Medical Records Custodian Checklist for Practice Administrators

  • Electronic Medical Records, EMR, Medical Records Custodian Services, Records Management

medical records custodian checklist

Managing a medical practice closure or transition is one of the most operationally complex responsibilities a practice administrator faces. Unlike routine administrative work, a closure involves a defined endpoint, a compressed timeline, and a set of regulatory obligations that do not stop at the last patient appointment. Patient records must be transferred to a qualified custodian, patients must be notified, the EHR must be addressed before the vendor contract expires, and the practice must be able to demonstrate that every step was handled appropriately.

This checklist is designed to give practice administrators a structured, sequential framework for managing the medical records custodian transition from initial planning through post-closure maintenance. It draws together the most important tasks across six phases: planning, custodian selection, records preparation, patient notification, transfer execution, and ongoing maintenance. The specific requirements in some areas vary by state, so legal and compliance counsel should be consulted for jurisdiction-specific obligations.

Phase 1: Initial Planning

The earlier planning begins, the more control the practice has over the process. For planned closures, beginning 6 to 12 months in advance is ideal. For unexpected closures due to illness, death, or sudden circumstances, these tasks should begin as soon as the situation is stabilized.

  • Confirm the closure or transition date and build the planning timeline backward from that date
  • Contact the state medical board to understand requirements for practice closures, including any mandatory notification, minimum patient notice periods, and record retention requirements specific to the state
  • Engage a healthcare attorney familiar with practice closures to advise on legal obligations, including any matters involving the physician’s license, insurance contracts, or employment agreements
  • Notify the professional liability insurance carrier, including discussion of tail coverage requirements and any implications for records-related claims that may arise after closure
  • Determine the scope of records: how many paper charts exist, what date range they cover, what EHR system is in use, and whether records exist in any other format
  • Estimate the volume of records to be transferred to provide an accurate scope for custodian evaluation
  • Identify whether the practice has any active legal holds that affect records and confirm the scope of those holds with legal counsel before any records are moved or destroyed

Phase 2: Selecting and Engaging a Medical Records Custodian

Selecting the right custodian is one of the most consequential decisions in the process. The custodian will hold responsibility for patient records for the full applicable retention period, which may extend seven to ten years or more after the last patient visit. The relationship should be evaluated accordingly.

  • Define requirements before beginning the evaluation: what formats of records the custodian must accept (paper, electronic, or both), what scanning capabilities are needed, what the retrieval SLA must be, and what access controls and HIPAA compliance documentation the practice requires
  • Research and identify potential medical records custodians with experience in practice closures for the relevant specialty and record volume
  • Confirm that each candidate custodian can provide a signed Business Associate Agreement, which is required before any protected health information is transferred or even discussed
  • Verify that the custodian’s facility meets appropriate physical security standards for the storage of protected health information
  • Confirm the custodian’s process for receiving and fulfilling patient access requests, including response timelines and authorization verification procedures
  • Review the custodian’s retrieval SLA, including standard, rush, and emergency retrieval options and any scan-on-demand capabilities
  • Confirm the custodian’s retention tracking process: how they track when records become eligible for destruction and how they notify the practice or estate when that point is reached
  • Confirm the custodian’s destruction process and documentation: certificates of destruction should be issued for every destruction event
  • Execute the custodian agreement and the Business Associate Agreement before any records are transferred or discussed

Phase 3: Preparing Records for Transfer

Records preparation is the most labor-intensive phase of the process. Decisions made here determine how accessible and usable the records will be throughout the retention period.

  • Conduct a records audit: confirm the total volume of paper records, the date range they cover, the organizational structure of the filing system, and where records are physically located (including any records in offsite storage)
  • Apply the retention schedule before transfer: identify records that have already satisfied their retention period and can be destroyed before the transfer, reducing the volume the custodian must manage and the cost of custodian services
  • Coordinate with legal counsel before destroying any records, confirming that no active legal holds apply
  • Destroy eligible records through a certified shredding vendor and obtain a certificate of destruction for every destruction event
  • Prepare a complete box inventory for paper records before they leave the practice, including box identifiers, contents descriptions, date ranges, record types, and scheduled retention or destruction dates
  • Begin the EHR export process well before the vendor contract expires: contact the EHR vendor, confirm what the export includes and excludes, understand the format options, and request a timeline and cost estimate
  • Confirm that the EHR export captures the full designated record set as defined by HIPAA, including clinical records, billing records, and all attached or scanned documents
  • Determine whether paper records will be scanned before transfer to the custodian or transferred in physical form, and arrange scanning services if scanning is the chosen approach
  • Verify that all records in offsite storage have been accounted for in the transfer plan and contact the storage provider to arrange transfer to the custodian

Phase 4: Patient Notification

Patient notification is both a legal obligation and an ethical one. Patients must know where their records are going and how to reach the custodian to access them.

  • Determine the notification list: at minimum, all patients seen within the past two to three years, as well as any patient with an ongoing treatment need or records of particular clinical importance
  • Draft the patient notification letter, ensuring it includes: the practice closure date, a clear statement of what will happen to records, the custodian’s name and contact information, instructions for requesting copies of records or authorizing transfer to a new provider, and any deadline for making requests before transfer
  • Review the draft letter with legal counsel and confirm it meets state-specific notification requirements
  • Mail the notification letter to all patients on the list via first-class mail at least 30 days before closure, with 60 to 90 days preferred where the timeline allows
  • Post notice in the practice office during the period it remains open
  • Update the practice website with closure and records transfer information
  • Update the practice voicemail with closure information and the custodian’s contact details
  • Publish a newspaper notice if required by state law or recommended by state medical board guidance
  • Document all notification steps taken, including the date of mailing, the list of patients notified, and the date of any supplemental notices

Phase 5: Executing the Records Transfer

The transfer itself requires coordination between the practice, the custodian, and any vendors involved in scanning or moving records.

