
checking with your legal andyour IT because your IT are
gonna be very important inhelping you go to that fully
digital situation.
Daniel Williams (13:24):
Yeah. Well, great chatting with you again,
Christy.
Cristy Good (13:28):
Thank you.
Daniel Williams (13:29):
Alright. So until our next episode,
everyone, just wanna say toy'all, again, look for that
episode, the episode show notes.Also, look for that article
that'll come out. And thank youall so much for being MGMA
podcast listeners.
Well, hi, everyone, and welcome to another
ask an adviser podcast. I'mDaniel Williams, a senior editor
at MGMA, We're always joined onask an adviser with cohost and
MGMA senior adviser, ChristieGood. We have got a really cool
topic today. We're gonna reallylook at a really big question
(00:26):
that many practiceadministrators are asking. Can
we go fully digital withemployee files, or do we need to
still hang on to those papercopies?
So this is an environmentalquestion, but, no, we're really
looking at it from the not fromthe climate, change perspective,
but we're really looking at thisfrom the perspective of the
(00:50):
practices and the practiceadministrators. So, Christy,
let's just kick this off. Firstof all, it's always good to see
you.
Cristy Good (00:59):
Nice to see you too.
Daniel Williams (01:01):
Alright. So let's look at this issue. I I
was so happy when you sent thisover because it is one of those
things that there is somethingabout having a physical file,
but when so much is stored in acloud or a drive of some type
and people can access it thatway, you know, it really gets
down to that short answer for aquestion. Can practices make the
(01:24):
switch to digital employeefiles?
Cristy Good (01:28):
Yeah. And the question came through our MGMA
community, which I love, that,more questions are coming
through our MGMA communityasking peers such questions just
for guidance. Like, what areother people doing? And so I
keep reminding people that ourMGMA community is a great place
where you can ask your peersquestions such as this.
Daniel Williams (01:49):
Alright. Well, thank you for sharing that the
origination of where these comefrom. And just as a reminder,
everyone, that that communityfor MGMA is has really picked
up. As Christie's saying, we'vegot community live, and we've
got other outlets for you toconnect with each other and to
reach out to, the MGMA expertswith that ask MGMA green button
(02:13):
anywhere you go on the MGMAwebsite. So let's look at this,
question just in a short wayhere.
Can practices make the switch todigital employee files?
Cristy Good (02:26):
And the short answer is, yes, you could go
fully digital, but you do haveto make sure that you take some
things into consideration. Thereare no federal laws requiring
paper copies of employee files,but some states do have specific
rules. And beyond compliances,practices just need to think
about security, accessibility,and retention policies when
(02:47):
making that transition.
Daniel Williams (02:49):
Okay. Perfect. Alright. So we've got a lot to
cover here in the next ten totwelve minutes or so, and we do
like to keep this ask, MGMAsegment pretty short. We wanna
get right to the point and giveyou some tools.
So let's start with compliance.If there are no federal law
(03:10):
requiring paper copies, whatlegal issues do practice leaders
need to keep in mind?
Cristy Good (03:17):
So at the federal level, there are key regulations
that dictate how long certainrecords can must be kept, but
not necessarily in what format.However, some states do require
certain employee documents liketermination records or signed
agreements to be stored as hardcopies. That's why it's crucial
to check state specific lawsbefore making the transition.
(03:37):
And regardless of format,practices must meet HIPAA, EEOC,
and OSHA compliance withhandling employee records,
especially when it comes tostoring protective protected
health information or injuryreports.
Daniel Williams (03:50):
Okay. So let's say a practice decides to go
digital. They are committed toit. What are the best practices
then for storing employee filessecurely in at that level?
Cristy Good (04:03):
So security is key. Practices need to use a reliable
document management system andmake sure that the the data is
encrypted. So protected filesmust be protected from
unauthorized access, backupsystems to make sure that
records aren't lost due to,like, a system failure or an
emergency, and then have accesscontrols to limit file access to
(04:28):
only authorized personnel. It'sreally important to have IT
professionals involved insetting this up and maintaining
these systems. And just likepaper records, digital files
should be organized and easilyretrievable, whether for an
internal audit or an employeerequest.
