42 C.F.R. § 482.24 : Public Health — CENTERS FOR MEDICARE & MEDICAID SERVICES, DEPARTMENT OF HEALTH AND HUMAN SERVICES — STANDARDS AND CERTIFICATION — CONDITIONS OF PARTICIPATION FOR HOSPITALS — BASIC HOSPITAL FUNCTIONS — Condition of participation: Medical record services

The hospital must have a medical record service that has administrative responsibility for medical records. A medical record must be maintained for every individual evaluated or treated in the hospital.

(a) Standard: Organization and staffing. The organization of the medical record service must be appropriate to the scope and complexity of the services performed. The hospital must employ adequate personnel to ensure prompt completion, filing, and retrieval of records.
(b) Standard: Form and retention of record. The hospital must maintain a medical record for each inpatient and outpatient. Medical records must be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must use a system of author identification and record maintenance that ensures the integrity of the authentification and protects the security of all record entries.
(1) Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.
(2) The hospital must have a system of coding and indexing medical records. The system must allow for timely retrieval by diagnosis and procedure, in order to support medical care evaluation studies.
(3) The hospital must have a procedure for ensuring the confidentiality of patient records. In-formation from or copies of records may be released only to authorized individuals, and the hospital must ensure that unauthorized individuals cannot gain access to or alter patient records. Original medical records must be released by the hospital only in accordance with Federal or State laws, court orders, or subpoenas.
(c) Standard: Content of record. The medical record must contain information to justify admission and continued hospitalization, support the diagnosis, and describe the patient's progress and response to medications and services.
(1) All patient medical record entries must be legible, complete, dated, timed, and authenticated in written or electronic form by the person responsible for providing or evaluating the service provided, consistent with hospital policies and procedures.
(2) All orders, including verbal orders, must be dated, timed, and authenticated promptly by the ordering practitioner or by another practitioner who is responsible for the care of the patient only if such a practitioner is acting in accordance with State law, including scope-of-practice laws, hospital policies, and medical staff bylaws, rules, and regulations.
(3) Hospitals may use pre-printed and electronic standing orders, order sets, and protocols for patient orders only if the hospital:
(i) Establishes that such orders and protocols have been reviewed and approved by the medical staff and the hospital's nursing and pharmacy leadership;
(ii) Demonstrates that such orders and protocols are consistent with nationally recognized and evidence-based guidelines;
(iii) Ensures that the periodic and regular review of such orders and protocols is conducted by the medical staff and the hospital's nursing and pharmacy leadership to determine the continuing usefulness and safety of the orders and protocols; and
(iv) Ensures that such orders and protocols are dated, timed, and authenticated promptly in the patient's medical record by the ordering practitioner or by another practitioner responsible for the care of the patient only if such a practitioner is acting in accordance with State law, including scope-of-practice laws, hospital policies, and medical staff bylaws, rules, and regulations.
(4) All records must document the following, as appropriate:
(i) Evidence of-
(A) A medical history and physical examination completed and documented no more than 30 days before or 24 hours after admission or registration, but prior to surgery or a procedure requiring anesthesia services, and except as provided under paragraph (c)(4)(i)(C) of this section. The medical history and physical examination must be placed in the patient's medical record within 24 hours after admission or registration, but prior to surgery or a procedure requiring anesthesia services.
(B) An updated examination of the patient, including any changes in the patient's condition, when the medical history and physical examination are completed within 30 days before admission or registration, and except as provided under paragraph (c)(4)(i)(C) of this section. Documentation of the updated examination must be placed in the patient's medical record within 24 hours after admission or registration, but prior to surgery or a procedure requiring anesthesia services.
(C) An assessment of the patient (in lieu of the requirements of paragraphs (c)(4)(i)(A) and (B) of this section) completed and documented after registration, but prior to surgery or a procedure requiring anesthesia services, when the patient is receiving specific outpatient surgical or procedural services and when the medical staff has chosen to develop and maintain a policy that identifies, in accordance with the requirements at § 482.22(c)(5)(v), specific patients as not requiring a comprehensive medical history and physical examination, or any update to it, prior to specific outpatient surgical or procedural services.
(ii) Admitting diagnosis.
(iii) Results of all consultative evaluations of the patient and appropriate findings by clinical and other staff involved in the care of the patient.
(iv) Documentation of complications, hospital acquired infections, and unfavorable reactions to drugs and anesthesia.
(v) Properly executed informed consent forms for procedures and treatments specified by the medical staff, or by Federal or State law if applicable, to require written patient consent.
(vi) All practitioners' orders, nursing notes, reports of treatment, medication records, radiology, and laboratory reports, and vital signs and other information necessary to monitor the patient's condition.
(vii) Discharge summary with outcome of hospitalization, disposition of case, and provisions for follow-up care.
(viii) Final diagnosis with completion of medical records within 30 days following discharge.
(d) Standard: Electronic notifications. If the hospital utilizes an electronic medical records system or other electronic administrative system, which is conformant with the content exchange standard at 45 CFR 170.205(d)(2), then the hospital must demonstrate that-
(1) The system's notification capacity is fully operational and the hospital uses it in accordance with all State and Federal statutes and regulations applicable to the hospital's exchange of patient health information.
(2) The system sends notifications that must include at least patient name, treating practitioner name, and sending institution name.
(3) To the extent permissible under applicable federal and state law and regulations, and not inconsistent with the patient's expressed privacy preferences, the system sends notifications directly, or through an intermediary that facilitates exchange of health information, at the time of:
(i) The patient's registration in the hospital's emergency department (if applicable).
(ii) The patient's admission to the hospital's inpatient services (if applicable).
(4) To the extent permissible under applicable federal and state law and regulations and not inconsistent with the patient's expressed privacy preferences, the system sends notifications directly, or through an intermediary that facilitates exchange of health information, either immediately prior to, or at the time of:
(i) The patient's discharge or transfer from the hospital's emergency department (if applicable).
(ii) The patient's discharge or transfer from the hospital's inpatient services (if applicable).
(5) The hospital has made a reasonable effort to ensure that the system sends the notifications to all applicable post-acute care services providers and suppliers, as well as to any of the following practitioners and entities, which need to receive notification of the patient's status for treatment, care coordination, or quality improvement purposes:
(i) The patient's established primary care practitioner;
(ii) The patient's established primary care practice group or entity; or
(iii) Other practitioner, or other practice group or entity, identified by the patient as the practitioner, or practice group or entity, primarily responsible for his or her care.

42 C.F.R. §482.24

51 FR 22042, 6/17/1986, as amended at 71 FR 68694, 11/27/2006; 72 FR 66933, 11/27/2007; 77 FR 29074, 5/16/2012; 84 FR 51819, 11/29/2019; 85 FR 25637, 6/30/2020