  • Coordinate the physical transfer of paper records with the custodian, including scheduling, transportation, and intake procedures
  • Confirm that the box inventory accompanies the physical transfer and that the custodian has received it and can reconcile it against the boxes received
  • Obtain a written receipt or confirmation of transfer from the custodian, documenting what was received and when
  • Transfer EHR export files to the custodian in the agreed format, confirming that the custodian can access and organize the files by patient
  • Confirm that the custodian has indexed the received records and can fulfill a patient access request
  • Test the process by submitting a sample retrieval request if the timeline and circumstances allow
  • Retain independent copies of the box inventory, the transfer confirmation, and the BAA in the practice’s own records, separate from the custodian’s system

Phase 6: Post-Closure Maintenance

The custodian relationship does not end at transfer. Several ongoing tasks ensure that the transition remains compliant through the full retention period.

  • Maintain the custodian’s current contact information in a location accessible to the physician’s estate, the physician’s attorney, and any designated successor
  • Cancel or adjust the EHR vendor subscription only after the export has been confirmed as complete and accessible, not before
  • Notify Medicare, Medicaid, and other payers of the practice closure according to their specific requirements
  • Notify the state medical board of the closure if required
  • Update professional listings, insurance panel directories, and referral networks
  • Arrange for mail forwarding and phone call forwarding to an appropriate point of contact for incoming record requests that come through channels other than the custodian
  • Document the retention period expiration dates for each category of records in the custodian’s care, so that when records become eligible for destruction, that destruction can be scheduled and confirmed with the custodian
  • Retain all transfer documentation, custodian agreements, and certificates of destruction indefinitely, even after the retention period for the patient records themselves has expired

Evaluating Progress: Questions to Ask Before Considering the Transition Complete

Before the practice administrator considers the custodian transition complete, the following questions should each have a clear, documented answer:

  • Have all patients who should have been notified received notification with the custodian’s contact information?
  • Has the EHR export been completed and confirmed as complete before access to the system was terminated?
  • Have all paper records been inventoried, transferred, and confirmed as received by the custodian?
  • Is the Business Associate Agreement in place and has it been retained?
  • Can the custodian demonstrate, through a test request or confirmation, that it can retrieve and produce a specific patient’s records?
  • Have all records that were eligible for destruction been destroyed with certificates?
  • Are the transfer documentation and custodian agreement retained in a location accessible to the physician’s estate or designated successor?

Frequently Asked Questions

Who is responsible for managing the medical records custodian transition when a practice closes?

In most cases, the practice administrator manages the transition process operationally, working in coordination with the physician, legal counsel, and any HR or financial advisors involved in the closure. In a solo practice closure, the administrator and the physician share responsibility closely. In a group practice, the administrator typically leads the process with oversight from the physician partners and often with legal support. In the event of a physician’s unexpected death, the estate executor typically bears legal responsibility, but an experienced practice administrator can provide critical operational support during a difficult time.

What is the most common mistake practice administrators make in managing the custodian transition?

The most common mistake is underestimating the lead time required for every component of the process. EHR exports take time to arrange and longer to complete than expected. Custodian selection and contracting takes longer than expected. Patient notifications require time to prepare, time to mail, and then a waiting period for patients to respond. Shredding events for eligible records require scheduling. Attempting to compress all of these tasks into the final few weeks before a closure date creates avoidable risk at every step.

What records can be destroyed before transferring to a custodian? Records that have already satisfied their applicable state and federal retention period, records that are clearly duplicates of records being transferred, and records with no records value (such as blank forms, outdated marketing materials, and administrative convenience copies) can generally be destroyed before transfer after review against the retention schedule. Any destruction before transfer should involve legal counsel if there is any uncertainty, and all destruction should be documented with certificates from a certified vendor.

How long does a practice administrator need to stay involved after the closure?

The practice administrator’s active involvement typically concludes once the transfer is complete and the post-closure notifications have been sent. After that, the custodian manages ongoing record requests independently. However, some tasks may arise after the immediate closure: occasional record requests that come through the practice’s forwarded mail or phone, questions from the custodian about specific records, and the eventual scheduling of destruction events when retention periods expire. A documented handoff of the custodian relationship to the physician’s estate or a designated successor ensures that those future tasks are handled by someone with the authority and information to manage them.

What should be retained by the practice even after records are transferred to the custodian?

The practice should retain independently: a copy of the complete box inventory, the signed custodian agreement and Business Associate Agreement, transfer confirmation documentation, all certificates of destruction issued during the transition, copies of patient notifications sent, and any correspondence with the state medical board related to the closure. These records document that the transition was handled compliantly and should be retained indefinitely rather than destroyed with the patient records.

Emerald Document Imaging works with practice administrators, physicians, and healthcare attorneys to manage medical records custodian transitions for closing, retiring, and transitioning practices. From records preparation and scanning to patient record custody and access request fulfillment, we handle the process so practice administrators can focus on the rest of the closure.

Learn more about our Medical Records Custodian Services and contact us to begin planning your transition.

Share this Article

Related Posts