Required Documentation¶

Overview¶

Proper medical documentation is essential for clinical care, legal protection, and regulatory compliance. DPC simplifies some documentation burdens (no insurance coding optimization) but does not eliminate the need for good medical records.

This guide covers documentation requirements and best practices for Direct Primary Care practices.

Prerequisites¶

• Understanding that documentation serves clinical and legal purposes
• Awareness that documentation standards apply regardless of payment model
• EMR or documentation system selected (see EMR Selection Guide)

Starting Lean: Documentation Reality¶

What You Actually Need¶

Day 1 with a handful of patients: - A way to document patient encounters (EMR, paper, or even a secure document) - Basic patient information captured - Notes you could understand if you looked back

You don't need: - Enterprise EMR system - Elaborate templates - Voice transcription services

Documentation by Stage¶

The Paper Chart Option¶

Yes, you can start with paper charts. Many early DPC pioneers did.

Pros: - Zero cost - No technology learning curve - Works immediately

Cons: - Hard to search/organize as you grow - No remote access - No integrated prescribing, lab orders - Manual backup required - Eventually need to transition

Practical approach: Start with paper if needed, but plan to move to EMR as soon as practical (often worth it even at low patient counts for e-prescribing alone).

Medical Records Requirements¶

Legal Standards¶

Medical records must meet state law and standard of care requirements regardless of payment model.

General Requirements: - Document each patient encounter - Include relevant history and findings - Record assessment and plan - Maintain records for required retention period - Ensure records are legible and organized - Keep records confidential and secure

Why Documentation Still Matters in DPC¶

Even without insurance billing, you need documentation for: - Clinical care: Continuity, memory, coordination - Legal protection: Malpractice defense - Patient requests: Patients have right to their records - Referrals: Specialists need information - Prescribing: DEA rules require every controlled-substance prescription to be issued for a legitimate medical purpose in the usual course of practice and to carry the required content (21 CFR 1306.04 and 1306.05) - Lab orders: Documentation supports medical necessity - Disability/FMLA: Patients may need documentation for claims

Practice-Level Documents¶

Beyond the chart, the following documents are required where your practice is a HIPAA covered entity or has employees, as applicable (a cash-only practice that never sends a HIPAA standard electronic transaction is not a covered entity, but treat HIPAA as the floor; see HIPAA Compliance Basics). Confirm each citation against the current text before relying on it.

• Notice of Privacy Practices: 45 CFR 164.520
• HIPAA policies and procedures, and a security risk analysis: 45 CFR 164.308 and 164.316
• Business associate agreements: 45 CFR 164.504(e)
• Workforce training records: 45 CFR 164.530(b) and (j)
• CLIA certificate of waiver, if you run any in-office test, even waived ones: 42 CFR 493.3 and 493.35 (one application per location; the biennial waiver fee is $248 on the CMS fee schedule updated 2024)
• OSHA bloodborne pathogens exposure control plan, if you have employees: 29 CFR 1910.1030©; and the OSHA workplace poster, which has no small-employer exemption: 29 CFR 1903.2

Essential Elements of a Medical Record¶

Patient Identification¶

Every record should contain: - Full legal name - Date of birth - Contact information - Emergency contact - Preferred pharmacy

Medical History¶

Initial Collection: - Past medical history - Surgical history - Family history - Social history - Medications (with doses) - Allergies - Immunization records (when available)

Ongoing Updates: - Review and update at annual visits - Add new diagnoses, medications, allergies as they occur

Encounter Documentation¶

For each patient visit, document:

1. Date and Type of Encounter - Date of service - In-person, telehealth, phone, etc.

2. Chief Complaint / Reason for Visit - Why the patient is being seen - Patient's own words when helpful

3. History of Present Illness - Details of current concern - Duration, severity, associated symptoms - What makes it better/worse - Previous treatment

4. Review of Systems (as relevant) - Pertinent positives and negatives - Not needed for every visit

5. Physical Exam (as relevant) - Findings from examination - Document pertinent positives and negatives - Not every visit requires complete exam

