42 CFR 482.24 is the federal hospital Medical Record Services condition of participation requiring accurate, retained, retrievable, and confidential records for every inpatient and outpatient. It requires hospitals to preserve medical records in original or legally reproduced form for at least five years.
You're looking at a hospital production in a personal-injury case. The emergency-department note is present, but a signature is missing. A nursing entry appears out of sequence. The discharge summary refers to a diagnostic result that isn't in the file. The hospital says the production is complete, while opposing counsel argues that any gap proves spoliation. The practical question is not just whether the chart contains useful facts. It's whether the record can be shown to be complete enough, reliable enough, and traceable enough to support the chronology you intend to use.
That's where 42 CFR § 482.24 matters. The rule governs medical-record services as a condition of participation for Medicare-certified hospitals, covering both inpatients and outpatients. It addresses the existence of records, administrative responsibility, completion, filing, retention, retrieval, coding, indexing, confidentiality, and protection against unauthorized access or alteration. It doesn't decide liability for your client, and it doesn't transform every chart defect into proof of negligence. It gives you a regulatory framework for identifying what the hospital was required to maintain and what questions a defective production raises.
The most useful way to apply the rule is through four working lenses:
- The text of the regulation, to identify the actual obligation.
- The regulatory history, to evaluate records created under different compliance periods.
- A practical compliance checklist, to triage deficiencies.
- The litigation application, to authenticate chronologies, investigate alteration, and address preservation disputes.
For a broader workflow around organizing medical evidence, attorneys can also consult this guide to medical record review for attorneys. The point is to move from a general compliance rule to concrete work on the chart in front of you.
| Lens | Source | PI Task It Supports |
|---|---|---|
| Regulatory text | 42 CFR § 482.24 | Match a missing, late, or inaccessible chart element to a stated hospital obligation |
| Regulatory history | Federal Register and CMS guidance | Assess older records without applying later language mechanically |
| Compliance checklist | Rule requirements and interpretive guidance | Triage authenticity, completeness, retrieval, and security issues |
| Litigation application | The produced chart, metadata, indexes, and custodian testimony | Build an authenticated chronology and test alteration or spoliation theories |
What the Regulation Actually Says
The rule starts with a basic requirement. A Medicare-certified hospital must maintain a medical record for each individual evaluated or treated, whether the person was admitted or treated as an outpatient. That matters in PI practice because an emergency-department encounter, observation visit, outpatient procedure, and inpatient admission all fall within the recordkeeping framework. A production that omits an encounter can't be evaluated only by looking at the pages that were produced.
The medical-record service also carries administrative responsibility for the records. Its organization and staffing must fit the hospital's scope and complexity, and the hospital must employ enough personnel to support prompt completion, filing, and retrieval. This is operational language, but it has litigation value. It identifies the hospital's record system as an accountable function, not an informal collection of notes assembled only after a lawsuit begins.
The record must be usable, not merely present
Section 482.24 requires records to be accurately written, promptly completed, properly filed, retained, and accessible. CMS interpretive guidance adds substance to the idea of a complete record. The record should identify the patient, support the diagnosis or condition, justify the care and services provided, document the course and results of treatment, and promote continuity among providers. Those functions track the work of a PI chronology.
A page can exist without satisfying every practical purpose of a complete record. An unsigned note may show that text was entered, but it can leave authorship unresolved. A late entry may contain accurate information, yet raise questions about when the information became part of the chart. An illegible order may be physically present but functionally inaccessible.
The rule sets the important federal retention floor at at least five years, in original or legally reproduced form. The source text is available in the electronic Code of Federal Regulations version of § 482.24. That period is a minimum federal condition of participation, not a universal litigation disposition date.
Retrieval and security are separate obligations
Hospitals must maintain coding and indexing systems that permit timely retrieval by diagnosis and procedure. In a case involving several admissions, multiple providers, or a disputed treatment sequence, the index can be as important as the narrative notes. It may show how the hospital organized the encounter and whether a supposedly missing item should have been retrievable through a diagnosis or procedure pathway.
The regulation also protects confidentiality. Records may be released only to authorized individuals, and hospitals must prevent unauthorized access or alteration. Original records may be released only under applicable federal or state law, court order, or subpoena. Those restrictions can affect how counsel obtains an original, how the hospital describes a reproduction, and what foundation is needed before relying on a copy.
Regulatory History That Affects Older Records
Older charts create a recurring problem. Counsel may review records created under one version of a federal requirement while litigating under another. The answer isn't to assume that every later interpretive statement applied identically at the time of treatment. The answer is to separate the rule's historical wording from the durable functions that the record was expected to serve.
