Patient Records in a Senior Care Business Sale

Define custody before assigning the files

Begin with a record inventory and the entities involved. Care plans, visit notes, billing records, consent forms and family messages may sit in different systems. Paper archives may still be needed. Employee files and marketing contacts belong in the inventory too, but their rules may differ from those for patient records.

For each category, identify who holds it now, who uses it and who would hold it after closing. Record any vendor that stores or processes the data. The proposed custodian needs both a defined duty and a workable means of performing it. A business name in a closing schedule is only a starting point.

Ask counsel to assess the deal structure and the actual entities. Non-medical home care is not automatically subject to HIPAA merely because clients are older adults. Other privacy laws and contract duties may apply even where HIPAA does not. Records outside an electronic health record can also be protected.

Match the evidence to the buyer's question

After buyer screening and the appropriate confidentiality steps, commercial review can often use totals by payer, service type or period. Ask what decision the buyer needs to make before preparing a file. If a summary answers it, do not add individual details simply because they are easy to export. Keep the approved request and response together in the review log.

Codes can help organize a review, but coding alone does not make a file de-identified. A date, location or rare service pattern can reveal identity. Restrict any code key and have the full disclosure reviewed. HHS describes expert determination and Safe Harbor as HIPAA de-identification methods. (Source: HHS de-identification guidance)

Check the authority for transaction diligence

The HIPAA definition of health care operations includes certain sales, transfers, mergers and consolidations, and related diligence. It concerns a covered entity and another covered entity, or an entity that will become one through that activity. Those conditions matter when counsel assesses a proposed release. (Source: 45 CFR 164.501)

The definition does not give every broker, investor or competitor access to every chart. Record the recipient's role, task and need for the data. Check other applicable limits, including state law and special record categories. The team may be able to use a qualified reviewer's findings instead of circulating the underlying files.

Where minimum necessary applies, limit access to the information needed for the approved purpose. HHS describes both the standard and its exceptions. Apply it to the actual use or disclosure rather than stating that every situation has the same rule. (Source: HHS minimum necessary guidance)

Keep the agreements and user roles clear

An NDA sets commercial confidentiality terms. A business associate agreement addresses duties within a qualifying HIPAA relationship. A custody agreement assigns record-handling responsibilities. The documents may work together, but none should be assumed to answer every question merely because it contains a privacy clause.

HHS describes business associate status through the functions and services performed with protected information on another entity's behalf. Assess the actual relationship, including relevant subcontractors. Do not classify all buyers or all technology vendors alike. Obtain the required agreements and safeguards before giving access. (Source: HHS business associate guidance)

Set named user accounts, access levels and an end point for each reviewer's role. Keep a route for requesting more evidence when justified. View-only settings can help limit copying, but they do not create permission to disclose. Do not place protected files in personal email or an unapproved AI or file-sharing service.

The NDA access FAQ begins with a fictional approved summary, then introduces requests for more records, a different recipient and another use. Each request changes the earlier review. Use the exercise to compare the request with the prior decision before changing who can see the files.

Make the custody schedule usable after closing

The private schedule should name a responsible person or role and a backup for each duty. Include contact details there, rather than in a public sale package. Decide how the parties will route requests when the seller retires, staff leave or a vendor stops supporting the old product.

Address both transferred and retained records. A seller may need lawful access to defend a claim or answer an audit. That does not necessarily require permanent entry to the buyer's live system. Agree on how a request is checked, fulfilled and recorded, including who pays the resulting cost.

For residential-care deals, include contract versions and related attachments in the approved file review. The resident agreement assignment guide links that history to notices and opening charges. It adds an exception list for missing or conflicting documents.

Build a retention register by record type

HHS says the HIPAA Privacy Rule does not prescribe a medical-record retention period. Other applicable requirements still need review. Keep the underlying care record distinct from HIPAA policies or other compliance documents. A blanket instruction to retain everything for six years can confuse these separate duties. (Source: HHS retention FAQ)

For each category, record the governing authority, the event that starts the retention period and any hold that prevents disposal. Ask the relevant adviser to resolve conflicts or missing rules. Record who may authorize disposal when it becomes lawful. The sale date should not silently replace the correct starting event.

The hospice seller guide places an archived care record beside planned family support in a fictional handoff. Both remain relevant after active census ends, for different reasons. Use that distinction when assigning custody and ongoing work. The example supplies no blanket disposal date or right to release the archive.

Check storage and retrieval costs before ending a vendor contract. An archive may require a viewer, license or support service to remain useful. Include those costs and responsibilities in the deal plan. For visit-verification history, connect this register with the EVV handoff guide.

Test retrieval as well as transfer

Agree on a protected test plan with the operator and technology team. Define the source, destination, field mapping and access permissions. Use suitable test data or other approved safeguards. Compare counts, but also inspect the records people need to use. Confirm that histories and attachments remain connected to the correct individual.

Consider a fictional archive that opens and contains the expected number of records, yet its care-plan attachments are unreadable. The transfer is incomplete for that purpose. The team needs to preserve the source, identify the affected records and verify a repair. A vendor's export confirmation does not close the task.

Have authorized users demonstrate a routine lookup, an older-record request and the agreed escalation path. Record the result and any gap. Do not disable the old access until the responsible team has accepted a lawful, workable handoff. Keep the test separate from unauthorized edits to live records.

Plan for failures and continuing care

HHS's Security Rule summary describes risk assessment, access safeguards, backups and continuity for covered electronic information. Use that framework where it applies, with the privacy and technology teams. A named cloud product or a successful login is not a finding that the whole arrangement meets the rules. (Source: HHS Security Rule summary)

Write down who can pause a failed migration, restore access and alert the operating team. Confirm that required records remain available during the response. Keep the seller's production systems separate from buyer diligence access so changes to a data room do not interrupt care. Test the fallback before it is needed.

Handle requests, notices and a failed deal

Coordinate required notices and individual access rights with counsel and the care team. Explain verified changes, the responsible contact and how records questions will be routed. Commercial secrecy cannot override applicable duties. Avoid promises that care will never change; the operator should address clinical questions within its role.

If a bidder exits, apply the approved access-termination and return or disposal terms. Check downloaded copies, allowed retention and legal holds. Deleting an account does not prove that every copy is gone. Route suspected improper disclosure through the incident process while preserving the source records the business still needs.

Close the handoff with evidence

Review the inventory, signed responsibilities, access list, retention register, test results and open issues together. A task should show who accepted it and on what evidence. A missing attachment, unassigned request inbox or expiring archive contract remains a specific action item. Do not hide it beneath a general completion label.

Connect the custody test with the whole-business closing review. That guide distinguishes prepared documents, effective decisions and completed handoff tasks. A records test can support one part of readiness without proving that financing, operating permission or every other closing condition has been satisfied.

Use the seller document guide for collection and the buyer transition guide for follow-through. Jason Taken can help place these tasks on the sale timetable. Counsel, privacy staff, the operator and technology providers must make and carry out the relevant legal, care and security decisions.