When a medical practice changes ownership, whether through a sale, merger, acquisition, or partnership restructuring, the transition involves far more than business licenses and billing systems. One of the most critical and legally sensitive issues is what happens to patient medical records.
Patient records are not assets that can be casually transferred like furniture or equipment. They are protected by HIPAA, governed by state retention laws, and subject to strict rules around privacy, access, and continuity of care. Mishandling them during an ownership change can expose both the selling and acquiring parties to regulatory penalties, lawsuits, and patient complaints.
This article explains how patient records must be handled when a medical practice changes ownership, who is responsible at each stage, and how practices can ensure compliance while protecting patients and providers alike.
Why Patient Records Are a High-Risk Issue During Ownership Changes
Ownership transitions often happen quickly, but patient records create long-term obligations that extend well beyond the transaction date.
Key challenges include:
- Determining who becomes the legal custodian
- Ensuring uninterrupted patient access
- Complying with HIPAA and state laws
- Managing paper and electronic records across systems
- Communicating changes to patients
- Preventing unauthorized access or disclosure
If these responsibilities are not clearly defined and properly executed, compliance risks multiply.
Who Owns Patient Records vs. Who Controls Them
One of the most common points of confusion involves ownership versus custody.
Medical Practices Typically Own the Physical or Electronic Record
The practice entity usually owns the medical record itself (paper or digital).
Patients Own the Information
Patients have legal rights to:
- Access their records
- Request copies
- Direct where records are sent
- Expect privacy and security
Custodians Control Access and Retention
The entity responsible for storing and releasing records is the custodian, and that role can change during an ownership transition.
Understanding this distinction is essential for compliance.
Common Scenarios Where Ownership Changes Affect Records
Patient record handling depends on the nature of the transaction.
1. Full Practice Sale (Asset or Stock Sale)
In a full sale, one entity acquires another practice entirely.
What happens to records:
- Records typically transfer to the acquiring practice
- The new owner becomes the custodian
- HIPAA allows this transfer as part of a healthcare operation
Key requirements:
- Records must remain secure during transfer
- Access controls must be updated
- Retention schedules must be honored
- Patients may need to be notified, depending on state law
2. Practice Merger
When two practices merge, records are consolidated.
Risks during mergers:
- Duplicate patient records
- Incompatible EMR systems
- Conflicting retention policies
- Access confusion across locations
Best practice:
- Centralize records under a single custodian
- Digitize legacy paper charts
- Standardize retention and access rules
3. Partial Sale or Partner Buy-In
If a new partner buys into an existing practice:
- Custodianship often remains unchanged
- Access rights may expand
- HIPAA policies must be updated
This scenario still requires careful documentation to avoid internal misuse of PHI.
4. Practice Acquisition by a Hospital or Health System
When a hospital system acquires a private practice:
- Records may need to be migrated into the hospital’s EMR
- Historical charts may remain outside the EMR
- Long-term retention becomes more complex
Hospitals often rely on third-party custodians during these transitions.
5. Sale With Physician Departure
If a selling physician leaves the practice entirely:
- The acquiring entity typically becomes custodian
- The departing physician may still retain liability
- Patient access must remain uninterrupted
Clear agreements are essential to avoid future disputes.
HIPAA Rules Governing Record Transfers During Ownership Changes
HIPAA permits the transfer of patient records during ownership changes without individual patient authorization—but only if strict safeguards are followed.
HIPAA allows transfer when:
- The transfer is part of healthcare operations
- Records are used for treatment, payment, or operations
- Privacy protections remain intact
HIPAA requires:
- Secure handling during transfer
- Updated Business Associate Agreements (BAAs)
- Role-based access controls
- Audit trails
- Minimum necessary access
Failure to follow these rules can result in violations—even if the transfer itself is allowed.
State Retention Laws Still Apply After the Sale
Ownership changes do not reset retention clocks.
Examples:
- Adult records may need to be retained 6–10 years
- Pediatric records often until age 21–28
- OB/GYN and behavioral health records may require longer retention
The new owner inherits these obligations.
Destroying records early—even unintentionally—can result in penalties years after the transaction.
Patient Notification Requirements
Whether patients must be notified depends on state law and the transaction structure.
Common notification triggers include:
- Change in custodian
- Practice closure or relocation
- Significant change in how records are accessed
- Transfer of records outside the local community
Notifications typically explain:
- Who now holds the records
- How patients can request copies
- Where to direct future record requests
Failure to notify properly can lead to patient complaints and regulatory scrutiny.
What Happens to Paper Records During Ownership Changes
Paper records create some of the greatest risks during transitions.
Common problems include:
- Lost boxes during office moves
- Untracked access
- Improper storage
- Unauthorized disposal
- Incomplete inventories
Best practices:
- Inventory all paper charts
- Barcode and track boxes
- Store records in HIPAA-compliant facilities
- Digitize where possible
- Use professional medical records custodians
Third-party custodians often serve as neutral, compliant handlers during ownership changes.
What Happens to Electronic Medical Records (EMRs)?
EMR transitions are often more complex than expected.
Challenges include:
- Incompatible EMR platforms
- Partial data migrations
- Missing attachments or scanned files
- Metadata loss
- Access gaps
Key considerations:
- Who maintains access to legacy systems
- How historical records will be accessed
- How audit logs are preserved
- How patient requests are fulfilled
Many practices retain a hybrid solution—EMR for active patients and custodial storage for historical records.
Role of a Medical Records Custodian During Ownership Changes
Medical records custodians play a crucial role in reducing risk during transitions.
They provide:
- Secure storage for paper and digital records
- Chain-of-custody documentation
- Patient request handling
- Retention tracking
- HIPAA-compliant access controls
- Neutral third-party oversight
Custodians are especially valuable when:
- Practices close locations
- Physicians retire
- Records are split between entities
- Long-term retention is required
Legal and Liability Risks If Records Are Mishandled
Improper record handling during ownership changes can result in:
- HIPAA violations
- State investigations
- Civil lawsuits
- Loss of licensure
- Delayed patient care
- Reputational damage
Importantly, both the selling and acquiring parties may remain liable if responsibilities are not clearly assigned.
Best Practices for Handling Patient Records During a Practice Sale
To minimize risk, practices should follow these steps:
1. Address records explicitly in the purchase agreement
Define who becomes custodian and who handles future requests.
2. Inventory all records
Paper and electronic, active and inactive.
3. Confirm retention obligations
By state, specialty, and patient age.
4. Update HIPAA documentation
Including BAAs and privacy policies.
5. Secure records during transfer
Use tracked, professional services—not ad hoc moves.
6. Plan patient communications
If required by law or best practice.
7. Use a qualified medical records custodian
Especially for long-term retention and ROI management.
What Patients Should Expect
From the patient’s perspective, ownership changes should be invisible.
Patients should still be able to:
- Request records
- Transfer records to new providers
- Expect privacy
- Receive timely responses
Any disruption is a sign of poor transition planning.
When a medical practice changes ownership, patient records remain a long-term legal and ethical responsibility. While HIPAA allows records to transfer as part of healthcare operations, strict safeguards must be followed to protect patient privacy, ensure access, and comply with retention laws.
Clear agreements, secure handling, proper custodianship, and thoughtful planning are essential to preventing compliance failures during ownership transitions.
Emerald Document Imaging helps medical practices, physician groups, and health systems manage patient records during sales, mergers, and acquisitions through secure custodial services, digitization, retention management, and compliant release-of-information workflows.
Reach out today to make Emerald your trusted medical records custodian →