So, make sure also to keep aneye on any updates to those
(04:49):
systems.
Daniel Williams (04:51):
Okay. Yeah. That's the part that freaks me
out. I mean, there is that fearthat, you know, you have
everything stored up into somesystem, whether it's a drive or
wherever that's being kept, thatwhat if that just goes away and
you don't have the paper copyand it just totally freaks you
out? I don't know.
(05:12):
In your practice experience, Iknow you've been at MGMA now for
seven to eight years. So backwhen you were at a practice
last, did what did y'all do tomake sure you had it?
Cristy Good (05:24):
For employee files, we had paper, but but, you know,
I was part of that whole EHRtransition, and we're we're
trusting that everything in ourEHR is gonna be backed up and
stored and protected becausethose are patient records.
Right? So you're still doingthat same thing. These are
employee records. These arepatient records.
(05:44):
The key is to make sure you'rebacked up. And and often, you
know, having that some placeshave a hard drive that they
backed up back up to at night aswell as the cloud, so they have
a double backup, which is good,especially with just cyber as
we've just had a recent, youknow, certificate program on.
(06:06):
It's very important withcybersecurity to to have backup,
and maybe it's two ways tobackup. One's an internal hard
drive or one on your practiceand the other one's the cloud. I
mean, I have pictures right nowin the cloud, and it I'm still
gonna put those on the thumbdrive for myself because I don't
wanna lose my picture.
So I know we all that angst ofwhat if we lose it? So having a
(06:28):
you know, maybe out back up intwo places, is a great way to
just ensure that you have youwill have it.
Daniel Williams (06:36):
Yeah. Yeah. Well, thanks for sharing that
personal experience with it. AndI guess those pictures are like
your son's doing hockey andthings like that. You know?
Cristy Good (06:46):
But you don't want those pictures.
Daniel Williams (06:48):
You do not. Absolutely not. Okay. So let's
talk about retention periods.They're always a big question.
Can you walk us through how longdifferent types of employee
records need to be kept?
Cristy Good (07:02):
Yes. And we'll have this also in the podcast kinda
article because I know somepeople wanna refer back to it,
but I'll go over the main ones.The performance review should be
kept at least two years aftertermination. Payroll records
should be kept to four years tocomply with IRS rules. Health
and benefits records are usuallygeneral three generally three
(07:24):
years after termination.
Drug test rules are results, Imean, retained usually for three
years after termination. Jobrelated injuries and illnesses
are kept for five years underOSHA. The form I nine, you
either keep that for three yearsafter hire or one year after
termination, whichever whicheveris longer. And then EEO data
(07:49):
forms are permanent. So theseare federal guidelines, but,
again, practices should alwayscheck with their state laws for
any additional requirements.
Daniel Williams (07:57):
That's a really good point. Yeah. Because there
is that the the Fed rules andthe state rules don't always
match up. They often don't. Andso, yeah, it is really important
to keep track of both of thoseas well.
So let's move on to the nextaspect of this, and that's
really getting down to documentauthenticity and legal validity.
(08:18):
So if a practice scans andstores files digitally, are they
considered legally valid?
Cristy Good (08:25):
Yes. But they need to be the true representations
of the original document. Thatmeans scanned copies should be
complete, legible, andunaltered. So for additional
security, some practices use adigital signature, which can
also help verify authenticity.And if a practice ever needs to
provide documentation in a legalsituation, courts typically
(08:47):
accept that digital record aslong as they were stored
properly and haven't beentampered with.
Daniel Williams (08:53):
Okay. Next question. How should practices
handle HIPAA compliance whendigitizing records?