6. Assessment - Your clinical impression - Diagnosis or differential diagnosis

7. Plan - Treatment plan - Medications prescribed (including dose, instructions) - Tests ordered - Referrals made - Patient education provided - Follow-up plan

8. Signature/Authentication - Your signature or electronic authentication - Date

Documentation for Common DPC Scenarios¶

Routine Office Visit¶

Basic SOAP format works well:

S (Subjective): Chief complaint, HPI, patient's description O (Objective): Vital signs, physical exam findings, test results A (Assessment): Diagnosis/impression P (Plan): Treatment, prescriptions, follow-up

Telehealth Visit¶

Document same elements as in-person, plus: - Type of telehealth (video, phone) - Patient's location (for licensing purposes) - Consent for telehealth (or reference to standing consent) - Any technical issues affecting the visit - Why telehealth was appropriate (or note if in-person recommended)

Phone/Message Consultations¶

Even brief consultations should be documented: - Date and time - Patient concern - Your response/advice - Any orders placed - Follow-up recommended

For quick messages: Brief documentation is fine ("Pt messaged re: medication refill question. Advised to continue current dose. No f/u needed.")

After-Hours Contacts¶

Document: - Date, time - Nature of concern - Assessment (even if limited) - Advice provided - Disposition (home care, come in tomorrow, go to ER)

Prescription Refills¶

Document: - Medication, dose, quantity - Rationale (chronic medication, etc.) - Any relevant clinical information reviewed

Lab/Test Results¶

Document: - Results reviewed - Your interpretation - Action taken - Patient notification

Prescribing Documentation¶

General Prescriptions¶

For each prescription, document: - Medication name and strength - Dose and instructions - Quantity and refills - Indication (why prescribed)

Controlled Substances¶

Enhanced documentation required: - Clear medical necessity documented - Treatment plan in record - Risk assessment for abuse potential - Discussion of risks/benefits with patient - PDMP check documented (where required) - Ongoing monitoring plan for chronic controlled substance use

Informed Consent Documentation¶

When Written Consent Is Needed¶

Always: - Invasive procedures - Significant risk procedures - As required by state law

Recommended: - Higher-risk treatments - Off-label medication use - Anything where risk discussion is important

Consent Documentation Should Include¶

• Procedure/treatment described
• Risks discussed
• Benefits discussed
• Alternatives discussed
• Patient questions addressed
• Patient agreement
• Signature and date

General Consent for Treatment¶

Most practices obtain a general consent at enrollment covering routine care. Document that this was obtained.

Telehealth Consent¶

Document that patient understands and consents to telehealth care (can be included in membership agreement or separate consent).

Records Retention¶

Retention Requirements¶

State laws vary. Typical requirements:

There is no federal chart-retention rule for a private practice. Some states require longer than the range above; research your state's specific requirements.

Federal rules that do apply: - HIPAA requires you to keep your privacy and security documentation (policies, the Notice of Privacy Practices, BAAs, risk analyses, training records) for 6 years from creation or last effective date, whichever is later (45 CFR 164.530(j)(2)). - Physicians enrolled in Medicare must keep documentation of orders, certifications and referrals for 7 years from the date of service (42 CFR 424.516(f)).

Retention Best Practices¶

• Know your state's requirements
• Maintain records at least as long as required
• Consider keeping indefinitely (storage is cheap)
• Have policy for secure destruction when appropriate

Records Requests and Release¶

Patient Right to Records¶

Patients have the right to access their medical records under HIPAA (45 CFR 164.524). You must: - Provide copies within 30 days of the request; one 30-day extension is allowed if, within the first 30 days, you give the patient written notice of the reason for the delay and the date you will respond (164.524(b)(2)(ii)) - For electronic records, also comply with the information-blocking rules, which do not permit unreasonable delay (45 CFR Part 171) - May charge only a reasonable, cost-based fee covering labor to copy, supplies and postage (164.524©(4)); HHS guidance says you may not charge for searching for or retrieving the record - Cannot withhold records due to unpaid bills - Cannot withhold records to keep patient from leaving

Releasing Records to Others¶

Obtain written authorization before releasing records to third parties (with exceptions for treatment, payment, operations, and legally required disclosures).

