“Records custodian” — sometimes called a “custodian of records” — is a term that seems self-explanatory. On a basic level, a records custodian is exactly what it sounds like: an entity that has custody (possession) of a record.

However, the full definition is a bit more complex. Additionally, federal and state laws impose specific responsibilities on records custodians. We explain what records custodians are, what they do and how ABI works with them to obtain medical and business records for our clients.

What Is a Records Custodian?

Generally, a records custodian is a person, entity or department with the job of looking after records. These records can be in paper form, electronic form or both. Most of the time, when someone refers to a records custodian, they really mean an entity rather than an individual person — although many records departments employ several records specialists who can be referred to as “records custodians.”

This is why it can get a little confusing when you hear the term “records custodian.” Depending on the circumstances, it can refer to an entity or a specific person. For example, the records custodian for a hospital could be its legal department or a specific department tasked with records management, but it can also refer to the manager or department head tasked with overseeing the entire records department.

Records management has become such a large area of business that many technical schools now offer courses and certification in maintaining and caring for records. Because medical and business records are primarily stored online, there is a technical component to records management that typically requires in-depth training and experience to ensure that sensitive information is secured against data breaches and improper access.

Responsibilities for Records Custodians

Records custodians fulfill several roles. Accordingly, they have many different responsibilities. On the whole, these responsibilities fall under the general umbrella of records management. Depending on the size of the organization that maintains the records, the records management department may be quite large, with dozens of employees whose sole job is to maintain and manage records.

The duties of a records custodian can vary, but some of the most common responsibilities include:

• Managing Records – It goes without saying that one of the primary jobs of any records custodian is managing and maintaining the records under their care. This includes being familiar with the entity’s filing system, as well as ensuring that only authorized personnel have access to data within the records.
• Fulfilling Records Requests – One of the main jobs of a records custodian is to respond to records requests, both from private individuals and record retrieval companies. Records custodians must make sure that records requests are proper before turning over records. If any information is missing in the request, they must ask for additional information. If the requesting party can’t provide the needed information, the records custodian must inform the requester of the reason why the custodian is denying the request.
• Responding to Subpoenas – In some cases, a party requesting records issues a subpoena to a records custodian. Part of a records custodian’s job is to review the subpoena to determine if it’s proper and fully in compliance with the law. Assuming it is, the custodian would then turn over the requested records.
• Updating Best Practices and Procedures – Records management systems can be extremely complex. Additionally, the laws that govern medical and business records change over time. Records custodians must regularly review their procedures and practices and update them to ensure they stay in compliance.
• Complying with Privacy Laws – With more and more records being stored online, data breaches have become an unfortunate reality — and a common one. When records custodians fail to protect the data under their care, they can face penalties under federal and state privacy laws.

Best Practices for Records Custodians

In most cases, the everyday person doesn’t give records custodians much thought. When you go to the doctor, for example, you probably don’t think about what happens to your medical records after your visit. Most of us have a general sense that the records are stored on a computer somewhere, where they can be accessed at a later date if needed.

But records management isn’t just about making sure the computer server has a power supply, or that records are uploaded to the cloud. Records custodians have the important job of safeguarding those records and only releasing them to requesters who can show that their access is proper and warranted.

While every organization is different, and best practices will vary from custodian to custodian, there are several general guidelines that make up a core set of best practices for the majority of records custodians.

Written Policies for Access

In almost all cases, records custodians should consider creating a set of written guidelines that help their staff gauge whether a requesting entity should have access to the records. A written policy helps ensure that employees follow the same protocols for every records request. At a minimum, it’s a good idea for the policy to include standards for:

• The process for how records requests are made and what information is required from the requesting party.
• The process for how the custodian responds to requests.
• What kinds of fees the custodian charges for requests

It should be noted that some states have codified fee schedules that determine how much a records custodian can charge for records, and even whether a custodian can charge anything at all.

Identifying a Records Request Supervisor

Some records custodians designate a department head or other individual to act as a records request supervisor or coordinator. In the case of records requests, it’s often a best practice to have one decision-maker who can review requests in the event individual employees have questions about the validity of the request. This can eliminate delays and help ensure uniformity in how custodians handle records requests.

A records request supervisor can also step in and assist requesting parties when a party requests records from the wrong custodian. It’s sometimes the case that the custodian knows which custodian actually has possession of the records. In those cases, the request supervisor can notify the requesting party that the records are in possession of a different entity. This can save requesting parties a great deal of time and frustration.

Additionally, having a designated records request supervisor or department head can help authenticate records for legal proceedings. Before evidence, such as medical records, can be introduced as evidence in court, the party submitting it must authenticate it by showing a chain of possession. In the case of medical records, this is typically achieved by the records custodian certifying in writing (and sometimes by way of in-person testimony) that the records are accurate and have been kept in the ordinary course of business.

It’s also a best practice for records custodians to create a form authentication letter for a department head or supervisor to sign when a request for records seeks authentication for a legal matter.

Prompt Turnaround of Records

Records custodians should make it a priority to process records requests as efficiently as possible. It’s often a best practice to make prompt turnaround part of the custodian’s written procedures and policies.

This is one of the advantages of working with an experienced, reputable record retrieval company. Many custodians choose to enter into a mutually beneficial working relationship with a record retrieval company that has proven itself to adhere to the highest ethical and compliance standards. Here are ABI, we have developed relationships with custodians across the country for over three decades. Because we work so closely with some of the largest records custodians in the country, we know their procedures and protocols for making records requests.

Set Retention Periods for Records

There are many different rules that govern how long a custodian must maintain records. It’s a best practice for records custodians to research how long they must keep the various types of records and then incorporate that information into their written policies. This helps ensure that records are not inadvertently destroyed or lost before the retention period has run out.

Set Password and Access Protocols

Unfortunately, data breaches have become routine news across a number of industries. In recent years, the healthcare industry has been a top target of hackers and data thieves. According to Robert Lord in Forbes, credit card hacks may dominate most people’s thoughts, “[h]owever, there’s a much greater threat to our personal data that few are thinking about at all.

That threat is the theft and sale of our health records on the black market, a thriving business with ‘dark web’ online stores that don’t look much different from an Amazon marketplace. In fact, there were nine times more medical than financial records breached in 2016 — 27 million — representing nearly 10% of the U.S. population.”

When you think about it, it’s easy to understand why medical records are a bigger target for data thieves than financial records. Health records are extremely detailed. They contain a wide range of personal information, including addresses, birthdates, social security numbers, health history and perhaps even financial data. With this sort of information in hand, cyber thieves can steal a person’s identity, open accounts in their name and sometimes even claim government benefits like social security payments.

Records custodians are the first and sometimes only line of defense against cyber criminals. Furthermore, data breaches don’t have to come from outside an organization. In some cases, data is lost, stolen or corrupted by internal staff — whether deliberately or accidentally. This is why it’s a best practice for records custodians to set strong, clear access and password protocols for their employees.

Set Recordkeeping Requirements

It’s also a best practice for records custodians to set clear procedures for how records are filed. These procedures should usually include information about how records are labeled and organized, which person or department is responsible for maintaining the records and what happens to records after their retention period has run out.

Clear filing and recordkeeping requirements help ensure that records custodians are consistent in their labeling and maintenance. In turn, this helps them capture all of the records in a request by a record retrieval company. When records are not labeled or maintained in a consistent way, some records may fall through the cracks when a request comes in.

Call ABI to Learn More About Record Retrieval

At ABI, we have worked with records custodians around the country for more than 30 years. To learn more about our approach to record retrieval, contact us online or give us a call at 800-266-0613.