The documented history identifies a foundational publication in the Federal Register on June 17, 1986, at 51 FR 22042. Significant amendments followed on November 27, 2006, at 71 FR 68694, and November 27, 2007, at 72 FR 66933. These milestones are identified in CMS historical and interpretive material, including the CMS State Operations Manual guidance for hospitals.
What remained stable
Across editions from 2007 through 2021, the core requirements remained consistent. Hospitals were expected to maintain records for every evaluated or treated individual, retain them for at least five years, use coding and indexing for retrieval, and protect confidentiality. Entries were also expected to be legible, complete, dated, timed, and authenticated by the responsible individual, whether written or electronic.
That continuity helps when a case includes records created over a long treatment history. A later chart may use a different electronic system, form, or authentication method, but the attorney can still ask stable questions. Who was treated? What condition or diagnosis did the record support? What care was provided? When was the entry made? Who authenticated it? Could the hospital retrieve it through its ordinary indexing system?
The completeness test has evidentiary consequences
CMS guidance describes a complete record through its functions. It should identify the patient, support the diagnosis or condition, justify the care and services, document the course and results of treatment, and promote continuity among providers. Those are not merely administrative ideals. They help an attorney decide whether a chronology accurately reflects the clinical course or only the subset of notes that survived production.
A gap doesn't automatically establish tampering. An authentication defect doesn't automatically invalidate every clinical fact. But when several deficiencies converge, they can justify targeted discovery into the hospital's record system, audit history, amendment practices, and production process. For older records, the careful approach is to identify the applicable edition and then use the stable requirements as a framework for testing reliability.
Compliance Checklist Built From the Rule
A chart review should begin with a record-level audit, not with an argument about negligence. The question is whether the production satisfies the basic conditions that make the record usable. Work from the rule's requirements, preserve what you find, and distinguish a missing document from a document that is present but incomplete or unauthenticated.
Existence and responsibility
- Patient coverage: Confirm that the production contains records for each inpatient and outpatient encounter relevant to the claim.
- Administrative control: Identify the hospital's medical-record service, custodian, or designated records department responsible for organization and retrieval.
- Scope of production: Compare the produced materials with encounter references, diagnosis entries, procedure references, discharge documents, and facility indexes.
A hospital's statement that it produced “the chart” isn't the same as a demonstrated search of all applicable record locations. Ask what systems were searched, what record categories were included, and whether the production came from an original system or a legally reproduced archive.
Accuracy, completion, and authentication
- Accurate writing: Look for internal contradictions, unexplained replacements, and text that doesn't match the surrounding clinical sequence.
- Prompt completion: Flag entries that appear to have been added after the event, especially when the record doesn't clearly identify the timing or status of the entry.
- Legibility: Treat illegible orders, timestamps, or signatures as functional gaps, not cosmetic problems.
- Dating and timing: Confirm that significant entries contain a date and time sufficient to place them in the chronology.
- Authentication: Determine whether the responsible individual authenticated the entry in the hospital's written or electronic system.
The practical distinction is between a defect that affects weight and one that affects foundation. A missing signature may support a deposition question about authorship and completion. A visible amendment trail may help establish when information changed. Neither issue should be overstated without examining the hospital's authentication policy and available system records.
The regulation also requires proper filing, retention, and accessibility. Counsel should preserve the production exactly as received, including file names, pagination, native files when available, and correspondence describing the search.
For firms building a defensible preservation policy, this resource on law firm retention schedule help can supplement the case-specific analysis. It doesn't replace the need to apply the hospital's obligations and the governing state rules to the particular record.
Retrieval, confidentiality, and release
- Diagnosis indexing: Determine whether diagnosis-based retrieval should have located a disputed encounter or note.
- Procedure indexing: Check whether procedure-based retrieval should have produced operative, procedural, or treatment documentation.
- Access controls: Ask who could access or alter the record and whether the system preserves an audit history.
- Authorized release: Confirm that the production was released to an authorized recipient or pursuant to lawful process.
- Original status: Establish whether the file is an original, a legally reproduced record, or a derivative export.
A secure document workflow also matters after production. Firms handling PHI can review guidance on HIPAA-compliant document management while maintaining the litigation file.
The checklist is a triage tool. It tells you where to ask better questions. It doesn't by itself prove that a provider breached the standard of care or that a hospital intentionally destroyed evidence.
