HIPAA-Compliant Medical Records Scanning: A Guide for California Practices

Every practice that has ever considered digitizing its charts has run into the same worry: the moment those boxes leave your building, you are still the one HIPAA holds responsible. That worry is correct, and it is worth taking seriously.

The good news is that HIPAA does not prohibit sending records to an outside scanning company. It sets conditions. This guide walks through what those conditions actually are, what a California practice should ask a vendor before signing anything, and where the real risk sits — which is usually not where people expect.

You Stay Responsible. The Vendor Becomes a Business Associate.

Under HIPAA, a scanning company that handles protected health information on your behalf is a business associate. That status is not optional and it is not something either party gets to opt out of. It means the vendor is directly liable for safeguarding the records, and it means you are required to have a written Business Associate Agreement in place before any PHI changes hands.

“Before” is the part practices get wrong. A BAA signed after the truck has already come is a BAA signed too late. If a vendor is willing to pick up your charts first and paper the agreement afterward, that tells you something about how they handle the rest of it.

A BAA is not a formality to be skimmed. At minimum it should state what the vendor may and may not do with your records, require them to safeguard the information, require them to report breaches to you, address what happens to the data when the engagement ends, and extend the same obligations to any subcontractor they use.

That last point deserves emphasis. Ask directly whether any part of the work — scanning, indexing, data entry, storage — is subcontracted or sent offshore. Some national vendors route indexing work overseas. That is not automatically a HIPAA violation if the agreements are correct, but it is something you should know before you decide, not after.

Chain of Custody Is the Part That Actually Fails

Most people picture a HIPAA breach as a hacker. In records scanning, the far more common failure is physical and mundane: a box that nobody can account for.

Chain of custody means every box is logged when it leaves your office, logged when it arrives at the facility, tracked through preparation and scanning, and reconciled at the end. If a vendor cannot tell you where box 47 is on a Tuesday afternoon, they do not have chain of custody — they have a pile.

Questions worth asking:

• Who transports the records? Your own employees, or a third-party courier? A common carrier that also delivers packages is a different risk profile than a vendor’s own vehicle and staff.
• Is every box individually logged and labeled? You should receive an inventory, not a headcount.
• Where are records held between pickup and scanning? A secured area within a controlled facility, or a warehouse floor?
• Can you retrieve a chart mid-project? Practices in the middle of a scanning project still see patients. A vendor who cannot pull a specific chart and get it back to you the same day has not thought about how medical offices actually work.
• Can you visit? A vendor who will not let you see where your patient records are handled is telling you something.

At Paperless Revolution, our facility is on Shoemaker Ave. in Santa Fe Springs. Records stay in our building and are handled by our own staff. If you want to see the room your charts will sit in before you commit, drive over.

Who Touches Your Records

HIPAA requires workforce training and appropriate safeguards, but it does not hand you a checklist for vetting a vendor’s staff. Ask anyway:

• Are the people handling PHI employees, or temporary labor brought in per project?
• Are they background-checked?
• Are they HIPAA-trained, and is that training documented?
• Is access to the scanning area restricted, and is there a record of who was in it?

Temporary staffing is the honest pressure point in this industry. Scanning is labor-intensive and volume is uneven, so some operations scale up with day labor when a big job lands. That is a legitimate business model for scanning warehouse inventory sheets. It is a different proposition for psychiatric records.

What Happens to the Paper Afterward

This is the question that stalls the most deals, and it deserves a plain answer.

Our default is certified destruction. Once scanning is complete and you have confirmed the digital files are correct, the original paper is shredded and you receive a certificate of destruction documenting it. If you would rather have your originals back, we return them for a fee — the boxes have to be re-palletized and transported, and we would rather charge for that honestly than bury it somewhere else in the quote.

Whichever you choose, insist on two things. First, that nothing is destroyed until you have verified the scans, not until the vendor believes the job is done. Second, that you get documentation of the destruction. A certificate of destruction is what you produce if anyone ever asks what became of a chart.

The Six-Year Rule Is Not What Most People Think

You will hear that “HIPAA requires records to be kept six years.” That is a persistent and expensive misunderstanding.

HIPAA’s six-year retention requirement applies to HIPAA compliance documentation — your policies, your risk analyses, your BAAs, your breach records. It does not set a retention period for patient medical records. Those periods come from state law.

In California, requirements vary by provider type. General acute care hospitals must retain records at least seven years following discharge (22 CCR § 70751), and skilled nursing facilities seven years after discharge (22 CCR § 72543). Licensed primary care clinics — the category that includes community clinics and free clinics under Health & Safety Code § 1204 — must keep records a minimum of seven years (22 CCR § 75055). For all three, records of minors must be held until at least one year past the patient’s eighteenth birthday, and never less than seven years. Medi-Cal providers have their own obligations.

Individual physician practices used to be the awkward case, because California set no specific period for them. That changed on January 1, 2024. Business and Professions Code § 2266, as amended by SB 815, now makes it unprofessional conduct for a physician and surgeon to fail to maintain adequate and accurate patient records for at least seven years after the last date of service to that patient.

Note the trigger: seven years from the last date of service, not from the date the chart was created. A patient you saw for a decade generates a retention clock that does not start until the final visit. Because malpractice and disciplinary exposure can run longer than seven years, and because minors raise separate issues, most practices retain adult records past the minimum and minors’ records substantially longer.

Be careful with older articles on this topic. A good deal of what is still online — including sources that were accurate when written — says California imposes no retention period on physicians. That advice is now three years out of date, and acting on it means shredding charts you are required to keep.

The practical takeaway: digitizing does not shorten your retention obligation, but it makes meeting it dramatically cheaper. Ten years of paper charts is a storage unit. Ten years of indexed PDFs is a folder.

None of the above is legal advice, and retention rules change. Confirm your specific obligations with your own counsel or malpractice carrier before you destroy anything.

What You Should Get Back

A HIPAA-compliant project is only useful if the output is usable. What we deliver:

• 300 DPI capture minimum. Enough resolution that handwriting, signatures, and older carbon-copy forms stay legible.
• Indexing to the fields you choose. Typically patient last name, first name, date of birth, and chart or account number — so a front-desk staffer can find a chart in seconds rather than guessing at a filename.
• Optional OCR. Optical character recognition makes the text inside the documents searchable, not just the index fields. It is an add-on rather than something bundled into every job, because plenty of practices index well and never need full-text search. If you want it, say so up front and it goes in the quote.
• Consistent file naming so the files import cleanly into your EMR instead of arriving as a folder of scan0001.pdf.
• A certificate of destruction, or your originals returned.

Questions to Ask Any Scanning Vendor

Print this and use it on whoever you are evaluating, including us.

• Will you sign a BAA before you take possession of anything?
• Is any part of this work subcontracted or performed outside the United States?
• Who physically transports the boxes?
• Can I see the facility?
• Are the people handling my charts your employees, and are they background-checked and HIPAA-trained?
• Can you retrieve a specific chart for me mid-project, and how fast?
• What is the destruction process, and do I sign off before anything is shredded?
• Is the price per box, and what is quoted separately?

Working With Us

Paperless Revolution has been digitizing records for Southern California practices for more than sixteen years, from our own facility in Santa Fe Springs. We sign the BAA first, we handle records with our own staff in our own building, and we quote per box so you know the cost of the project before it starts rather than watching a per-page meter run.

If you have patient charts filling a room you would rather use for something else, get in touch and we will come count boxes and give you a written number. There is no charge for that, and no obligation attached to it.

More on our approach: medical records scanning.