A valid authorization must include (45 CFR 164.508©):

Core elements: - A specific and meaningful description of the information to be disclosed - The name or other specific identification of the person(s) authorized to make the disclosure (you or your practice) - The name or other specific identification of the person(s) to whom the disclosure may be made - A description of each purpose of the disclosure ("at the request of the individual" is sufficient when the patient initiates it) - An expiration date or expiration event - The patient's signature and date; if a personal representative signs, a description of that person's authority to act for the patient

Required statements: - The patient's right to revoke the authorization in writing, any exceptions to that right, and how to revoke - Whether you may condition treatment, payment, enrollment or eligibility for benefits on the authorization (a physician generally may not) - That information disclosed under the authorization may be redisclosed by the recipient and may no longer be protected by HIPAA

The authorization must be written in plain language, and you must give the patient a copy. An authorization that is missing any required element or statement is invalid, and a disclosure made under it is an impermissible disclosure (164.508(b)(2)).

Responding to Subpoenas¶

If you receive a subpoena for records: 1. Don't panic 2. Verify authenticity 3. Check if patient authorization is included 4. Consult attorney if unsure 5. Follow proper procedures for your state

Documentation Best Practices¶

Practical Tips¶

Be Contemporaneous: Document at time of visit or soon after. Memory fades.

Be Legible: Whether paper or electronic, others must be able to read it.

Be Accurate: Record what actually happened. Don't copy forward outdated information.

Be Complete but Concise: Include what's relevant without padding.

Document Clinical Reasoning: Especially for significant decisions, note why you made the choice you did.

Quote Patient When Useful: "Patient states chest pain 'feels like an elephant sitting on my chest'" is more useful than "patient has chest pain."

What NOT to Do¶

• Don't document what you didn't do (false documentation)
• Don't alter records without clear late-entry notation
• Don't editorialize or include unprofessional comments
• Don't include information about other patients
• Don't use unclear abbreviations

Addenda and Corrections¶

Late Entries: Label clearly as addendum, include current date, explain reason for late entry.

Corrections: In paper records, single line through error, initial and date. In EMR, follow system's correction process. Never delete—always maintain audit trail.

Patient-requested amendments: Patients may ask you to amend their record (45 CFR 164.526). Act on the request within 60 days (one 30-day extension with written notice). If you deny it, give the patient a written denial and allow them to file a statement of disagreement that stays with the record.

Templates and Efficiency¶

Using Templates¶

Templates can improve efficiency and ensure completeness:

Good Uses: - Annual wellness exam template - Chronic disease management visits (DM, HTN) - Sports physicals - New patient intake

Caution: - Customize for each patient - Don't auto-populate information you didn't verify - Review template output for accuracy

Smart Phrases / Macros¶

Time-savers for common documentation elements: - Normal exam findings - Standard patient education - Common medication instructions - Recall/follow-up templates

Checklist: Documentation Requirements¶

Setup¶

• Establish documentation system (EMR or paper)
• Create or customize templates for common visits
• Set up patient intake forms
• Establish records retention policy
• Create records release authorization form

Each Patient¶

• Complete patient identification information
• Obtain and document consent for treatment
• Collect medical history
• Medication list current
• Allergies documented

Each Encounter¶

• Date and type documented
• Reason for visit documented
• Relevant history recorded
• Exam findings (if applicable) recorded
• Assessment documented
• Plan documented
• Signed/authenticated

Ongoing¶

• Prescription documentation complete
• Lab/test results documented
• Referrals documented
• Records requests handled properly
• Records retained per policy

Resources¶

• EMR Selection Guide - Choosing documentation system
• HIPAA Compliance Basics - Privacy and security
• Your state medical board - Documentation requirements
• Your malpractice carrier - Documentation recommendations

This guide is educational content, not legal advice.

Sources checked against primary law and agency guidance on 2026-09-22.

Next Steps¶

After establishing documentation practices: - Patient Onboarding Workflow - New patient documentation - Daily Workflow Optimization - Efficient documentation processes