Building a Defensible Record-Review Workflow
A defensible chronology must show more than what the reviewer concluded. It should show what documents the reviewer relied on, how the documents were ordered, how gaps were identified, and whether the source could later be examined by another lawyer, expert, or witness.
Preserve provenance before extracting facts
Start by separating original records from reproductions. Keep the received production untouched in a preservation folder. Create a working copy for OCR, page labeling, sorting, or structured extraction. Record the producing entity, delivery date, file format, page count if supplied, and any description of the system or repository used.
That separation becomes important when someone alleges that a date, signature, or note was changed during review. You can demonstrate which file was received and which file was processed. If the hospital produced a legally reproduced record, preserve the hospital's description of that status rather than treating the copy as an original without acknowledging its reproduced nature.
Build the chronology around encounters and indexes
Capture the encounter type for every entry. Mark whether the entry relates to an inpatient or outpatient encounter, then identify the date, time, provider, diagnosis, procedure, symptom, treatment, and result. Keep diagnosis and procedure indexing with the chronology where the production includes it. Retrieval should be repeatable, not dependent on one reviewer's memory.
A useful chronology also preserves uncertainty. Label a date as unclear when the source is unclear. Identify a missing document as missing rather than filling the gap with an inference. Note whether a statement comes from a contemporaneous note, a later summary, a medication record, or a patient-reported history.
Practical rule: A chronology is stronger when every important proposition can be traced back to a page, an encounter, and an identifiable source entry.
Version-control the analysis
Timestamp your own review notes and maintain a change history. If a chronology is corrected, preserve the earlier version and explain the correction. Don't overwrite a disputed interpretation. A later reviewer should be able to distinguish the hospital's amendment from your own editorial revision.
Automation can help extract dates, diagnoses, treatments, providers, and symptom chronology from hospital records. It shouldn't replace attorney judgment about causation, credibility, privilege, standard of care, or the significance of a gap. Ares is one example of a platform that processes hospital records, operative reports, nursing notes, and discharge summaries into structured, cited timelines and demand-drafting materials. The lawyer still decides what the evidence proves.
Firms that need a consistent method to manage legal documents can use document-management procedures alongside this record-review protocol. The technology matters less than the discipline of preserving the source and maintaining a reliable audit trail.
This workflow supports three recurring litigation tasks. It helps test whether an apparent alteration occurred in the hospital system or during later handling. It helps answer a spoliation allegation by showing what was received and preserved. It helps authenticate a chronology because the reviewer can explain the source, method, and limits of the extraction.
Beyond Five Years When Disposition Decisions Arise
The federal period is a floor, not a ceiling. Section 482.24 requires preservation for at least five years, but it doesn't authorize a hospital or custodian to destroy a record automatically when that period ends. Other obligations may control, and an active or reasonably anticipated dispute can suspend ordinary disposition practices.
The retention analysis should account for the record holder, the care setting, the patient's age, the source of the obligation, and the event that starts the retention period. State law may use discharge, final treatment, last entry, death, or another trigger. A payer contract, accreditation requirement, organizational policy, or litigation hold may impose a longer period.
Situations that require caution
An ongoing treatment relationship can make destruction especially risky because later care may depend on earlier records. Pediatric records often require patient-specific analysis. Mental-health and substance-use materials may involve additional confidentiality rules. Government investigations, audits, and pending discovery requests also change the ordinary disposition analysis.
The federal rule itself doesn't resolve those issues. Counsel and custodians should check state, contractual, payer, and litigation-hold requirements before authorizing disposition. The medical-record retention guide provides a starting point for identifying the issues, but the controlling law must be verified for the relevant jurisdiction and record holder.
| Category | Typical Retention | Why It Extends |
|---|---|---|
| Federal hospital requirement | At least five years | Section 482.24 establishes a minimum federal preservation period |
| State hospital law | May exceed the federal minimum | State licensing rules can impose a longer period or a different trigger |
| Contractual or payer requirement | Contract-dependent | Agreements may require preservation beyond the federal floor |
| Minor's records | Patient-specific | Age and majority rules can delay the disposition date |
| Active litigation hold | Until the hold is released | Preservation duties can continue after ordinary retention expires |
| Government inquiry or audit | Matter-dependent | An investigation can suspend routine destruction |
The most common mistake is treating the federal minimum as a safe harbor for every record. It isn't. The second mistake is looking only at the hospital's written retention policy. A policy may be outdated, may not address a litigation hold, or may not identify the rule applicable to a particular business unit.
When a record is missing, ask when it should have been retained, which rule governed, who controlled disposition, and whether the hospital had notice of a claim. Those questions are more useful than merely asserting that the chart should still exist.
