Unsigned Medical Records are a Security Threat

Did you know that each unsigned medical record represents a potential HIPAA security threat? Any unsigned record is vulnerable to access (intentionally or not) and potentially could have exam data edited or deleted from within the record. HIPAA regulations stipulate that medical records be signed off within three business days of the date of service to limit such vulnerability. In addition, other vital functions cannot be performed when a record remains unsigned. For example, a patient’s claim cannot be billed to insurance and records cannot be released back to a referring doctor or sent with a consultation request until the record is signed off. Therefore, the best practice is to sign off on patient records for each patient encounter at the end of each clinic session, unless legitimate circumstances prevent this from occurring. In those instances, signoff within no longer than three days.

Missing signatures also create voluminous amounts of additional work for the medical records and billing staff. They have to search for, track, and communicate with attendings about each and every missing signature. Therefore, it is of vital importance for attendings to do the following on every patient encounter:

  • Log into each of your intern’s exams from the consult room or exam room during the patient encounter so that your name is added to the chart as the provider.
  • Get in the practice of signing off on your charts at the end of each clinic session. Double check to make sure you don’t have any outstanding charts by running a missing signature report before leaving for the end of the day.
  • If additional information needs to be added to a record at the end of the clinic session, sign off on the record and input the additional information later with an addendum explaining why the chart was reopened after signoff.

If you have any unsigned records beyond the three-day timeframe, please respond promptly to notifications from the medical records department that are sent as e-mails or tasks within Compulink.