Cristy Good (09:01):
Oh, HIPAA applies whenever you're dealing with
protective health information.And I think sometimes people
don't think about that, but it,you know, often is in employee
files, which includes medicalleave requests, disability
accommodations, and drug testresults. So to stay compliant
with HIPAA, you need to makesure that you store your PHI in
a secure encrypted system aswe've talked about. You restrict
(09:23):
access to only authorizedpersonnel, and then you train
staff on how to handle PHIsecurely. So it's just as
important as in patient records,as in employee records, to be
HIPAA compliant.
And, you know, that HIPAAviolations can be costly. So
Yeah. You definitely wanna makesure to review your policies
regularly and make sure that theright protections are in place.
Daniel Williams (09:44):
Yep. I love that. Okay. So switching from
paper to digital sounds great intheory, but what's the best way
to manage that transition?
Cristy Good (09:55):
Actually, I'm making a I'll have a checklist
here soon that'll be availableto members online. But in
general, kinda like five quicksteps is to assure current
records can be identified, yourdocuments that you need
digitizing. So make sure you'relooking at everything and
deciding which need to bedigitized. Choose a secure
(10:17):
storage system, which could becloud based or on premise, or as
I suggested, maybe both. Setclear retention and destruction
policies.
So many people already have aretention policy or a
destruction policy. That appliesalso then to these electronic
files, and you won't maybe haveto shred them, but you're still
(10:41):
trying to figure out how do Idestroy old ones, and then how
do I, going forward, decide howlong I'm keeping those
electronic files. You need totrain your staff to make sure
everyone knows how to manage andaccess digital files, and then
verify the transition, whichmeans keep paper files until
everything is confirmed asaccurate and accessible. So,
(11:04):
like, you should be testing. Youshould be making sure that
everything you just uploaded,just like when you did your EHR
and you went from paper patientpaper files to your EHR.
You kept for a short bit oftime. You tested. You made sure
you had it. So, that is that'sreally key to making sure so you
don't lose anything.
Daniel Williams (11:25):
That is so valid. And, hey, as a added
benefit, we may even save a treeor two. Who knows?
Cristy Good (11:31):
Exactly.
Daniel Williams (11:33):
We just had y'all, we just had in, Denver,
the Denver area, we just had asort of a mini blizzard for
about a day or two, and thesun's back out already. But it
actually snapped like two orthree pine trees in our
neighborhood, Christy. Aw. Iknow. I know.
Cristy Good (11:50):
It a heavy snow.
Daniel Williams (11:51):
It was a heavy, wet, heavy snow. So enough
enough of the climate, y'all.Y'all can see that my brain is
now just fixated on the weatheroutside. So with all that said,
Christy, I love thisconversation. It it makes
perfect sense.
So employee record keeping issomething every practice deals
(12:12):
with in transitioning to digitalfiles can make things more
efficient if done the right way,and really appreciate your
insights and wanted to leteverybody know that we are going
to put this information into theepisode show notes. We're also
gonna be creating an articlethat really hits the highlights
of all of this, own MGMA.com,and we'll also direct you to
(12:35):
some resources. Christie, youput together some really
interesting resources. Any ofthose you just wanna just share
where they came from withanybody here that are of import?
Cristy Good (12:46):
Sure. The EEOC has a recordkeeping requirements,
and then SHRM, has we have alink to that, and they have a
more detailed list of some ofthose specifics on what
different types of records andhow long. And then we have our
HIPAA essentials course thatpeople may just wanna get a
(13:08):
refresher on HIPAA. And, youknow, it's free to members, So I
just recommend any of those.And, again, make sure you're
checking with your legal andyour IT because your IT are
gonna be very important inhelping you go to that fully
digital situation.
Daniel Williams (13:24):
Yeah. Well, great chatting with you again,
Christy.
Cristy Good (13:28):
Thank you.
Daniel Williams (13:29):
Alright. So until our next episode,
everyone, just wanna say toy'all, again, look for that
episode, the episode show notes.Also, look for that article
that'll come out. And thank youall so much for being MGMA
podcast listeners.
Popular Podcasts
On Purpose with Jay Shetty
I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com