Confidentiality, Release, and Authentication Disputes
Section 482.24 creates three practical controls that often collide with PI discovery. The hospital must release records only to authorized individuals, prevent unauthorized access or alteration, and release original records only under applicable federal or state law, court order, or subpoena. These obligations protect the record, but they don't give a hospital a blanket reason to refuse a lawful request.
When the hospital resists a request
If a hospital cites confidentiality in response to a properly authorized request, identify the exact issue. Is the authorization defective? Is the requested material held by a different entity? Is the hospital refusing an original while offering a legally reproduced record? Is it claiming that the request seeks information outside the patient's authorization?
Ask for a written explanation and preserve the correspondence. If necessary, use the applicable discovery process or subpoena. Section 482.24 should be treated as a record-control rule, not as a substitute for analyzing HIPAA, state privacy law, authorization requirements, and civil discovery.
When an original becomes disputed
An original released under court order, subpoena, or other lawful process should be tracked carefully. Document who produced it, when it was received, how it was stored, and whether it was returned. If the hospital provides a reproduction, obtain the custodian's explanation of how it was created and whether the reproduction is treated as legally equivalent to the original.
Authentication usually depends on more than the word “original” on a cover letter. The witness or records custodian should be able to explain the record system, ordinary course of creation, authentication method, and production process. A visible audit trail can be particularly useful when the opposing side alleges that a note was altered.
What the regulation doesn't do
Section 482.24 doesn't create a private right of action. A violation of the condition of participation isn't automatically a standalone damages claim for your client. The rule can still provide persuasive evidence about expected record controls and support discovery into negligent recordkeeping, alteration, or spoliation under applicable state law.
A chart defect is evidence of a problem to investigate. It isn't the conclusion of the investigation.
Use the rule precisely. A missing authentication may support an objection to foundation or a request for the underlying audit data. An unexplained alteration may support a focused deposition. A failure to retrieve a record may support an argument about production completeness. The legal consequence depends on the facts and the governing law.
Quick Reference and Cross-Linked Glossary
The following terms provide a compact way to audit a produced chart. Each one connects a regulatory phrase to a litigation task.
- Medical-record service: The hospital function with administrative responsibility for medical records. Use it to identify the custodian, production process, staffing responsibility, and retrieval pathway.
- Administrative responsibility: The obligation to organize and staff the record service appropriately for the hospital's scope and complexity. It supports questions about who controlled the chart and how the hospital searched for missing material.
- Original or legally reproduced form: The required form in which records must be preserved. Confirm whether the production is an original, a legally reproduced record, or a derivative export before making an authenticity argument.
- Authorized individual: A person permitted to receive the record under the applicable authorization or legal process. Use this term when a hospital invokes confidentiality or disputes the recipient's authority.
- Coding and indexing: Systems that permit timely retrieval by diagnosis and procedure. Compare the index with the produced chronology when an encounter or procedure appears to be missing.
- Accurately written: The requirement that entries reliably express the recorded clinical information. Test it against contradictions, unexplained substitutions, and amendment history.
- Promptly completed: The requirement that entries be completed without unexplained delay. Examine late entries, their authentication, and whether the timing is visible.
- Properly filed and accessible: The operational requirements that make the record retrievable. Ask where the record was stored, what systems were searched, and whether the hospital can reproduce the search.
- Confidential and protected: The hospital must limit release to authorized persons and prevent unauthorized access or alteration. Apply this to subpoena handling, audit trails, and alteration disputes.
- Complete record: CMS guidance describes a record that identifies the patient, supports the diagnosis or condition, justifies care and services, documents treatment and results, and promotes continuity among providers. Use those functions to evaluate whether a chronology is clinically and legally coherent.
For a rapid chart audit, trace each issue to its provision. Patient coverage and administrative responsibility address whether the record should exist. Accuracy, completion, dating, timing, and authentication address reliability. Filing, accessibility, coding, and indexing address retrieval. Confidentiality and release controls address security and lawful production. Retention addresses whether the record should have remained available, subject to longer requirements and litigation holds.
The regulation won't supply your causation opinion or prove that a provider caused an injury. It can give your review a disciplined foundation and help you ask the hospital, custodian, and opposing expert questions tied to an actual federal requirement.
Ares helps personal-injury firms turn hospital records into structured, cited timelines covering dates, diagnoses, treatments, providers, and symptom progression, with demand-drafting support for case development. Visit Ares to see how its record-review workflow can help your team identify gaps and build a defensible medical narrative.
